diff --git a/.gitattributes b/.gitattributes
index 284508182..3a5d9bf5a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -25,3 +25,8 @@ bugs/** -text
 # The VB6 template `bug_repro.mjs new --with-vb6` copies into a reproducer's vb6/
 # is CRLF in every checkout, as the bugs/** files it becomes are, and VB6 needs it.
 test/repro-templates/vb6/** -text
+
+# The PngDump modules `bug_repro.mjs new --with-images` copies into a reproducer are CRLF
+# in every checkout for the same reason: PngDump.bas is VB6's, and the copy is compared
+# with the template line by line.
+test/repro-templates/png/** -text
diff --git a/.github/actions/run-gates/action.yml b/.github/actions/run-gates/action.yml
index fd3d42325..92e15dfc8 100644
--- a/.github/actions/run-gates/action.yml
+++ b/.github/actions/run-gates/action.yml
@@ -82,6 +82,14 @@ runs:
     - name: Unit-test the date formatter (test/strftime.test.mjs)
       shell: bash
       run: node --test test/strftime.test.mjs
+    # Unit tests for the pictures of a bug reproducer: PNG decoding, comparing
+    # and the side-by-side image (scripts/lib/png.mjs), the files behind
+    # repro.json's images and expect.imagesDiffer, and bug_repro.mjs's own
+    # refusals over fixtures. Starts no IDE and no VB6. No browser, no built
+    # tree, about 4 s.
+    - name: Unit-test the bug reproducers' pictures (test/png.test.mjs)
+      shell: bash
+      run: node --test test/png.test.mjs
     # check_examples.mjs's probes: batching, crash isolation through a fake
     # lane, the canaries and the fence classifier. check_examples.mjs needs a
     # twinBASIC install, which CI has not; its probes need none.
diff --git a/BUGS-TO-REPORT.md b/BUGS-TO-REPORT.md
index e90bf4170..ef05bce1c 100644
--- a/BUGS-TO-REPORT.md
+++ b/BUGS-TO-REPORT.md
@@ -60,7 +60,12 @@ How the four duties above fit it:
   the narrowed steps.
 - **Expected behavior** says what should happen instead, and why: what VBA or VB6 does,
   what the documentation says, or what the IDE does in the neighbouring case.
-- **Screenshots** is left out when there are none.
+- **Screenshots** is left out when there are none. A graphical defect's section says what
+  each panel of its comparison shows and embeds the picture, as
+  `![<what it shows>](bugs/<slug>/images/<name>-compare.png)`, so that it shows in this file;
+  `bug_repro.mjs file` rewrites the path to `images/<name>-compare.png` in `REPORT.md`. A
+  GitHub issue cannot reach a path in the repository, so when the entry is pasted into one,
+  the picture is dragged into the issue in place of that line.
 - **Desktop** gives the build as `BETA <n>`, the build it was last reproduced on.
 - **Additional context** gives what did not reproduce it, the severity, and the builds it
   was checked on besides the one above.
@@ -86,8 +91,15 @@ kebab-case name for the bug, and its **To Reproduce** names the project file:
 | `bugs/<slug>/src/` | the project's exported source tree: `Settings`, `Sources/` and the rest | yes, byte for byte |
 | `bugs/<slug>/<slug>.twinproj` | the project file, packed from `src/` | yes |
 | `bugs/<slug>/<slug>.zip` | the `.twinproj` zipped, because a GitHub issue does not accept a `.twinproj` attachment, with any file `repro.json`'s `attach` names, such as a `.twinpack` | no |
-| `bugs/<slug>/vb6/` | optional: a VB6 project, to show what VB6 does where the entry compares it with twinBASIC: `Probe.vbp` and its `.bas`, `.cls` and `.frm` files, sources only, never an exe or an output | yes, byte for byte |
+| `bugs/<slug>/vb6/` | optional: a VB6 project, to show what VB6 does where the entry compares it with twinBASIC: `Probe.vbp` and its `.bas`, `.cls`, `.frm` and `.ctl` files (with their `.frx` and `.ctx`), sources only, never an exe or an output | yes, byte for byte |
 | `bugs/<slug>/<slug>-vb6.zip` | the source files of `vb6/` zipped, to attach beside the other zip; written only when `vb6/` exists | no |
+| `bugs/<slug>/images/` | optional: the pictures of a graphical defect, `<name>-tb.png` (from `run`), `<name>-vb6.png` (from `vb6`) and `<name>-compare.png`, which shows both and their difference; the zip holds them all | yes |
+
+**A graphical defect carries pictures.** Its `repro.json` names them under `images`, the
+`PngDump` modules from `test/repro-templates/png/` save them (`new --with-images` copies them),
+and its entry embeds each `-compare.png` under **Screenshots**: what twinBASIC drew beside
+what VB6 drew, the pixels that differ in red. `test/png.test.mjs` fails when an entry or a filed
+`REPORT.md` does not embed one. `expect.imagesDiffer` lets `verify` judge by them.
 
 `scripts/bug_repro.mjs` makes and checks them (the tool's page is
 [Tools and Scripts](docs/Documentation/Tools.md#bug-repro)):
@@ -245,7 +257,7 @@ So exit 0 on a project with errors happens only for an error in code nothing cal
 
 Silence on stdout and stderr: measured on BETA 983 first, and on BETA 995 by redirecting the standard handles of the process to a file. The same redirection captures the compiler executable's own output (`twinBASIC_win32.exe settings <project>` wrote the whole `Settings` file), so the capture works.
 
-<!-- Manual in bugs/build-and-exit-silent/repro.json: the switch belongs to the IDE executable, which opens a window, so nothing here may run on the user's desktop. Measured with a scratch copy of scripts/lib/tb-launch.ps1 (private desktop, kill-on-close job, TBBUILD_CMD replacing the command line, standard handles redirected to a file), with scripts/lib/tb-registry.mjs startTidy and finishTidy around the run. Stated in scripts/tbbuild.mjs (header comment) and WIP.Harness.md, "Do not reach for --buildAndExit32 instead": when fixed, those two say the switch is unusable. The exit-0-on-errors claim there was stated for BETA 983 without a reproduction; it is true only for an error in code nothing calls, so correct it either way. -->
+<!-- Manual in bugs/build-and-exit-silent/repro.json: the switch belongs to the IDE executable, which opens a window, so nothing here may run on the user's desktop. Measured with a scratch copy of scripts/lib/tb-launch.ps1 (private desktop, kill-on-close job, TBBUILD_CMD replacing the command line, standard handles redirected to a file), with scripts/lib/tb-registry.mjs startTidy and finishTidy around the run. Stated in scripts/tbbuild.mjs (header comment) and WIP.Harness.md, "Do not reach for --buildAndExit32 instead": when fixed, those two say the switch is unusable. So do docs/Documentation/Tools.md (the tbbuild section) and docs/Features/Packages/Import-export tool.md ("Compiling from the command line"). All four say exit 0 only for an error in code nothing calls, and a hang for an error the build reaches. -->
 
 ---
 
@@ -344,31 +356,32 @@ What does not reproduce it: a long input path to `export`, and any output folder
 *DEFERRED until after v1*
 
 **Describe the bug**
-Given a file that is not a valid project, the compiler executable opens a modal message box (*invalid header* and *invalid file format* were both seen) and prints nothing more until it is closed. `export`, `settings` and `readme` each waited on the box indefinitely. Once the box is closed, `export` prints `WARNING: failed to parse project file, file may be corrupt`, then `... DONE`, and exits 0.
+Given a file that is not a valid project, the compiler executable opens a modal message box and prints nothing more until it is closed. `export`, `settings` and `readme` each wait on the box indefinitely. Once the box is closed, `export` prints `WARNING: failed to parse project file, file may be corrupt`, then `... DONE`, and exits 0; `settings` and `readme` print an `ERROR:` line, and exit 0 as well.
 
 **To Reproduce**
 Steps to reproduce the behavior:
-1. Unzip `damaged-project-modal-box.zip` (it holds `damaged-project-modal-box.twinproj`, an ordinary valid project) and make damaged copies of it, in PowerShell: `$b = [IO.File]::ReadAllBytes("C:\p\damaged-project-modal-box.twinproj")`, then `$b[0] = $b[0] -bxor 0xFF; [IO.File]::WriteAllBytes("C:\p\firstbyte.twinproj", $b)` for one with its first byte changed, and `[IO.File]::WriteAllBytes("C:\p\cut.twinproj", $b[0..([int]($b.Length / 2))])` for one cut off halfway. A 20-byte text file named `garbage.twinproj`, or an empty file, is damaged enough too.
+1. Unzip `damaged-project-modal-box.zip`. It holds `damaged-project-modal-box.twinproj`, an ordinary valid project, and four damaged copies of it: `garbage.twinproj`, `empty.twinproj`, `firstbyte.twinproj` and `cut.twinproj`. They were made in PowerShell: `$b = [IO.File]::ReadAllBytes("C:\p\damaged-project-modal-box.twinproj")`, then `$b[0] = $b[0] -bxor 0xFF; [IO.File]::WriteAllBytes("C:\p\firstbyte.twinproj", $b)` for one with its first byte changed, and `[IO.File]::WriteAllBytes("C:\p\cut.twinproj", $b[0..([int]($b.Length / 2))])` for one cut off halfway. A 20-byte text file named `garbage.twinproj`, or an empty file, is damaged enough too.
 2. Run `twinBASIC_win32.exe export C:\p\garbage.twinproj C:\p\out\`, on a desktop someone is watching.
-3. See a message box and no further output. The command was still waiting when it was ended after 25 seconds.
-4. Close the box. See `WARNING: failed to parse project file, file may be corrupt`, then `... DONE`, and exit code 0. For the project cut off halfway it also writes the one file it could read, `Settings`.
-5. Run `settings` or `readme` on the same file: each waits on a box the same way.
+3. See a message box titled `TWINBASIC ERROR`, saying `invalid file header: bad file format`, and no output after the `exporting from ... to ...` line. The command is still waiting when it is ended after 20 seconds. The empty file and the one with its first byte changed give the same box.
+4. Close the box. See `WARNING: failed to parse project file, file may be corrupt`, then `... DONE`, and exit code 0, with no file written.
+5. Run `settings` or `readme` on the same file: each waits on the same box, prints nothing until it is closed, then prints `ERROR: failed to parse project file, file may be corrupt or inaccessible` and exits 0.
+6. Run `export` on the project cut off halfway. The box is titled `bad file format` and says `WARNING: failed to deserialize file system.  Some files might be lost or truncated.` Once it is closed, `export` writes the one file it could read, `Sources\Startup.twin`, prints `[EXPORT] DONE:` for it and then `... DONE`, with no warning, and exits 0. `settings` on it waits on the same box, then prints `ERROR: failed to find file, file may be corrupt`; `readme` waits, then prints nothing.
 
 **Expected behavior**
-No window opens from a command-line verb. The command prints the problem (`ERROR: failed to parse project file, file may be corrupt or inaccessible`, which it already prints when a folder is given where the project should be), ends `... FAILED`, and does not report `... DONE` for a file it could not read.
+No window opens from a command-line verb. The command prints the problem (`ERROR: failed to parse project file, file may be corrupt or inaccessible`, which it already prints when a folder is given where the project should be), ends `... FAILED`, does not report `... DONE` for a file it could not read, and exits with a code other than 0.
 
 **Desktop:**
  - OS: Windows 10 Pro 22H2 (build 19045)
- - twinBASIC compiler version: BETA 983 (the 20-byte text file was also seen on BETA 995)
+ - twinBASIC compiler version: BETA 995
 
 **Additional context**
-Severity: an unattended `export`, `settings` or `readme` never finishes, and once the box is closed `export` reports success, so a script that tests for `... DONE` is fooled as well.
+Severity: an unattended `export`, `settings` or `readme` never finishes, and once the box is closed every one of them exits 0 and `export` reports success, so a script that tests the exit code or `... DONE` is fooled as well.
 
-All four kinds of damaged input were tried on BETA 983: a 20-byte text file, an empty file, a real project with its first byte changed, and one cut off halfway. On BETA 995 a run with a 20-second limit found `export` and `settings` on the 20-byte text file still waiting at the limit; the other inputs returned inside it, and whether each opened a box was not checked.
+All four kinds of damaged input open the box under all three commands, on BETA 995 and on BETA 983. The undamaged project exports at once, with no box. On BETA 983 `export` of the project cut off halfway wrote `Settings` rather than `Sources\Startup.twin`.
 
 What does not reproduce it: a folder given where the project should be. `settings` then prints `ERROR: failed to parse project file, file may be corrupt or inaccessible` and exits, with no box.
 
-<!-- Manual in bugs/damaged-project-modal-box/repro.json, and not to be run unattended: the box opens on the desktop of whoever runs the command (the probe that found it opened message boxes on the user's desktop three times on BETA 995 alone). No test or page states it. The command-line verbs are described on docs/Documentation/Tools.md (impexp) and in scripts/impexp.mjs, which does not open a box for a damaged file; check them when fixed. Found by probing the command line for the rewrite of the Import/Export Tool page; the boxes appeared on the desktop of the person at the machine, which is how their wording is known. Measured on BETA 983 with a 25 second limit, on BETA 995 with 20 (cli995/log2-995.txt). -->
+<!-- A cli reproducer in bugs/damaged-project-modal-box/repro.json, run on a private desktop by bug_repro, which reads each box and closes it (the probe that found it opened message boxes on the user's desktop three times on BETA 995 alone, which is why nothing runs these commands on a desktop anyone uses). No test or page states it. The command-line verbs are described on docs/Documentation/Tools.md (impexp) and in scripts/impexp.mjs, which does not open a box for a damaged file; check them when fixed. Found by probing the command line for the rewrite of the Import/Export Tool page; on BETA 983 the boxes appeared on the desktop of the person at the machine (25 second limit). On BETA 995 all fifteen runs (three commands, four damaged inputs and the undamaged control) were made on a private desktop inside a kill-on-close job, the box's title and text read from that desktop, and each run repeated with OK pressed after 3 seconds (kit beta995-probes/s74/damaged/results-995.md and harness.ps1, local scratch). -->
 
 ---
 
@@ -854,7 +867,7 @@ What was tried:
 - An interface with three `[PreserveSig]` members declared in `IUnknown`'s order, `QueryInterface`, `AddRef` and `Release`, behaves the same way: `Set` succeeds, and the calls go to the wrong slots (one `AddRef` returned 0, and the next call crashed).
 - `Interface IUnk Extends stdole.IUnknown` with that identifier compiles, and `u.AddRef` is then reported as `TB5027 Unrecognized member 'AddRef' on type 'IUnk'`, as it is for `stdole.IUnknown` itself, which has no members that twinBASIC code can call.
 
-<!-- Reproducer: bugs/iunknown-iid-interface/ (mode run, expects tbrun exit 5, the output `ok` and the native exception); verified on 995. Stated in docs/Reference/COM-Interfaces/IUnknown.md, section "Implementing it" (the paragraph that begins "A project's own Interface that carries the identifier of IUnknown also compiles"): when fixed, replace it with whatever the compiler now does (a diagnostic, or a working call). -->
+<!-- Reproducer: bugs/iunknown-iid-interface/ (mode run, expects tbrun exit 5, the output `ok` and the native exception); verified on 995. Stated in docs/Reference/COM-Interfaces/IUnknown.md, section "Implementing it" (the WARNING, which names BETA 995, after the paragraph that begins "A project's own Interface that carries the identifier of IUnknown also compiles"): when fixed, replace it with a NOTE saying since which build and what the compiler now does (a diagnostic, or a working call). -->
 
 ---
 
@@ -897,7 +910,7 @@ What does not reproduce it: a statement with no arguments (`o.Fail3`, `o.Hello`,
 
 The second call resembles VB's rule for `o.Member(args)` on a property that returns an object or a collection: read the property with no arguments, then apply the arguments to the result. It is applied after a failure of any call that has arguments. The single run of `Hello` in the raw `Invoke` case is also at odds with the COM contract, which gives `DISP_E_BADPARAMCOUNT` for too many arguments without running the member; it is left out of this entry.
 
-<!-- Reproducer: bugs/latebound-call-retried/ (mode run, expects the Hello and Prop lines above); verified on 995. VB6 side in bugs/latebound-call-retried/vb6/ (o.Hello 1 -> 450 and Hits=0; o.Prop = 1 -> 5 and Gets=0). Stated in docs/Reference/COM-Interfaces/IDispatch.md, the second NOTE under "Errors from a late-bound call" (a call that fails inside Invoke can be made twice) and the first row of the table under "Classes written in twinBASIC" in the same page. When fixed, reduce that NOTE to the CallByName part (see callbyname-membernotfound-retried), or delete it, and remove the sentence about "a late-bound statement does this twice". The Property Get run and the replaced error number are not on the page yet. -->
+<!-- Reproducer: bugs/latebound-call-retried/ (mode run, expects the Hello and Prop lines above); verified on 995. VB6 side in bugs/latebound-call-retried/vb6/ (o.Hello 1 -> 450 and Hits=0; o.Prop = 1 -> 5 and Gets=0). Stated in docs/Reference/COM-Interfaces/IDispatch.md, the second callout under "Errors from a late-bound call", a WARNING naming BETA 995 (a call that fails inside Invoke can be made twice) and the first row of the table under "Classes written in twinBASIC" in the same page. When fixed, reduce that NOTE to the CallByName part (see callbyname-membernotfound-retried), or delete it, and remove the sentence about "a late-bound statement does this twice". The Property Get run and the replaced error number are not on the page yet. -->
 
 ---
 
@@ -932,7 +945,7 @@ What does not reproduce it: `CallByName` with `vbGet` or `vbLet` against `DISP_E
 
 A separate behaviour, in its own entry, repeats a failed late-bound statement that passes arguments as a property read: see the entry "A late-bound call that passes arguments and fails is issued a second time, without them". The two are not the same: that one is for calls with arguments and needs no `DISP_E_MEMBERNOTFOUND`, and this one is `CallByName` with or without arguments.
 
-<!-- Reproducer: bugs/callbyname-membernotfound-retried/ (mode run, expects the two count lines above); verified on 995. Stated in docs/Reference/COM-Interfaces/IDispatch.md, the second NOTE under "Errors from a late-bound call": its sentence "CallByName repeats a call that returned DISP_E_MEMBERNOTFOUND with a null pVarResult". When fixed, remove that sentence (the other half of the NOTE is the entry on late-bound calls with arguments). The flags 1/2/4 combinations come from the probe in s71/idispatch/tb6, a local scratch file that is not in the repository. -->
+<!-- Reproducer: bugs/callbyname-membernotfound-retried/ (mode run, expects the two count lines above); verified on 995. Stated in docs/Reference/COM-Interfaces/IDispatch.md, the second callout under "Errors from a late-bound call", a WARNING naming BETA 995: its sentence "CallByName repeats a call that returned DISP_E_MEMBERNOTFOUND with a null pVarResult". When fixed, remove that sentence (the other half of the NOTE is the entry on late-bound calls with arguments). The flags 1/2/4 combinations come from the probe in s71/idispatch/tb6, a local scratch file that is not in the repository. -->
 
 ---
 
@@ -1091,7 +1104,7 @@ Severity: low for a program that passes all the arguments; for one that does not
 
 Related and also different from VB6: `Err.Raise 65536` is accepted, and `Err.Number` is 65536, where VB6 raises error 5. `Err.Raise 0` raises error 5 in both. An explicit empty string for the source or the description gives an empty `Source` or `Description`, in VB6 as well. `Err.HelpContext` is 0 in twinBASIC, and VB6 sets it to 1000000 plus the number for a `Raise` without one (`1000005` for 5).
 
-<!-- Reproducer: bugs/err-raise-defaults/ (mode run, expects the five lines above in twinBASIC); verified on 995. VB6 side from the same program, in bugs/err-raise-defaults/vb6/; the full sweep and the per-number lists are in s71/raise/ (out-tb-995.txt, out-vb6.txt, analyze.mjs), local scratch files that are not in the repository. Stated in docs/Reference/Default/VBA/ErrObject/Raise.md (the table under *description* and the NOTE after it, plus the check_run sample), in Source.md (the NOTE) and in Description.md (the NOTE); docs/Reference/COM-Interfaces/IErrorInfo.md says GetSource returns an empty string and GetDescription the standard text when Raise gets neither. When fixed, delete those NOTEs and the table, restore the sentences about the project's programmatic ID, the generic message and the carried-over values, and rewrite the sample's expected output. docs/Reference/Default/VBRUN/ErrorContext/index.md says Source is the project name for errors raised inside a project; that is not what Err.Source holds and should be checked when this is fixed. -->
+<!-- Reproducer: bugs/err-raise-defaults/ (mode run, expects the five lines above in twinBASIC); verified on 995. VB6 side from the same program, in bugs/err-raise-defaults/vb6/; the full sweep and the per-number lists are in s71/raise/ (out-tb-995.txt, out-vb6.txt, analyze.mjs), local scratch files that are not in the repository. Stated in docs/Reference/Default/VBA/ErrObject/Raise.md (the table under *description* and the WARNING after it, which names BETA 995, plus the check_run sample), in Source.md (the WARNING) and in Description.md (the WARNING); docs/Reference/COM-Interfaces/IErrorInfo.md says GetSource returns an empty string and GetDescription the standard text when Raise gets neither. When fixed, replace those WARNINGs with NOTEs saying since which build, delete the table, restore the sentences about the project's programmatic ID, the generic message and the carried-over values, and rewrite the sample's expected output. docs/Reference/Default/VBRUN/ErrorContext/index.md says Source is the project name for errors raised inside a project; that is not what Err.Source holds and should be checked when this is fixed. -->
 
 ---
 
@@ -1128,7 +1141,7 @@ The two symptoms are one bug because the object is the same: `ObjPtr` of what `G
 What does not reproduce it: a fresh thread (`GetErrorInfo` returns `S_FALSE`); a caller that makes the call through an interface whose methods are declared `[PreserveSig]` and reads the slot itself, where the first `GetErrorInfo` returns the values and the second returns `S_FALSE`; the second `GetErrorInfo` after the object has been read from the slot (it returns `S_FALSE`, so `GetErrorInfo` does empty the slot).
 Severity: low. The slot is not a documented twinBASIC interface, but a program that reads error information with the COM functions, or a library that does, sees values that change under it, and a program cannot rely on the description of a failure that came with no error information.
 
-<!-- Reproducer: bugs/err-info-live-view/ (mode run, expects the lines above); verified on 995. The VB6 slot results (empty after Err.Raise 5 in the procedure, after a raise in a class method handled by the caller, and after a class method that handled its own error) are from bugs/err-info-live-view/vb6/; the full set of probes (T1 to T10, with ObjPtr) is in s71/liveview/, a local scratch folder that is not in the repository. Stated in docs/Reference/COM-Interfaces/IErrorInfo.md: "Two things about the object matter to a caller that reads it" in *A method that raises an error*, and "The slot is not always empty" under *A failure with no error information*. When fixed, delete the second half of the first and rewrite the second paragraph; the table of Automation error and the `emptySlot` samples need no change except the sentence about a stale object. -->
+<!-- Reproducer: bugs/err-info-live-view/ (mode run, expects the lines above); verified on 995. The VB6 slot results (empty after Err.Raise 5 in the procedure, after a raise in a class method handled by the caller, and after a class method that handled its own error) are from bugs/err-info-live-view/vb6/; the full set of probes (T1 to T10, with ObjPtr) is in s71/liveview/, a local scratch folder that is not in the repository. Stated in docs/Reference/COM-Interfaces/IErrorInfo.md, in two WARNINGs that name BETA 995: the one after "**GetErrorInfo** empties the slot" in *A method that raises an error*, and the one that begins "the slot is not always empty" under *A failure with no error information*. When fixed, replace each with a NOTE saying since which build, or delete it; the table of Automation error and the `emptySlot` samples need no change except the sentence about a stale object. -->
 
 ---
 
@@ -1171,7 +1184,7 @@ Severity: low in practice, since a program rarely advises a null sink, but a COM
 
 What was tried: an object that is not a sink gives an ordinary error (`E_NOINTERFACE`, `&H80004002`, see the entry about `Advise` and `Unadvise` error codes), so only a null pointer crashes. The address of the crash is the same in the standalone probe and in this project.
 
-<!-- Reproducer: bugs/advise-nothing-crashes/ (mode run, expects tbrun exit 5, the output `before` and the native exception); verified on 995. Stated in docs/Reference/COM-Interfaces/IConnectionPoint.md, section Advise, the last bullet of "In twinBASIC" ("Passing Nothing ends the run with an access violation in BETA 995"): when fixed, replace it with the error it raises, and add Nothing to the example if it fits. -->
+<!-- Reproducer: bugs/advise-nothing-crashes/ (mode run, expects tbrun exit 5, the output `before` and the native exception); verified on 995. Stated in docs/Reference/COM-Interfaces/IConnectionPoint.md, section Advise, the last bullet of "In twinBASIC" and the WARNING after it, which names BETA 995 ("Advise with Nothing as the sink ends the program with an access violation"): when fixed, replace the WARNING with a NOTE saying since which build and what error it raises, and add Nothing to the example if it fits. -->
 
 ---
 
@@ -1207,7 +1220,7 @@ Steps to reproduce the behavior:
 Severity: low. A client that tests for `CONNECT_E_CANNOTCONNECT` to tell a refused sink from other failures never sees it, and a client that releases a connection twice, or with a wrong cookie, is told it worked.
 
 What was tried: a sink that is an ordinary twinBASIC class gives the same `E_NOINTERFACE` whether it has no members or implements `IDispatch` (the outgoing interface's identifier is generated for each build, so a twinBASIC class cannot answer for it). Nothing is connected afterwards, and no event reaches the sink. Calling `Unadvise` a second time with the cookie of the failed `Advise`, which is 0, also returns without an error.
-<!-- Reproducer: bugs/advise-unadvise-hresults/ (mode run, expects tbrun exit 0 and the three lines above); verified on 995. Stated in docs/Reference/COM-Interfaces/IConnectionPoint.md, sections Advise (the second bullet of "In twinBASIC") and Unadvise (the sentence "In twinBASIC a cookie that names no connection...") and the last example, whose comments show 80004002 and 0: when fixed, change those. When the page is updated, state the code twinBASIC returns for a bad cookie. -->
+<!-- Reproducer: bugs/advise-unadvise-hresults/ (mode run, expects tbrun exit 0 and the three lines above); verified on 995. Stated in docs/Reference/COM-Interfaces/IConnectionPoint.md, sections Advise (the second bullet of "In twinBASIC") and Unadvise (the WARNING, which names BETA 995, about a cookie that names no connection) and the last example, whose comments show 80004002 and 0: when fixed, replace the WARNING with a NOTE saying since which build, and change the rest. When the page is updated, state the code twinBASIC returns for a bad cookie. -->
 
 ---
 
@@ -1245,3 +1258,457 @@ VB6 has no comparison: a project cannot declare an `Interface`, and the interfac
 
 <!-- Reproducer: bugs/new-on-interface/ (mode run, expects tbrun exit 5, the four lines above and the native exception); verified on 995. Probes from the narrowing are local scratch files, not in the repository. docs/Reference/Default/VBRUN/ErrorContext/index.md, ErrorCallstack/index.md and ErrorStackFrame/index.md carry a NOTE that no code can obtain these objects in BETA 995 ("code that uses them compiles, but nothing returns an object that implements them"); when this is fixed, check that wording, since `New` on them compiles today and returns an object that has no implementation. -->
 
+---
+
+## Clear All Breakpoints is undone by restarting the compiler, unless the project was saved in between
+
+**Describe the bug**
+Breakpoints removed with **Debug > Clear All Breakpoints** come back when the compiler restarts. After **Restart the compiler** on the toolbar the margin shows them again, as they were just before they were cleared, and the next run stops at them. A breakpoint removed with F9 stays removed, and saving the project between the two keeps the effect of **Clear All Breakpoints**.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `clear-all-breakpoints-restart.twinproj` (attached as `clear-all-breakpoints-restart.zip`) and open `Startup.twin`. `Main` prints three lines:
+   ```
+   Public Sub Main()
+       Debug.Print "main start"
+       Debug.Print "the breakpoint's line" ' BREAK
+       Debug.Print "main end"
+   End Sub
+   ```
+2. Put the cursor on the line marked `BREAK` and press F9. A breakpoint appears in the margin.
+3. Choose **Debug > Clear All Breakpoints** (Ctrl+Shift+F9). The breakpoint goes.
+4. Click **Restart the compiler** on the toolbar, and wait for the compile to end. The breakpoint is back in the margin.
+5. Press F5. The run stops at the breakpoint, having printed only `main start`.
+
+**Expected behavior**
+Breakpoints cleared with **Clear All Breakpoints** stay cleared, as a breakpoint removed with F9 does: after the restart the margin shows none, and F5 prints all three lines.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Also on BETA 987, identically.
+
+What does not reproduce it: removing the breakpoint with F9 instead, which stays removed across the restart; and saving the project (Ctrl+S) after **Clear All Breakpoints** and before the restart, which keeps them cleared. A breakpoint saved with the project survives a restart, as it should. Not tried: whether the IDE's other ways of starting a new compiler, such as switching between win32 and win64, do the same.
+
+Where it seems to come from, in BETA 995's `ide/main.js`: F9 records each change in `g_SessionFilesystemTransactions`, which the IDE replays into a new compiler and which a save empties; **Clear All Breakpoints** (`tbDebug_BreakpointsClear`) clears the breakpoints in the compiler and records nothing there, so the replay sets them again.
+
+Severity: breakpoints a person has removed stop the program again after a restart, with nothing to connect the two.
+
+<!-- Asserted by `ide-test.bat --only breakpoints` (test/ide/breakpoints.test.mjs: the fault, then F9, saving after Clear All, and a saved breakpoint across a restart); passes on BETA 995 and 987. The reproducer's Startup.twin is test/ide/probes/breakpoints/Sources/Startup.twin with a different header comment. When fixed: update that test and this entry. -->
+
+---
+
+## A watch on a variable of a user-defined type fails with a codegen error, and the Debug Console reports a linker error at every stop
+
+**Describe the bug**
+While the debugger is stopped, a watch on a variable of a user-defined type cannot be evaluated. **Watches** shows `(compile error: codegen error; check for compilation errors)`, of type `ERROR`, and the Debug Console prints `[LINKER] compilation (codegen) error detected in 'Startup.{temp_procedure}' at line #1`. The linker error comes again at every later stop while the watch exists, and `? p` in the Debug Console fails the same way. **Variables** shows the same variable and its fields without trouble, and a watch on one of its fields works.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `udt-watch-codegen-error.twinproj` (attached as `udt-watch-codegen-error.zip`). `Startup.twin` declares a type, and `Main` passes the line marked `BREAK` twice:
+   ```
+   Private Type Point
+       X As Long
+       Y As Long
+   End Type
+
+   Public Sub Main()
+       Dim p As Point
+       Dim i As Long
+       p.X = 7
+       For i = 1 To 2
+           Debug.Print "pass " & i ' BREAK
+       Next
+   End Sub
+   ```
+2. Put a breakpoint on the line marked `BREAK` (F9) and press F5. The run stops there, and **Variables** shows `p` as `{user defined type, 8 bytes}`, with `X` and `Y`.
+3. Add a watch on `p` (**Debug > Add Watch...**, or the plus sign in **Watches**). The watch shows `(compile error: codegen error; check for compilation errors)`, of type `ERROR`, and the Debug Console prints `[LINKER] compilation (codegen) error detected in 'Startup.{temp_procedure}' at line #1`.
+4. Press F5. The run stops at the breakpoint again, and the Debug Console prints the linker error again.
+5. Type `? p` in the Debug Console and press Enter. It fails with the same error, and the Debug Console prints the same linker line.
+
+**Expected behavior**
+The watch shows `p` as **Variables** does, `{user defined type, 8 bytes}` opening to its fields, as VBA's Watch window shows a variable of a user-defined type. An expression that cannot be shown, such as `? p`, which has no single value to print, is refused with a message about the expression. A linker error about generated code reads as though the project had failed to build, which it has not.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Also on BETA 987, identically.
+
+What does not reproduce it: a watch on a field, `p.X`, which shows `7`, of type `Variant [Long]`; and **Variables**, which shows `p` and its fields. That type suggests a watch is evaluated as a `Variant`, which cannot hold a value of a user-defined type. Seen with a `Private Type` declared in the module; other declarations of the type were not tried.
+
+Severity: a watch on a structure is unusable, and while it exists every stop adds a linker error to the Debug Console.
+
+<!-- Asserted by `ide-test.bat --only watches` (test/ide/watches.test.mjs: the watch on p, the watch on p.X, the next stop, and ? p); passes on BETA 995 and 987. The reproducer's Startup.twin is test/ide/probes/watches/Sources/Startup.twin with a different header comment. When fixed: update that test and this entry. -->
+
+---
+
+## After Break Into Code stops in DoEvents, evaluating anything ends the program with an access violation
+
+**Describe the bug**
+**Break Into Code** (Ctrl+Break), pressed while a program is in `DoEvents`, stops inside the VB package rather than in the program: the IDE opens the package's `IdleMessageLoopBreak.twin` at `IdleMessageLoopBreakpoint`, which **Call Stack** shows above the program's procedure. Evaluating anything at that stop ends the program with a native access violation: a line in the Debug Console, even `? 1`, or any watch, which the IDE evaluates at every stop. The IDE then stays in break mode, with the yellow arrow on the package's line and **Stop** and the step commands enabled, although the program has ended.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `break-in-doevents-evaluate-crash.twinproj` (attached as `break-in-doevents-evaluate-crash.zip`). `Main` loops on `DoEvents`:
+   ```
+   Public Sub Main()
+       Do
+           DoEvents
+       Loop
+   End Sub
+   ```
+2. Press F5, then Ctrl+Break (**Run > Break**). The IDE opens `IdleMessageLoopBreak.twin` under `Packages/VB/Sources/SUPPORT`, stopped in `IdleMessageLoopBreakpoint`, and **Call Stack** shows `IdleMessageLoopBreakpoint` above `Main`.
+3. Type `? 1` in the Debug Console and press Enter. The program ends, and the Debug Console prints:
+   ```
+   (runtime error -2147467259: NATIVE EXCEPTION: ACCESS_VIOLATION)
+   0001 <time> NATIVE EXCEPTION: ACCESS_VIOLATION  {unknown} [$1EBD9288:twinBASIC_win32.dll+001D9288]
+   ```
+   The yellow arrow stays on the package's line, and **Stop** and the step commands stay enabled. **Restart the compiler** puts the IDE right.
+4. Add any watch, such as `1 + 1`, and repeat step 2. The program ends at the stop in the same way, with nothing typed.
+
+**Expected behavior**
+**Break Into Code** stops in the program, where F5 at the package's stop goes next: in `Main`, on the line after `DoEvents`. An expression evaluated at a stop is evaluated, or refused with a message, and the program stays stopped where it was.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Also on BETA 987, identically.
+
+What does not reproduce it: evaluating nothing at the first stop, after which F5 stops again at once, in `Main` on the line after `DoEvents` (`Loop`), where `? 1` prints `1`; and a break that lands in the program's own code rather than in `DoEvents`, where the Debug Console and watches work. A name that the package's procedure cannot see, such as a local of `Main`, ends the program as `? 1` does.
+
+Severity: high. Breaking into a loop that calls `DoEvents` is an everyday way to see what a program is doing, and a watch left over from earlier is enough to end the program at the stop.
+
+<!-- Asserted by `ide-test.bat --only break-into` (test/ide/break-into.test.mjs: the stop in the package and F5's second stop, ? 1 there, and a watch); passes on BETA 995 and 987. The lane clears the Debug Console after each crash it asserts, because tb-lane.mjs fails a lane whose console holds a NATIVE EXCEPTION line. The reproducer's Startup.twin is test/ide/probes/break-into/Sources/Startup.twin with a different header comment. When fixed: update that test and this entry. -->
+
+---
+
+## A system colour value with a nonzero second or third byte draws black since BETA 984, where VB6 takes the index from the low 16 bits
+
+**Describe the bug**
+Since BETA 984 (release note: "fixed: Circle/Line/PSet color value handling to match VB6's relaxed rules"), `Line`, `Circle` and `PSet` draw black for a colour whose top byte is `&H80` and whose second or third byte is not 0, such as `&H80FF000F` or `&H80010003`. The colour is read as a system colour only when the value minus `&H80000000` is 0 to 30, and any other `&H80` value draws black. VB6 takes the system colour index from the low 16 bits and ignores the bits in between, so it draws system colour 15 for `&H80FF000F` and system colour 3 for `&H80010003`. BETA 983 gave the same colours as VB6 for these two values. Observed by reading the pixel back with `GetPixel` from a form with `AutoRedraw` set.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `system-colour-extra-bytes-black.twinproj` (attached as `system-colour-extra-bytes-black.zip`). Its `Sub Main` loads `Form1`, sets `AutoRedraw`, `ScaleMode = vbPixels` and `BackColor = &H30201`, draws one point with `Form1.PSet (10, 10), Color` for each of three colours, and prints the pixel read back with `GetPixel`.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   &H8000000F -> F0F0F0
+   &H80FF000F -> 000000
+   &H80010003 -> 000000
+   ```
+
+**Expected behavior**
+The colours VB6 draws, which BETA 983 drew as well:
+```
+&H8000000F -> F0F0F0
+&H80FF000F -> F0F0F0
+&H80010003 -> DBCDBF
+```
+`F0F0F0` is system colour 15 (`vbButtonFace`) and `DBCDBF` is system colour 3 (`vbInactiveTitleBar`) on the machine of the observation. The VB6 project, attached as `system-colour-extra-bytes-black-vb6.zip`, prints exactly these three lines.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low. A value like these is not what a `vbButtonFace`-style constant holds, and the colours of VB6 forms and controls are always the plain `&H8000000F` form. The effect is a different colour for a value that VB6 accepts.
+
+BETA 983 drew the same colours as VB6 for `&H80FF000F` and `&H80010003`, by passing the value to `OleTranslateColor`. It also raised error 5 for a value that is neither a system colour nor an RGB value with a top byte of 0, 1 or 2, and 984 fixed that: `-1`, `&HFF0000FF`, `&H7FFFFFFF` and the `&H01` palette forms now draw as VB6 draws them (the low 24 bits), as do a `Double` such as 255.7 (256) and a `String` such as `"255"`. Only the `&H80` top byte differs from VB6.
+
+The same difference exists for the high end of the index range: VB6 draws `&H80000019` to `&H8000001E` black, and twinBASIC draws the system colour of that index (`&H8000001D` gives `FF9933`, `&H8000001E` gives `F0F0F0`); this looks deliberate, since the source names `COLOR_MENUBAR` (30) as the limit. `&H80000100` draws black in both BETA 995 and VB6, and `C8C8C8` (index 0) in BETA 983.
+
+The change is `TranslateColor2` in the VB package's `Graphics.twin`, which `Line`, `Circle` and `PSet` call on `Color`: for a top byte of `&H80` it returns the system colour when the value minus `&H80000000` is 0 to 30 and 0 otherwise, and for any other value it returns the low 24 bits.
+
+<!-- Reproducer: bugs/system-colour-extra-bytes-black/ (mode run, expects the three lines above in twinBASIC); verified on 995, with 983 as the control (F0F0F0, F0F0F0, DBCDBF). The VB6 project is in bugs/system-colour-extra-bytes-black/vb6/ (`bug_repro.mjs vb6 system-colour-extra-bytes-black` prints the three lines above). The fuller sweep (about 45 colour values on 995, 983 and VB6) is in .claude/tooling-review-scratch/beta995-probes/s73/forms/ (c1.out995.txt, c1.out983.txt, c1.outvb6.txt), local scratch files that are not in the repository. Stated in docs/Reference/Core/Graphics-Methods.md, section "Colour values" (the first bullet and the WARNING after it, which names BETA 995; the NOTE below the WARNING is the deliberate difference for indexes 25 to 30): when fixed, replace the WARNING with a NOTE saying since which build twinBASIC takes the index from the low 16 bits, and change the bullet. -->
+
+---
+
+## Setting a colour property to a value that is not a colour stores it, and raises error 5 or nothing, where VB6 raises error 380 and keeps the old value
+
+**Describe the bug**
+Assigning a value that is not a colour to a colour property does not leave the property as it was, on a form, on a PictureBox or UserControl, on the Printer, and on every control tried. `Form.ForeColor = -1` and `Form.ForeColor = &H8000001F` raise error 5 (*Invalid procedure call or argument*) and still store the value, so `ForeColor` reads back `FFFFFFFF` and `8000001F` afterwards. `Form.BackColor = -1` and `Form.FillColor = -1` raise nothing and store the value. `ForeColor` raises error 5 on the surfaces that draw with a device context (Form, PictureBox, UserControl, Printer); every other colour property tried raises nothing, for `-1`, `&H8000001F` and `&HFF0000FF` alike. VB6 raises error 380 (*Invalid property value*) for every one of these assignments and keeps the colour the property had. Observed by assigning with `On Error Resume Next` and printing `Err.Number` and the value read back.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `forecolor-invalid-value-stored.twinproj` (attached as `forecolor-invalid-value-stored.zip`). Its `Sub Main` loads `Form1`, which holds a PictureBox, a Label, a TextBox, a CommandButton and a user control, UC1, whose `RunCases` assigns its own colour properties. For each property tried it sets `vbGreen`, then assigns `-1` (and `&H8000001F` to the form's `ForeColor`) under `On Error Resume Next` and prints the error number and the value read back. The Printer lines need a default printer; nothing is printed.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   Form.ForeColor = -1: Err 5, reads FFFFFFFF
+   Form.ForeColor = &H8000001F: Err 5, reads 8000001F
+   Form.BackColor = -1: Err 0, reads FFFFFFFF
+   Form.FillColor = -1: Err 0, reads FFFFFFFF
+   PictureBox.ForeColor = -1: Err 5, reads FFFFFFFF
+   PictureBox.BackColor = -1: Err 0, reads FFFFFFFF
+   PictureBox.FillColor = -1: Err 0, reads FFFFFFFF
+   Label.ForeColor = -1: Err 0, reads FFFFFFFF
+   Label.BackColor = -1: Err 0, reads FFFFFFFF
+   TextBox.ForeColor = -1: Err 0, reads FFFFFFFF
+   TextBox.BackColor = -1: Err 0, reads FFFFFFFF
+   CommandButton.BackColor = -1: Err 0, reads FFFFFFFF
+   Printer.ForeColor = -1: Err 5, reads FFFFFFFF
+   Printer.FillColor = -1: Err 0, reads FFFFFFFF
+   UserControl.ForeColor = -1: Err 5, reads FFFFFFFF
+   UserControl.BackColor = -1: Err 0, reads FFFFFFFF
+   UserControl.FillColor = -1: Err 0, reads FFFFFFFF
+   ```
+
+**Expected behavior**
+Error 380 for each assignment, and the old value kept, as VB6 does (the VB6 project, attached as `forecolor-invalid-value-stored-vb6.zip`, prints):
+```
+Form.ForeColor = -1: Err 380, reads FF00
+Form.ForeColor = &H8000001F: Err 380, reads FF00
+Form.BackColor = -1: Err 380, reads FF00
+Form.FillColor = -1: Err 380, reads FF00
+PictureBox.ForeColor = -1: Err 380, reads FF00
+PictureBox.BackColor = -1: Err 380, reads FF00
+PictureBox.FillColor = -1: Err 380, reads FF00
+Label.ForeColor = -1: Err 380, reads FF00
+Label.BackColor = -1: Err 380, reads FF00
+TextBox.ForeColor = -1: Err 380, reads FF00
+TextBox.BackColor = -1: Err 380, reads FF00
+CommandButton.BackColor = -1: Err 380, reads FF00
+Printer.ForeColor = -1: Err 380, reads FF00
+Printer.FillColor = -1: Err 380, reads FF00
+UserControl.ForeColor = -1: Err 380, reads FF00
+UserControl.BackColor = -1: Err 380, reads FF00
+UserControl.FillColor = -1: Err 380, reads FF00
+```
+`FF00` is `vbGreen`, which each property held before the assignment. A program that sets a colour from user input and handles the error then keeps the colour it had.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low. `ForeColor` raises the error on the surfaces and the other properties do not, and the stored value is what a later `Line`, `Circle`, `PSet` or `Print` then uses (or what the control paints with), so a handled error leaves the invalid colour in force.
+
+What was tried: the same lines on BETA 983 print the same, so this is not a change of BETA 984. A value that is a valid colour, such as `&H100FF00` or `&H20000FF`, is accepted by `ForeColor` with no error, as in VB6. Besides the attached project, each of `-1`, `&H8000001F` and `&HFF0000FF` was assigned to every colour property of a UserControl (placed on the form), CheckBox, Frame, ListBox, Shape, ComboBox, DirListBox, DriveListBox, FileListBox, OptionButton and OLE in a project of its own, on BETA 995 and 983 and in VB6: the results are the same as above, error 5 for the UserControl's `ForeColor` and none for the rest in twinBASIC, error 380 and the old value kept in VB6. The twinBASIC-only controls behave the same (`QRCode.ForeColor` raises error 5, `CheckMark.BackColor` and `MultiFrame.BackColor` raise nothing), and so do `CommandButton.ForeColor` and the Data control's colours, which VB6 has no counterpart or no loadable project for. The package source explains the pattern: the colour properties are plain stored fields (`Public ForeColor As OLE_COLOR` and so on, in `GraphicsBase` for Form, PictureBox, UserControl, PropertyPage and Report, and declared again in each control), with nothing that validates the value; the error 5 comes from the `ForeColor` change handler of `GraphicsBase`, which runs after the value is stored.
+
+<!-- Reproducer: bugs/forecolor-invalid-value-stored/ (mode run, expects the seventeen lines above in twinBASIC); verified on 995 and 983. The VB6 project is in bugs/forecolor-invalid-value-stored/vb6/ (`bug_repro.mjs vb6 forecolor-invalid-value-stored` prints the seventeen lines above). The wider sweep (every colour property of the classes named under "What was tried", three values each, on 995, 983 and VB6) is in .claude/tooling-review-scratch/beta995-probes/s73/colours/ (c4.out995.txt, c4.out983.txt, c5.outvb6.txt, c6.Data.outvb6.txt, c3.out*.txt for the UserControl), local scratch files that are not in the repository. Stated in a WARNING naming BETA 995 under each of the colour properties on the pages under docs/Reference/Default/VB/ for: Form, PictureBox, UserControl, PropertyPage, Report, Printer, Label, TextBox, CommandButton, CheckBox, OptionButton, Frame, ListBox, ComboBox, DirListBox, DriveListBox, FileListBox, Shape, OLE (the VB6 comparison is in the WARNING) and Data, CheckMark, MultiFrame, QRCode (twinBASIC behaviour only; CommandButton.ForeColor likewise). PropertyPage and Report were not run: they inherit GraphicsBase, as Form does. MDIForm carries none: its BackColor assigns a separate field and its ForeColor and FillColor raise an unsupported-property error, and none was run. When fixed, replace each WARNING with a NOTE saying since which build. -->
+
+---
+
+## `TextBox.Text` assigned in code is not limited by `MaxLength`, where VB6 truncates it
+
+**Describe the bug**
+With `MaxLength` set to 3, `Text1.Text = "abcdef"` stores all six characters and `Len(Text1.Text)` is 6. VB6 truncates the new text to `MaxLength` characters: `Text` reads `abc`. `SelText` is affected in the same way: with `Text` equal to `"ab"` and the caret at the end, assigning `SelText = "cdef"` leaves `abcdef` in twinBASIC and `abc` in VB6. The `Text` property setter of the VB package sends `WM_SETTEXT` to the edit control, and the whole string is stored. Observed by reading `Text` back.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `textbox-text-ignores-maxlength.twinproj` (attached as `textbox-text-ignores-maxlength.zip`). Its `Form1` holds one `TextBox`, `Text1`, and its `Sub Main` loads the form, sets `Text1.MaxLength = 3`, assigns `Text` and `SelText`, and prints what `Text` holds.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   Text = "abcdef": [abcdef] Len 6
+   SelText = "cdef" after "ab": [abcdef] Len 6
+   ```
+
+**Expected behavior**
+The text is cut to `MaxLength` characters, as in VB6 (the VB6 project, attached as `textbox-text-ignores-maxlength-vb6.zip`, prints):
+```
+Text = "abcdef": [abc] Len 3
+SelText = "cdef" after "ab": [abc] Len 3
+```
+A program that relies on `MaxLength` to bound a field, for instance one that stores `Text` in a fixed-size record, gets a string longer than the limit.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low to medium. Typing into the box was not tried; the gap is the assignment in code.
+
+What was tried: BETA 983 prints the same two lines. Assigning the same long text a second time raises no `Change` event, in twinBASIC and in VB6.
+
+<!-- Reproducer: bugs/textbox-text-ignores-maxlength/ (mode run, expects the two lines above in twinBASIC); verified on 995 and 983. The VB6 project is in bugs/textbox-text-ignores-maxlength/vb6/ (`bug_repro.mjs vb6 textbox-text-ignores-maxlength` prints the two lines above). Stated in docs/Reference/Default/VB/TextBox/index.md, the MaxLength section, in a WARNING that names BETA 995 ("assigning Text in code is not limited by MaxLength"): when fixed, replace it with a NOTE saying since which build Text is truncated. -->
+
+---
+
+## `LSet` on a `Long` variable compiles, and the build fails with a codegen error
+
+**Describe the bug**
+`LSet` is defined for a string or a user-defined type. A statement `LSet n = "ab"` with `n` declared `As Long` is accepted by the compiler without a diagnostic, and building the project then fails: the linker reports a code-generation error at the statement, and no exe is produced. Run from the IDE (F5), the project stops the same way. Observed in a build of the reproducer project.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `lset-long-codegen-error.twinproj` (attached as `lset-long-codegen-error.zip`). Its one source file, `Startup.twin`, is a `Sub Main` with `Dim n As Long` and `LSet n = "ab"`.
+2. Compile it: no errors, warnings or hints.
+3. Build it (Build, or F5) and read the DEBUG CONSOLE:
+   ```
+   [BUILD] Starting...
+   [LINKER] compilation (codegen) error detected in 'Startup.Mainrootmain' at line #5
+   [LINKER] FAILED due to compilation errors 'LsetLongCodegenError_win32.exe'
+   [BUILD] failed
+   ```
+
+**Expected behavior**
+A compile error on the `LSet` line, as for the neighbouring wrong operands: `LSet s = a` with `a` a user-defined type and `RSet a = b` with user-defined types are refused with TB5001 (*unable to convert type ... to String*), and `LSet a = s` with a string source and a user-defined type destination is refused with TB5249. VB6 refuses this statement at compile time with *LSet allowed only on strings and user-defined types* (attached as `lset-long-codegen-error-vb6.zip`, which does not build).
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low. The error is reported, so nothing runs wrongly, but it points at no cause, and the compile step that the IDE shows while typing says the project is fine.
+
+Tried with a `Long` destination only. The same on BETA 983.
+
+<!-- Reproducer: bugs/lset-long-codegen-error/ (mode build, expects tbbuild exit 5 and "codegen" in the message); verified on 995 and 983. The BUGS tool's `vb6` command prints VB6's compile error and exits 1 for it, which is the comparison. No page states it: docs/Reference/Core/LSet.md says nothing about other destinations. -->
+
+---
+
+## `LSet` and `RSet` on an element of a `Variant` that holds an array change nothing
+
+**Describe the bug**
+`LSet v(0) = "zz"` and `RSet v(1) = "zz"` do nothing when `v` is a `Variant` that holds an array, whether the array came from `Array(...)` or from `ReDim v(0 To 1)` on the `Variant`. The statements raise no error, and the element keeps its value. The same statements on an element of an array declared `Dim w(0 To 1) As Variant` work. Observed in a run of the reproducer project.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `lset-variant-array-element-noop.twinproj` (attached as `lset-variant-array-element-noop.zip`). Its one source file, `Startup.twin`, has a `Sub Main` that assigns `v = Array("0123456789", "abcde")`, runs `LSet v(0) = "zz"` and `RSet v(1) = "zz"`, and does the same to the elements of `Dim w(0 To 1) As Variant`.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   LSet v(0), v = Array(...):   [0123456789]
+   RSet v(1), v = Array(...):   [abcde]
+   LSet w(0), w(0 To 1) As Variant: [zz        ]
+   RSet w(1), w(0 To 1) As Variant: [   zz]
+   ```
+
+**Expected behavior**
+The elements of `v` change as those of `w` do: `[zz        ]` and `[   zz]`. VB6 does so (attached as `lset-variant-array-element-noop-vb6.zip`).
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low to medium. A statement that has no effect and no error is easy to miss.
+
+Tried: `ReDim v2(0 To 1)` on a `Variant`, then `LSet v2(0) = "zz"`, does the same. The `w` elements and `Dim a(0 To 2) As String` elements work. On BETA 983 the `v` lines read the same, and the `w` line for `LSet` reads `[zz23456789]`, because `LSet` did not yet fill with spaces there (fixed in BETA 984, which is a separate matter).
+
+<!-- Reproducer: bugs/lset-variant-array-element-noop/ (mode run, expects the four lines above); verified on 995, 983 gives the same `v` lines. docs/Reference/Core/LSet.md and RSet.md each carry a WARNING naming BETA 995 for this, after the paragraph that says the destination can be a Variant that holds a string; when fixed, replace each with a NOTE saying since which build. -->
+
+---
+
+## `LSet` and `RSet` on a `Variant` destination raise 13 for `Null` and for an object, and pad a `Boolean` as `-1`
+
+**Describe the bug**
+When the destination of `LSet` or `RSet` is a `Variant`, three subtypes behave differently from VB6. A `Variant` holding `Null` raises error 13 (*Type mismatch*), where VB6 raises 94 (*Invalid use of Null*). A `Variant` holding an object, such as a `Collection`, raises error 13, where VB6 raises no error. A `Variant` holding `True` is aligned as the two characters `-1`: `RSet v = "ab"` leaves `[ab]` with `Len` 2, where VB6 aligns within `"True"` and leaves `[  ab]` with `Len` 4. Observed in a run of the reproducer project.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `lset-variant-destination-types.twinproj` (attached as `lset-variant-destination-types.zip`). Its one source file, `Startup.twin`, has a `Sub Main` under `On Error Resume Next` that runs `LSet v = "abc"` on a `Variant` holding `Null`, `LSet v = "abc"` on one holding `New Collection`, and `RSet v = "ab"` on one holding `True`.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   LSet, destination Null:    error 13
+   LSet, destination Object:  error 13
+   RSet, destination True:    [ab] Len 2
+   ```
+
+**Expected behavior**
+`error 94` for `Null`, no error for the object, and `[  ab] Len 4` for `True`, as in VB6 (attached as `lset-variant-destination-types-vb6.zip`, which prints `error 94`, `error 0` and `[  ab] Len 4`).
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low. Programs rarely align into a `Variant` that holds `Null` or an object, and the error number matters only to a handler that tests for 94.
+
+A `Variant` holding an `Integer`, a `Long`, a `Double` or a `Date` is aligned within its text as in VB6, and one holding an error value or an array raises 13 in both. A `Null` source into a `String` destination raises 94 in both. The same results on BETA 983.
+
+<!-- Reproducer: bugs/lset-variant-destination-types/ (mode run, expects the three lines above); verified on 995 and 983. No page states these cases: docs/Reference/Core/LSet.md and RSet.md say that a Null source raises error 94 and that the destination can be a Variant that holds a string. -->
+
+---
+
+## The Debug Console offers no completion for a name typed after `?` and a space
+
+**Describe the bug**
+The Debug Console's IntelliSense list offers no names after `?` and a space, the form a line in the console is usually typed in. With the run stopped at a breakpoint and `total`, a local, in scope, typing `? tot` opens no list at any key, and Ctrl+Space at the end of the line opens none either. Typed with no space, `?tot` opens the list at the `t`, and it offers `total`; so does `tot` at the start of the line. `Debug.Print tot` opens no list, as `? tot` does.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `console-completion-after-print.twinproj` (attached as `console-completion-after-print.zip`). In `Startup.twin`, `Main` has two locals and calls a private Sub on the line marked `BREAK`:
+   ```
+   Public Sub Main()
+       Dim total As Long
+       Dim items As New Collection
+       total = 5
+       items.Add total
+       Touch total ' BREAK
+   End Sub
+
+   Private Sub Touch(ByVal n As Long)
+       Debug.Print "total " & n
+   End Sub
+   ```
+2. Put a breakpoint on the line marked `BREAK` (F9) and press F5. The run stops there.
+3. Click in the Debug Console's input and type `? tot`. No list opens at any key. Press Ctrl+Space: no list opens.
+4. Clear the input and type `?tot`, with no space. The list opens at the `t`, and once the line reads `?tot` it offers only `total`. Typing `tot` alone does the same.
+
+**Expected behavior**
+`? tot` opens the list with `total` in it, as `?tot` and `tot` do: the space does not change which names can follow the `?`. A `?` and a space is how a line is usually typed in the Debug Console, as in VBA's Immediate window, so that is where the list is wanted most.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Also on BETA 987, identically.
+
+What does not reproduce it: `tot` after leading spaces, which opens the list with `total`; and a dot after `?` and a space, `? items.`, which opens the list with the `Collection`'s members, so only the names are missing there. With Ctrl+Space at the end of the line, `Touch tot`, an argument of a Sub call, opens the list with `total`, and `Call Tou` and `total = to` open none, so names are missing after `Call` and on the right of an assignment as well. Typed key by key, `Call Tou` goes wrong sooner, for a separate reason: the space after `Call` accepts the list's first entry, and the line becomes `CallByDispId()`. With no program running, Ctrl+Space gives the same results: `Mai` offers `Main`, and `? Mai` opens no list.
+
+Severity: low to moderate. Name completion does not work in the form the console is nearly always typed in, and leaving out the space after `?` is the only way round it.
+
+<!-- Asserted by `ide-test.bat --only console-completion` (test/ide/console-completion.test.mjs: ?tot, tot, tot after leading spaces and Touch tot offer total; ? tot, Debug.Print tot, Call Tou and total = to open no list; ? items. offers the Collection's members; with no program running, Mai offers Main and ? Mai opens no list); passes on BETA 995 and 987. The lane puts each line in the console's input and presses Ctrl+Space; typed key by key, ? tot, ?tot, tot, tot after leading spaces, Debug.Print tot and ? items. do the same, which was checked on BETA 995 and is not asserted. The reproducer's Startup.twin is test/ide/probes/console-completion/Sources/Startup.twin with a different header comment. When fixed: update that test and this entry. -->
+
+---
+
+## A space typed in the Debug Console accepts the IntelliSense list's selection, so `Print x` becomes `Printerx`
+
+**Describe the bug**
+While the Debug Console's IntelliSense list is open, a space typed in its input accepts the list's first entry: the entry is written over the word before the caret, and the space is lost. The console's list never offers keywords, so a keyword that starts a longer name is replaced by that name. With the run stopped at a breakpoint, typing `Print total` gives `Printertotal`, because at `Print` the list offers `Printer`, `PrinterObjectConstants` and others, but not `Print`. In the same way, `Call Touch(total)` becomes `CallByDispId(Touch(total))`, and `Set obj = items` becomes `SetAttr(obj = items)`. The console refuses all three lines.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `console-space-accepts-completion.twinproj` (attached as `console-space-accepts-completion.zip`). In `Startup.twin`, `Main` has three locals and calls a private Sub on the line marked `BREAK`:
+   ```
+   Public Sub Main()
+       Dim total As Long
+       Dim items As New Collection
+       Dim obj As Object
+       total = 5
+       items.Add total
+       Touch total ' BREAK
+   End Sub
+
+   Private Sub Touch(ByVal n As Long)
+       Debug.Print "total " & n
+   End Sub
+   ```
+2. Put a breakpoint on the line marked `BREAK` (F9) and press F5. The run stops there.
+3. Click in the Debug Console's input and type `Print total` at an ordinary speed. The list opens while `Print` is typed, the space after it turns the line into `Printer`, and the line ends as `Printertotal`. Press Enter: the console prints `(compile error: Unrecognized symbol 'Printertotal')`.
+4. Type `Call Touch(total)`: the space after `Call` writes `CallByDispId()`, with the caret between the parentheses, and the line ends as `CallByDispId(Touch(total))`. Type `Set obj = items`: it ends as `SetAttr(obj = items)`. Enter gives a compile error for each.
+5. Type `Print`, press Escape, and type ` total`: the line is `Print total`, and Enter prints `5`.
+
+**Expected behavior**
+Each line stays as it is typed, as it does in the code editor. The code editor's list offers the keywords, so at `Print` its first entry is `Print` itself, and the space after it is typed: typed the same way in a procedure, `Print total`, `Call Touch(total)` and `Set obj = items` stay as they are. In the console, `Print total` typed with Escape before the space prints `5`.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Also on BETA 987, identically.
+
+What does not reproduce it: a word that is already the list's first entry, and not a procedure, keeps its space, so `total = 6` stays as it is. `? total` and `Debug.Print total` stay as they are. Escape before the space closes the list, and the space is then typed. With the IDE's IntelliSense mode set to LEGACY or MANUAL, the list does not open while the first word of a line is typed, and `Print total` and `Call Touch(total)` stay as they are.
+
+In the default mode, MODERN, the console asks for the list after every key and answers within a few milliseconds, so the list is open at the space whenever a line is typed at an ordinary speed. Every keyword that starts a longer name is replaced in the same way, and the others type as they are: `Do` becomes `DockModeConstants`, `For` becomes `FormArrangeConstants`, `On` becomes `OnErrorCatch`, `Get` becomes `GetAllSettings()` and `RaiseEvent` becomes `RaiseEventByName()`, while `Dim`, `End`, `Exit`, `With`, `Open`, `Close`, `ReDim`, `Stop` and `GoTo` stay. The same happens with no program running: `Print 1 + 1` becomes `Printer1 + 1`.
+
+Severity: moderate. `Print`, `Call` and `Set` begin lines that are often typed in the console, and each becomes a line the console refuses. The only ways round it are Escape before the space and another IntelliSense mode.
+
+<!-- Asserted by `ide-test.bat --only console-space` (test/ide/console-space.test.mjs: with the run stopped at BREAK and each line typed key by key, Print total becomes Printertotal, Call Touch(total) becomes CallByDispId(Touch(total)) and Set obj = items becomes SetAttr(obj = items), and the console refuses each; Print, Escape and then the rest give Print total, which prints 5; total = 6, ? total and Debug.Print total type as they are; with no program running, Print 1 + 1 becomes Printer1 + 1); passes on BETA 995 and 987. The lane waits after each key for the console's answer to it, as a person typing at an ordinary speed sees the list. Checked on BETA 995 and 987 and not asserted: the other keywords named above. Checked on BETA 995 and not asserted: the LEGACY and MANUAL modes, and the code editor. The reproducer's Startup.twin is test/ide/probes/console-space/Sources/Startup.twin with a different header comment. Related: "The Debug Console offers no completion for a name typed after `?` and a space", whose Additional context mentions this one. When fixed: update that test and this entry. -->
diff --git a/WIP.ExamplesBuild.md b/WIP.ExamplesBuild.md
index f2b282df7..cd1f7355b 100644
--- a/WIP.ExamplesBuild.md
+++ b/WIP.ExamplesBuild.md
@@ -290,6 +290,39 @@ already consumes. Two exist:
 |---|---|---|
 | `console` | stdole, VB (Forms), AppGlobalClassObject | everything by default |
 | `packages` | the above plus all eleven other shipped packages | `Reference/Built-In/` and the package tutorials |
+| `form` | `console`, a delta | a `check_run` sample that needs a real form: drawing, `Cls`, `Print`, `Scale`, a form property. Never inferred: a fence says `project=form` |
+
+(The table is the two whole templates. The deltas over them --- `vb-private`, `cc-private`,
+`wnc-private`, `cef-private`, `implicit`, `cef`, `webview2` --- are `TEMPLATE_BASE` in
+`scripts/lib/example-batches.mjs`, with `form`.)
+
+**`form` is `console` plus a real `Form1`**: `Sources/Form1.twin` (a predeclared class with the
+`FormDesignerId` attribute) and `Sources/Form1.tbform` (its designer file), and its own
+`tbxStage.twin`, which is console's less the line `Public Form1 As Form`. A form made with
+`New Form` in code has no designer file and cannot be drawn on (`Load` raises 361, `AutoRedraw`
+raises -2147467259), so the form has to be a file of the project. Four facts about it, all
+measured on BETA 995:
+
+- **An empty form has no `_children` key.** `"_children": []` in `Form1.tbform` fails the build with
+  `TB5247 unable to find matching form designer JSON via FormDesignerId`, and `Form1` is then
+  unrecognised everywhere.
+- **The stand-in makes no difference to `Load Form1`.** With `Public Form1 As Form` in the stage
+  beside a real `Form1` class, `Form1` reaches the class's predeclared instance
+  (`TypeName(Form1)` is `Form1`, `Load Form1` and `AutoRedraw` work), and the stand-in stays
+  `Nothing`. In the `console` template, with no class, `Form1` is the stand-in and is `Nothing` at
+  run time. The `form` stage drops the line anyway, so that no second `Form1` exists at project
+  scope. A probe holds the two stage sets to "console's less that line", which is the only
+  thing that keeps the lists from drifting apart.
+- **Fences for `form` go in a run project of their own.** Batches are grouped by template, so a
+  `project=form` run fence is never packed with a `console` one; a `projname=` group whose fences
+  all say `project=form` is one form project (`checkGroups` refuses a group of two templates, so
+  the `slot=file` module fence that declares `GetPixel` says `project=form` too).
+- **The dispatcher unloads every form each sample leaves loaded.** A loaded form ends the
+  run with `[DEBUGGER] Waiting for remaining forms to close...` and keeps it waiting, and the next
+  sample finds the form with what the last one drew (a second sample's `GetPixel` on a form the
+  first had drawn on read red before it drew anything). `tbxRun` therefore calls `tbxUnloadForms`
+  after each sample and before its end marker; a sample that forgets `Unload Form1` costs nothing,
+  and the samples share no form. The VB6 harness does the same.
 
 **`project.references` is a plain JSON array, and a hand-written entry works.** Measured:
 an entry composed by hand from a package's own `Settings` --- id, name, version,
@@ -429,6 +462,18 @@ less two; and `Err.Source` of an error raised in the exe is the project name, wh
 `ErrObject/Raise.md` differs. `Close` with no argument in a sample also closes the file the
 output goes to, so the sample's next `Debug.Print` raises error 52.
 
+**A `project=form` fence is built in VB6 with a blank `Form1.frm`.** The project then has a
+`Form=Form1.frm` line and no `Unattended=-1`, which VB6 refuses for a project with a form, so
+its exe is run on a private desktop (`runOnDesktop`, as a reproducer's is) and the time limit ends
+one that waits on a box. A `projname=` group takes the form when any of its fences says
+`project=form`; plain fences that say it are one project of their own. The harness unloads each
+sample's forms before the end marker, as the twinBASIC dispatcher does, because a loaded form keeps a
+VB6 exe running after `Main` returns. `Declare PtrSafe` is not VB6: `declaresForVb6` drops `PtrSafe`
+and reads `LongPtr` as `Long` on a Declare statement's lines (and its continuations) and touches
+nothing else, which is what lets the documentation's `GetPixel` module build. Checked on BETA 995
+and in VB6: both form samples print what the pages say (`Graphics-Methods.md`'s three lines, and
+the Form page's `True`).
+
 Two things a batch runner must do that a single-fence runner need not:
 
 - **Keep a source map.** Errors return against a generated file and line; the report names
diff --git a/WIP.Harness.md b/WIP.Harness.md
index 8a5e4d5f5..8a1c08948 100644
--- a/WIP.Harness.md
+++ b/WIP.Harness.md
@@ -343,10 +343,12 @@ Two bugs came out of the move, and neither had been noticed:
 
 **Do not reach for `--buildAndExit32` instead.** It exists, it is real (`parseCommandLine()`
 reads it, and Personal Edition is refused by name), and it is useless unattended: **nothing
-is written to stdout or stderr, ever**, it exits 0 on a project the IDE flags, and when the
-build genuinely fails it does not exit at all --- it sits on a "Please wait…" dialog at 100%
-forever. Silent, falsely green, and hanging on the one case worth catching. Measured all
-three ways.
+is written to stdout or stderr, ever**, it exits 0 with the `.exe` written when the error is
+in code nothing calls, and for an error the build reaches --- an unknown procedure or type,
+an undeclared variable, no `Sub Main` --- it does not exit at all: it sits on a "Please
+wait…" dialog at 100% forever. Silent, falsely green, and hanging on the one case worth
+catching. Measured all three ways, on BETA 983 and 995 (the BUGS-TO-REPORT entry on
+`--buildAndExit32`).
 
 **It runs the IDE on a private Windows desktop, and that is not decoration.** A build tool
 that seizes the keyboard mid-sentence is a build tool nobody runs while working. No window
@@ -360,11 +362,22 @@ That is the one piece of the harness that cannot be JavaScript, because it is
 started running inside a job, the job object calls ([The IDE runs inside a
 job](#the-ide-runs-inside-a-job)) --- and Node has no FFI without a native addon.
 [scripts/lib/tb-launch.ps1](scripts/lib/tb-launch.ps1) holds those calls. It is **not run
-as a file**: `tb-ide.mjs` reads the text and passes it through
+as a file**: `tb-ide.mjs` reads the text and runs it through
 `-EncodedCommand`, so the default execution policy --- which refuses `.ps1` files on this
 machine, and which is the same policy [BOOKPLAN.md](BOOKPLAN.md) records blocking `npx.ps1`
 --- never comes into it, and no `-ExecutionPolicy Bypass` has to be recommended to anyone.
 Its inputs arrive as environment variables, so there is no argument quoting to get wrong.
+**The script itself arrives in one too** (`TBBUILD_SCRIPT`), and `-EncodedCommand` carries only a
+one-line bootstrap that takes it out of the environment, so the launched program does not
+inherit it, and runs it. The script went through `-EncodedCommand` whole until it grew past about
+12,000 characters: UTF-16 in base64 is 2.7 characters to each, a command line stops at 32,767,
+and every launch then failed with `spawn ENAMETOOLONG`. An environment variable stops at 32,767
+characters of its own; `launchOnDesktop` refuses a script over 30,000. The script also takes
+`TBBUILD_STDOUT` / `TBBUILD_STDERR` (files for the program's standard output and error),
+`TBBUILD_ARGS` (more of the command line, already quoted) and `TBBUILD_DIALOGS=close`, which
+polls the private desktop every 250 ms for visible `#32770` boxes belonging to the program or
+its job, prints each as `dialog <base64 of JSON {title, text}>` and presses its OK button:
+`bug_repro`'s `cli` mode uses all four for a compiler that opens a modal box on a damaged project.
 
 A launch that fails prints no pid, and its cause as one line on stderr, which `launchIde`
 reports. Two things used to hide the cause. With its streams redirected, PowerShell writes
@@ -1224,9 +1237,15 @@ anybody watches. A caller can still set the variable otherwise, or leave it out
 `undefined` as its value: Node leaves such a variable out of a child's environment even
 when its own environment has it (measured).
 
-**Measured on BETA 983 (P10 in WIP.HelpAddin.md):** a probe add-in printed the variable
-from `Host_OnProjectLoaded`. Through `launchIde` it read `1`, from `Environ$` and from
-`GetEnvironmentVariableW` alike, and with the variable left out both said it was unset. The
+**Measured on BETA 983 and 995 (P10 in WIP.HelpAddin.md), and held by
+[test/addin/env.test.mjs](test/addin/env.test.mjs):** the EnvProbe add-in
+([probes/env](test/addin/probes/env)) prints the variable from `Host_OnProjectLoaded`.
+Through `launchIde` it read `1`, from `Environ$` and from
+`GetEnvironmentVariableW` alike, and with the variable left out (`env: { TB_ADDIN_TEST:
+undefined }` to `Lane.open`, after `closeProject`) `Environ$` was empty and the Win32 call
+said unset. The lane asserts all of that, and that the process id the add-in read is
+`compilerPid`'s, that a restart prints from a different process, and that it reads `1`
+again. The
 path it travels: `tb-launch.ps1` calls `CreateProcess` with no environment block of its own,
 so the IDE inherits the launcher's; the IDE starts the compiler, `twinBASIC_win32_noDEP.exe`,
 as a direct child; and the add-in runs inside the compiler's process --- the process id it
@@ -1398,6 +1417,19 @@ probe lanes:
   name, `_v2`, `_v3` as built, and `_v4`, none longer than the original, with NULs after
   it. The export table has one name, so its sorted order, which `GetProcAddress`
   searches, cannot change.
+- [test/addin/env.test.mjs](test/addin/env.test.mjs), P10: it builds the EnvProbe add-in
+  from [test/addin/probes/env](test/addin/probes/env), which prints one line as the project
+  loads: `Environ$("TB_ADDIN_TEST")`, the same through `GetEnvironmentVariableW` (`(unset)`
+  when absent) and its process id. The first test asserts `1` twice and that the id is the
+  compiler's; the second restarts the compiler with `Lane.restartCompiler` and asserts `1`
+  twice and a different id; the third is the control, `closeProject` and then `Lane.open`
+  with `env: { TB_ADDIN_TEST: undefined }`, and asserts an empty `Environ$` and `(unset)`.
+  The probe opens nothing, so running an IDE without the variable is safe. Two IDEs in one
+  lane need no change to the runner, and the second takes the same port once the first has
+  been ended.
+
+**Measured on BETA 995:** the eleven lanes, with the env lane (16 s alone) added, take
+1 min 43 s at the default two at a time.
 
 **Measured on BETA 983:**
 
diff --git a/WIP.HelpAddin.md b/WIP.HelpAddin.md
index aeaa01a31..ab4a8a6d4 100644
--- a/WIP.HelpAddin.md
+++ b/WIP.HelpAddin.md
@@ -6,7 +6,7 @@ tests IDE add-ins by machine, which the add-in is developed against.
 
 **Status: Stages 1 and 2 are done, and Stage 3's index is built** --- `addin-test.bat`
 operates Samples 10 and 15 end to end and leaves the registry as it found it; all fourteen
-of Stage 2's questions are answered, twelve of them by eight probe lanes that fail when a
+of Stage 2's questions are answered, thirteen of them by nine probe lanes that fail when a
 later IDE build behaves differently; and every build publishes `tB/symbols.json`, 5,536
 names at 4,086 URLs, under a drift guard that fails the build when one of its URLs goes.
 Stage 3's embedded mode, a `theme` parameter the site would read, waits until the add-in
@@ -630,12 +630,16 @@ Everything after this stage is developed against it.
    read as one. `PrintText` stores its text escaped (`<b>` as `&lt;b&gt;`), so a URL comes
    back exactly as printed, `&` included.
 
-   **The probe stayed in scratch.** It was thirty lines: `Host_OnProjectLoaded` printing
-   `Environ$("TB_ADDIN_TEST")`, the same through `GetEnvironmentVariableW`, and its own process
-   id. What it measured matters only while the add-in depends on it, and the add-in checks it
-   itself from Stage 4 on (increment 1 below). `add-in/` holds the add-in's tree and nothing
-   else: `stageProject` copies the whole folder it is given and packs the copy, so a probe
-   kept inside it would be packed into the add-in's project.
+   **The probe is a lane.** It was thirty lines in scratch at first (`Host_OnProjectLoaded`
+   printing `Environ$("TB_ADDIN_TEST")`, the same through `GetEnvironmentVariableW`, and its
+   own process id), and nothing guarded the answer although the rule above depends on it.
+   It is now [test/addin/probes/env](test/addin/probes/env) with
+   [env.test.mjs](test/addin/env.test.mjs): the variable reads `1` both ways in the
+   compiler's process, again in the process a restart starts, and unset in an IDE started
+   without it. The add-in checks the variable itself from Stage 4 on (increment 1 below).
+   `add-in/` holds the add-in's tree and nothing else: `stageProject` copies the whole
+   folder it is given and packs the copy, so a probe kept inside it would be packed into
+   the add-in's project.
 7. **A runner.** Scenarios in JavaScript under `node:test`, one IDE per test project, lanes
    by `--port` as today. The add-in's pure twinBASIC logic --- word extraction, lookup --- is
    tested without loading any add-in: a test project holds those modules and a
@@ -695,11 +699,12 @@ offline route, and [appdata.test.mjs](test/addin/appdata.test.mjs) (P6) the lane
 `APPDATA` and the FAQ's answer on where add-ins go. [arch.test.mjs](test/addin/arch.test.mjs)
 (P7) holds up the Add Ins page's account of which folder loads when, and the win64 builds
 `buildAddin` now makes; [reload.test.mjs](test/addin/reload.test.mjs) (P8, P9) the account
-of a compiler restart on the tbIDE package page and the ToolWindows page; and
+of a compiler restart on the tbIDE package page and the ToolWindows page;
 [entry.test.mjs](test/addin/entry.test.mjs) (P14) the entry point's NOTE on the tbIDE
-package page. P9 turned up the shared id `""` of windows given none, and the test of it
+package page; and [env.test.mjs](test/addin/env.test.mjs) (P10) the rule that an add-in under
+test opens nothing, which reads `TB_ADDIN_TEST`. P9 turned up the shared id `""` of windows given none, and the test of it
 went in the panes lane, with the rest of what a tool window does. A probe that settles a
-question once, as P10's did, stays in scratch; so did the two P3 checks that need the
+question once stays in scratch; so did the two P3 checks that need the
 network or a changed WebView2, the live site in the frame and the colour scheme with
 WebView2 preferring light.
 
@@ -714,7 +719,7 @@ WebView2 preferring light.
 | P7 | Which bitness does the compiler start in, and does switching the build target restart it in the other one and load the other `addins` folder? **Answered, BETA 983 and 995: yes, and yes.** The target a project opens in picks the compiler --- win32 when the IDE remembers none, `twinBASIC_win64_noDEP.exe` for a project remembered as win64 --- and each compiler loads the folders of its own bitness alone, the install's and `%APPDATA%`'s. Switching the target of an open project restarts the compiler in the other bitness, and the new one loads the other folders: a 64-bit build of the probe in each win64 folder loaded, and ran 64-bit, once the project was switched to win64, and the 32-bit ones again after a switch back. | building and testing both bitnesses --- `buildAddin` builds either, and a shipped add-in needs both |
 | P8 | Is a loaded add-in DLL locked against being overwritten? **Answered, BETA 983 and 995: yes.** While its IDE runs, overwriting fails (`EBUSY`) and deleting fails (`EPERM`), though renaming works; the hold outlasts the compiler's exit by a few tens of milliseconds. The P9 lane checks all three again. | the rebuild loop --- the DLL is built outside `addins`, and copied in once the IDE has ended, or renamed aside first (P9) |
 | P9 | Does a compiler restart reload add-ins from disk? **Answered, BETA 983 and 995: yes.** A restart --- the restart button, a switch of build target, or the IDE's own after a crash --- removes every add-in's buttons and shortcuts, leaves its windows showing `(currently unavailable)`, kills the old compiler, so that no `Class_Terminate` runs, and starts a compiler that loads whatever file is in the folders then. With the loaded DLL renamed aside, a restart loaded nothing; with a new build put in its place, the next restart loaded it, about a second after the click, and it got its old windows back by their ids. | a rebuild loop without restarting the IDE --- it works: rename aside, copy in, restart |
-| P10 | Does an environment variable set by the harness reach the add-in (`Environ$`)? **Answered, BETA 983: yes**, through the launcher, the IDE and the compiler the IDE starts. With `TB_ADDIN_TEST=1` in `launchIde`'s environment, `Environ$` and `GetEnvironmentVariableW` both returned `1` in the add-in, and a compiler started by the restart button returned it too; left out, both said it was unset. `WEBVIEW2_USER_DATA_FOLDER`, which `launchIde` always sets, arrived with the lane's port in it. | the side-effect switch |
+| P10 | Does an environment variable set by the harness reach the add-in (`Environ$`)? **Answered, BETA 983 and 995: yes**, through the launcher, the IDE and the compiler the IDE starts. With `TB_ADDIN_TEST=1` in `launchIde`'s environment, `Environ$` and `GetEnvironmentVariableW` both returned `1` in the add-in, whose process id was the compiler's, and a compiler started by the restart button, a new process, returned it too; left out, `Environ$` was empty and the Win32 call said unset. Held by [test/addin/env.test.mjs](test/addin/env.test.mjs). `WEBVIEW2_USER_DATA_FOLDER`, which `launchIde` always sets, arrived with the lane's port in it. | the side-effect switch |
 | P11 | Does the IDE write into its own install folder during a session? **Answered, BETA 983 and 995: no.** On 983 a compile, a compiler crash and a `tbrun` build-and-run left all 233 files byte-identical, mtimes included. On 995 the install (235 files) was byte-identical after exports, a `tbbuild` and two `tbrun` runs; `%APPDATA%` was not re-checked. | hardlinks or copies --- copies, for safety, at 380 ms |
 | P12 | Does `raiseEvent` from plain tool-window HTML throw? **Answered, BETA 983 and 995: yes** --- `TypeError: Cannot read properties of null (reading 'rootEventHandler')`, and the listener is not called. An inline handler that calls the listener `AddEventListener` stored on its parent, `this.parentNode.<name>(event)`, reaches the add-in. | how the pane's events are written |
 | P13 | Does the compiler's HTTP server serve any file placed under `ide\`? **Answered, BETA 983 and 995: yes**, and it is the page server, `twinBASIC_win32.exe --ide=<pid>`, not the compiler. Any file, byte for byte, below the page's own path, including one written after the IDE started; a frame with a relative `src` shows it on the IDE page's own origin. A query string makes a 404, and `.html` has no `Content-Type`. | an offline route --- it exists ([Offline](#ways-to-show-a-page)) |
diff --git a/WIP.md b/WIP.md
index 796ef1789..e24af1a5f 100644
--- a/WIP.md
+++ b/WIP.md
@@ -224,6 +224,8 @@ The vocabulary tables further down cover word choice. The rules in this subsecti
 
    One callout per concern; don't stack a NOTE and an IMPORTANT for the same point.
 
+   **A known twinBASIC defect that silently gives a wrong result is a `> [!WARNING]` until a fixed build is released** (owner's rule): a wrong value with no error raised is data corruption the reader cannot see. A crash is a WARNING too (unsaved data is lost), and so is an error that hides a silent part (a procedure run twice before the error). A defect the reader cannot miss and that loses nothing --- an error raised, a statement refused --- is a `> [!NOTE]`. Name the build in either; once fixed, it becomes a NOTE saying since which build. The defect's BUGS-TO-REPORT entry says in its HTML comment which page carries the callout, so the callout is changed when the entry is retired.
+
 7. **See Also.** Last section on the page, after `Example`. Format: `- [Symbol](Symbol) <noun>` where `<noun>` is the kind: statement, function, property, method, class, module, package. Pages with annotations use `- [Symbol](Symbol) -- short description` — the `--` source renders as a typographic dash via markdown-it's typographer (en-dash for `--`, em-dash for `---`). Don't write literal `—` in source; keep `--` for consistency across the docs. Order by conceptual proximity, not strict alphabetical.
 
 8. **Name the fault directly; never build up to it.** Setting up a contrast and then withholding the point is coy, and it makes the reader parse the sentence twice to extract one fact. *Avoid:* "double-clicking it is the obvious shortcut, and it is the one that misleads"; "the specificity trap --- which is the one thing that reliably catches people out". *Use:* "double-clicking it is obvious, and wrong"; "the specificity trap: a rule that loses it applies in light mode and silently does not in dark". Say what the thing is and what it does, in that order, in one clause. The same applies to "and that is the one that…", "which is precisely the…" and "therein lies the…".
@@ -425,7 +427,7 @@ over them, because a `tb` fence is something `check_code_regions.mjs` protects t
 the compiler now. A sample opts in by carrying `check_build` in its fence info string; the
 tool works out what to generate around it, packs many samples into one project, builds them
 through `tbbuild` on concurrent lanes, and reports each diagnostic against the line in the
-page it came from. **1,144 samples are marked, and the run takes about 80 seconds.**
+page it came from. **1,197 samples are marked, and the run takes about 110 seconds.**
 
 It is **never** wired into `build.bat`, `check.bat`, `test.bat` or CI: it needs a twinBASIC
 install, which `npm install` is not, and Windows with a private desktop and a
@@ -463,13 +465,13 @@ Why the report separates the wedged task from the merely blocked ones, and why
 - `build.bat` — runs `node builder\tbdocs.mjs --src docs --check-audit-index` (which implies `--check`) and produces three trees in one pass: the online copy at `_site/`, a `file://`-browsable copy at `_site-offline/`, and the sparse pagedjs source at `_site-pdf/`. The offline pass adds ~700 ms and the PDF pass adds ~150 ms on top of the ~2 s online build. Toggle `also_build_offline` / `also_build_pdf` in `_config.yml` (or pass `--no-offline` / `--no-pdf`) to skip a sibling output. `--check` adds ~1.7 s and runs the link + integrity check over the HTML while it is still in worker memory; `build.bat --no-check` gets a plain build.
 - `serve.bat` — runs `tbdocs --serve`: initial build, then a long-lived process with watcher, debounced rebuilds, and SSE-driven browser auto-reload. Writes to `docs/_serve/` (disjoint from `build.bat`'s `_site*/`) and skips the offline + PDF passes — so a one-off `build.bat` for the PDF or offline mirror doesn't disturb the live preview. Ctrl+C to stop.
 - `check.bat` — the gates that read the built site: a freshness check that refuses a stale tree (`scripts/check_tree_fresh.mjs`), the DOT diagram fit check (`scripts/check_dot_fit.mjs`), the a11y sample-coverage check (`scripts/pick_a11y_sample.mjs --check`), then the accessibility check (`scripts/check_a11y.mjs`). The link + integrity check moved into `build.bat`. ~37 s.
-- `test.bat` — the tests the *toolchain* has to pass: the publish-allowlist self-test (`scripts/check_publish_policy.mjs`), the gate-list check (`scripts/check_gate_lists.mjs`), the CI-workflow roster check (`scripts/check_ci_workflows.mjs`), the lint gate (`scripts/check_lint.mjs`), the site-search unit tests (`node --test test/search.test.mjs`), the markdown-plugin unit tests (`node --test test/render.test.mjs`), the date-formatter unit tests (`node --test test/strftime.test.mjs`), `check_examples.mjs`'s probes (`node --test test/example-batches.test.mjs`), the regex-safety gate (`scripts/check_regex_safety.mjs`), the code-region gate (`scripts/check_code_regions.mjs`), the page-count drift-guard probes (`scripts/check_page_baseline.mjs`), the book-coverage probes (`scripts/check_book_coverage.mjs`), the symbol-index probes (`scripts/check_symbol_index.mjs`), the twinBASIC-scanner probes (`scripts/check_twin_parsers.mjs`), the attribute-sweep probes (`scripts/check_attribute_sweep.mjs`), the command-line probes and cases (`scripts/check_cli.mjs`), the pdf-lib shim comparison (`scripts/check_pdf_shims_equiv.mjs`), the impexp parity check (`scripts/check_impexp_parity.mjs`), and the axe source-patch verification (`scripts/check_axe_patch_equiv.mjs`). ~23 s, of which the regex-safety gate is ~10 s and the impexp check ~4 s. See [What belongs in test.bat rather than check.bat](WIP.Build.md#what-belongs-in-testbat-rather-than-checkbat).
+- `test.bat` — the tests the *toolchain* has to pass: the publish-allowlist self-test (`scripts/check_publish_policy.mjs`), the gate-list check (`scripts/check_gate_lists.mjs`), the CI-workflow roster check (`scripts/check_ci_workflows.mjs`), the lint gate (`scripts/check_lint.mjs`), the site-search unit tests (`node --test test/search.test.mjs`), the markdown-plugin unit tests (`node --test test/render.test.mjs`), the date-formatter unit tests (`node --test test/strftime.test.mjs`), the bug-reproducer picture tests (`node --test test/png.test.mjs`), `check_examples.mjs`'s probes (`node --test test/example-batches.test.mjs`), the regex-safety gate (`scripts/check_regex_safety.mjs`), the code-region gate (`scripts/check_code_regions.mjs`), the page-count drift-guard probes (`scripts/check_page_baseline.mjs`), the book-coverage probes (`scripts/check_book_coverage.mjs`), the symbol-index probes (`scripts/check_symbol_index.mjs`), the twinBASIC-scanner probes (`scripts/check_twin_parsers.mjs`), the attribute-sweep probes (`scripts/check_attribute_sweep.mjs`), the command-line probes and cases (`scripts/check_cli.mjs`), the pdf-lib shim comparison (`scripts/check_pdf_shims_equiv.mjs`), the impexp parity check (`scripts/check_impexp_parity.mjs`), and the axe source-patch verification (`scripts/check_axe_patch_equiv.mjs`). ~23 s, of which the regex-safety gate is ~10 s and the impexp check ~4 s. See [What belongs in test.bat rather than check.bat](WIP.Build.md#what-belongs-in-testbat-rather-than-checkbat).
 - `book.bat` — renders the PDF from `docs\_site-pdf\book.html` via `node book\render-book.mjs` into `docs\_pdf\twinBASIC Book.pdf`. Run `build.bat` first to populate `_site-pdf/`; `book.bat` refuses a tree older than its sources rather than rendering the previous book (see [The book refuses a stale source tree](WIP.Build.md#the-book-refuses-a-stale-source-tree)).
 
-- `examples.bat` — compiles the documentation's own twinBASIC code samples, every `tb` fence marked `check_build`, and reports the ones the compiler refuses against the line in the page they came from; a statement sample also marked `check_run` is built and run, and what it prints is checked against the page. Needs a twinBASIC install and Windows, so it is outside every gate and outside CI; ~80 s over the 1,144 samples marked. `--build` also builds each project that compiles clean, and `--llvm` builds it with LLVM (see [WIP.ExamplesBuild.md](WIP.ExamplesBuild.md)). Two modes need no compiler at all: `--census` classifies every fence and says how many classifiable ones are still unmarked, and `--report <survey.json>` groups a saved `--propose --json` survey by diagnostic, section and unresolved name. `--propose` itself does compile. See [Compiling the reference's own code samples](#compiling-the-references-own-code-samples) and [WIP.ExamplesBuild.md](WIP.ExamplesBuild.md).
-- `addin-test.bat` — tests IDE add-ins by operating an IDE: every lane in `test/addin/lanes.mjs` builds the add-ins it tests into a private copy of the install, opens a project and checks what the add-in does. Outside every gate and outside CI for the same reasons as `examples.bat`; ~140 s for the ten lanes today: Samples 10 and 15, and the eight probe lanes behind Stage 2's answers in [WIP.HelpAddin.md](WIP.HelpAddin.md). Exit 0 every lane passed and the registry is as it was found, 1 a lane failed, 2 the harness failed, 3 the registry or a work folder was not put back. See [Driving the twinBASIC compiler](#driving-the-twinbasic-compiler) for its rules.
+- `examples.bat` — compiles the documentation's own twinBASIC code samples, every `tb` fence marked `check_build`, and reports the ones the compiler refuses against the line in the page they came from; a statement sample also marked `check_run` is built and run, and what it prints is checked against the page. Needs a twinBASIC install and Windows, so it is outside every gate and outside CI; ~110 s over the 1,197 samples marked (33 of them `check_run`). `--build` also builds each project that compiles clean, and `--llvm` builds it with LLVM (see [WIP.ExamplesBuild.md](WIP.ExamplesBuild.md)). Two modes need no compiler at all: `--census` classifies every fence and says how many classifiable ones are still unmarked, and `--report <survey.json>` groups a saved `--propose --json` survey by diagnostic, section and unresolved name. `--propose` itself does compile. See [Compiling the reference's own code samples](#compiling-the-references-own-code-samples) and [WIP.ExamplesBuild.md](WIP.ExamplesBuild.md).
+- `addin-test.bat` — tests IDE add-ins by operating an IDE: every lane in `test/addin/lanes.mjs` builds the add-ins it tests into a private copy of the install, opens a project and checks what the add-in does. Outside every gate and outside CI for the same reasons as `examples.bat`; ~105 s for the eleven lanes today (BETA 995): Samples 10 and 15, and the nine probe lanes behind Stage 2's answers in [WIP.HelpAddin.md](WIP.HelpAddin.md). Exit 0 every lane passed and the registry is as it was found, 1 a lane failed, 2 the harness failed, 3 the registry or a work folder was not put back. See [Driving the twinBASIC compiler](#driving-the-twinbasic-compiler) for its rules.
 - `ide-test.bat` --- the same runner for scenarios that operate the IDE itself rather than an add-in: every lane in `test/ide/lanes.mjs`, base port 9660. Same exit codes, same standing outside every gate and outside CI, same rules.
-- `node scripts/bug_repro.mjs` --- the reproducer projects under `bugs/<slug>/` for the entries of [BUGS-TO-REPORT.md](BUGS-TO-REPORT.md): `new`, `pack` (impexp, then the zip, written in Node), `compile`, `build` and `run` through `tbbuild` and `tbrun`, `vb6` (builds the optional `vb6/` VB6 project beside the twinBASIC one in a temp copy and prints its `out.txt`; `pack` zips its sources into `<slug>-vb6.zip`; VB6 is started only by `scripts/lib/vb6.mjs`, never from a shell), `file` (moves a filed entry and its reproducer to `bugs/filed/<slug>/`; `file --marked` does every marked entry), and `verify`, which reads each `bugs/*/repro.json` and `bugs/filed/*/repro.json` and says whether the bug still reproduces on the newest beta. It has no wrapper. **`verify` is run by a person only**, never by a gate or CI: it needs a twinBASIC install, like `examples.bat`. Default port 9440, and `--jobs N` takes N ports from there. Its command-line cases are in `scripts/lib/cli-cases.mjs`, and need no IDE.
+- `node scripts/bug_repro.mjs` --- the reproducer projects under `bugs/<slug>/` for the entries of [BUGS-TO-REPORT.md](BUGS-TO-REPORT.md): `new`, `pack` (impexp, then the zip, written in Node), `compile`, `build` and `run` through `tbbuild` and `tbrun`, `vb6` (builds the optional `vb6/` VB6 project beside the twinBASIC one in a temp copy, runs its exe on a private desktop, and prints its `out.txt`; a project with a form or a user control is built without Unattended Execution, which VB6 refuses for it; `pack` zips its sources into `<slug>-vb6.zip`; VB6 is started only by `scripts/lib/vb6.mjs`, never from a shell; a graphical defect's `images` key makes `run` and `vb6` keep what the `PngDump` modules of `test/repro-templates/png/` draw as `images/<name>-tb.png` and `-vb6.png`, with a `-compare.png` of both, tested by `test/png.test.mjs`), `file` (moves a filed entry and its reproducer to `bugs/filed/<slug>/`; `file --marked` does every marked entry), and `verify`, which reads each `bugs/*/repro.json` and `bugs/filed/*/repro.json` and says whether the bug still reproduces on the newest beta. It has no wrapper. **`verify` is run by a person only**, never by a gate or CI: it needs a twinBASIC install, like `examples.bat`. Default port 9440, and `--jobs N` takes N ports from there. Its command-line cases are in `scripts/lib/cli-cases.mjs`, and need no IDE.
 - `node scripts/vb6run.mjs <file | ->` and `node scripts/vb6run.mjs --docs [--only <regex>]` --- build and run VB6 code, so that what a sample prints in twinBASIC can be compared with VB6: a stand-alone file of statements or a `.bas` module, or `--docs`, which builds the documentation's `check_run` fences in VB6 and says for each whether it prints what its page says (`same`, `differs`, `not VB6`, `error`, `refused`; a `projname=` group is built as a project of its own, its `slot=file` fences translated into VB6 `.cls` and `.bas` components). It has no wrapper and is outside every gate and outside CI: it needs VB6 (`--vb6`, `VB6_EXE`, or the standard install folder). **Never start `VB6.EXE` from a shell**: in Git Bash `/make` is rewritten as a path and VB6 answers with a modal box on the desktop; the tool spawns it from Node with an argument array, and a sample that calls `MsgBox` or `InputBox` or contains `End` is refused. Its `Debug.Print` rewrite and its file translation have probes in `test/example-batches.test.mjs`, and its command-line cases are in `scripts/lib/cli-cases.mjs`; both need no VB6. What it relies on is in [WIP.ExamplesBuild.md](WIP.ExamplesBuild.md).
 
 Three generators sit outside that loop and produce committed artifacts rather than build output — none runs during a build, and none is needed for one. `python scripts/build_fonts.py` rebuilds the subset webfaces under `docs/assets/fonts/` and needs a network connection; `node scripts/build_dot_metrics.mjs` regenerates `builder/inter-metrics.json` from those webfaces and needs only a browser. See [Typography](#typography). `node scripts/build_package_api.mjs` regenerates `builder/package-api.json`, the packages' declared API that the build's symbol index (`tB/symbols.json`, for the IDE help add-in) is annotated from; it needs a twinBASIC install, so **run it when the reference is re-indexed against a newer build** and commit it with the pages. See [WIP.HelpAddin.md, Stage 3](WIP.HelpAddin.md#stage-3-the-symbol-index-generated-by-the-docs-build).
@@ -484,7 +486,7 @@ build.bat && check.bat
 
 On the dev box that is ~4 s of build against ~37 s of check, of which the axe scan is ~20 s. [builder/PLAN-checks.md](builder/PLAN-checks.md) records how the link checker got folded into the build's task graph, what it cost and what it saved; the axe follow-ons are designed there but not implemented.
 
-**If the change touched `builder/`, `scripts/`, `lib/`, `book/`, `eval/`, `wisdom/`, `test/`, the site's scripts in `docs/assets/js/`, a wrapper or a workflow, run `test.bat` as well** --- another ~23 s. Sixteen of its nineteen gates cannot be affected by an edit under `docs/` at all. **Three can.** `check_lint.mjs` lints the site's two scripts in `docs/assets/js/` along with the tooling. `check_gate_lists.mjs` is the easy one to predict: it reads `README.md` and every page under `docs/Documentation/`, so an edit to any developer page that states a gate count can fail it. **`check_code_regions.mjs` is the one worth understanding**, and which half of it a content edit reaches is worth keeping straight. Its corpus sweep reads `DOCS_DIR`, which is `<repo>/docs`, and tokenises every markdown file in it, so a page that provokes a rewrite into *altering* a code region fails it --- that half is content-dependent. Its fixed probes are not: they run against their own sources whatever the tree holds, and they cover the **mirror** fault, where a rewrite silently stops firing. The sweep structurally cannot see that one, because text the rewrite skipped is masked and restored unchanged and every region still matches. So run `test.bat` after adding an unusual code construct --- a fence whose contents include a fence marker, a 4-space indented block, an admonition wrapping a fence --- and read the built page as well, because for the mirror fault the gate is asserting that the mask and the admonition scan still work rather than checking your page:
+**If the change touched `builder/`, `scripts/`, `lib/`, `book/`, `eval/`, `wisdom/`, `test/`, the site's scripts in `docs/assets/js/`, a wrapper or a workflow, run `test.bat` as well** --- another ~23 s. Seventeen of its twenty gates cannot be affected by an edit under `docs/` at all. **Three can.** `check_lint.mjs` lints the site's two scripts in `docs/assets/js/` along with the tooling. `check_gate_lists.mjs` is the easy one to predict: it reads `README.md` and every page under `docs/Documentation/`, so an edit to any developer page that states a gate count can fail it. **`check_code_regions.mjs` is the one worth understanding**, and which half of it a content edit reaches is worth keeping straight. Its corpus sweep reads `DOCS_DIR`, which is `<repo>/docs`, and tokenises every markdown file in it, so a page that provokes a rewrite into *altering* a code region fails it --- that half is content-dependent. Its fixed probes are not: they run against their own sources whatever the tree holds, and they cover the **mirror** fault, where a rewrite silently stops firing. The sweep structurally cannot see that one, because text the rewrite skipped is masked and restored unchanged and every region still matches. So run `test.bat` after adding an unusual code construct --- a fence whose contents include a fence marker, a 4-space indented block, an admonition wrapping a fence --- and read the built page as well, because for the mirror fault the gate is asserting that the mask and the admonition scan still work rather than checking your page:
 
 ```sh
 build.bat && check.bat && test.bat
diff --git a/bugs/break-in-doevents-evaluate-crash/break-in-doevents-evaluate-crash.twinproj b/bugs/break-in-doevents-evaluate-crash/break-in-doevents-evaluate-crash.twinproj
new file mode 100644
index 000000000..051d23dfe
Binary files /dev/null and b/bugs/break-in-doevents-evaluate-crash/break-in-doevents-evaluate-crash.twinproj differ
diff --git a/bugs/break-in-doevents-evaluate-crash/repro.json b/bugs/break-in-doevents-evaluate-crash/repro.json
new file mode 100644
index 000000000..20c8579e2
--- /dev/null
+++ b/bugs/break-in-doevents-evaluate-crash/repro.json
@@ -0,0 +1,4 @@
+{
+  "mode": "manual",
+  "steps": "1. Open break-in-doevents-evaluate-crash.twinproj in the twinBASIC IDE and press F5. Main loops on DoEvents.\n2. Press Ctrl+Break (Run > Break). The IDE stops inside the VB package: it opens IdleMessageLoopBreak.twin under Packages/VB/Sources/SUPPORT at the procedure IdleMessageLoopBreakpoint, and CALL STACK shows IdleMessageLoopBreakpoint above Main.\n3. Type ? 1 in the DEBUG CONSOLE and press Enter.\n4. Expected: 1. Actual: the program ends, and the DEBUG CONSOLE prints (runtime error -2147467259: NATIVE EXCEPTION: ACCESS_VIOLATION) and NATIVE EXCEPTION: ACCESS_VIOLATION {unknown} [$1EBD9288:twinBASIC_win32.dll+001D9288]. The IDE stays in break mode: the yellow arrow stays on the package's line, and Stop and the step commands stay enabled. Restarting the compiler puts it right.\nThe same happens with no console line at all when any watch exists, because the IDE evaluates the watches at the stop.\nControl: F5 at that first stop stops again at once, in Main, on the line after DoEvents; ? 1 there prints 1.\nAsserted on BETA 995 by `ide-test.bat --only break-into` (the project is test/ide/probes/break-into)."
+}
diff --git a/bugs/break-in-doevents-evaluate-crash/src/Settings b/bugs/break-in-doevents-evaluate-crash/src/Settings
new file mode 100644
index 000000000..d42b4dc2a
--- /dev/null
+++ b/bugs/break-in-doevents-evaluate-crash/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "BreakInDoeventsEvaluateCrash",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: After Break Into Code stops in DoEvents, evaluating anything ends the program with an access violation",
+	"project.exportPathIsV2": true,
+	"project.id": "{4B2042DF-438A-4347-B61D-8EF26801D9DF}",
+	"project.name": "BreakInDoeventsEvaluateCrash",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/break-in-doevents-evaluate-crash/src/Sources/Startup.twin b/bugs/break-in-doevents-evaluate-crash/src/Sources/Startup.twin
new file mode 100644
index 000000000..4a9d7109a
--- /dev/null
+++ b/bugs/break-in-doevents-evaluate-crash/src/Sources/Startup.twin
@@ -0,0 +1,12 @@
+' Press F5, then Break Into Code (Ctrl+Break): the loop spends nearly all its time
+' in DoEvents, and the debugger stops inside the VB package. Then type ? 1 in the
+' Debug Console: the program ends with an access violation.
+Module Startup
+
+    Public Sub Main()
+        Do
+            DoEvents
+        Loop
+    End Sub
+
+End Module
diff --git a/bugs/clear-all-breakpoints-restart/clear-all-breakpoints-restart.twinproj b/bugs/clear-all-breakpoints-restart/clear-all-breakpoints-restart.twinproj
new file mode 100644
index 000000000..48abb9764
Binary files /dev/null and b/bugs/clear-all-breakpoints-restart/clear-all-breakpoints-restart.twinproj differ
diff --git a/bugs/clear-all-breakpoints-restart/repro.json b/bugs/clear-all-breakpoints-restart/repro.json
new file mode 100644
index 000000000..509f834dd
--- /dev/null
+++ b/bugs/clear-all-breakpoints-restart/repro.json
@@ -0,0 +1,4 @@
+{
+  "mode": "manual",
+  "steps": "1. Open clear-all-breakpoints-restart.twinproj in the twinBASIC IDE and open Startup.twin.\n2. Put the cursor on the line marked BREAK and press F9. A breakpoint appears in the margin.\n3. Choose Debug > Clear All Breakpoints (Ctrl+Shift+F9). The breakpoint goes.\n4. Click Restart the compiler on the toolbar, and wait for the compile to end.\n5. Expected: no breakpoint. Actual: the breakpoint is back in the margin.\n6. Press F5. Expected: the DEBUG CONSOLE shows main start, the breakpoint's line and main end. Actual: the run stops at the breakpoint.\nControls: a breakpoint removed with F9 instead stays removed after a restart, and saving the project (Ctrl+S) between Clear All Breakpoints and the restart keeps them cleared. A breakpoint saved with the project survives a restart, as it should.\nAsserted on BETA 995 by `ide-test.bat --only breakpoints` (the project is test/ide/probes/breakpoints)."
+}
diff --git a/bugs/clear-all-breakpoints-restart/src/Settings b/bugs/clear-all-breakpoints-restart/src/Settings
new file mode 100644
index 000000000..a0adc78b8
--- /dev/null
+++ b/bugs/clear-all-breakpoints-restart/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ClearAllBreakpointsRestart",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: Clear All Breakpoints is undone by restarting the compiler, unless the project was saved in between",
+	"project.exportPathIsV2": true,
+	"project.id": "{8C486AF4-90AD-4407-AB35-C54960FD6D7B}",
+	"project.name": "ClearAllBreakpointsRestart",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/clear-all-breakpoints-restart/src/Sources/Startup.twin b/bugs/clear-all-breakpoints-restart/src/Sources/Startup.twin
new file mode 100644
index 000000000..33f3cd97f
--- /dev/null
+++ b/bugs/clear-all-breakpoints-restart/src/Sources/Startup.twin
@@ -0,0 +1,13 @@
+' Put a breakpoint on the line marked BREAK (F9), remove it with Debug > Clear All
+' Breakpoints, click the toolbar's Restart the compiler, and press F5: the run
+' stops at the breakpoint that was cleared. With no breakpoint, it prints all
+' three lines.
+Module Startup
+
+    Public Sub Main()
+        Debug.Print "main start"
+        Debug.Print "the breakpoint's line" ' BREAK
+        Debug.Print "main end"
+    End Sub
+
+End Module
diff --git a/bugs/console-completion-after-print/console-completion-after-print.twinproj b/bugs/console-completion-after-print/console-completion-after-print.twinproj
new file mode 100644
index 000000000..57a516b7c
Binary files /dev/null and b/bugs/console-completion-after-print/console-completion-after-print.twinproj differ
diff --git a/bugs/console-completion-after-print/repro.json b/bugs/console-completion-after-print/repro.json
new file mode 100644
index 000000000..8ce27d68e
--- /dev/null
+++ b/bugs/console-completion-after-print/repro.json
@@ -0,0 +1,4 @@
+{
+  "mode": "manual",
+  "steps": "1. Open console-completion-after-print.twinproj in the twinBASIC IDE, put a breakpoint on the line marked BREAK (F9) and press F5. The run stops there, with total and items, locals of Main, in scope.\n2. Click in the DEBUG CONSOLE's input and type ? tot.\n3. Expected: the IntelliSense list opens with total in it, as it does for ?tot. Actual: no list opens at any key, and Ctrl+Space at the end of the line opens none either.\n4. Replace the line with ?tot, with no space, or with tot alone: the list opens at the t, and offers total.\nThe same: Debug.Print tot opens no list; Touch tot, a Sub call's argument, opens it; ? items. opens it with the Collection's members.\nAsserted on BETA 995 and 987 by `ide-test.bat --only console-completion` (the project is test/ide/probes/console-completion)."
+}
diff --git a/bugs/console-completion-after-print/src/Settings b/bugs/console-completion-after-print/src/Settings
new file mode 100644
index 000000000..def5246d5
--- /dev/null
+++ b/bugs/console-completion-after-print/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ConsoleCompletionAfterPrint",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: The Debug Console offers no completion for a name typed after `?` and a space",
+	"project.exportPathIsV2": true,
+	"project.id": "{48892EDE-B438-4995-AE50-7F8C7E0B34A9}",
+	"project.name": "ConsoleCompletionAfterPrint",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/console-completion-after-print/src/Sources/Startup.twin b/bugs/console-completion-after-print/src/Sources/Startup.twin
new file mode 100644
index 000000000..90e5c501b
--- /dev/null
+++ b/bugs/console-completion-after-print/src/Sources/Startup.twin
@@ -0,0 +1,18 @@
+' Put a breakpoint on the line marked BREAK (F9) and press F5. In the Debug
+' Console, ? tot opens no IntelliSense list, typed or with Ctrl+Space; ?tot,
+' with no space, and tot alone open it with total in it.
+Module Startup
+
+    Public Sub Main()
+        Dim total As Long
+        Dim items As New Collection
+        total = 5
+        items.Add total
+        Touch total ' BREAK
+    End Sub
+
+    Private Sub Touch(ByVal n As Long)
+        Debug.Print "total " & n
+    End Sub
+
+End Module
diff --git a/bugs/console-space-accepts-completion/console-space-accepts-completion.twinproj b/bugs/console-space-accepts-completion/console-space-accepts-completion.twinproj
new file mode 100644
index 000000000..f21a5acc8
Binary files /dev/null and b/bugs/console-space-accepts-completion/console-space-accepts-completion.twinproj differ
diff --git a/bugs/console-space-accepts-completion/repro.json b/bugs/console-space-accepts-completion/repro.json
new file mode 100644
index 000000000..296027be6
--- /dev/null
+++ b/bugs/console-space-accepts-completion/repro.json
@@ -0,0 +1,4 @@
+{
+  "mode": "manual",
+  "steps": "1. Open console-space-accepts-completion.twinproj in the twinBASIC IDE, put a breakpoint on the line marked BREAK (F9) and press F5. The run stops there, with total, items and obj, locals of Main, in scope.\n2. Click in the DEBUG CONSOLE's input and type Print total at an ordinary speed.\n3. Expected: the line stays Print total, and Enter prints 5. Actual: the IntelliSense list opens as Print is typed, and the space after it writes the list's first entry, Printer, over Print and is lost; the line becomes Printertotal, and Enter prints (compile error: Unrecognized symbol 'Printertotal').\n4. The same: Call Touch(total) becomes CallByDispId(Touch(total)), and Set obj = items becomes SetAttr(obj = items). Escape before the space keeps the line as typed.\nAsserted on BETA 995 and 987 by `ide-test.bat --only console-space` (the project is test/ide/probes/console-space)."
+}
diff --git a/bugs/console-space-accepts-completion/src/Settings b/bugs/console-space-accepts-completion/src/Settings
new file mode 100644
index 000000000..e4366358e
--- /dev/null
+++ b/bugs/console-space-accepts-completion/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ConsoleSpaceAcceptsCompletion",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: A space typed in the Debug Console accepts the IntelliSense list's selection, so `Print x` becomes `Printerx`",
+	"project.exportPathIsV2": true,
+	"project.id": "{75131106-A065-4B74-B917-60F5432B8FC7}",
+	"project.name": "ConsoleSpaceAcceptsCompletion",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/console-space-accepts-completion/src/Sources/Startup.twin b/bugs/console-space-accepts-completion/src/Sources/Startup.twin
new file mode 100644
index 000000000..89feed58a
--- /dev/null
+++ b/bugs/console-space-accepts-completion/src/Sources/Startup.twin
@@ -0,0 +1,19 @@
+' Put a breakpoint on the line marked BREAK (F9) and press F5. In the Debug
+' Console, type Print total at an ordinary speed: the space after Print accepts
+' the IntelliSense list's first entry, and the line becomes Printertotal.
+Module Startup
+
+    Public Sub Main()
+        Dim total As Long
+        Dim items As New Collection
+        Dim obj As Object
+        total = 5
+        items.Add total
+        Touch total ' BREAK
+    End Sub
+
+    Private Sub Touch(ByVal n As Long)
+        Debug.Print "total " & n
+    End Sub
+
+End Module
diff --git a/bugs/damaged-project-modal-box/cut.twinproj b/bugs/damaged-project-modal-box/cut.twinproj
new file mode 100644
index 000000000..05f1bea1e
Binary files /dev/null and b/bugs/damaged-project-modal-box/cut.twinproj differ
diff --git a/bugs/damaged-project-modal-box/empty.twinproj b/bugs/damaged-project-modal-box/empty.twinproj
new file mode 100644
index 000000000..e69de29bb
diff --git a/bugs/damaged-project-modal-box/firstbyte.twinproj b/bugs/damaged-project-modal-box/firstbyte.twinproj
new file mode 100644
index 000000000..4b3abd764
Binary files /dev/null and b/bugs/damaged-project-modal-box/firstbyte.twinproj differ
diff --git a/bugs/damaged-project-modal-box/garbage.twinproj b/bugs/damaged-project-modal-box/garbage.twinproj
new file mode 100644
index 000000000..03462d20e
--- /dev/null
+++ b/bugs/damaged-project-modal-box/garbage.twinproj
@@ -0,0 +1 @@
+garbage garbage garb
\ No newline at end of file
diff --git a/bugs/damaged-project-modal-box/repro.json b/bugs/damaged-project-modal-box/repro.json
index 96eb76ad2..3220af536 100644
--- a/bugs/damaged-project-modal-box/repro.json
+++ b/bugs/damaged-project-modal-box/repro.json
@@ -1,4 +1,25 @@
 {
-  "mode": "manual",
-  "steps": "Not automatable, and not run unattended: the compiler executable opens a modal message box on the desktop of whoever runs it, and waits until it is closed. 1. Pack the project (node scripts/bug_repro.mjs pack damaged-project-modal-box). 2. Make a damaged copy: change the first byte of the .twinproj, or cut it off halfway, or write any short text file with the name garbage.twinproj. 3. Run: bin\\twinBASIC_win32.exe export <full path>\\garbage.twinproj <full path>\\out\\ and see a message box (invalid header, or invalid file format) and no further output until it is closed. 4. Close the box: export prints WARNING: failed to parse project file, file may be corrupt, then ... DONE, and exits 0. settings and readme wait on the box the same way."
+  "mode": "cli",
+  "attach": ["garbage.twinproj", "empty.twinproj", "firstbyte.twinproj", "cut.twinproj"],
+  "cli": [
+    ["export", "{tmp}\\garbage.twinproj", "{tmp}\\out-garbage\\"],
+    ["settings", "{tmp}\\garbage.twinproj"],
+    ["readme", "{tmp}\\garbage.twinproj"],
+    ["export", "{tmp}\\firstbyte.twinproj", "{tmp}\\out-firstbyte\\"],
+    ["export", "{tmp}\\empty.twinproj", "{tmp}\\out-empty\\"],
+    ["export", "{tmp}\\cut.twinproj", "{tmp}\\out-cut\\"],
+    ["settings", "{tmp}\\cut.twinproj"]
+  ],
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^dialog: TWINBASIC ERROR: invalid file header",
+      "^dialog: bad file format: WARNING: failed to deserialize file system",
+      "^  WARNING: failed to parse project file, file may be corrupt",
+      "^  ERROR: failed to parse project file, file may be corrupt or inaccessible",
+      "^  ERROR: failed to find file, file may be corrupt",
+      "^\\[EXPORT\\]  DONE: .*\\\\Sources\\\\Startup\\.twin",
+      "^\\.\\.\\. DONE"
+    ]
+  }
 }
diff --git a/bugs/filed/circle-positive-angle-unchecked/REPORT.md b/bugs/filed/circle-positive-angle-unchecked/REPORT.md
new file mode 100644
index 000000000..c2a2ad4e3
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/REPORT.md
@@ -0,0 +1,41 @@
+Filed as [twinbasic/twinbasic#2463](https://github.com/twinbasic/twinbasic/issues/2463).
+
+## `Circle` with a positive angle above 2 pi raises no error and draws an arc, where VB6 raises error 5
+
+**Describe the bug**
+`Circle` does not check a positive *Start* or *End*. VB6 accepts angles from -2 pi to 2 pi and raises error 5 (*Invalid procedure call or argument*) for any other, drawing nothing. twinBASIC raises error 5 for a negative angle below -2 pi, as VB6 does, but a positive angle above 2 pi raises nothing and is drawn as if 2 pi had been subtracted from it: `Form1.Circle (195, 65), 50, vbRed, 7, 3` draws the arc from 0.72 to 3 radians. Observed by drawing on a form with `AutoRedraw` on, printing `Err.Number`, and saving what the form holds as a picture.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `circle-positive-angle-unchecked.twinproj` (attached as `circle-positive-angle-unchecked.zip`). Its `Sub Main` loads `Form1` without showing it, sets `AutoRedraw`, `ScaleMode = vbPixels`, a white background and a client area of 260 x 130 pixels, and then runs:
+   ```
+   Form1.Circle (65, 65), 50, vbBlue, -0.5, -2
+   On Error Resume Next
+   Form1.Circle (195, 65), 50, vbRed, 7, 3
+   n = Err.Number
+   On Error GoTo 0
+   Debug.Print "Circle Start 7: Err " & n
+   PngDump.Surface Form1, "main"
+   ```
+   The blue pie is a valid call, there to give the picture a reference. `PngDump` is a module in the project that copies the form's pixels with `BitBlt` and saves them as `main.png` with GDI+, so the picture does not depend on twinBASIC's own picture code.
+2. Run it.
+3. The DEBUG CONSOLE shows `Circle Start 7: Err 0`, and `main.png` shows a red arc beside the pie.
+
+**Expected behavior**
+Error 5, and nothing drawn by the second call, as VB6 does. The VB6 project (attached as `circle-positive-angle-unchecked-vb6.zip`, the same code with the same `PngDump` module) prints `Circle Start 7: Err 5`, and its picture holds the pie alone.
+
+**Screenshots**
+What twinBASIC BETA 995 drew on the left, what VB6 drew in the middle, and on the right the 101 pixels that differ, in red over a grey copy of the VB6 picture:
+
+![Circle drawn by twinBASIC BETA 995 and by VB6, and the pixels that differ](images/main-compare.png)
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: low. A program whose angle grows past 2 pi by mistake gets a drawing instead of the error that would show the mistake.
+
+What was tried: BETA 983 behaves the same. A *Start* of 2 pi + 0.001 and an *End* of 7 are drawn the same way; -7 and -2 pi - 0.001, as *Start* or *End*, raise error 5 and draw nothing in both twinBASIC and VB6. VB6's limit is a little above 2 pi, the same for either sign: the **Single** 6.283186 is accepted and 6.283187 refused, and twinBASIC refuses the same negative values. The rest of `Circle`'s angle handling matches VB6: a negative angle draws the radius to that end, a pie (both negative) is filled with `FillColor` and `FillStyle`, and an arc with one radius or none is not. The package source shows the cause: `Circle` in the VB package's `Graphics.twin` compares the angle with `6.28318619728` only inside `If Start < 0 Then` (and `If _End < 0 Then`), after taking its absolute value, so a positive angle is never compared.
+
+<!-- Reproducer: bugs/circle-positive-angle-unchecked/ (mode run, expects the line `Circle Start 7: Err 0`, and expect.imagesDiffer: the picture differs from images/main-vb6.png); run on 995. The VB6 project is in vb6/ (`bug_repro.mjs vb6 circle-positive-angle-unchecked`). The sweep behind "What was tried" (every case on 995, 983 and VB6) is in .claude/tooling-review-scratch/beta995-probes/s75/ (circle.out995.txt, circle.out983.txt, circle.outvb6.txt), local scratch files that are not in the repository. Stated in a WARNING naming BETA 995 in docs/Reference/Core/Graphics-Methods.md (section "What the built-in surfaces do with the flags") and under Circle's Start/End on the pages for Form, PictureBox, Printer, UserControl, Report and PropertyPage under docs/Reference/Default/VB/. Only Form was run; the other five share the same implementation. When fixed, replace each WARNING with a NOTE saying since which build. -->
diff --git a/bugs/filed/circle-positive-angle-unchecked/circle-positive-angle-unchecked.twinproj b/bugs/filed/circle-positive-angle-unchecked/circle-positive-angle-unchecked.twinproj
new file mode 100644
index 000000000..4867f70d4
Binary files /dev/null and b/bugs/filed/circle-positive-angle-unchecked/circle-positive-angle-unchecked.twinproj differ
diff --git a/bugs/filed/circle-positive-angle-unchecked/images/main-compare.png b/bugs/filed/circle-positive-angle-unchecked/images/main-compare.png
new file mode 100644
index 000000000..1072310a1
Binary files /dev/null and b/bugs/filed/circle-positive-angle-unchecked/images/main-compare.png differ
diff --git a/bugs/filed/circle-positive-angle-unchecked/images/main-tb.png b/bugs/filed/circle-positive-angle-unchecked/images/main-tb.png
new file mode 100644
index 000000000..86777567a
Binary files /dev/null and b/bugs/filed/circle-positive-angle-unchecked/images/main-tb.png differ
diff --git a/bugs/filed/circle-positive-angle-unchecked/images/main-vb6.png b/bugs/filed/circle-positive-angle-unchecked/images/main-vb6.png
new file mode 100644
index 000000000..1c2dc4ceb
Binary files /dev/null and b/bugs/filed/circle-positive-angle-unchecked/images/main-vb6.png differ
diff --git a/bugs/filed/circle-positive-angle-unchecked/images/tb-beta.txt b/bugs/filed/circle-positive-angle-unchecked/images/tb-beta.txt
new file mode 100644
index 000000000..6e1fc58db
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/images/tb-beta.txt
@@ -0,0 +1 @@
+995
diff --git a/bugs/filed/circle-positive-angle-unchecked/repro.json b/bugs/filed/circle-positive-angle-unchecked/repro.json
new file mode 100644
index 000000000..77c46636c
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/repro.json
@@ -0,0 +1,14 @@
+{
+  "mode": "run",
+  "images": [
+    "main"
+  ],
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^Circle Start 7: Err 0$"
+    ],
+    "imagesDiffer": true
+  },
+  "issue": 2462
+}
diff --git a/bugs/filed/circle-positive-angle-unchecked/src/Settings b/bugs/filed/circle-positive-angle-unchecked/src/Settings
new file mode 100644
index 000000000..98af685ba
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "CirclePositiveAngleUnchecked",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: Circle accepts a Start or End above 2 pi, and draws a short arc where VB6 raises error 5",
+	"project.exportPathIsV2": true,
+	"project.id": "{6E04B665-A7E0-4612-AA05-759573420612}",
+	"project.name": "CirclePositiveAngleUnchecked",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.tbform b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.tbform
new file mode 100644
index 000000000..7fb728da5
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.tbform
@@ -0,0 +1,95 @@
+[
+	{
+		"AlwaysShowKeyboardCues": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": -2147483633,
+		"BorderStyle": "vbSizable",
+		"Caption": "Form1",
+		"ClipControls": true,
+		"ControlBox": true,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01}",
+		"HasDC": true,
+		"Height": 300,
+		"HelpContextID": 0,
+		"Icon": [],
+		"KeyPreview": false,
+		"Left": 0,
+		"LinkMode": "vbLinkNone",
+		"LinkTopic": null,
+		"MDIChild": false,
+		"MaxButton": true,
+		"MaxHeight": 0,
+		"MaxWidth": 0,
+		"MinButton": true,
+		"MinHeight": 0,
+		"MinWidth": 0,
+		"MouseIcon": [],
+		"MousePointer": "vbDefault",
+		"Moveable": true,
+		"Name": "Form1",
+		"NegotiateMenus": false,
+		"OLEDropMode": "vbOLEDropNone",
+		"Opacity": 100,
+		"Palette": [],
+		"PaletteMode": "vbPaletteModeHalftone",
+		"Picture": [],
+		"PictureDpiScaling": false,
+		"RightToLeft": false,
+		"ScaleHeight": 4500,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 4500,
+		"ShowInTaskbar": true,
+		"StartUpPosition": "vbStartUpScreen",
+		"TabFocusAutoSelect": false,
+		"Tag": null,
+		"Top": 0,
+		"TopMost": false,
+		"TransparencyKey": -1,
+		"Visible": true,
+		"WhatsThisButton": false,
+		"WhatsThisHelp": false,
+		"Width": 300,
+		"WindowState": "vbNormal",
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"multiColoredGrabbers": false,
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 2061908507,
+		"_className": "Form",
+		"_clsid": "{33AD4F38-6699-11CF-B70C-00AA0060D393}",
+		"_children": [
+			{
+				"Index": -1,
+				"Name": "Label1",
+				"Left": 20,
+				"Top": 60,
+				"Width": 100,
+				"Height": 30,
+				"_className": "Label",
+				"_clsid": "{33AD4ED8-6699-11CF-B70C-00AA0060D393}"
+			}
+		]
+	}
+]
diff --git a/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.twin b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.twin
new file mode 100644
index 000000000..fa6a1c3a9
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Form1.twin
@@ -0,0 +1,9 @@
+[Description("")]
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01")]
+[PredeclaredId]
+Class Form1
+
+    Sub New()
+    End Sub
+
+End Class
diff --git a/bugs/filed/circle-positive-angle-unchecked/src/Sources/PngDump.twin b/bugs/filed/circle-positive-angle-unchecked/src/Sources/PngDump.twin
new file mode 100644
index 000000000..766d74baa
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/src/Sources/PngDump.twin
@@ -0,0 +1,201 @@
+Module PngDump
+
+    ' Saves what a surface or a window shows as a PNG file, for a bug report that is
+    ' best shown by a picture. The same module, as PngDump.bas, runs in VB6, so that the
+    ' two pictures can be put side by side (node scripts/bug_repro.mjs run, then vb6).
+    '
+    '     PngDump.Surface Form1, "main"       ' an object with an hDC: a Form, PictureBox, UserControl
+    '     PngDump.Window Text1.hWnd, "text"   ' a control with no hDC; its client area
+    '
+    ' The file is <folder>\<Name>.png. The folder is the BUGREPRO_IMAGES environment
+    ' variable, which bug_repro.mjs sets, or else App.Path. Name uses letters, digits,
+    ' - and _. Any failure raises error 5, whose Description says which call failed.
+    '
+    ' The pixels are copied with BitBlt (or PrintWindow) into a bitmap of this module's own
+    ' and saved with GDI+, so the picture is what was drawn, not what the object's Image
+    ' property or SavePicture would make of it.
+    '
+    ' The Declares are aliased to Png... names, so that a reproducer's own BitBlt or
+    ' SelectObject cannot collide with them.
+
+    Private Type PngGuid
+        Data1 As Long
+        Data2 As Integer
+        Data3 As Integer
+        Data4(0 To 7) As Byte
+    End Type
+
+    Private Type PngGdipInput
+        GdiplusVersion As Long
+        DebugEventCallback As LongPtr
+        SuppressBackgroundThread As Long
+        SuppressExternalCodecs As Long
+    End Type
+
+    Private Type PngRect
+        Left As Long
+        Top As Long
+        Right As Long
+        Bottom As Long
+    End Type
+
+    Private Type PngBmpHeader
+        biSize As Long
+        biWidth As Long
+        biHeight As Long
+        biPlanes As Integer
+        biBitCount As Integer
+        biCompression As Long
+        biSizeImage As Long
+        biXPelsPerMeter As Long
+        biYPelsPerMeter As Long
+        biClrUsed As Long
+        biClrImportant As Long
+    End Type
+
+    Private Declare PtrSafe Function PngGdiplusStartup Lib "gdiplus" Alias "GdiplusStartup" ( _
+        ByRef token As LongPtr, ByRef startInput As PngGdipInput, ByVal startOutput As LongPtr) As Long
+    Private Declare PtrSafe Sub PngGdiplusShutdown Lib "gdiplus" Alias "GdiplusShutdown" ( _
+        ByVal token As LongPtr)
+    Private Declare PtrSafe Function PngGdipCreateBitmapFromHBITMAP Lib "gdiplus" Alias "GdipCreateBitmapFromHBITMAP" ( _
+        ByVal hbm As LongPtr, ByVal hpal As LongPtr, ByRef bitmap As LongPtr) As Long
+    Private Declare PtrSafe Function PngGdipSaveImageToFile Lib "gdiplus" Alias "GdipSaveImageToFile" ( _
+        ByVal image As LongPtr, ByVal fileName As LongPtr, ByRef clsidEncoder As PngGuid, ByVal encoderParams As LongPtr) As Long
+    Private Declare PtrSafe Function PngGdipDisposeImage Lib "gdiplus" Alias "GdipDisposeImage" ( _
+        ByVal image As LongPtr) As Long
+    Private Declare PtrSafe Function PngCLSIDFromString Lib "ole32" Alias "CLSIDFromString" ( _
+        ByVal lpsz As LongPtr, ByRef pclsid As PngGuid) As Long
+    Private Declare PtrSafe Function PngCreateCompatibleDC Lib "gdi32" Alias "CreateCompatibleDC" ( _
+        ByVal hdc As LongPtr) As LongPtr
+    Private Declare PtrSafe Function PngCreateDIBSection Lib "gdi32" Alias "CreateDIBSection" ( _
+        ByVal hdc As LongPtr, ByRef pbmi As PngBmpHeader, ByVal usage As Long, ByRef ppvBits As LongPtr, _
+        ByVal hSection As LongPtr, ByVal offset As Long) As LongPtr
+    Private Declare PtrSafe Function PngSelectObject Lib "gdi32" Alias "SelectObject" ( _
+        ByVal hdc As LongPtr, ByVal hObject As LongPtr) As LongPtr
+    Private Declare PtrSafe Function PngDeleteObject Lib "gdi32" Alias "DeleteObject" ( _
+        ByVal hObject As LongPtr) As Long
+    Private Declare PtrSafe Function PngDeleteDC Lib "gdi32" Alias "DeleteDC" ( _
+        ByVal hdc As LongPtr) As Long
+    Private Declare PtrSafe Function PngBitBlt Lib "gdi32" Alias "BitBlt" ( _
+        ByVal hdcDest As LongPtr, ByVal xDest As Long, ByVal yDest As Long, ByVal cx As Long, ByVal cy As Long, _
+        ByVal hdcSrc As LongPtr, ByVal xSrc As Long, ByVal ySrc As Long, ByVal rop As Long) As Long
+    Private Declare PtrSafe Function PngGetClientRect Lib "user32" Alias "GetClientRect" ( _
+        ByVal hwnd As LongPtr, ByRef rc As PngRect) As Long
+    Private Declare PtrSafe Function PngPrintWindow Lib "user32" Alias "PrintWindow" ( _
+        ByVal hwnd As LongPtr, ByVal hdcBlt As LongPtr, ByVal flags As Long) As Long
+
+    ' Saves the pixels an object with an hDC has drawn, <Name>.png.
+    Public Sub Surface(ByVal Obj As Object, ByVal Name As String)
+        Dim target As String
+        Dim w As Long
+        Dim h As Long
+        Dim src As LongPtr
+        target = TargetFile(Name)
+        w = CLng(Obj.ScaleX(Obj.ScaleWidth, Obj.ScaleMode, vbPixels))
+        h = CLng(Obj.ScaleY(Obj.ScaleHeight, Obj.ScaleMode, vbPixels))
+        src = CLngPtr(Obj.hDC)
+        Capture 0, src, w, h, target
+    End Sub
+
+    ' Saves the client area of a window, <Name>.png: for a control with no hDC.
+    Public Sub Window(ByVal hWnd As LongPtr, ByVal Name As String)
+        Dim target As String
+        Dim rc As PngRect
+        target = TargetFile(Name)
+        If hWnd = 0 Then Err.Raise 5, "PngDump", "the window handle is 0"
+        If PngGetClientRect(hWnd, rc) = 0 Then
+            Err.Raise 5, "PngDump", "GetClientRect failed, error " & Err.LastDllError
+        End If
+        Capture hWnd, 0, rc.Right - rc.Left, rc.Bottom - rc.Top, target
+    End Sub
+
+    ' The file's path, or error 5 for a name that is empty or uses a character outside
+    ' letters, digits, - and _.
+    Private Function TargetFile(ByVal Name As String) As String
+        Dim i As Long
+        Dim c As Long
+        Dim folder As String
+        If Len(Name) = 0 Then Err.Raise 5, "PngDump", "the image name is empty"
+        For i = 1 To Len(Name)
+            c = AscW(Mid$(Name, i, 1))
+            If Not ((c >= 48 And c <= 57) Or (c >= 65 And c <= 90) Or (c >= 97 And c <= 122) Or c = 45 Or c = 95) Then
+                Err.Raise 5, "PngDump", "the image name """ & Name & """ must use only letters, digits, - and _"
+            End If
+        Next i
+        folder = Environ$("BUGREPRO_IMAGES")
+        If Len(folder) = 0 Then folder = App.Path
+        If Right$(folder, 1) = "\" Then folder = Left$(folder, Len(folder) - 1)
+        TargetFile = folder & "\" & Name & ".png"
+    End Function
+
+    ' Copies w by h pixels, from the DC srcDC or, when hWnd is not 0, with PrintWindow, into a
+    ' 24-bit bitmap of our own and saves it as target. Every GDI object and the GDI+ token
+    ' are released on every path, and the error is raised after that.
+    Private Sub Capture(ByVal hWnd As LongPtr, ByVal srcDC As LongPtr, ByVal w As Long, ByVal h As Long, ByVal target As String)
+        Dim token As LongPtr
+        Dim memDC As LongPtr
+        Dim dib As LongPtr
+        Dim oldBmp As LongPtr
+        Dim image As LongPtr
+        Dim bits As LongPtr
+        Dim hdr As PngBmpHeader
+        Dim gdipIn As PngGdipInput
+        Dim encoder As PngGuid
+        Dim status As Long
+        Dim failure As String
+
+        If w < 1 Or h < 1 Then failure = "the surface is " & w & " by " & h & " pixels: nothing to capture": GoTo Done
+
+        gdipIn.GdiplusVersion = 1
+        status = PngGdiplusStartup(token, gdipIn, 0)
+        If status <> 0 Then token = 0: failure = "GdiplusStartup failed, status " & status: GoTo Done
+
+        status = PngCLSIDFromString(StrPtr("{557CF406-1A04-11D3-9A73-0000F81EF32E}"), encoder)
+        If status <> 0 Then failure = "CLSIDFromString failed for the PNG encoder, HRESULT " & Hex$(status): GoTo Done
+
+        memDC = PngCreateCompatibleDC(0)
+        If memDC = 0 Then failure = "CreateCompatibleDC failed, error " & Err.LastDllError: GoTo Done
+
+        hdr.biSize = 40
+        hdr.biWidth = w
+        hdr.biHeight = h
+        hdr.biPlanes = 1
+        hdr.biBitCount = 24
+        dib = PngCreateDIBSection(memDC, hdr, 0, bits, 0, 0)
+        If dib = 0 Then failure = "CreateDIBSection failed, error " & Err.LastDllError: GoTo Done
+
+        oldBmp = PngSelectObject(memDC, dib)
+        If oldBmp = 0 Then failure = "SelectObject failed, error " & Err.LastDllError: GoTo Done
+
+        If hWnd = 0 Then
+            If PngBitBlt(memDC, 0, 0, w, h, srcDC, 0, 0, &HCC0020&) = 0 Then
+                failure = "BitBlt failed, error " & Err.LastDllError: GoTo Done
+            End If
+        Else
+            If PngPrintWindow(hWnd, memDC, 3) = 0 Then
+                failure = "PrintWindow failed, error " & Err.LastDllError: GoTo Done
+            End If
+        End If
+
+        ' GDI+ must not be given a bitmap that is selected into a device context.
+        PngSelectObject memDC, oldBmp
+        oldBmp = 0
+
+        status = PngGdipCreateBitmapFromHBITMAP(dib, 0, image)
+        If status <> 0 Then image = 0: failure = "GdipCreateBitmapFromHBITMAP failed, status " & status: GoTo Done
+
+        status = PngGdipSaveImageToFile(image, StrPtr(target), encoder, 0)
+        If status <> 0 Then failure = "GdipSaveImageToFile failed for " & target & ", status " & status
+
+Done:
+        If image <> 0 Then PngGdipDisposeImage image
+        If memDC <> 0 Then
+            If oldBmp <> 0 Then PngSelectObject memDC, oldBmp
+            If dib <> 0 Then PngDeleteObject dib
+            PngDeleteDC memDC
+        End If
+        If token <> 0 Then PngGdiplusShutdown token
+        If Len(failure) > 0 Then Err.Raise 5, "PngDump", failure
+    End Sub
+
+End Module
diff --git a/bugs/filed/circle-positive-angle-unchecked/src/Sources/Startup.twin b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Startup.twin
new file mode 100644
index 000000000..6f0f3b872
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/src/Sources/Startup.twin
@@ -0,0 +1,25 @@
+Module Startup
+
+    Public Sub Main()
+        Dim n As Long
+        Load Form1
+        Form1.AutoRedraw = True
+        Form1.ScaleMode = vbPixels
+        Form1.BackColor = vbWhite
+        Form1.Width = Form1.Width + (260 - Form1.ScaleWidth) * Screen.TwipsPerPixelX
+        Form1.Height = Form1.Height + (130 - Form1.ScaleHeight) * Screen.TwipsPerPixelY
+        Form1.Cls
+        Debug.Print "Client area " & Form1.ScaleWidth & " x " & Form1.ScaleHeight & " pixels"
+        ' A valid pie, as the picture's context: a negative Start and End draw the radius lines.
+        Form1.Circle (65, 65), 50, vbBlue, -0.5, -2
+        ' A Start above 2 * pi: VB6 raises error 5 and draws nothing.
+        On Error Resume Next
+        Form1.Circle (195, 65), 50, vbRed, 7, 3
+        n = Err.Number
+        On Error GoTo 0
+        Debug.Print "Circle Start 7: Err " & n
+        PngDump.Surface Form1, "main"
+        Unload Form1
+    End Sub
+
+End Module
diff --git a/bugs/filed/circle-positive-angle-unchecked/vb6/Form1.frm b/bugs/filed/circle-positive-angle-unchecked/vb6/Form1.frm
new file mode 100644
index 000000000..69b0b2971
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/vb6/Form1.frm
@@ -0,0 +1,19 @@
+VERSION 5.00
+Begin VB.Form Form1
+   Caption         =   "Form1"
+   ClientHeight    =   1950
+   ClientLeft      =   60
+   ClientTop       =   345
+   ClientWidth     =   3900
+   LinkTopic       =   "Form1"
+   ScaleHeight     =   1950
+   ScaleWidth      =   3900
+   StartUpPosition =   3  'Windows Default
+   Visible         =   0   'False
+End
+Attribute VB_Name = "Form1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = False
+Attribute VB_PredeclaredId = True
+Attribute VB_Exposed = False
+Option Explicit
diff --git a/bugs/filed/circle-positive-angle-unchecked/vb6/Module1.bas b/bugs/filed/circle-positive-angle-unchecked/vb6/Module1.bas
new file mode 100644
index 000000000..2fb9744b7
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/vb6/Module1.bas
@@ -0,0 +1,34 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+' The VB6 side of the reproducer: node scripts/bug_repro.mjs vb6 circle-positive-angle-unchecked
+
+Sub Main()
+    Dim n As Long
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    Load Form1
+    Form1.AutoRedraw = True
+    Form1.ScaleMode = vbPixels
+    Form1.BackColor = vbWhite
+    Form1.Width = Form1.Width + (260 - Form1.ScaleWidth) * Screen.TwipsPerPixelX
+    Form1.Height = Form1.Height + (130 - Form1.ScaleHeight) * Screen.TwipsPerPixelY
+    Form1.Cls
+    Print #9, "Client area " & Form1.ScaleWidth & " x " & Form1.ScaleHeight & " pixels"
+    ' A valid pie, as the picture's context: a negative Start and End draw the radius lines.
+    Form1.Circle (65, 65), 50, vbBlue, -0.5, -2
+    ' A Start above 2 * pi: VB6 raises error 5 and draws nothing.
+    On Error Resume Next
+    Form1.Circle (195, 65), 50, vbRed, 7, 3
+    n = Err.Number
+    On Error GoTo Fail
+    Print #9, "Circle Start 7: Err " & n
+    PngDump.Surface Form1, "main"
+    Unload Form1
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/filed/circle-positive-angle-unchecked/vb6/PngDump.bas b/bugs/filed/circle-positive-angle-unchecked/vb6/PngDump.bas
new file mode 100644
index 000000000..181d5e68c
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/vb6/PngDump.bas
@@ -0,0 +1,200 @@
+Attribute VB_Name = "PngDump"
+Option Explicit
+
+' Saves what a surface or a window shows as a PNG file, for a bug report that is
+' best shown by a picture. The same module, as PngDump.twin, runs in twinBASIC, so that
+' the two pictures can be put side by side (node scripts/bug_repro.mjs run, then vb6).
+'
+'     PngDump.Surface Form1, "main"       ' an object with an hDC: a Form, PictureBox, UserControl
+'     PngDump.Window Text1.hWnd, "text"   ' a control with no hDC; its client area
+'
+' The file is <folder>\<Name>.png. The folder is the BUGREPRO_IMAGES environment
+' variable, which bug_repro.mjs sets, or else App.Path. Name uses letters, digits,
+' - and _. Any failure raises error 5, whose Description says which call failed.
+'
+' The pixels are copied with BitBlt (or PrintWindow) into a bitmap of this module's own
+' and saved with GDI+, so the picture is what was drawn, not what the object's Image
+' property or SavePicture would make of it.
+'
+' The Declares are aliased to Png... names, so that a reproducer's own BitBlt or
+' SelectObject cannot collide with them.
+
+Private Type PngGuid
+    Data1 As Long
+    Data2 As Integer
+    Data3 As Integer
+    Data4(0 To 7) As Byte
+End Type
+
+Private Type PngGdipInput
+    GdiplusVersion As Long
+    DebugEventCallback As Long
+    SuppressBackgroundThread As Long
+    SuppressExternalCodecs As Long
+End Type
+
+Private Type PngRect
+    Left As Long
+    Top As Long
+    Right As Long
+    Bottom As Long
+End Type
+
+Private Type PngBmpHeader
+    biSize As Long
+    biWidth As Long
+    biHeight As Long
+    biPlanes As Integer
+    biBitCount As Integer
+    biCompression As Long
+    biSizeImage As Long
+    biXPelsPerMeter As Long
+    biYPelsPerMeter As Long
+    biClrUsed As Long
+    biClrImportant As Long
+End Type
+
+Private Declare Function PngGdiplusStartup Lib "gdiplus" Alias "GdiplusStartup" ( _
+    ByRef token As Long, ByRef startInput As PngGdipInput, ByVal startOutput As Long) As Long
+Private Declare Sub PngGdiplusShutdown Lib "gdiplus" Alias "GdiplusShutdown" ( _
+    ByVal token As Long)
+Private Declare Function PngGdipCreateBitmapFromHBITMAP Lib "gdiplus" Alias "GdipCreateBitmapFromHBITMAP" ( _
+    ByVal hbm As Long, ByVal hpal As Long, ByRef bitmap As Long) As Long
+Private Declare Function PngGdipSaveImageToFile Lib "gdiplus" Alias "GdipSaveImageToFile" ( _
+    ByVal image As Long, ByVal fileName As Long, ByRef clsidEncoder As PngGuid, ByVal encoderParams As Long) As Long
+Private Declare Function PngGdipDisposeImage Lib "gdiplus" Alias "GdipDisposeImage" ( _
+    ByVal image As Long) As Long
+Private Declare Function PngCLSIDFromString Lib "ole32" Alias "CLSIDFromString" ( _
+    ByVal lpsz As Long, ByRef pclsid As PngGuid) As Long
+Private Declare Function PngCreateCompatibleDC Lib "gdi32" Alias "CreateCompatibleDC" ( _
+    ByVal hdc As Long) As Long
+Private Declare Function PngCreateDIBSection Lib "gdi32" Alias "CreateDIBSection" ( _
+    ByVal hdc As Long, ByRef pbmi As PngBmpHeader, ByVal usage As Long, ByRef ppvBits As Long, _
+    ByVal hSection As Long, ByVal offset As Long) As Long
+Private Declare Function PngSelectObject Lib "gdi32" Alias "SelectObject" ( _
+    ByVal hdc As Long, ByVal hObject As Long) As Long
+Private Declare Function PngDeleteObject Lib "gdi32" Alias "DeleteObject" ( _
+    ByVal hObject As Long) As Long
+Private Declare Function PngDeleteDC Lib "gdi32" Alias "DeleteDC" ( _
+    ByVal hdc As Long) As Long
+Private Declare Function PngBitBlt Lib "gdi32" Alias "BitBlt" ( _
+    ByVal hdcDest As Long, ByVal xDest As Long, ByVal yDest As Long, ByVal cx As Long, ByVal cy As Long, _
+    ByVal hdcSrc As Long, ByVal xSrc As Long, ByVal ySrc As Long, ByVal rop As Long) As Long
+Private Declare Function PngGetClientRect Lib "user32" Alias "GetClientRect" ( _
+    ByVal hwnd As Long, ByRef rc As PngRect) As Long
+Private Declare Function PngPrintWindow Lib "user32" Alias "PrintWindow" ( _
+    ByVal hwnd As Long, ByVal hdcBlt As Long, ByVal flags As Long) As Long
+
+' Saves the pixels an object with an hDC has drawn, <Name>.png.
+Public Sub Surface(ByVal Obj As Object, ByVal Name As String)
+    Dim target As String
+    Dim w As Long
+    Dim h As Long
+    Dim src As Long
+    target = TargetFile(Name)
+    w = CLng(Obj.ScaleX(Obj.ScaleWidth, Obj.ScaleMode, vbPixels))
+    h = CLng(Obj.ScaleY(Obj.ScaleHeight, Obj.ScaleMode, vbPixels))
+    src = CLng(Obj.hDC)
+    Capture 0, src, w, h, target
+End Sub
+
+' Saves the client area of a window, <Name>.png: for a control with no hDC.
+Public Sub Window(ByVal hWnd As Long, ByVal Name As String)
+    Dim target As String
+    Dim rc As PngRect
+    target = TargetFile(Name)
+    If hWnd = 0 Then Err.Raise 5, "PngDump", "the window handle is 0"
+    If PngGetClientRect(hWnd, rc) = 0 Then
+        Err.Raise 5, "PngDump", "GetClientRect failed, error " & Err.LastDllError
+    End If
+    Capture hWnd, 0, rc.Right - rc.Left, rc.Bottom - rc.Top, target
+End Sub
+
+' The file's path, or error 5 for a name that is empty or uses a character outside
+' letters, digits, - and _.
+Private Function TargetFile(ByVal Name As String) As String
+    Dim i As Long
+    Dim c As Long
+    Dim folder As String
+    If Len(Name) = 0 Then Err.Raise 5, "PngDump", "the image name is empty"
+    For i = 1 To Len(Name)
+        c = AscW(Mid$(Name, i, 1))
+        If Not ((c >= 48 And c <= 57) Or (c >= 65 And c <= 90) Or (c >= 97 And c <= 122) Or c = 45 Or c = 95) Then
+            Err.Raise 5, "PngDump", "the image name """ & Name & """ must use only letters, digits, - and _"
+        End If
+    Next i
+    folder = Environ$("BUGREPRO_IMAGES")
+    If Len(folder) = 0 Then folder = App.Path
+    If Right$(folder, 1) = "\" Then folder = Left$(folder, Len(folder) - 1)
+    TargetFile = folder & "\" & Name & ".png"
+End Function
+
+' Copies w by h pixels, from the DC srcDC or, when hWnd is not 0, with PrintWindow, into a
+' 24-bit bitmap of our own and saves it as target. Every GDI object and the GDI+ token
+' are released on every path, and the error is raised after that.
+Private Sub Capture(ByVal hWnd As Long, ByVal srcDC As Long, ByVal w As Long, ByVal h As Long, ByVal target As String)
+    Dim token As Long
+    Dim memDC As Long
+    Dim dib As Long
+    Dim oldBmp As Long
+    Dim image As Long
+    Dim bits As Long
+    Dim hdr As PngBmpHeader
+    Dim gdipIn As PngGdipInput
+    Dim encoder As PngGuid
+    Dim status As Long
+    Dim failure As String
+
+    If w < 1 Or h < 1 Then failure = "the surface is " & w & " by " & h & " pixels: nothing to capture": GoTo Done
+
+    gdipIn.GdiplusVersion = 1
+    status = PngGdiplusStartup(token, gdipIn, 0)
+    If status <> 0 Then token = 0: failure = "GdiplusStartup failed, status " & status: GoTo Done
+
+    status = PngCLSIDFromString(StrPtr("{557CF406-1A04-11D3-9A73-0000F81EF32E}"), encoder)
+    If status <> 0 Then failure = "CLSIDFromString failed for the PNG encoder, HRESULT " & Hex$(status): GoTo Done
+
+    memDC = PngCreateCompatibleDC(0)
+    If memDC = 0 Then failure = "CreateCompatibleDC failed, error " & Err.LastDllError: GoTo Done
+
+    hdr.biSize = 40
+    hdr.biWidth = w
+    hdr.biHeight = h
+    hdr.biPlanes = 1
+    hdr.biBitCount = 24
+    dib = PngCreateDIBSection(memDC, hdr, 0, bits, 0, 0)
+    If dib = 0 Then failure = "CreateDIBSection failed, error " & Err.LastDllError: GoTo Done
+
+    oldBmp = PngSelectObject(memDC, dib)
+    If oldBmp = 0 Then failure = "SelectObject failed, error " & Err.LastDllError: GoTo Done
+
+    If hWnd = 0 Then
+        If PngBitBlt(memDC, 0, 0, w, h, srcDC, 0, 0, &HCC0020) = 0 Then
+            failure = "BitBlt failed, error " & Err.LastDllError: GoTo Done
+        End If
+    Else
+        If PngPrintWindow(hWnd, memDC, 3) = 0 Then
+            failure = "PrintWindow failed, error " & Err.LastDllError: GoTo Done
+        End If
+    End If
+
+    ' GDI+ must not be given a bitmap that is selected into a device context.
+    PngSelectObject memDC, oldBmp
+    oldBmp = 0
+
+    status = PngGdipCreateBitmapFromHBITMAP(dib, 0, image)
+    If status <> 0 Then image = 0: failure = "GdipCreateBitmapFromHBITMAP failed, status " & status: GoTo Done
+
+    status = PngGdipSaveImageToFile(image, StrPtr(target), encoder, 0)
+    If status <> 0 Then failure = "GdipSaveImageToFile failed for " & target & ", status " & status
+
+Done:
+    If image <> 0 Then PngGdipDisposeImage image
+    If memDC <> 0 Then
+        If oldBmp <> 0 Then PngSelectObject memDC, oldBmp
+        If dib <> 0 Then PngDeleteObject dib
+        PngDeleteDC memDC
+    End If
+    If token <> 0 Then PngGdiplusShutdown token
+    If Len(failure) > 0 Then Err.Raise 5, "PngDump", failure
+End Sub
diff --git a/bugs/filed/circle-positive-angle-unchecked/vb6/Probe.vbp b/bugs/filed/circle-positive-angle-unchecked/vb6/Probe.vbp
new file mode 100644
index 000000000..58915ee0b
--- /dev/null
+++ b/bugs/filed/circle-positive-angle-unchecked/vb6/Probe.vbp
@@ -0,0 +1,9 @@
+Type=Exe
+Form=Form1.frm
+Module=Module1; Module1.bas
+Module=PngDump; PngDump.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/filed/proper-case-even-separators/REPORT.md b/bugs/filed/proper-case-even-separators/REPORT.md
new file mode 100644
index 000000000..da3f7dd82
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/REPORT.md
@@ -0,0 +1,31 @@
+Filed as [twinbasic/twinbasic#2464](https://github.com/twinbasic/twinbasic/issues/2464).
+
+## `StrConv` with `vbProperCase` leaves a word in lowercase when it follows an even number of separators
+
+**Describe the bug**
+`StrConv(s, vbProperCase)` capitalises the first letter of a word that follows one, three or five separator characters (space, tab, `vbCr`, `vbLf`, vertical tab, form feed, NUL), and a word at the start of the string. After two, four or six separators the word is left in lowercase, so every word after a `vbCrLf` in multi-line text stays lowercase, and so does the second word of `"a  b"` (two spaces). It is a regression: BETA 983 capitalised every word. Observed in a run of the reproducer project.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Open `proper-case-even-separators.twinproj` (attached as `proper-case-even-separators.zip`). Its one source file, `Startup.twin`, has a `Sub Main` that calls `StrConv` with `vbProperCase` on `"a b"`, `"a  b"`, `"a   b"` and `"a" & vbCrLf & "b"`.
+2. Run it (F5) and read the DEBUG CONSOLE:
+   ```
+   one space:    [A B]
+   two spaces:   [A  b]
+   three spaces: [A   B]
+   vbCrLf:       [A<CRLF>b]
+   ```
+
+**Expected behavior**
+Every word is capitalised, whatever the number of separators before it: `[A  B]` and `[A<CRLF>B]`. VB6 does so (attached as `proper-case-even-separators-vb6.zip`, which prints `[A  B]` and `[A<CRLF>B]`), and so does BETA 983.
+
+**Desktop:**
+ - OS: Windows 10 Pro 22H2 (build 19045)
+ - twinBASIC compiler version: BETA 995
+
+**Additional context**
+Severity: medium. Text with a line break or with aligned columns comes out half capitalised, and nothing reports it.
+
+With `"a" & Space$(n) & "b" & Space$(n) & "c"`, n = 0 gives `Abc` and n = 1, 3 and 5 give every word capitalised; n = 2, 4 and 6 give `A`, then `b` and `c` in lowercase. A space followed by a tab counts as two separators, and `" a  b  c "` (one leading space) comes out as `" a  b  c "`, all lowercase. The result is the same with an explicit `LCID` of 1033. It looks as if each separator toggles a "capitalise the next letter" flag instead of setting it. BETA 983 and VB6 give the same result as each other for all of these.
+
+<!-- Reproducer: bugs/proper-case-even-separators/ (mode run, expects the four lines above); verified on 995, 983 gives `[A  B]` and `[A<CRLF>B]`. docs/Reference/Default/VBA/Strings/StrConv.md carries a WARNING about this ("BETA 995 has a defect in vbProperCase ..."); when fixed, replace it with a NOTE saying since which build. -->
diff --git a/bugs/filed/proper-case-even-separators/proper-case-even-separators.twinproj b/bugs/filed/proper-case-even-separators/proper-case-even-separators.twinproj
new file mode 100644
index 000000000..1bfa56779
Binary files /dev/null and b/bugs/filed/proper-case-even-separators/proper-case-even-separators.twinproj differ
diff --git a/bugs/filed/proper-case-even-separators/repro.json b/bugs/filed/proper-case-even-separators/repro.json
new file mode 100644
index 000000000..0693c751d
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/repro.json
@@ -0,0 +1,13 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^one space:    \\[A B\\]$",
+      "^two spaces:   \\[A  b\\]$",
+      "^three spaces: \\[A   B\\]$",
+      "^vbCrLf:       \\[A<CRLF>b\\]$"
+    ]
+  },
+  "issue": 2464
+}
diff --git a/bugs/filed/proper-case-even-separators/src/Settings b/bugs/filed/proper-case-even-separators/src/Settings
new file mode 100644
index 000000000..17cad0c21
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ProperCaseEvenSeparators",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: StrConv vbProperCase leaves a word in lowercase after an even number of separators",
+	"project.exportPathIsV2": true,
+	"project.id": "{003E64D6-B17F-4683-B01E-20DD325B7651}",
+	"project.name": "ProperCaseEvenSeparators",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/filed/proper-case-even-separators/src/Sources/Startup.twin b/bugs/filed/proper-case-even-separators/src/Sources/Startup.twin
new file mode 100644
index 000000000..ce1283cc8
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/src/Sources/Startup.twin
@@ -0,0 +1,10 @@
+Module Startup
+
+    Public Sub Main()
+        Debug.Print "one space:    [" & StrConv("a b", vbProperCase) & "]"
+        Debug.Print "two spaces:   [" & StrConv("a  b", vbProperCase) & "]"
+        Debug.Print "three spaces: [" & StrConv("a   b", vbProperCase) & "]"
+        Debug.Print "vbCrLf:       [" & Replace(StrConv("a" & vbCrLf & "b", vbProperCase), vbCrLf, "<CRLF>") & "]"
+    End Sub
+
+End Module
diff --git a/bugs/filed/proper-case-even-separators/vb6/Module1.bas b/bugs/filed/proper-case-even-separators/vb6/Module1.bas
new file mode 100644
index 000000000..d6befbbbe
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/vb6/Module1.bas
@@ -0,0 +1,17 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+Sub Main()
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    Print #9, "one space:    [" & StrConv("a b", vbProperCase) & "]"
+    Print #9, "two spaces:   [" & StrConv("a  b", vbProperCase) & "]"
+    Print #9, "three spaces: [" & StrConv("a   b", vbProperCase) & "]"
+    Print #9, "vbCrLf:       [" & Replace(StrConv("a" & vbCrLf & "b", vbProperCase), vbCrLf, "<CRLF>") & "]"
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/filed/proper-case-even-separators/vb6/Probe.vbp b/bugs/filed/proper-case-even-separators/vb6/Probe.vbp
new file mode 100644
index 000000000..4d210b0e8
--- /dev/null
+++ b/bugs/filed/proper-case-even-separators/vb6/Probe.vbp
@@ -0,0 +1,7 @@
+Type=Exe
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/forecolor-invalid-value-stored/forecolor-invalid-value-stored.twinproj b/bugs/forecolor-invalid-value-stored/forecolor-invalid-value-stored.twinproj
new file mode 100644
index 000000000..b1d28aab9
Binary files /dev/null and b/bugs/forecolor-invalid-value-stored/forecolor-invalid-value-stored.twinproj differ
diff --git a/bugs/forecolor-invalid-value-stored/repro.json b/bugs/forecolor-invalid-value-stored/repro.json
new file mode 100644
index 000000000..5af787d28
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/repro.json
@@ -0,0 +1,25 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^Form\\.ForeColor = -1: Err 5, reads FFFFFFFF$",
+      "^Form\\.ForeColor = &H8000001F: Err 5, reads 8000001F$",
+      "^Form\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^Form\\.FillColor = -1: Err 0, reads FFFFFFFF$",
+      "^PictureBox\\.ForeColor = -1: Err 5, reads FFFFFFFF$",
+      "^PictureBox\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^PictureBox\\.FillColor = -1: Err 0, reads FFFFFFFF$",
+      "^Label\\.ForeColor = -1: Err 0, reads FFFFFFFF$",
+      "^Label\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^TextBox\\.ForeColor = -1: Err 0, reads FFFFFFFF$",
+      "^TextBox\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^CommandButton\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^Printer\\.ForeColor = -1: Err 5, reads FFFFFFFF$",
+      "^Printer\\.FillColor = -1: Err 0, reads FFFFFFFF$",
+      "^UserControl\\.ForeColor = -1: Err 5, reads FFFFFFFF$",
+      "^UserControl\\.BackColor = -1: Err 0, reads FFFFFFFF$",
+      "^UserControl\\.FillColor = -1: Err 0, reads FFFFFFFF$"
+    ]
+  }
+}
diff --git a/bugs/forecolor-invalid-value-stored/src/Settings b/bugs/forecolor-invalid-value-stored/src/Settings
new file mode 100644
index 000000000..035cd36e5
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ForecolorInvalidValueStored",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: Setting a colour property to a value that is not a colour stores it, and raises error 5 or nothing, where VB6 raises error 380 and keeps the old value",
+	"project.exportPathIsV2": true,
+	"project.id": "{1F0BF038-06CA-497C-8638-B5B87D2572C2}",
+	"project.name": "ForecolorInvalidValueStored",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/forecolor-invalid-value-stored/src/Sources/Form1.tbform b/bugs/forecolor-invalid-value-stored/src/Sources/Form1.tbform
new file mode 100644
index 000000000..e5d0e4107
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Sources/Form1.tbform
@@ -0,0 +1,135 @@
+[
+	{
+		"AlwaysShowKeyboardCues": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": -2147483633,
+		"BorderStyle": "vbSizable",
+		"Caption": "Form1",
+		"ClipControls": true,
+		"ControlBox": true,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01}",
+		"HasDC": true,
+		"Height": 300,
+		"HelpContextID": 0,
+		"Icon": [],
+		"KeyPreview": false,
+		"Left": 0,
+		"LinkMode": "vbLinkNone",
+		"LinkTopic": null,
+		"MDIChild": false,
+		"MaxButton": true,
+		"MaxHeight": 0,
+		"MaxWidth": 0,
+		"MinButton": true,
+		"MinHeight": 0,
+		"MinWidth": 0,
+		"MouseIcon": [],
+		"MousePointer": "vbDefault",
+		"Moveable": true,
+		"Name": "Form1",
+		"NegotiateMenus": false,
+		"OLEDropMode": "vbOLEDropNone",
+		"Opacity": 100,
+		"Palette": [],
+		"PaletteMode": "vbPaletteModeHalftone",
+		"Picture": [],
+		"PictureDpiScaling": false,
+		"RightToLeft": false,
+		"ScaleHeight": 4500,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 4500,
+		"ShowInTaskbar": true,
+		"StartUpPosition": "vbStartUpScreen",
+		"TabFocusAutoSelect": false,
+		"Tag": null,
+		"Top": 0,
+		"TopMost": false,
+		"TransparencyKey": -1,
+		"Visible": true,
+		"WhatsThisButton": false,
+		"WhatsThisHelp": false,
+		"Width": 300,
+		"WindowState": "vbNormal",
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"multiColoredGrabbers": false,
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 2061908507,
+		"_className": "Form",
+		"_clsid": "{33AD4F38-6699-11CF-B70C-00AA0060D393}",
+		"_children": [
+			{
+				"Index": -1,
+				"Name": "PictureBox1",
+				"Left": 20,
+				"Top": 20,
+				"Width": 100,
+				"Height": 30,
+				"_className": "PictureBox",
+				"_clsid": "{33AD4ED0-6699-11CF-B70C-00AA0060D393}"
+			},
+			{
+				"Index": -1,
+				"Name": "Label1",
+				"Left": 20,
+				"Top": 60,
+				"Width": 100,
+				"Height": 30,
+				"_className": "Label",
+				"_clsid": "{33AD4ED8-6699-11CF-B70C-00AA0060D393}"
+			},
+			{
+				"Index": -1,
+				"Name": "TextBox1",
+				"Left": 20,
+				"Top": 100,
+				"Width": 100,
+				"Height": 30,
+				"_className": "TextBox",
+				"_clsid": "{33AD4EE0-6699-11CF-B70C-00AA0060D393}"
+			},
+			{
+				"Index": -1,
+				"Name": "CommandButton1",
+				"Left": 20,
+				"Top": 140,
+				"Width": 100,
+				"Height": 30,
+				"_className": "CommandButton",
+				"_clsid": "{33AD4EF0-6699-11CF-B70C-00AA0060D393}"
+			},
+			{
+				"Index": -1,
+				"Name": "UC1",
+				"Left": 140,
+				"Top": 20,
+				"Width": 100,
+				"Height": 100,
+				"_className": "UC1",
+				"_clsid": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA10}"
+			}
+		]
+	}
+]
\ No newline at end of file
diff --git a/bugs/forecolor-invalid-value-stored/src/Sources/Form1.twin b/bugs/forecolor-invalid-value-stored/src/Sources/Form1.twin
new file mode 100644
index 000000000..fa6a1c3a9
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Sources/Form1.twin
@@ -0,0 +1,9 @@
+[Description("")]
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01")]
+[PredeclaredId]
+Class Form1
+
+    Sub New()
+    End Sub
+
+End Class
diff --git a/bugs/forecolor-invalid-value-stored/src/Sources/Startup.twin b/bugs/forecolor-invalid-value-stored/src/Sources/Startup.twin
new file mode 100644
index 000000000..006430f0b
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Sources/Startup.twin
@@ -0,0 +1,52 @@
+Module Startup
+
+    Public Sub Main()
+        Load Form1
+        On Error Resume Next
+        Form1.ForeColor = vbGreen
+        Form1.ForeColor = -1
+        Debug.Print "Form.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.ForeColor): Err.Clear
+        Form1.ForeColor = vbGreen
+        Form1.ForeColor = &H8000001F
+        Debug.Print "Form.ForeColor = &H8000001F: Err " & Err.Number & ", reads " & Hex$(Form1.ForeColor): Err.Clear
+        Form1.BackColor = vbGreen
+        Form1.BackColor = -1
+        Debug.Print "Form.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.BackColor): Err.Clear
+        Form1.FillColor = vbGreen
+        Form1.FillColor = -1
+        Debug.Print "Form.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.FillColor): Err.Clear
+        Form1.PictureBox1.ForeColor = vbGreen
+        Form1.PictureBox1.ForeColor = -1
+        Debug.Print "PictureBox.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.ForeColor): Err.Clear
+        Form1.PictureBox1.BackColor = vbGreen
+        Form1.PictureBox1.BackColor = -1
+        Debug.Print "PictureBox.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.BackColor): Err.Clear
+        Form1.PictureBox1.FillColor = vbGreen
+        Form1.PictureBox1.FillColor = -1
+        Debug.Print "PictureBox.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.FillColor): Err.Clear
+        Form1.Label1.ForeColor = vbGreen
+        Form1.Label1.ForeColor = -1
+        Debug.Print "Label.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.Label1.ForeColor): Err.Clear
+        Form1.Label1.BackColor = vbGreen
+        Form1.Label1.BackColor = -1
+        Debug.Print "Label.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.Label1.BackColor): Err.Clear
+        Form1.TextBox1.ForeColor = vbGreen
+        Form1.TextBox1.ForeColor = -1
+        Debug.Print "TextBox.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.TextBox1.ForeColor): Err.Clear
+        Form1.TextBox1.BackColor = vbGreen
+        Form1.TextBox1.BackColor = -1
+        Debug.Print "TextBox.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.TextBox1.BackColor): Err.Clear
+        Form1.CommandButton1.BackColor = vbGreen
+        Form1.CommandButton1.BackColor = -1
+        Debug.Print "CommandButton.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.CommandButton1.BackColor): Err.Clear
+        Printer.ForeColor = vbGreen
+        Printer.ForeColor = -1
+        Debug.Print "Printer.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Printer.ForeColor): Err.Clear
+        Printer.FillColor = vbGreen
+        Printer.FillColor = -1
+        Debug.Print "Printer.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Printer.FillColor): Err.Clear
+        Form1.UC1.RunCases
+        Unload Form1
+    End Sub
+
+End Module
diff --git a/bugs/forecolor-invalid-value-stored/src/Sources/UC1.tbcontrol b/bugs/forecolor-invalid-value-stored/src/Sources/UC1.tbcontrol
new file mode 100644
index 000000000..e962717bb
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Sources/UC1.tbcontrol
@@ -0,0 +1,78 @@
+[
+	{
+		"AccessKeys": null,
+		"Alignable": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": 11065270,
+		"BackStyle": "vbBFOpaque",
+		"BorderStyle": "vbNoBorder",
+		"CanGetFocus": true,
+		"ClipBehavior": "vbClipUseRegion",
+		"ClipControls": true,
+		"ControlContainer": false,
+		"DataBindingBehavior": "vbDataBindingNone",
+		"DataSourceBehavior": "vbDataSourceNone",
+		"DefaultCancel": false,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"EditAtDesignTime": false,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForceResizeToContainer": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA11}",
+		"ForwardFocus": false,
+		"HasDC": true,
+		"Height": 100,
+		"HitBehavior": "vbHitTestUseRegion",
+		"Index": -1,
+		"InvisibleAtRuntime": false,
+		"KeyPreview": false,
+		"Left": 0,
+		"MaskColor": -2147483633,
+		"MaskPicture": "",
+		"MouseIcon": "",
+		"MousePointer": "vbDefault",
+		"Name": "UC1",
+		"OLEDropMode": "vbOLEDropNone",
+		"OverrideMiscStatus": 0,
+		"Palette": "",
+		"PaletteMode": "vbPaletteModeContainer",
+		"Picture": "",
+		"PictureDpiScaling": true,
+		"Public": true,
+		"RightToLeft": false,
+		"ScaleHeight": 0,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 0,
+		"Tag": null,
+		"ToolboxBitmap": "",
+		"Top": 0,
+		"Width": 100,
+		"Windowless": false,
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 714827664,
+		"_children": [],
+		"_className": "UserControl",
+		"_clsid": "{33AD5010-6699-11CF-B70C-00AA0060D393}"
+	}
+]
\ No newline at end of file
diff --git a/bugs/forecolor-invalid-value-stored/src/Sources/UC1.twin b/bugs/forecolor-invalid-value-stored/src/Sources/UC1.twin
new file mode 100644
index 000000000..654c2fb16
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/src/Sources/UC1.twin
@@ -0,0 +1,21 @@
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA11")]
+[ClassId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA10")]
+[InterfaceId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA12")]
+[EventInterfaceId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA13")]
+[COMControl]
+Public Class UC1
+
+    Public Sub RunCases()
+        On Error Resume Next
+        ForeColor = vbGreen
+        ForeColor = -1
+        Debug.Print "UserControl.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(ForeColor): Err.Clear
+        BackColor = vbGreen
+        BackColor = -1
+        Debug.Print "UserControl.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(BackColor): Err.Clear
+        FillColor = vbGreen
+        FillColor = -1
+        Debug.Print "UserControl.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(FillColor): Err.Clear
+    End Sub
+
+End Class
diff --git a/bugs/forecolor-invalid-value-stored/vb6/Form1.frm b/bugs/forecolor-invalid-value-stored/vb6/Form1.frm
new file mode 100644
index 000000000..373c3c018
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/vb6/Form1.frm
@@ -0,0 +1,55 @@
+VERSION 5.00
+Begin VB.Form Form1
+   Caption         =   "Form1"
+   ClientHeight    =   3000
+   ClientLeft      =   60
+   ClientTop       =   345
+   ClientWidth     =   4000
+   LinkTopic       =   "Form1"
+   ScaleHeight     =   3000
+   ScaleWidth      =   4000
+   StartUpPosition =   3  'Windows Default
+   Visible         =   0   'False
+   Begin Probe.UC1 UC1
+      Height          =   1215
+      Left            =   3360
+      TabIndex        =   7
+      Top             =   120
+      Width           =   1215
+   End
+   Begin VB.CommandButton CommandButton1
+      Height          =   255
+      Left            =   240
+      TabIndex        =   3
+      Top             =   1800
+      Width           =   855
+   End
+   Begin VB.TextBox TextBox1
+      Height          =   255
+      Left            =   240
+      TabIndex        =   2
+      Top             =   1320
+      Width           =   855
+   End
+   Begin VB.Label Label1
+      Height          =   255
+      Left            =   240
+      Top             =   840
+      Width           =   855
+   End
+   Begin VB.PictureBox PictureBox1
+      Height          =   255
+      Left            =   240
+      ScaleHeight     =   195
+      ScaleWidth      =   795
+      TabIndex        =   0
+      Top             =   360
+      Width           =   855
+   End
+End
+Attribute VB_Name = "Form1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = False
+Attribute VB_PredeclaredId = True
+Attribute VB_Exposed = False
+Option Explicit
diff --git a/bugs/forecolor-invalid-value-stored/vb6/Module1.bas b/bugs/forecolor-invalid-value-stored/vb6/Module1.bas
new file mode 100644
index 000000000..05057c104
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/vb6/Module1.bas
@@ -0,0 +1,65 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+' The VB6 side of the reproducer: node scripts/bug_repro.mjs vb6 forecolor-invalid-value-stored
+
+Private Sub Cases()
+    Load Form1
+    On Error Resume Next
+    Form1.ForeColor = vbGreen
+    Form1.ForeColor = -1
+    Print #9, "Form.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.ForeColor): Err.Clear
+    Form1.ForeColor = vbGreen
+    Form1.ForeColor = &H8000001F
+    Print #9, "Form.ForeColor = &H8000001F: Err " & Err.Number & ", reads " & Hex$(Form1.ForeColor): Err.Clear
+    Form1.BackColor = vbGreen
+    Form1.BackColor = -1
+    Print #9, "Form.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.BackColor): Err.Clear
+    Form1.FillColor = vbGreen
+    Form1.FillColor = -1
+    Print #9, "Form.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.FillColor): Err.Clear
+    Form1.PictureBox1.ForeColor = vbGreen
+    Form1.PictureBox1.ForeColor = -1
+    Print #9, "PictureBox.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.ForeColor): Err.Clear
+    Form1.PictureBox1.BackColor = vbGreen
+    Form1.PictureBox1.BackColor = -1
+    Print #9, "PictureBox.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.BackColor): Err.Clear
+    Form1.PictureBox1.FillColor = vbGreen
+    Form1.PictureBox1.FillColor = -1
+    Print #9, "PictureBox.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.PictureBox1.FillColor): Err.Clear
+    Form1.Label1.ForeColor = vbGreen
+    Form1.Label1.ForeColor = -1
+    Print #9, "Label.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.Label1.ForeColor): Err.Clear
+    Form1.Label1.BackColor = vbGreen
+    Form1.Label1.BackColor = -1
+    Print #9, "Label.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.Label1.BackColor): Err.Clear
+    Form1.TextBox1.ForeColor = vbGreen
+    Form1.TextBox1.ForeColor = -1
+    Print #9, "TextBox.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.TextBox1.ForeColor): Err.Clear
+    Form1.TextBox1.BackColor = vbGreen
+    Form1.TextBox1.BackColor = -1
+    Print #9, "TextBox.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.TextBox1.BackColor): Err.Clear
+    Form1.CommandButton1.BackColor = vbGreen
+    Form1.CommandButton1.BackColor = -1
+    Print #9, "CommandButton.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(Form1.CommandButton1.BackColor): Err.Clear
+    Printer.ForeColor = vbGreen
+    Printer.ForeColor = -1
+    Print #9, "Printer.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(Printer.ForeColor): Err.Clear
+    Printer.FillColor = vbGreen
+    Printer.FillColor = -1
+    Print #9, "Printer.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(Printer.FillColor): Err.Clear
+    Form1.UC1.RunCases
+    Unload Form1
+End Sub
+
+Sub Main()
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    Cases
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/forecolor-invalid-value-stored/vb6/Probe.vbp b/bugs/forecolor-invalid-value-stored/vb6/Probe.vbp
new file mode 100644
index 000000000..f2be8429f
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/vb6/Probe.vbp
@@ -0,0 +1,9 @@
+Type=Exe
+Form=Form1.frm
+UserControl=UC1.ctl
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/forecolor-invalid-value-stored/vb6/UC1.ctl b/bugs/forecolor-invalid-value-stored/vb6/UC1.ctl
new file mode 100644
index 000000000..20846f82c
--- /dev/null
+++ b/bugs/forecolor-invalid-value-stored/vb6/UC1.ctl
@@ -0,0 +1,28 @@
+VERSION 5.00
+Begin VB.UserControl UC1
+   ClientHeight    =   1000
+   ClientLeft      =   0
+   ClientTop       =   0
+   ClientWidth     =   1000
+   ScaleHeight     =   1000
+   ScaleWidth      =   1000
+End
+Attribute VB_Name = "UC1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+Public Sub RunCases()
+    On Error Resume Next
+    UserControl.ForeColor = vbGreen
+    UserControl.ForeColor = -1
+    Print #9, "UserControl.ForeColor = -1: Err " & Err.Number & ", reads " & Hex$(UserControl.ForeColor): Err.Clear
+    UserControl.BackColor = vbGreen
+    UserControl.BackColor = -1
+    Print #9, "UserControl.BackColor = -1: Err " & Err.Number & ", reads " & Hex$(UserControl.BackColor): Err.Clear
+    UserControl.FillColor = vbGreen
+    UserControl.FillColor = -1
+    Print #9, "UserControl.FillColor = -1: Err " & Err.Number & ", reads " & Hex$(UserControl.FillColor): Err.Clear
+End Sub
diff --git a/bugs/lset-long-codegen-error/lset-long-codegen-error.twinproj b/bugs/lset-long-codegen-error/lset-long-codegen-error.twinproj
new file mode 100644
index 000000000..4abe7bb17
Binary files /dev/null and b/bugs/lset-long-codegen-error/lset-long-codegen-error.twinproj differ
diff --git a/bugs/lset-long-codegen-error/repro.json b/bugs/lset-long-codegen-error/repro.json
new file mode 100644
index 000000000..d43c1f71d
--- /dev/null
+++ b/bugs/lset-long-codegen-error/repro.json
@@ -0,0 +1,7 @@
+{
+  "mode": "build",
+  "expect": {
+    "exit": 5,
+    "message": "codegen"
+  }
+}
diff --git a/bugs/lset-long-codegen-error/src/Settings b/bugs/lset-long-codegen-error/src/Settings
new file mode 100644
index 000000000..0f2214928
--- /dev/null
+++ b/bugs/lset-long-codegen-error/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "LsetLongCodegenError",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: LSet on a Long variable compiles and fails in code generation",
+	"project.exportPathIsV2": true,
+	"project.id": "{01B13C5C-8764-4E48-A6BE-AD4D30426525}",
+	"project.name": "LsetLongCodegenError",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/lset-long-codegen-error/src/Sources/Startup.twin b/bugs/lset-long-codegen-error/src/Sources/Startup.twin
new file mode 100644
index 000000000..4f5b3c023
--- /dev/null
+++ b/bugs/lset-long-codegen-error/src/Sources/Startup.twin
@@ -0,0 +1,8 @@
+Module Startup
+
+    Public Sub Main()
+        Dim n As Long
+        LSet n = "ab"
+    End Sub
+
+End Module
diff --git a/bugs/lset-long-codegen-error/vb6/Module1.bas b/bugs/lset-long-codegen-error/vb6/Module1.bas
new file mode 100644
index 000000000..e768a79d9
--- /dev/null
+++ b/bugs/lset-long-codegen-error/vb6/Module1.bas
@@ -0,0 +1,9 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+' VB6 refuses this project at compile time: "LSet allowed only on strings and user-defined types".
+
+Sub Main()
+    Dim n As Long
+    LSet n = "ab"
+End Sub
diff --git a/bugs/lset-long-codegen-error/vb6/Probe.vbp b/bugs/lset-long-codegen-error/vb6/Probe.vbp
new file mode 100644
index 000000000..4d210b0e8
--- /dev/null
+++ b/bugs/lset-long-codegen-error/vb6/Probe.vbp
@@ -0,0 +1,7 @@
+Type=Exe
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/lset-variant-array-element-noop/lset-variant-array-element-noop.twinproj b/bugs/lset-variant-array-element-noop/lset-variant-array-element-noop.twinproj
new file mode 100644
index 000000000..a06378ca3
Binary files /dev/null and b/bugs/lset-variant-array-element-noop/lset-variant-array-element-noop.twinproj differ
diff --git a/bugs/lset-variant-array-element-noop/repro.json b/bugs/lset-variant-array-element-noop/repro.json
new file mode 100644
index 000000000..96b80ba1f
--- /dev/null
+++ b/bugs/lset-variant-array-element-noop/repro.json
@@ -0,0 +1,12 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^LSet v\\(0\\), v = Array\\(\\.\\.\\.\\):   \\[0123456789\\]$",
+      "^RSet v\\(1\\), v = Array\\(\\.\\.\\.\\):   \\[abcde\\]$",
+      "^LSet w\\(0\\), w\\(0 To 1\\) As Variant: \\[zz        \\]$",
+      "^RSet w\\(1\\), w\\(0 To 1\\) As Variant: \\[   zz\\]$"
+    ]
+  }
+}
diff --git a/bugs/lset-variant-array-element-noop/src/Settings b/bugs/lset-variant-array-element-noop/src/Settings
new file mode 100644
index 000000000..f39d78fa5
--- /dev/null
+++ b/bugs/lset-variant-array-element-noop/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "LsetVariantArrayElementNoop",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: LSet and RSet on an element of a Variant that holds an array change nothing",
+	"project.exportPathIsV2": true,
+	"project.id": "{D1274B35-C887-43A2-B58F-3E1D21F6F6A8}",
+	"project.name": "LsetVariantArrayElementNoop",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/lset-variant-array-element-noop/src/Sources/Startup.twin b/bugs/lset-variant-array-element-noop/src/Sources/Startup.twin
new file mode 100644
index 000000000..b6380dfca
--- /dev/null
+++ b/bugs/lset-variant-array-element-noop/src/Sources/Startup.twin
@@ -0,0 +1,21 @@
+Module Startup
+
+    Public Sub Main()
+        Dim v As Variant
+        Dim w(0 To 1) As Variant
+
+        v = Array("0123456789", "abcde")
+        LSet v(0) = "zz"
+        RSet v(1) = "zz"
+        Debug.Print "LSet v(0), v = Array(...):   [" & v(0) & "]"
+        Debug.Print "RSet v(1), v = Array(...):   [" & v(1) & "]"
+
+        w(0) = "0123456789"
+        w(1) = "abcde"
+        LSet w(0) = "zz"
+        RSet w(1) = "zz"
+        Debug.Print "LSet w(0), w(0 To 1) As Variant: [" & w(0) & "]"
+        Debug.Print "RSet w(1), w(0 To 1) As Variant: [" & w(1) & "]"
+    End Sub
+
+End Module
diff --git a/bugs/lset-variant-array-element-noop/vb6/Module1.bas b/bugs/lset-variant-array-element-noop/vb6/Module1.bas
new file mode 100644
index 000000000..64c127050
--- /dev/null
+++ b/bugs/lset-variant-array-element-noop/vb6/Module1.bas
@@ -0,0 +1,28 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+Sub Main()
+    Dim v As Variant
+    Dim w(0 To 1) As Variant
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+
+    v = Array("0123456789", "abcde")
+    LSet v(0) = "zz"
+    RSet v(1) = "zz"
+    Print #9, "LSet v(0), v = Array(...):   [" & v(0) & "]"
+    Print #9, "RSet v(1), v = Array(...):   [" & v(1) & "]"
+
+    w(0) = "0123456789"
+    w(1) = "abcde"
+    LSet w(0) = "zz"
+    RSet w(1) = "zz"
+    Print #9, "LSet w(0), w(0 To 1) As Variant: [" & w(0) & "]"
+    Print #9, "RSet w(1), w(0 To 1) As Variant: [" & w(1) & "]"
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/lset-variant-array-element-noop/vb6/Probe.vbp b/bugs/lset-variant-array-element-noop/vb6/Probe.vbp
new file mode 100644
index 000000000..4d210b0e8
--- /dev/null
+++ b/bugs/lset-variant-array-element-noop/vb6/Probe.vbp
@@ -0,0 +1,7 @@
+Type=Exe
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/lset-variant-destination-types/lset-variant-destination-types.twinproj b/bugs/lset-variant-destination-types/lset-variant-destination-types.twinproj
new file mode 100644
index 000000000..1c517736f
Binary files /dev/null and b/bugs/lset-variant-destination-types/lset-variant-destination-types.twinproj differ
diff --git a/bugs/lset-variant-destination-types/repro.json b/bugs/lset-variant-destination-types/repro.json
new file mode 100644
index 000000000..569ba47b6
--- /dev/null
+++ b/bugs/lset-variant-destination-types/repro.json
@@ -0,0 +1,11 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^LSet, destination Null:    error 13$",
+      "^LSet, destination Object:  error 13$",
+      "^RSet, destination True:    \\[ab\\] Len 2$"
+    ]
+  }
+}
diff --git a/bugs/lset-variant-destination-types/src/Settings b/bugs/lset-variant-destination-types/src/Settings
new file mode 100644
index 000000000..7eed4ebbc
--- /dev/null
+++ b/bugs/lset-variant-destination-types/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "LsetVariantDestinationTypes",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: LSet and RSet on a Variant destination handle Null, Object and Boolean differently from VB6",
+	"project.exportPathIsV2": true,
+	"project.id": "{849C07AD-7637-4EB1-B4B6-6195E081EEAD}",
+	"project.name": "LsetVariantDestinationTypes",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/lset-variant-destination-types/src/Sources/Startup.twin b/bugs/lset-variant-destination-types/src/Sources/Startup.twin
new file mode 100644
index 000000000..1d40029af
--- /dev/null
+++ b/bugs/lset-variant-destination-types/src/Sources/Startup.twin
@@ -0,0 +1,23 @@
+Module Startup
+
+    Public Sub Main()
+        Dim v As Variant
+        On Error Resume Next
+
+        v = Null
+        Err.Clear
+        LSet v = "abc"
+        Debug.Print "LSet, destination Null:    error " & Err.Number
+
+        v = New Collection
+        Err.Clear
+        LSet v = "abc"
+        Debug.Print "LSet, destination Object:  error " & Err.Number
+
+        v = True
+        Err.Clear
+        RSet v = "ab"
+        Debug.Print "RSet, destination True:    [" & v & "] Len " & Len(v)
+    End Sub
+
+End Module
diff --git a/bugs/lset-variant-destination-types/vb6/Module1.bas b/bugs/lset-variant-destination-types/vb6/Module1.bas
new file mode 100644
index 000000000..5b6ca3097
--- /dev/null
+++ b/bugs/lset-variant-destination-types/vb6/Module1.bas
@@ -0,0 +1,30 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+Sub Main()
+    Dim v As Variant
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    On Error Resume Next
+
+    v = Null
+    Err.Clear
+    LSet v = "abc"
+    Print #9, "LSet, destination Null:    error " & Err.Number
+
+    v = New Collection
+    Err.Clear
+    LSet v = "abc"
+    Print #9, "LSet, destination Object:  error " & Err.Number
+
+    v = True
+    Err.Clear
+    RSet v = "ab"
+    Print #9, "RSet, destination True:    [" & v & "] Len " & Len(v)
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/lset-variant-destination-types/vb6/Probe.vbp b/bugs/lset-variant-destination-types/vb6/Probe.vbp
new file mode 100644
index 000000000..4d210b0e8
--- /dev/null
+++ b/bugs/lset-variant-destination-types/vb6/Probe.vbp
@@ -0,0 +1,7 @@
+Type=Exe
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/system-colour-extra-bytes-black/repro.json b/bugs/system-colour-extra-bytes-black/repro.json
new file mode 100644
index 000000000..8963f22ec
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/repro.json
@@ -0,0 +1,11 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^&H8000000F -> F0F0F0$",
+      "^&H80FF000F -> 000000$",
+      "^&H80010003 -> 000000$"
+    ]
+  }
+}
diff --git a/bugs/system-colour-extra-bytes-black/src/Settings b/bugs/system-colour-extra-bytes-black/src/Settings
new file mode 100644
index 000000000..98f494aed
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "SystemColourExtraBytesBlack",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: A system colour value with a nonzero second or third byte draws black since BETA 984, where VB6 takes the index from the low 16 bits",
+	"project.exportPathIsV2": true,
+	"project.id": "{003D484D-BD3F-44C7-A128-45DBC3269FAC}",
+	"project.name": "SystemColourExtraBytesBlack",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/system-colour-extra-bytes-black/src/Sources/Form1.tbform b/bugs/system-colour-extra-bytes-black/src/Sources/Form1.tbform
new file mode 100644
index 000000000..a7f451a7d
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/src/Sources/Form1.tbform
@@ -0,0 +1,83 @@
+[
+	{
+		"AlwaysShowKeyboardCues": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": -2147483633,
+		"BorderStyle": "vbSizable",
+		"Caption": "Form1",
+		"ClipControls": true,
+		"ControlBox": true,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01}",
+		"HasDC": true,
+		"Height": 300,
+		"HelpContextID": 0,
+		"Icon": [],
+		"KeyPreview": false,
+		"Left": 0,
+		"LinkMode": "vbLinkNone",
+		"LinkTopic": null,
+		"MDIChild": false,
+		"MaxButton": true,
+		"MaxHeight": 0,
+		"MaxWidth": 0,
+		"MinButton": true,
+		"MinHeight": 0,
+		"MinWidth": 0,
+		"MouseIcon": [],
+		"MousePointer": "vbDefault",
+		"Moveable": true,
+		"Name": "Form1",
+		"NegotiateMenus": false,
+		"OLEDropMode": "vbOLEDropNone",
+		"Opacity": 100,
+		"Palette": [],
+		"PaletteMode": "vbPaletteModeHalftone",
+		"Picture": [],
+		"PictureDpiScaling": false,
+		"RightToLeft": false,
+		"ScaleHeight": 4500,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 4500,
+		"ShowInTaskbar": true,
+		"StartUpPosition": "vbStartUpScreen",
+		"TabFocusAutoSelect": false,
+		"Tag": null,
+		"Top": 0,
+		"TopMost": false,
+		"TransparencyKey": -1,
+		"Visible": true,
+		"WhatsThisButton": false,
+		"WhatsThisHelp": false,
+		"Width": 300,
+		"WindowState": "vbNormal",
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"multiColoredGrabbers": false,
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 2061908507,
+		"_className": "Form",
+		"_clsid": "{33AD4F38-6699-11CF-B70C-00AA0060D393}"
+	}
+]
\ No newline at end of file
diff --git a/bugs/system-colour-extra-bytes-black/src/Sources/Form1.twin b/bugs/system-colour-extra-bytes-black/src/Sources/Form1.twin
new file mode 100644
index 000000000..fa6a1c3a9
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/src/Sources/Form1.twin
@@ -0,0 +1,9 @@
+[Description("")]
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01")]
+[PredeclaredId]
+Class Form1
+
+    Sub New()
+    End Sub
+
+End Class
diff --git a/bugs/system-colour-extra-bytes-black/src/Sources/Startup.twin b/bugs/system-colour-extra-bytes-black/src/Sources/Startup.twin
new file mode 100644
index 000000000..1a0425124
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/src/Sources/Startup.twin
@@ -0,0 +1,22 @@
+Module Startup
+
+    Private Declare PtrSafe Function GetPixel Lib "gdi32" (ByVal hdc As LongPtr, ByVal x As Long, ByVal y As Long) As Long
+
+    Private Sub Draw(ByVal Label As String, ByVal Color As Long)
+        Form1.Cls
+        Form1.PSet (10, 10), Color
+        Debug.Print Label & " -> " & Right$("000000" & Hex$(GetPixel(Form1.hDC, 10, 10)), 6)
+    End Sub
+
+    Public Sub Main()
+        Load Form1
+        Form1.AutoRedraw = True
+        Form1.ScaleMode = vbPixels
+        Form1.BackColor = &H30201
+        Draw "&H8000000F", &H8000000F
+        Draw "&H80FF000F", &H80FF000F
+        Draw "&H80010003", &H80010003
+        Unload Form1
+    End Sub
+
+End Module
diff --git a/bugs/system-colour-extra-bytes-black/system-colour-extra-bytes-black.twinproj b/bugs/system-colour-extra-bytes-black/system-colour-extra-bytes-black.twinproj
new file mode 100644
index 000000000..2627f8936
Binary files /dev/null and b/bugs/system-colour-extra-bytes-black/system-colour-extra-bytes-black.twinproj differ
diff --git a/bugs/system-colour-extra-bytes-black/vb6/Form1.frm b/bugs/system-colour-extra-bytes-black/vb6/Form1.frm
new file mode 100644
index 000000000..4022cfbd6
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/vb6/Form1.frm
@@ -0,0 +1,19 @@
+VERSION 5.00
+Begin VB.Form Form1
+   Caption         =   "Form1"
+   ClientHeight    =   3000
+   ClientLeft      =   60
+   ClientTop       =   345
+   ClientWidth     =   4000
+   LinkTopic       =   "Form1"
+   ScaleHeight     =   3000
+   ScaleWidth      =   4000
+   StartUpPosition =   3  'Windows Default
+   Visible         =   0   'False
+End
+Attribute VB_Name = "Form1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = False
+Attribute VB_PredeclaredId = True
+Attribute VB_Exposed = False
+Option Explicit
diff --git a/bugs/system-colour-extra-bytes-black/vb6/Module1.bas b/bugs/system-colour-extra-bytes-black/vb6/Module1.bas
new file mode 100644
index 000000000..b110be567
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/vb6/Module1.bas
@@ -0,0 +1,35 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+' The VB6 side of the reproducer: node scripts/bug_repro.mjs vb6 system-colour-extra-bytes-black
+
+Private Declare Function GetPixel Lib "gdi32" (ByVal hdc As Long, ByVal x As Long, ByVal y As Long) As Long
+
+Private Sub Draw(ByVal Label As String, ByVal Color As Long)
+    Form1.Cls
+    Form1.PSet (10, 10), Color
+    Print #9, Label & " -> " & Right$("000000" & Hex$(GetPixel(Form1.hdc, 10, 10)), 6)
+End Sub
+
+Private Sub Cases()
+    Load Form1
+    Form1.AutoRedraw = True
+    Form1.ScaleMode = vbPixels
+    Form1.BackColor = &H30201
+    Draw "&H8000000F", &H8000000F
+    Draw "&H80FF000F", &H80FF000F
+    Draw "&H80010003", &H80010003
+    Unload Form1
+End Sub
+
+Sub Main()
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    Cases
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/system-colour-extra-bytes-black/vb6/Probe.vbp b/bugs/system-colour-extra-bytes-black/vb6/Probe.vbp
new file mode 100644
index 000000000..ad33b4479
--- /dev/null
+++ b/bugs/system-colour-extra-bytes-black/vb6/Probe.vbp
@@ -0,0 +1,8 @@
+Type=Exe
+Form=Form1.frm
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/textbox-text-ignores-maxlength/repro.json b/bugs/textbox-text-ignores-maxlength/repro.json
new file mode 100644
index 000000000..0de565df1
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/repro.json
@@ -0,0 +1,10 @@
+{
+  "mode": "run",
+  "expect": {
+    "exit": 0,
+    "output": [
+      "^Text = \"abcdef\": \\[abcdef\\] Len 6$",
+      "^SelText = \"cdef\" after \"ab\": \\[abcdef\\] Len 6$"
+    ]
+  }
+}
diff --git a/bugs/textbox-text-ignores-maxlength/src/Settings b/bugs/textbox-text-ignores-maxlength/src/Settings
new file mode 100644
index 000000000..236a013fc
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "TextboxTextIgnoresMaxlength",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: TextBox.Text assigned in code is not limited by MaxLength, where VB6 truncates it",
+	"project.exportPathIsV2": true,
+	"project.id": "{5DA15EF5-2EA2-4146-BDE6-E2E6333C8851}",
+	"project.name": "TextboxTextIgnoresMaxlength",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.tbform b/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.tbform
new file mode 100644
index 000000000..7c968eda4
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.tbform
@@ -0,0 +1,153 @@
+[
+	{
+		"AlwaysShowKeyboardCues": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": -2147483633,
+		"BorderStyle": "vbSizable",
+		"Caption": "Form1",
+		"ClipControls": true,
+		"ControlBox": true,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01}",
+		"HasDC": true,
+		"Height": 300,
+		"HelpContextID": 0,
+		"Icon": [],
+		"KeyPreview": false,
+		"Left": 0,
+		"LinkMode": "vbLinkNone",
+		"LinkTopic": null,
+		"MDIChild": false,
+		"MaxButton": true,
+		"MaxHeight": 0,
+		"MaxWidth": 0,
+		"MinButton": true,
+		"MinHeight": 0,
+		"MinWidth": 0,
+		"MouseIcon": [],
+		"MousePointer": "vbDefault",
+		"Moveable": true,
+		"Name": "Form1",
+		"NegotiateMenus": false,
+		"OLEDropMode": "vbOLEDropNone",
+		"Opacity": 100,
+		"Palette": [],
+		"PaletteMode": "vbPaletteModeHalftone",
+		"Picture": [],
+		"PictureDpiScaling": false,
+		"RightToLeft": false,
+		"ScaleHeight": 4500,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 4500,
+		"ShowInTaskbar": true,
+		"StartUpPosition": "vbStartUpScreen",
+		"TabFocusAutoSelect": false,
+		"Tag": null,
+		"Top": 0,
+		"TopMost": false,
+		"TransparencyKey": -1,
+		"Visible": false,
+		"WhatsThisButton": false,
+		"WhatsThisHelp": false,
+		"Width": 300,
+		"WindowState": "vbNormal",
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"multiColoredGrabbers": false,
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 2061908507,
+		"_className": "Form",
+		"_clsid": "{33AD4F38-6699-11CF-B70C-00AA0060D393}",
+		"_children": [
+			{
+				"Alignment": "vbLeftJustify",
+				"Anchors": {
+					"Bottom": false,
+					"Left": true,
+					"Right": true,
+					"Top": true,
+					"_clsid": "{8524D4B5-72A9-40A9-A189-29E7905C40CA}"
+				},
+				"Appearance": "vbAppear3d",
+				"BackColor": -2147483643,
+				"BorderStyle": "vbFixedSingleBorder",
+				"CausesValidation": true,
+				"DataField": null,
+				"DataFormat": null,
+				"DataMember": null,
+				"DataSource": null,
+				"Dock": "vbDockNone",
+				"DragIcon": "",
+				"DragMode": "vbManual",
+				"Enabled": true,
+				"FontBold": false,
+				"FontItalic": false,
+				"FontName": "Segoe UI",
+				"FontSize": 12,
+				"FontStrikethru": false,
+				"FontUnderline": false,
+				"ForeColor": -2147483640,
+				"Height": 30,
+				"HelpContextID": 0,
+				"HideSelection": true,
+				"Index": -1,
+				"Left": 20,
+				"LinkItem": null,
+				"LinkMode": "vbLinkNone",
+				"LinkTimeout": 50,
+				"LinkTopic": null,
+				"Locked": false,
+				"MaxLength": 0,
+				"MouseIcon": "",
+				"MousePointer": "vbDefault",
+				"MultiLine": false,
+				"Name": "Text1",
+				"NumbersOnly": false,
+				"OLEDragMode": "vbOLEDragManual",
+				"OLEDropMode": "vbOLEDropNone",
+				"Opacity": 100,
+				"PasswordChar": null,
+				"RightToLeft": false,
+				"ScrollBars": "vbSBNone",
+				"TabFocusAutoSelect": true,
+				"TabIndex": 0,
+				"TabStop": true,
+				"Tag": null,
+				"Text": "",
+				"TextHint": null,
+				"TextHintAlways": false,
+				"ToolTipText": null,
+				"Top": 20,
+				"TransparencyKey": -1,
+				"Visible": true,
+				"VisualStyles": true,
+				"WhatsThisHelpID": 0,
+				"WheelScrollEvent": true,
+				"Width": 200,
+				"_className": "TextBox",
+				"_clsid": "{33AD4EE0-6699-11CF-B70C-00AA0060D393}"
+			}
+		]
+	}
+]
\ No newline at end of file
diff --git a/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.twin b/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.twin
new file mode 100644
index 000000000..fa6a1c3a9
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/src/Sources/Form1.twin
@@ -0,0 +1,9 @@
+[Description("")]
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01")]
+[PredeclaredId]
+Class Form1
+
+    Sub New()
+    End Sub
+
+End Class
diff --git a/bugs/textbox-text-ignores-maxlength/src/Sources/Startup.twin b/bugs/textbox-text-ignores-maxlength/src/Sources/Startup.twin
new file mode 100644
index 000000000..4e0fa7ad3
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/src/Sources/Startup.twin
@@ -0,0 +1,15 @@
+Module Startup
+
+    Public Sub Main()
+        Load Form1
+        Form1.Text1.MaxLength = 3
+        Form1.Text1.Text = "abcdef"
+        Debug.Print "Text = ""abcdef"": [" & Form1.Text1.Text & "] Len " & Len(Form1.Text1.Text)
+        Form1.Text1.Text = "ab"
+        Form1.Text1.SelStart = 2
+        Form1.Text1.SelText = "cdef"
+        Debug.Print "SelText = ""cdef"" after ""ab"": [" & Form1.Text1.Text & "] Len " & Len(Form1.Text1.Text)
+        Unload Form1
+    End Sub
+
+End Module
diff --git a/bugs/textbox-text-ignores-maxlength/textbox-text-ignores-maxlength.twinproj b/bugs/textbox-text-ignores-maxlength/textbox-text-ignores-maxlength.twinproj
new file mode 100644
index 000000000..7789521e1
Binary files /dev/null and b/bugs/textbox-text-ignores-maxlength/textbox-text-ignores-maxlength.twinproj differ
diff --git a/bugs/textbox-text-ignores-maxlength/vb6/Form1.frm b/bugs/textbox-text-ignores-maxlength/vb6/Form1.frm
new file mode 100644
index 000000000..5e59465ac
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/vb6/Form1.frm
@@ -0,0 +1,26 @@
+VERSION 5.00
+Begin VB.Form Form1
+   Caption         =   "Form1"
+   ClientHeight    =   3000
+   ClientLeft      =   60
+   ClientTop       =   345
+   ClientWidth     =   4000
+   LinkTopic       =   "Form1"
+   ScaleHeight     =   3000
+   ScaleWidth      =   4000
+   StartUpPosition =   3  'Windows Default
+   Visible         =   0   'False
+   Begin VB.TextBox Text1
+      Height          =   495
+      Left            =   240
+      TabIndex        =   0
+      Top             =   240
+      Width           =   2415
+   End
+End
+Attribute VB_Name = "Form1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = False
+Attribute VB_PredeclaredId = True
+Attribute VB_Exposed = False
+Option Explicit
diff --git a/bugs/textbox-text-ignores-maxlength/vb6/Module1.bas b/bugs/textbox-text-ignores-maxlength/vb6/Module1.bas
new file mode 100644
index 000000000..24aaa0cd9
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/vb6/Module1.bas
@@ -0,0 +1,28 @@
+Attribute VB_Name = "Module1"
+Option Explicit
+
+' The VB6 side of the reproducer: node scripts/bug_repro.mjs vb6 textbox-text-ignores-maxlength
+
+Private Sub Cases()
+    Load Form1
+    Form1.Text1.MaxLength = 3
+    Form1.Text1.Text = "abcdef"
+    Print #9, "Text = ""abcdef"": [" & Form1.Text1.Text & "] Len " & Len(Form1.Text1.Text)
+    Form1.Text1.Text = "ab"
+    Form1.Text1.SelStart = 2
+    Form1.Text1.SelText = "cdef"
+    Print #9, "SelText = ""cdef"" after ""ab"": [" & Form1.Text1.Text & "] Len " & Len(Form1.Text1.Text)
+    Unload Form1
+End Sub
+
+Sub Main()
+    On Error GoTo Fail
+    Open App.Path & "\out.txt" For Output As #9
+    Cases
+    Close #9
+    Exit Sub
+Fail:
+    On Error Resume Next
+    Print #9, "unhandled error " & Err.Number & ": " & Err.Description
+    Close #9
+End Sub
diff --git a/bugs/textbox-text-ignores-maxlength/vb6/Probe.vbp b/bugs/textbox-text-ignores-maxlength/vb6/Probe.vbp
new file mode 100644
index 000000000..ad33b4479
--- /dev/null
+++ b/bugs/textbox-text-ignores-maxlength/vb6/Probe.vbp
@@ -0,0 +1,8 @@
+Type=Exe
+Form=Form1.frm
+Module=Module1; Module1.bas
+Startup="Sub Main"
+ExeName32="Probe.exe"
+Name="Probe"
+CompilationType=0
+OptimizationType=0
diff --git a/bugs/udt-watch-codegen-error/repro.json b/bugs/udt-watch-codegen-error/repro.json
new file mode 100644
index 000000000..5effeb9a4
--- /dev/null
+++ b/bugs/udt-watch-codegen-error/repro.json
@@ -0,0 +1,4 @@
+{
+  "mode": "manual",
+  "steps": "1. Open udt-watch-codegen-error.twinproj in the twinBASIC IDE, put a breakpoint on the line marked BREAK (F9) and press F5. The run stops there; VARIABLES shows p as {user defined type, 8 bytes}, with X and Y.\n2. Add a watch on p (Debug > Add Watch..., or the plus sign in WATCHES).\n3. Expected: the watch shows p as VARIABLES does. Actual: its value is (compile error: codegen error; check for compilation errors) and its type ERROR, and the DEBUG CONSOLE prints [LINKER] compilation (codegen) error detected in 'Startup.{temp_procedure}' at line #1.\n4. Press F5. The run stops at the breakpoint again, on the loop's second pass, and the DEBUG CONSOLE prints the linker error again: it does so at every stop while the watch is there.\n5. Type ? p in the DEBUG CONSOLE and press Enter: the same error, and the same linker line.\nControl: a watch on p.X shows 7, of type Variant [Long].\nAsserted on BETA 995 by `ide-test.bat --only watches` (the project is test/ide/probes/watches)."
+}
diff --git a/bugs/udt-watch-codegen-error/src/Settings b/bugs/udt-watch-codegen-error/src/Settings
new file mode 100644
index 000000000..3d8efc34e
--- /dev/null
+++ b/bugs/udt-watch-codegen-error/src/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "UdtWatchCodegenError",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "Reproduces: A watch on a variable of a user-defined type fails with a codegen error, and the Debug Console reports a linker error at every stop",
+	"project.exportPathIsV2": true,
+	"project.id": "{3CEDB37B-D547-483D-AC69-EFFC82159A24}",
+	"project.name": "UdtWatchCodegenError",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/bugs/udt-watch-codegen-error/src/Sources/Startup.twin b/bugs/udt-watch-codegen-error/src/Sources/Startup.twin
new file mode 100644
index 000000000..176c362e7
--- /dev/null
+++ b/bugs/udt-watch-codegen-error/src/Sources/Startup.twin
@@ -0,0 +1,20 @@
+' Put a breakpoint on the line marked BREAK (F9), press F5, and add a watch on p:
+' the watch fails, and the Debug Console reports a linker error, again at every
+' later stop while the watch is there. A watch on p.X works.
+Module Startup
+
+    Private Type Point
+        X As Long
+        Y As Long
+    End Type
+
+    Public Sub Main()
+        Dim p As Point
+        Dim i As Long
+        p.X = 7
+        For i = 1 To 2
+            Debug.Print "pass " & i ' BREAK
+        Next
+    End Sub
+
+End Module
diff --git a/bugs/udt-watch-codegen-error/udt-watch-codegen-error.twinproj b/bugs/udt-watch-codegen-error/udt-watch-codegen-error.twinproj
new file mode 100644
index 000000000..06ea2ed9b
Binary files /dev/null and b/bugs/udt-watch-codegen-error/udt-watch-codegen-error.twinproj differ
diff --git a/builder/page-baseline.json b/builder/page-baseline.json
index a32e7a3c1..73b27bf71 100644
--- a/builder/page-baseline.json
+++ b/builder/page-baseline.json
@@ -1,5 +1,5 @@
 {
   "src": "docs",
-  "pages": 921,
+  "pages": 922,
   "staticFiles": 250
 }
diff --git a/builder/symbol-baseline.json b/builder/symbol-baseline.json
index f269aff8b..6da00f5ba 100644
--- a/builder/symbol-baseline.json
+++ b/builder/symbol-baseline.json
@@ -105,6 +105,7 @@
     "/tB/Core/Get",
     "/tB/Core/GoSub-Return",
     "/tB/Core/GoTo",
+    "/tB/Core/Graphics-Methods",
     "/tB/Core/Handles",
     "/tB/Core/If-Then-Else",
     "/tB/Core/Imp",
diff --git a/docs/Documentation/Authoring.md b/docs/Documentation/Authoring.md
index 283595d08..e19c4c90e 100644
--- a/docs/Documentation/Authoring.md
+++ b/docs/Documentation/Authoring.md
@@ -551,7 +551,7 @@ generated `Sub`. Three keys override it when it guesses wrong, and one flag asks
 | `hidden` | Context for the page's other samples that the reader never sees. Implies `check_build`. See below. |
 | `slot=file` / `slot=module` / `slot=sub` / `slot=class` / `slot=method` | What to generate around it, when the inference is wrong. `class` and `method` are the same two shapes inside a `Class` rather than a `Module`, for code-behind. The report always names the slot it used, so a wrong guess reads as a wrong guess. |
 | `inherits=<class>` | The sample is code-behind *of* something --- `inherits=Form`, `inherits=MDIForm`. The wrapper becomes a `Class` that inherits it, so `Me.Caption` resolves against the real type. |
-| `project=<name>` | Which template project to build into. The default follows the page: a page under `Reference/Built-In/` gets the one that references every package. |
+| `project=<name>` | Which template project to build into. The default follows the page: a page under `Reference/Built-In/` gets the one that references every package. `project=form` is for a `check_run` sample that needs a real form, to draw on or to read a property of: the project has an empty `Form1`, and the checker unloads every form a sample leaves loaded. Every fence of a `projname` group names the same project. |
 | `projname=<name>` | Build these samples **as one project**, for a page that presents one program in pieces --- a function in one fence and the tests for it in the next three. Every sample sharing the name is compiled together and nothing else is compiled with them. |
 | `concat_group=<name>` | Join these fences, in page order, into **one** piece of code before building it --- for a single construct shown in parts, such as a `Sub` or a `Class` introduced a section at a time. Implies `check_build`. See below. |
 | `expect-error=<code>` | This sample is *meant* not to compile --- it is showing what goes wrong --- and the run fails if it compiles. |
@@ -922,6 +922,8 @@ Three severities, used distinctly:
 - `> [!IMPORTANT]` --- requirements that affect correctness, such as admin rights, threading constraints, or ordering.
 - `> [!WARNING]` --- operations that can corrupt state or lose data.
 
+A known defect in twinBASIC follows the same scale. A defect that silently gives a wrong result --- a function that returns the wrong value and raises no error --- is a `> [!WARNING]` until a fixed build is released, because nothing tells the reader that their data is wrong. A defect that crashes the program is a `> [!WARNING]` too, because whatever it had not saved is lost. So is a defect whose error hides a silent part, such as a procedure that runs twice before the error is raised. A defect the reader cannot miss and that loses nothing, such as an error raised or a statement the compiler refuses, is a `> [!NOTE]`. Either callout names the build it applies to, and once a fixed build is out it becomes a `> [!NOTE]` saying since which build the behaviour is correct.
+
 Use one callout per concern, and reserve them for genuine notes --- plain "why this is useful" prose should stay a plain paragraph.
 
 ## Document the product as it is
diff --git a/docs/Documentation/Building.md b/docs/Documentation/Building.md
index 71f101236..a3cfe2282 100644
--- a/docs/Documentation/Building.md
+++ b/docs/Documentation/Building.md
@@ -75,6 +75,7 @@ Each `.bat` opens with `@pushd "%~dp0"`, which is what lets it be invoked from a
       && node --test test/search.test.mjs \
       && node --test test/render.test.mjs \
       && node --test test/strftime.test.mjs \
+      && node --test test/png.test.mjs \
       && node --test test/example-batches.test.mjs \
       && node scripts/check_regex_safety.mjs \
       && node scripts/check_code_regions.mjs \
diff --git a/docs/Documentation/Permanent-Links.md b/docs/Documentation/Permanent-Links.md
index bde6deb14..f5cfd958d 100644
--- a/docs/Documentation/Permanent-Links.md
+++ b/docs/Documentation/Permanent-Links.md
@@ -60,7 +60,7 @@ A name can have several entries, and many do: `Add` is a method of a dozen class
 - [Date](../../tB/Core/Date), [Declare](../../tB/Core/Declare), [Deftype](../../tB/Core/Deftype), [DeleteSetting](../../tB/Core/DeleteSetting), [Dim](../../tB/Core/Dim), [Do-Loop](../../tB/Core/Do-Loop)
 - [End](../../tB/Core/End), [Enum](../../tB/Core/Enum), [Erase](../../tB/Core/Erase), [Error](../../tB/Core/Error), [Event](../../tB/Core/Event), [Exit](../../tB/Core/Exit)
 - [FileCopy](../../tB/Core/FileCopy), [For-Next](../../tB/Core/For-Next), [For-Each-Next](../../tB/Core/For-Each-Next), [Function](../../tB/Core/Function)
-- [Get](../../tB/Core/Get), [GetSetting](../../tB/Core/GetSetting), [GoSub-Return](../../tB/Core/GoSub-Return), [GoTo](../../tB/Core/GoTo)
+- [Get](../../tB/Core/Get), [GetSetting](../../tB/Core/GetSetting), [GoSub-Return](../../tB/Core/GoSub-Return), [GoTo](../../tB/Core/GoTo), [Graphics-Methods](../../tB/Core/Graphics-Methods) for `Line`, `Circle`, `PSet` and `Scale`
 - [If-Then-Else](../../tB/Core/If-Then-Else), [Implements](../../tB/Core/Implements), [Input](../../tB/Core/Input), [Interface](../../tB/Core/Interface), [Is](../../tB/Core/Is)
 - [Kill](../../tB/Core/Kill)
 - [LBound](../../tB/Core/LBound), [Let](../../tB/Core/Let), [Line-Input](../../tB/Core/Line-Input), [Load](../../tB/Core/Load), [Lock](../../tB/Core/Lock), [LSet](../../tB/Core/LSet)
diff --git a/docs/Documentation/Tools.md b/docs/Documentation/Tools.md
index 41fe81ec0..97460cfd4 100644
--- a/docs/Documentation/Tools.md
+++ b/docs/Documentation/Tools.md
@@ -71,7 +71,7 @@ One of the four does not mean the same thing locally as it does in CI, on any pl
 
     test.bat
 
-The tests the toolchain has to pass. Nineteen steps, each stopping the run if it fails:
+The tests the toolchain has to pass. Twenty steps, each stopping the run if it fails:
 
 1. [`scripts/check_publish_policy.mjs`](#check-publish-policy) --- verifies the publish allowlist still refuses the types it is meant to. Needs neither a browser nor a built tree, so it goes first.
 2. [`scripts/check_gate_lists.mjs`](#check-gate-lists) --- verifies the two gate lists on this page still match the wrappers that run them.
@@ -80,18 +80,19 @@ The tests the toolchain has to pass. Nineteen steps, each stopping the run if it
 5. [`test/search.test.mjs`](#search-test) --- unit tests for the site search: what the search entries hold, and that the copies of the search client agree.
 6. [`test/render.test.mjs`](#render-test) --- unit tests for the markdown-it plugins, on inputs no page holds.
 7. [`test/strftime.test.mjs`](#strftime-test) --- unit tests for the footer's date formatter, which no build calls.
-8. [`test/example-batches.test.mjs`](#example-batches-test) --- runs `check_examples.mjs`'s probes, which test how samples are batched and how a crashed batch is cut down, without an IDE.
-9. [`scripts/check_regex_safety.mjs`](#check-regex-safety) --- refuses a regex that can backtrack exponentially, written as a literal or built from constants.
-10. [`scripts/check_code_regions.mjs`](#check-code-regions) --- verifies no pre-render rewrite alters the contents of a code fence or code span, that the rewrites over rendered HTML leave a raw `<pre>` or `<code>` alone, and that `lib/markdown.mjs` and `lib/frontmatter.mjs` pass their probes.
-11. [`scripts/check_page_baseline.mjs`](#check-page-baseline) --- verifies the page-count drift guard still refuses a fall.
-12. [`scripts/check_book_coverage.mjs`](#check-book-coverage) --- verifies the build still warns about a page `docs/_book.yml` does not mention.
-13. [`scripts/check_symbol_index.mjs`](#check-symbol-index) --- verifies the symbol index still places each kind of symbol, and its drift guard still refuses a lost URL.
-14. [`scripts/check_twin_parsers.mjs`](#check-twin-parsers) --- verifies the scanners of twinBASIC source and of the attribute reference still read the shapes each once misread.
-15. [`scripts/check_attribute_sweep.mjs`](#check-attribute-sweep) --- verifies the logic of the attribute sweep: its site skeletons, how it reads a probe's diagnostics, how it batches probes, and how it compares the answers with `Attributes.md`.
-16. [`scripts/check_cli.mjs`](#check-cli) --- verifies `lib/cli.mjs`, the command-line parser, and each tool's recorded command-line errors.
-17. [`scripts/check_pdf_shims_equiv.mjs`](#check-pdf-shims-equiv) --- verifies the book's pdf-lib shims write what stock pdf-lib writes, patch the members of pdf-lib it lists, and run.
-18. [`scripts/check_impexp_parity.mjs`](#check-impexp-parity) --- verifies the two editions of the impexp tool pass the same built-in tests, and exit, print and write the same for one sequence of commands. Without Python it reports itself skipped and passes, except in CI.
-19. [`scripts/check_axe_patch_equiv.mjs`](#check-axe-patch-equiv) --- verifies the vendored axe source patch still produces identical colour values.
+8. [`test/png.test.mjs`](#png-test) --- unit tests for the pictures of a bug reproducer: PNG decoding, comparing and the side-by-side image, the files behind `images` and `expect.imagesDiffer`, and the refusals of `bug_repro.mjs` over fixtures.
+9. [`test/example-batches.test.mjs`](#example-batches-test) --- runs `check_examples.mjs`'s probes, which test how samples are batched and how a crashed batch is cut down, without an IDE.
+10. [`scripts/check_regex_safety.mjs`](#check-regex-safety) --- refuses a regex that can backtrack exponentially, written as a literal or built from constants.
+11. [`scripts/check_code_regions.mjs`](#check-code-regions) --- verifies no pre-render rewrite alters the contents of a code fence or code span, that the rewrites over rendered HTML leave a raw `<pre>` or `<code>` alone, and that `lib/markdown.mjs` and `lib/frontmatter.mjs` pass their probes.
+12. [`scripts/check_page_baseline.mjs`](#check-page-baseline) --- verifies the page-count drift guard still refuses a fall.
+13. [`scripts/check_book_coverage.mjs`](#check-book-coverage) --- verifies the build still warns about a page `docs/_book.yml` does not mention.
+14. [`scripts/check_symbol_index.mjs`](#check-symbol-index) --- verifies the symbol index still places each kind of symbol, and its drift guard still refuses a lost URL.
+15. [`scripts/check_twin_parsers.mjs`](#check-twin-parsers) --- verifies the scanners of twinBASIC source and of the attribute reference still read the shapes each once misread.
+16. [`scripts/check_attribute_sweep.mjs`](#check-attribute-sweep) --- verifies the logic of the attribute sweep: its site skeletons, how it reads a probe's diagnostics, how it batches probes, and how it compares the answers with `Attributes.md`.
+17. [`scripts/check_cli.mjs`](#check-cli) --- verifies `lib/cli.mjs`, the command-line parser, and each tool's recorded command-line errors.
+18. [`scripts/check_pdf_shims_equiv.mjs`](#check-pdf-shims-equiv) --- verifies the book's pdf-lib shims write what stock pdf-lib writes, patch the members of pdf-lib it lists, and run.
+19. [`scripts/check_impexp_parity.mjs`](#check-impexp-parity) --- verifies the two editions of the impexp tool pass the same built-in tests, and exit, print and write the same for one sequence of commands. Without Python it reports itself skipped and passes, except in CI.
+20. [`scripts/check_axe_patch_equiv.mjs`](#check-axe-patch-equiv) --- verifies the vendored axe source patch still produces identical colour values.
 
 POSIX:
 
@@ -102,6 +103,7 @@ POSIX:
       && node --test test/search.test.mjs \
       && node --test test/render.test.mjs \
       && node --test test/strftime.test.mjs \
+      && node --test test/png.test.mjs \
       && node --test test/example-batches.test.mjs \
       && node scripts/check_regex_safety.mjs \
       && node scripts/check_code_regions.mjs \
@@ -117,7 +119,7 @@ POSIX:
 
 Exit codes: **0** every step passed; otherwise the code of the step that stopped the run, as that step's entry gives it.
 
-**Sixteen of the nineteen cannot be affected by an edit confined to `docs/`**, which is why they are separate from `check.bat`. Run this one when the change touches `builder/`, `scripts/`, `lib/`, `book/`, `eval/`, `wisdom/` or `test/`, the site's scripts in `docs/assets/js/`, a wrapper, or a workflow. Both CI workflows run all nineteen unconditionally, so skipping it locally cannot let a tooling regression reach `staging`.
+**Seventeen of the twenty cannot be affected by an edit confined to `docs/`**, which is why they are separate from `check.bat`. Run this one when the change touches `builder/`, `scripts/`, `lib/`, `book/`, `eval/`, `wisdom/` or `test/`, the site's scripts in `docs/assets/js/`, a wrapper, or a workflow. Both CI workflows run all twenty unconditionally, so skipping it locally cannot let a tooling regression reach `staging`.
 
 The three exceptions are [`check_code_regions.mjs`](#check-code-regions), [`check_gate_lists.mjs`](#check-gate-lists), which reads this page, and [`check_lint.mjs`](#check-lint), which lints the site's scripts in `docs/assets/js/`. The first is worth knowing in detail. Its corpus sweep tokenises every markdown file under `docs/`, so a page that provokes a rewrite into altering a code region fails it. Its fixed probes are a different matter: they run against their own sources whatever the tree holds, and they cover the *mirror* fault, where a rewrite silently stops firing. The sweep cannot see that one --- text the rewrite skipped is stashed and restored unchanged, so every region still matches. Add a page with an unusual code construct and run `test.bat`, but read the built page too.
 
@@ -583,12 +585,21 @@ Unit tests for `builder/strftime.mjs`, which formats the "Page last modified" li
 
 Exit codes: **0** every test passed, **1** a test failed.
 
+### png.test.mjs
+{: #png-test }
+
+    node --test test/png.test.mjs
+
+Unit tests for the pictures a bug reproducer carries (see [`bug_repro.mjs`](#bug-repro)). `scripts/lib/png.mjs` reads and writes PNG files, compares two pictures and draws the side-by-side image: these tests build PNG files by hand for each filter type, for RGB and for palette images, and check that a wrong checksum and every unsupported kind of file is refused, that `comparePngs` counts each differing pixel once, and that the comparison image has the size, the labels and the red pixels it should. `scripts/lib/repro-images.mjs` holds the files and judgements behind `images` and `expect.imagesDiffer`: the check of a reproducer's `PngDump` modules, the `Probe.vbp` line, and the rule that decides whether a run reproduces. The last group runs `bug_repro.mjs` itself over fixture reproducers in a temp folder (`BUG_REPRO_BUGS` names it), through `new --with-images` and the refusals of `verify`, which end before any IDE is looked for. No twinBASIC, no VB6, no browser, no built tree, a few seconds.
+
+Exit codes: **0** every test passed, **1** a test failed.
+
 ### example-batches.test.mjs
 {: #example-batches-test }
 
     node --test test/example-batches.test.mjs
 
-Runs the probes of [`check_examples.mjs`](#check-examples) under Node's own test runner. They live in `scripts/lib/example-batches.mjs`, beside what they test: how samples are packed into projects, how a batch whose build crashed the compiler is cut down to the samples that crash it, the canary every batch carries, the fence classifier, and how a `check_run` sample is refused, read for what it says it prints, called and judged. `check_examples.mjs` runs them before every run too, but it needs a twinBASIC install, so it runs only by hand and never in CI. The probes need no IDE: crash isolation is driven through a fake lane whose builds crash on the samples a probe chooses. The same file also runs the probes of [`vb6run.mjs`](#vb6run), from `scripts/lib/vb6.mjs`: the `Debug.Print` rewrite on strings, comments, statement separators, single-line `If` and a bare `Debug.Print`, the generated modules, the reading of VB6's build log and the Windows-1252 encoding. It also holds the probes for a bug reproducer's VB6 project (see [`bug_repro.mjs`](#bug-repro)): which files go into its zip, what refuses a project, and the project file the build copy gets. They need no VB6. No browser, no built tree, well under a second.
+Runs the probes of [`check_examples.mjs`](#check-examples) under Node's own test runner. They live in `scripts/lib/example-batches.mjs`, beside what they test: how samples are packed into projects, how a batch whose build crashed the compiler is cut down to the samples that crash it, the canary every batch carries, the fence classifier, and how a `check_run` sample is refused, read for what it says it prints, called and judged. `check_examples.mjs` runs them before every run too, but it needs a twinBASIC install, so it runs only by hand and never in CI. The probes need no IDE: crash isolation is driven through a fake lane whose builds crash on the samples a probe chooses. The same file also runs the probes of [`vb6run.mjs`](#vb6run), from `scripts/lib/vb6.mjs`: the `Debug.Print` rewrite on strings, comments, statement separators, single-line `If` and a bare `Debug.Print`, the generated modules, the reading of VB6's build log and the Windows-1252 encoding. It also holds the probes for a bug reproducer's VB6 project (see [`bug_repro.mjs`](#bug-repro)): which files go into its zip, what refuses a project (the `PngDump.bas` picture module among the sources that must pass), and the project file the build copy gets. They need no VB6. No browser, no built tree, well under a second.
 
 Exit codes: **0** every test passed, **1** a test failed.
 
@@ -815,7 +826,7 @@ Exit codes: **0** the trees match; **1** the trees differ; **2** a refused comma
 
 Compiles a `.twinproj` and prints its diagnostics, with no IDE window to click through. This is how a claim the documentation makes about the language gets checked against the compiler rather than against memory: write a one-module project that uses the construct in the position you are asking about, run this, and read what comes back. Windows only, and no part of the site build.
 
-twinBASIC has no command-line build. The compiler executable's whole surface is six verbs --- `export`, `import`, `settings`, `licence`, `changelog`, `readme` --- and none of them builds. The IDE executable does take `--buildAndExit32` and `--buildAndExit64`, and both are worse than useless unattended: they write nothing to stdout or stderr, exit 0 on a project the IDE flags, and do not exit at all when the build genuinely fails. So this drives the IDE. Its user interface is a WebView2 page and WebView2 honours `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`, so the IDE starts with a Chrome DevTools port and is driven over CDP. The diagnostics come from the IDE's own *copy compilation error report* walk with the clipboard write removed, so the text is exactly what that command gives a person.
+twinBASIC has no command-line build. The compiler executable's whole surface is six verbs --- `export`, `import`, `settings`, `licence`, `changelog`, `readme` --- and none of them builds. The IDE executable does take `--buildAndExit32` and `--buildAndExit64`, and both are worse than useless unattended: they write nothing to stdout or stderr, exit 0 when the error is in code nothing calls, and do not exit at all for an error the build reaches. So this drives the IDE. Its user interface is a WebView2 page and WebView2 honours `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`, so the IDE starts with a Chrome DevTools port and is driven over CDP. The diagnostics come from the IDE's own *copy compilation error report* walk with the clipboard write removed, so the text is exactly what that command gives a person.
 
 | Flag | Effect |
 |---|---|
@@ -992,7 +1003,7 @@ Exit codes: **0** the probe ran and its output was captured; **1** the project h
 ### bug_repro.mjs
 {: #bug-repro }
 
-    node scripts/bug_repro.mjs new <slug> "<entry title>" [--template <name>] [--with-vb6]
+    node scripts/bug_repro.mjs new <slug> "<entry title>" [--template <name>] [--with-vb6] [--with-images]
     node scripts/bug_repro.mjs pack <slug>
     node scripts/bug_repro.mjs compile|build|run <slug> [--ide <twinBASIC.exe>] [--port N]
                                [--arch win32|win64] [--timeout S] [--llvm] [--exe] [--keep] [--show|--hide]
@@ -1012,12 +1023,12 @@ outside every gate and outside CI, and `verify` is run by a person only.
 
 | Command | Effect |
 |---|---|
-| `new <slug> "<title>"` | Creates `bugs/<slug>/src/` from the console template under `test/example-projects/`, with the project named after the slug in PascalCase, a fresh project id, the description `Reproduces: <title>` and a `Startup` module holding an empty `Sub Main`. Also writes `bugs/<slug>/repro.json` with `"mode": "manual"`. Refused, with exit 3, when `bugs/<slug>` exists. `--template <name>` starts from a folder of `test/repro-templates/` instead: its `Settings`, with the same four keys rewritten, and its `Sources/` as they are. `webview2-form` is a form holding one WebView2 control, which opens `about:blank` when the control is ready and closes when that navigation completes, shown modally by `Sub Main`. `--with-vb6` also creates `bugs/<slug>/vb6/` from the VB6 template in `test/repro-templates/vb6/`: `Probe.vbp` and `Module1.bas`, whose `Sub Main` opens `out.txt` beside the exe, prints one line under an error handler and closes. |
-| `pack <slug>` | Runs `node scripts/impexp.mjs import` on `src/`, to `<slug>.twinproj`, and then writes `<slug>.zip` holding that file and the files `repro.json`'s `attach` names. The zip is written by the script itself, so neither PowerShell nor 7-Zip is needed. An `impexp` exit of 0 or 6 counts as a pack, and its output is printed. When `bugs/<slug>/vb6/` exists, it also writes `<slug>-vb6.zip`, holding the source files of that folder (`.vbp`, `.bas`, `.cls`, `.frm` and `.frx`) and nothing else, so an exe or an output left there is not zipped; the files left out are named. A `vb6/` with no `Probe.vbp`, or whose sources call `MsgBox` or `InputBox`, is refused. |
+| `new <slug> "<title>"` | Creates `bugs/<slug>/src/` from the console template under `test/example-projects/`, with the project named after the slug in PascalCase, a fresh project id, the description `Reproduces: <title>` and a `Startup` module holding an empty `Sub Main`. Also writes `bugs/<slug>/repro.json` with `"mode": "manual"`. Refused, with exit 3, when `bugs/<slug>` exists. `--template <name>` starts from a folder of `test/repro-templates/` instead: its `Settings`, with the same four keys rewritten, and its `Sources/` as they are. `webview2-form` is a form holding one WebView2 control, which opens `about:blank` when the control is ready and closes when that navigation completes, shown modally by `Sub Main`. `--with-vb6` also creates `bugs/<slug>/vb6/` from the VB6 template in `test/repro-templates/vb6/`: `Probe.vbp` and `Module1.bas`, whose `Sub Main` opens `out.txt` beside the exe, prints one line under an error handler and closes. `--with-images` also copies `PngDump.twin` from `test/repro-templates/png/` into `src/Sources/` and, with `--with-vb6`, `PngDump.bas` into `vb6/` with its `Module=PngDump; PngDump.bas` line in `Probe.vbp`, and writes `"images": ["main"]` into `repro.json`. |
+| `pack <slug>` | Runs `node scripts/impexp.mjs import` on `src/`, to `<slug>.twinproj`, and then writes `<slug>.zip` holding that file and the files `repro.json`'s `attach` names. The zip is written by the script itself, so neither PowerShell nor 7-Zip is needed. An `impexp` exit of 0 or 6 counts as a pack, and its output is printed. When `bugs/<slug>/vb6/` exists, it also writes `<slug>-vb6.zip`, holding the source files of that folder (`.vbp`, `.bas`, `.cls`, `.frm`, `.frx`, `.ctl` and `.ctx`) and nothing else, so an exe or an output left there is not zipped; the files left out are named. A `vb6/` with no `Probe.vbp`, or whose sources call `MsgBox` or `InputBox`, is refused. The zip also holds every file of `images/`, and `pack` prints the path of each `<name>-compare.png`, the pictures to put in the issue. |
 | `compile <slug>` | Packs, then compiles the project with `tbbuild --json` and prints its diagnostics. |
 | `build <slug>` | Packs, then compiles and builds it with `tbbuild --build`, or `--llvm` when that is given. A build that fails prints the build log and the failing line. |
-| `run <slug>` | Copies `src/` to `%TEMP%\bugrepro\<port>\<slug>`, adds a `TbRunProbe` module whose `[RunAfterBuild]` Sub calls `Debug.Cls` and then `Main`, runs `tbrun` on the copy and prints what it captured. The Sub clears `WEBVIEW2_USER_DATA_FOLDER` and `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS` while `Main` runs: the harness starts the IDE with both, and WebView2 lets them override what a WebView2 control in the project asks for, so the control would fail to start inside the IDE's process. The tree under `bugs/` is not changed. With `--exe` no probe module is added: `tbrun` runs `Sub Main` in the built exe. |
-| `vb6 <slug>` | Builds the reproducer's VB6 project, in `vb6/`, and prints what its exe wrote. By convention `Probe.vbp` builds `Probe.exe`, which writes its findings to `out.txt` beside the exe and handles every error itself. The sources are copied to a new folder under the OS temp folder, so no exe or output lands in the repository, and the copy's project is given VB6's Unattended Execution option, which sends a message box or an unhandled error to the Windows event log instead of the desktop. The project is refused, exit 2, when its sources call `MsgBox` or `InputBox`, which would open a modal box. VB6 is found from `--vb6 <path>`, else the `VB6_EXE` environment variable, else `VB98\VB6.EXE` under `C:\Program Files (x86)\Microsoft Visual Studio` and then `C:\Program Files\Microsoft Visual Studio`; it is started from Node with an argument array and no shell, as [`vb6run.mjs`](#vb6run) does it. `--timeout` is the time limit on the exe (default 30 s), and `--keep` keeps the work folder and prints where it is. It needs no IDE. |
+| `run <slug>` | Copies `src/` to `%TEMP%\bugrepro\<port>\<slug>`, adds a `TbRunProbe` module whose `[RunAfterBuild]` Sub calls `Debug.Cls` and then `Main`, runs `tbrun` on the copy and prints what it captured. The Sub clears `WEBVIEW2_USER_DATA_FOLDER` and `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS` while `Main` runs: the harness starts the IDE with both, and WebView2 lets them override what a WebView2 control in the project asks for, so the control would fail to start inside the IDE's process. Apart from the pictures below, the tree under `bugs/` is not changed. With `--exe` no probe module is added: `tbrun` runs `Sub Main` in the built exe. With `images` in `repro.json`, `run` also gives `tbrun` an empty folder in `BUGREPRO_IMAGES`, which the IDE and, with `--exe`, the exe inherit, and when the run finishes keeps each picture as `images/<name>-tb.png`. A picture the probe did not write is a failure that names it, exit 9. |
+| `vb6 <slug>` | Builds the reproducer's VB6 project, in `vb6/`, and prints what its exe wrote. By convention `Probe.vbp` builds `Probe.exe`, which writes its findings to `out.txt` beside the exe and handles every error itself. The sources are copied to a new folder under the OS temp folder, so no exe or output lands in the repository, and the copy's project is given VB6's Unattended Execution option, which sends a message box or an unhandled error to the Windows event log instead of the desktop. VB6 refuses that option for a project with a form, a user control, a property page, a user document or a designer, so such a project is built without it. The exe always runs on a private desktop, inside a job that ends everything it starts, as `tbrun --exe` runs one: a box it shows is on no desktop anyone uses, and the time limit ends it. The project is refused, exit 2, when its sources call `MsgBox` or `InputBox`, which would open a modal box. VB6 is found from `--vb6 <path>`, else the `VB6_EXE` environment variable, else `VB98\VB6.EXE` under `C:\Program Files (x86)\Microsoft Visual Studio` and then `C:\Program Files\Microsoft Visual Studio`; it is started from Node with an argument array and no shell, as [`vb6run.mjs`](#vb6run) does it. `--timeout` is the time limit on the exe (default 30 s), and `--keep` keeps the work folder and prints where it is. It needs no IDE. With `images` in `repro.json`, the exe is given an empty folder in `BUGREPRO_IMAGES`, and each picture it wrote is kept as `images/<name>-vb6.png`. |
 | `verify [slug ...]` | Reads `repro.json` for each named reproducer, or every one under `bugs/` and `bugs/filed/`, runs what it says and reports one line each. A filed reproducer's line is labelled with its issue, such as `(filed #2453)`, and the summary counts the filed ones on a line of their own. |
 | `file <slug> <issue>` | Moves the entry that names `` `<slug>.twinproj` `` out of `BUGS-TO-REPORT.md`, together with one `---` beside it, into `bugs/filed/<slug>/REPORT.md`, whose first line links the issue (`--existing`: "Covered by the existing issue ..." when an existing issue already covered the bug) and which holds no mark line. Then moves `bugs/<slug>/` to `bugs/filed/<slug>/` and records `issue` (and `existing`) in its `repro.json`. An entry whose reproducer is not an attachment names `bugs/<slug>/` in its closing comment instead. Refused, with exit 2 and nothing changed, when no entry or more than one names the slug, `bugs/<slug>` is missing, or `bugs/filed/<slug>` exists. |
 | `file --marked` | Does that for every entry with a mark line directly under its title: `*FILED #<n>*`, `*CAPTURED IN EXISTING #<n>*` or `*CAPTURED IN \#<n>*`, the issue and the slug taken from the entry. A line such as `*DEFERRED until after v1*` is not a mark, and the entry is skipped. If a mark cannot be read, or a slug cannot be settled, the entries concerned are printed and nothing at all is filed, exit 2. One line is printed for each entry filed. Takes neither a slug nor an issue. |
@@ -1032,6 +1043,31 @@ A VB6 project in `vb6/` has no key in `repro.json`: the folder says it is there.
 `verify` check it, and `attach` may not name `<slug>-vb6.zip` or a path under `vb6/`.
 `verify` runs the twinBASIC side only, and never starts VB6.
 
+**A graphical defect carries pictures.** What twinBASIC drew beside what VB6 drew shows it
+better than a description, and `images` in `repro.json` names them. Two modules draw them,
+`PngDump.twin` in `src/Sources/` and `PngDump.bas` in `vb6/` (`new --with-images` copies
+both from `test/repro-templates/png/`), and have the same members:
+`PngDump.Surface Form1, "main"` for an object that has an `hDC`, and
+`PngDump.Window Text1.hWnd, "text"` for a control with none. Each copies the pixels with
+`BitBlt` or `PrintWindow` into a bitmap of its own and saves it with GDI+, so the picture is
+what was drawn and not what the object's `Image` property or `SavePicture` would make of it.
+The file is `<name>.png` in the folder `BUGREPRO_IMAGES` names, which `run` and `vb6` set,
+else in `App.Path`. A name uses letters, digits, `-` and `_`. Any failure raises error 5 with
+a description of the call that failed, and no message box opens.
+
+`run` keeps each picture as `bugs/<slug>/images/<name>-tb.png`, `vb6` as `<name>-vb6.png`, and
+when both exist `<name>-compare.png` shows twinBASIC, VB6 and their difference side by side,
+with the beta that drew the first named over it. A pixel that differs is pure red in the
+difference panel. Each command prints `image <name>: identical`, or how many pixels differ.
+`pack` puts every file of `images/` into `<slug>.zip` and prints the `-compare.png` paths,
+which are the pictures to put in the issue. The pictures are part of the report, so the entry in
+`BUGS-TO-REPORT.md` embeds each `-compare.png` under **Screenshots** as
+`![...](bugs/<slug>/images/<name>-compare.png)`: `pack` warns when it does not, `test/png.test.mjs`
+fails, and `file` rewrites the path to `images/<name>-compare.png` in `REPORT.md`, which sits
+beside the pictures. A copy of either module that differs from the
+template draws a warning and nothing more, because a filed reproducer stays as it was filed.
+`verify` never changes the tree: it keeps its pictures in the temp folder.
+
 **`repro.json` says how to ask the compiler about a reproducer.** It is committed with the
 reproducer and is not part of the `.twinproj`. A key it does not have, or a value of the
 wrong type, is refused with exit 2, naming the file and the key, before anything runs.
@@ -1048,9 +1084,11 @@ wrong type, is refused with exit 2, naming the file and the key, before anything
 | `expect.message` | `build`. A regular expression the message `tbbuild` prints on standard error must match. |
 | `expect.output` | `run` and `cli`. Regular expressions, each of which must match the output. They are matched line by line, so `^` and `$` hold at each line. |
 | `expect.absent` | `run` and `cli`. Regular expressions, none of which may match the output, such as an `ERROR` line the bug's fix would print. |
-| `cli` | `cli` mode. The arguments for the compiler executable, `bin\twinBASIC_win32.exe`, or a list of such lists, run in turn; their output is joined, and their exit code is the one they all gave, or the codes joined by commas, such as `0,999`. `{tmp}` stands for a new temp folder, deleted afterwards; `{project}` for a copy of the packed `.twinproj` in it, and `{src}` for a copy of `src/`, so a command that writes either never touches the committed reproducer; `{ide}` for the folder of the IDE that `--ide` names or that is found, so a file the installation ships can be named without a user name. Give an output folder with backslashes and a trailing one, as `export` requires. |
+| `cli` | `cli` mode. The arguments for the compiler executable, `bin\twinBASIC_win32.exe`, or a list of such lists, run in turn; their output is joined, and their exit code is the one they all gave, or the codes joined by commas, such as `0,999`. `{tmp}` stands for a new temp folder, deleted afterwards; `{project}` for a copy of the packed `.twinproj` in it, and `{src}` for a copy of `src/`, so a command that writes either never touches the committed reproducer; `{ide}` for the folder of the IDE that `--ide` names or that is found, so a file the installation ships can be named without a user name. Give an output folder with backslashes and a trailing one, as `export` requires. Each command runs on a private desktop, inside a job that ends everything it starts, with its standard output and error written to files; `--timeout` (default 120 seconds) is the limit on each. The compiler opens a modal message box for some inputs, such as a damaged project, and waits for it to be closed, and on a private desktop nobody could close it. So the tool reads every dialog box a command opens, and presses its OK button, which lets the command go on. A command's output begins with one line for each box, in the order they opened, `dialog: <title>: <text>` with the box's text on one line, then its standard output, then its standard error, and `expect.output` and `expect.absent` are matched against that. |
 | `steps` | `manual`. What a person does to see the bug. `verify` prints it. |
-| `attach` | Optional. Files besides the project that the issue needs, such as a `.twinpack`: paths relative to the reproducer's folder, with forward slashes. `pack` adds each to `<slug>.zip`. |
+| `images` | Optional, `run` and `manual`. A non-empty list of picture names, each of letters, digits, `-` and `_`, without repeats. The project needs a `PngDump.twin` under `src/Sources/` and, when there is a `vb6/`, a `vb6/PngDump.bas` and a `Module=PngDump; PngDump.bas` line in its `Probe.vbp`; without them the file is refused. |
+| `expect.imagesDiffer` | `run`, with `images`. `true` reproduces only when at least one picture of the fresh run differs from the committed `images/<name>-vb6.png`, a difference in size counting; `false` only when all of them match. `images/<name>-vb6.png` must exist for every name, and the file is refused when one does not. |
+| `attach` | Optional. Files besides the project that the issue needs, such as a `.twinpack`: paths relative to the reproducer's folder, with forward slashes. `pack` adds each to `<slug>.zip`. A `cli` command finds a copy of each in its temp folder, at the same relative path: `{tmp}\garbage.twinproj` for `garbage.twinproj`, so a command may damage or write to it. |
 | `issue` | Optional. A positive whole number, the number of the `twinbasic/twinbasic` issue the bug was filed as. `file` writes it. |
 | `existing` | Optional, with `issue` only. `true` when the issue was not filed for this bug but already covered it. `file --existing` writes it. |
 
@@ -1064,7 +1102,7 @@ the bug unless `expect.exit` names it. Reproducers run one at a time. `--jobs N`
 once, each in the IDE on its own port, from `--port` up. `verify` tidies the IDE's registry
 entries once for all of them, as [`check_examples.mjs`](#check-examples) does.
 
-Exit codes: **0** done --- a project that compiled, built or ran as it should, or, for `verify`, every reproducer that can be run on its own still reproduces; **1** a finding: the project has errors, or its build failed after a clean compile, or, for `vb6`, VB6 refused the project, or, for `verify`, at least one reproducer no longer reproduces; **2** a refused command line, a `repro.json` that is not valid, no IDE, a project that could not be packed, a harness that failed, or a crash; for `vb6`, no VB6, a reproducer with no `vb6/` folder, a project that has no `Probe.vbp` or calls `MsgBox` or `InputBox`, or VB6 failing to build it; for `verify`, a lane's harness failed; for `file`, an entry that is missing, ambiguous or marked unreadably, or a `bugs/filed/<slug>` already there, with nothing changed; **3** `new` found `bugs/<slug>` or `bugs/filed/<slug>` already there; **4** the compile never settled; **5** the project crashes the compiler; **6** `run`: the probe printed nothing; for `vb6`, the exe wrote no `out.txt`, or an empty one; **7** `run`: the probe ended before it returned; **8** `run --exe`, and `vb6`: the exe exited with a code other than 0, or was still running after `--timeout`.
+Exit codes: **0** done --- a project that compiled, built or ran as it should, or, for `verify`, every reproducer that can be run on its own still reproduces; **1** a finding: the project has errors, or its build failed after a clean compile, or, for `vb6`, VB6 refused the project, or, for `verify`, at least one reproducer no longer reproduces; **2** a refused command line, a `repro.json` that is not valid, no IDE, a project that could not be packed, a harness that failed, or a crash; for `vb6`, no VB6, a reproducer with no `vb6/` folder, a project that has no `Probe.vbp` or calls `MsgBox` or `InputBox`, or VB6 failing to build it; for `verify`, a lane's harness failed; for `file`, an entry that is missing, ambiguous or marked unreadably, or a `bugs/filed/<slug>` already there, with nothing changed; **3** `new` found `bugs/<slug>` or `bugs/filed/<slug>` already there; **4** the compile never settled; **5** the project crashes the compiler; **6** `run`: the probe printed nothing; for `vb6`, the exe wrote no `out.txt`, or an empty one; **7** `run`: the probe ended before it returned; **8** `run --exe`, and `vb6`: the exe exited with a code other than 0, or was still running after `--timeout`; **9** `run` and `vb6`: a picture that `images` names was not written, or could not be read.
 
 ### vb6run.mjs
 {: #vb6run }
@@ -1081,7 +1119,7 @@ Builds and runs Visual Basic 6 code, so that what a documented sample prints in
 | Mode | Effect |
 |---|---|
 | `<file>` | A `.bas` module, or a text file of bare statements; `-` reads statements from standard input. A file that defines `Sub Main` is a whole module: it is built as written, its `Sub Main` is renamed so that the generated `Main` can start it, and it keeps its `Attribute VB_Name` line or is given one. Any other file is the body of a generated procedure. What the sample printed goes to standard output. A compile error is reported to standard error as VB6 reports it, with the line given as a line of the file, and a run-time error as `[vb6] error <n>: <description>`. |
-| `--docs` | Reads the documentation's `check_run` fences with the reader `check_examples.mjs` uses and builds each as a module of its own in a VB6 project; the fences that need no other fence share one project. The run fences of a `projname=` group are built in a project of their own, since class and module names collide between groups, together with the other fences of the group, each of which is a file. A `slot=file` fence is translated into VB6 components: every `Class <Name>` block becomes a class module and every `Module <Name>` block a standard module, `Public`, `Private` or `Friend` before the keyword being accepted, and anything outside those blocks (`Declare`, `Type`, `Enum`, `Const`, procedures) becomes one more standard module. Nothing else is translated. A construct VB6 has no form for, such as an `Interface`, a `CoClass`, a generic or an attribute line, stays where it is and VB6 refuses it, so each run fence of a group whose files do not build is `not VB6`, with the first error at its line in the page. Each of the run fences ends as `same` (VB6 prints what the page says twinBASIC prints), `differs` (the lines that differ, the page against VB6, with the page path and line), `not VB6` (VB6 refuses to compile it, with its first error; most twinBASIC syntax ends here, and it is informational), `error` (a run-time error, or it did not return), or `refused` (the sample cannot be run, for the reasons `check_run` gives). A compile error stops VB6 at the first module that fails, so that module is dropped and the project is built again until it builds. A summary line gives the count of each. `--only <regex>` keeps the pages whose path under `docs/` matches. |
+| `--docs` | Reads the documentation's `check_run` fences with the reader `check_examples.mjs` uses and builds each as a module of its own in a VB6 project; the fences that need no other fence share one project. The run fences of a `projname=` group are built in a project of their own, since class and module names collide between groups, together with the other fences of the group, each of which is a file. A `slot=file` fence is translated into VB6 components: every `Class <Name>` block becomes a class module and every `Module <Name>` block a standard module, `Public`, `Private` or `Friend` before the keyword being accepted, and anything outside those blocks (`Declare`, `Type`, `Enum`, `Const`, procedures) becomes one more standard module. Nothing else is translated. A construct VB6 has no form for, such as an `Interface`, a `CoClass`, a generic or an attribute line, stays where it is and VB6 refuses it, so each run fence of a group whose files do not build is `not VB6`, with the first error at its line in the page. Each of the run fences ends as `same` (VB6 prints what the page says twinBASIC prints), `differs` (the lines that differ, the page against VB6, with the page path and line), `not VB6` (VB6 refuses to compile it, with its first error; most twinBASIC syntax ends here, and it is informational), `error` (a run-time error, or it did not return), or `refused` (the sample cannot be run, for the reasons `check_run` gives). A fence that says `project=form` is built with a blank `Form1.frm`, which VB6 refuses to build with Unattended Execution, so such a project is built without it and its exe runs on a private desktop; each sample's forms are unloaded when it ends. On a `Declare` statement, `PtrSafe` is dropped and `LongPtr` is read as `Long`, because VB6 knows neither. A compile error stops VB6 at the first module that fails, so that module is dropped and the project is built again until it builds. A summary line gives the count of each. `--only <regex>` keeps the pages whose path under `docs/` matches. |
 
 Other options: `--timeout S` is the time limit, in seconds, for each run of the built exe (default 30), and `--json` prints one JSON object in place of the text.
 
@@ -1115,8 +1153,9 @@ the compiler loads add-ins from. The last three check what the [Add Ins](../../t
 and [tbIDE package](../../tB/Packages/tbIDE/) pages say about loading: which folder each
 build target loads, what a compiler restart does to a loaded add-in, and which entry-point
 names the IDE accepts. They build add-ins for win64 as well as win32, restart the compiler,
-and patch a built DLL's export name. The ten lanes take about two and a half minutes
-together.
+and patch a built DLL's export name. One more checks that the environment variable the
+runner sets, which keeps an add-in under test from opening a browser, reaches the add-in,
+also after a compiler restart. The eleven lanes take under two minutes together.
 
 | Flag | Effect |
 |---|---|
@@ -1260,7 +1299,11 @@ reports.
 project tree --- a `Settings` file and a `Sources/` folder. `console` is the default;
 `packages` references every package the IDE ships and is what a page under
 `Reference/Built-In/` or a package tutorial gets without asking. A fence can name one with
-`project=`.
+`project=`. `form` is `console` with a real, empty `Form1` for the samples that draw on a form
+or read its properties: a form made in code has no designer file and cannot be drawn on.
+After each `check_run` sample the run unloads every form the sample left loaded, so a sample
+that forgets `Unload Form1` neither keeps the run waiting nor leaves its drawing for the next
+sample.
 
 Each template also carries a **stage set**: a module declaring the control instances the
 samples assume, `Text1`, `ListView1`, `CefBrowser1` and the rest. A sample that says
diff --git a/docs/Features/Packages/Import-export tool.md b/docs/Features/Packages/Import-export tool.md
index a153e94f3..ea5476261 100644
--- a/docs/Features/Packages/Import-export tool.md	
+++ b/docs/Features/Packages/Import-export tool.md	
@@ -365,8 +365,8 @@ under `src\Packages`, so the tB executable's `import` can pack it as well: see s
 
 None of these commands builds a project. The IDE, `twinBASIC.exe`, accepts
 `--buildAndExit32` and `--buildAndExit64` next to a project path, but it prints nothing,
-exits `0` when the project has errors, and does not exit at all when the build fails, so it
-cannot check a build unattended. The repository behind this documentation has
+exits `0` when an error is in code nothing calls, and does not exit at all for an error the
+build reaches, so it cannot check a build unattended. The repository behind this documentation has
 `scripts/tbbuild.mjs` for that; see [Tools and Scripts](../../Documentation/Development/Tools#tbbuild).
 
 ## See also
diff --git a/docs/Reference/COM-Interfaces/IConnectionPoint.md b/docs/Reference/COM-Interfaces/IConnectionPoint.md
index 5cd016900..0d0ba17bf 100644
--- a/docs/Reference/COM-Interfaces/IConnectionPoint.md
+++ b/docs/Reference/COM-Interfaces/IConnectionPoint.md
@@ -127,7 +127,10 @@ In twinBASIC:
 - Cookies start at 1 for each source object and increase by one for every connection made. A cookie is not used again after its connection ends.
 - A sink that does not answer for the outgoing interface fails with `E_NOINTERFACE` (`&H80004002`), where the COM contract names `CONNECT_E_CANNOTCONNECT`. An object of an ordinary twinBASIC class is such a sink, even when the class implements **IDispatch**, and so is a class declared **NotDispatchable** that implements it. A twinBASIC class cannot answer for the identifier, because the identifier of a class's event interface changes with every build and so cannot be declared. A sink that works is the object twinBASIC creates for a **WithEvents** variable, which **EnumConnections** returns (see the example).
 - A sink that is already connected to the point is not connected a second time. **Advise** raises no error, returns 0, and adds nothing.
-- Passing **Nothing** ends the run with an access violation in BETA 995. The COM contract returns `E_POINTER`.
+- Passing **Nothing** is a defect in BETA 995, described in the warning below.
+
+> [!WARNING]
+> BETA 995 has a defect: **Advise** with **Nothing** as the sink ends the program with an access violation, and any unsaved data is lost. The COM contract returns `E_POINTER`. Test the sink for **Nothing** before calling **Advise**.
 
 ### Unadvise
 {: .no_toc }
@@ -141,7 +144,10 @@ Syntax: *object*.**Unadvise** *dwCookie*
 
 The connection point releases the reference it held to the sink, and the source stops calling it. An event that the source raises afterwards does not reach that sink.
 
-In twinBASIC a cookie that names no connection, 0 included, raises no error, where the COM contract reports one. A **WithEvents** variable whose connection was ended with **Unadvise** can still be set to **Nothing** without an error.
+> [!WARNING]
+> BETA 995 has a defect: **Unadvise** with a cookie that names no connection, 0 included, succeeds and does nothing, where the COM contract returns an error (`E_POINTER`). A caller that releases a connection twice, or with a wrong cookie, is told that it worked.
+
+A **WithEvents** variable whose connection was ended with **Unadvise** can still be set to **Nothing** without an error.
 
 ### EnumConnections
 {: .no_toc }
diff --git a/docs/Reference/COM-Interfaces/IDispatch.md b/docs/Reference/COM-Interfaces/IDispatch.md
index 7a8b5cb87..8867d7f9a 100644
--- a/docs/Reference/COM-Interfaces/IDispatch.md
+++ b/docs/Reference/COM-Interfaces/IDispatch.md
@@ -230,8 +230,8 @@ The four [**VbCallType**](../../tB/Modules/Constants/VbCallType) values are the
 > [!NOTE]
 > In VBA an unknown member raises error 438. In twinBASIC it raises `&H80020006`, so an error handler that tests for 438 does not catch it. This holds for objects of any origin: a twinBASIC class, a **Collection**, a **Dictionary** and a **FileSystemObject** all behave alike.
 
-> [!NOTE]
-> A call that fails inside **Invoke** can be made twice. A failed property assignment is followed by a second **Invoke** with *wFlags* 3, and **CallByName** repeats a call that returned `DISP_E_MEMBERNOTFOUND` with a null *pVarResult*. A call with more arguments than a **Sub** takes runs the **Sub**, then fails with error 13, and a late-bound statement does this twice. Code that implements **Invoke** must not change state before it can still fail.
+> [!WARNING]
+> BETA 995 has a defect: a call that fails inside **Invoke** can be made twice, so its side effects happen twice and nothing says so. VB6 makes the call once. A failed property assignment is followed by a second **Invoke** with *wFlags* 3, and **CallByName** repeats a call that returned `DISP_E_MEMBERNOTFOUND` with a null *pVarResult*. A call with more arguments than a **Sub** takes runs the **Sub**, then fails with error 13, and a late-bound statement does this twice. Code that implements **Invoke** must not change state before it can still fail.
 
 ## Classes written in twinBASIC
 
diff --git a/docs/Reference/COM-Interfaces/IErrorInfo.md b/docs/Reference/COM-Interfaces/IErrorInfo.md
index 3a3148c61..4f3140423 100644
--- a/docs/Reference/COM-Interfaces/IErrorInfo.md
+++ b/docs/Reference/COM-Interfaces/IErrorInfo.md
@@ -181,7 +181,10 @@ The object that **GetErrorInfo** returns then holds what the method gave **Raise
 - **GetHelpFile** and **GetHelpContext** return *helpfile* and *helpcontext*, and an empty string and 0 when they were omitted.
 - **GetGUID** fails with `E_NOTIMPL` (`&H80004001`): a raised error has no interface identifier.
 
-Two things about the object matter to a caller that reads it. **GetErrorInfo** empties the slot as COM requires, so a second read returns `Nothing`. And the object does not copy the values: it reads them from the **Err** object when a method is called. [**Err.Clear**](../../tB/Modules/ErrObject/Clear) empties **Err**, and an object read after it returns empty strings and 0. Read the five properties before calling anything else that clears **Err**.
+**GetErrorInfo** empties the slot as COM requires, so a second read returns `Nothing`.
+
+> [!WARNING]
+> BETA 995 has a defect: the object does not keep the values it was given, and no error tells the caller. It reads them from the **Err** object each time a method is called. [**Err.Clear**](../../tB/Modules/ErrObject/Clear) empties **Err**, so an object read after it returns empty strings and 0, and the next error changes the values to its own. COM requires an **IErrorInfo** to keep what was stored in it. Read the five properties before calling anything else that clears **Err** or raises an error.
 
 A method that handles an error itself, with [**On Error**](../../tB/Core/On-Error), still leaves the values in **Err** and a returned **IErrorInfo** that shows them, although it returns `S_OK`. A caller reads the slot only after a failure code.
 
@@ -225,7 +228,8 @@ A method can return a failure **HRESULT** without calling **SetErrorInfo**, and
 | `&H80070005` (`E_ACCESSDENIED`) | -2147024891 | `Automation error` |
 | `&H8FFF0001` (no meaning) | -1879113727 | `Automation error` |
 
-The slot is not always empty. A failed call can leave an object in it that reads from **Err**, and when **Err** has been cleared in between, that object has an empty description. **Description** is then the standard text of the code: `Unspecified error` for `E_FAIL`, `Invalid procedure call or argument` for `&H800A0005` and `Access is denied.`, in the language of the system, for `E_ACCESSDENIED`. A program that must tell failures apart reads **Number** and does not rely on **Description** for a code that arrived without information.
+> [!WARNING]
+> BETA 995 has a defect: the slot is not always empty, and no error tells the caller. A handled error leaves in it an object that reads from **Err**, even when the error was handled in twinBASIC code that never read the slot. VB6 leaves the slot empty. When **Err** has been cleared in between, that object has an empty description, so **Description** of a failure that arrived without information is the standard text of the code: `Unspecified error` for `E_FAIL`, `Invalid procedure call or argument` for `&H800A0005` and `Access is denied.`, in the language of the system, for `E_ACCESSDENIED`. A program that must tell failures apart reads **Number** and does not rely on **Description** for a code that arrived without information.
 
 ### A method that sets error information itself
 
diff --git a/docs/Reference/COM-Interfaces/IUnknown.md b/docs/Reference/COM-Interfaces/IUnknown.md
index a47a2c09d..12d843a4a 100644
--- a/docs/Reference/COM-Interfaces/IUnknown.md
+++ b/docs/Reference/COM-Interfaces/IUnknown.md
@@ -128,7 +128,10 @@ The class's `Class_Terminate` procedure runs inside the **Release** that brings
 
 A class never needs to implement **IUnknown**: the compiler gives every class an implementation, and an interface that extends **stdole.IUnknown** is satisfied without a body for those three methods.
 
-`Implements stdole.IUnknown` compiles, and the class works as before. A project's own **Interface** that carries the identifier of **IUnknown** also compiles, and a class can implement it, but the interface is unusable: **Set** to a variable of that type gives the object's ordinary **IUnknown** pointer, which has none of the interface's methods, and calling one ends in an access violation.
+`Implements stdole.IUnknown` compiles, and the class works as before. A project's own **Interface** that carries the identifier of **IUnknown** also compiles, and a class can implement it.
+
+> [!WARNING]
+> BETA 995 has a defect: that interface is unusable. **Set** to a variable of that type gives the object's ordinary **IUnknown** pointer, which has none of the interface's methods, and calling one ends the program with an access violation, and any unsaved data is lost. The compiler gives no diagnostic. Do not declare an **Interface** with the identifier of **IUnknown**; use `stdole.IUnknown`.
 
 ## Example
 
diff --git a/docs/Reference/Core/Graphics-Methods.md b/docs/Reference/Core/Graphics-Methods.md
new file mode 100644
index 000000000..3de75919a
--- /dev/null
+++ b/docs/Reference/Core/Graphics-Methods.md
@@ -0,0 +1,244 @@
+---
+title: Line, Circle, PSet, Scale
+parent: Statements
+permalink: /tB/Core/Graphics-Methods
+---
+# Line, Circle, PSet, Scale
+{: .no_toc }
+
+Turns the drawing syntax of **Line**, **Circle**, **PSet** and **Scale** into an ordinary method call with a flags argument.
+
+Drawing surfaces such as [**Form**](../Packages/VB/Form/), [**PictureBox**](../Packages/VB/PictureBox/) and [**Printer**](../Packages/VB/Printer/) take these four methods in a form that is not an ordinary argument list: the points are written `(x, y)`, two points are joined by `-`, **Step** makes a point relative, and **B** or **BF** turns a line into a box. The compiler recognises the method name, reads that syntax, and calls the method with a *Flags* value first that records which parts were written. The method receives plain numbers.
+
+Syntax:
+
+- > *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*, *Y2* ) [, [ *Color* ] [, **B** [ **F** ] ] ]
+- > *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [, [ *Start* ] [, [ *End* ] [, *Aspect* ] ] ] ]
+- > *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
+- > *object*.**Scale** [ ( *X1*, *Y1* )-( *X2*, *Y2* ) ]
+
+## The call the compiler makes
+
+Each form becomes a call with *Flags* as the first argument, followed by every remaining argument in a fixed order. A part that is left out is passed as `0`, with its flag clear, so the method can tell an omitted *Color* from a *Color* of `0`.
+
+| Method | Parameters, in order |
+|--------|----------------------|
+| **Line** | *Flags*, *X1*, *Y1*, *X2*, *Y2*, *Color* |
+| **Circle** | *Flags*, *X*, *Y*, *Radius*, *Color*, *Start*, *End*, *Aspect* |
+| **PSet** | *Flags*, *X*, *Y*, *Color* |
+| **Scale** | *Flags*, *X1*, *Y1*, *X2*, *Y2* |
+
+The coordinates, *Radius*, angles and *Aspect* are **Single** values, *Color* is a **Long**, and *Flags* is a **Long** bit mask.
+
+### The flags
+
+| Value | Name in the VB package | Set when |
+|------:|------------------------|----------|
+| 1 | StepOnFirstCoords | **Step** precedes the first point (**Line**, **PSet**, **Circle**) |
+| 2 | ColorSpecified | *Color* is written |
+| 4 | FirstCoordsSpecified | the first point of **Line** or **Scale** is written |
+| 8 | StepOnSecondCoords | **Step** precedes the second point of **Line** |
+| 16 | Box | **B** is written |
+| 32 | BoxFilled | **BF** is written |
+| 64 | StartSpecified | *Start* is written |
+| 128 | EndSpecified | *End* is written |
+| 256 | AspectSpecified | *Aspect* is written |
+
+The names belong to a private enumeration in the VB package, so code that implements these methods writes the numbers or declares its own constants. **BF** sets only 32, not 16 and 32 together.
+
+## Line
+
+The first point is optional. When it is left out, *X1* and *Y1* are passed as `0` and flag 4 is clear, which is how a method knows to start from the current position. **Step** before the first point sets flag 1, and **Step** before the second point sets flag 8.
+
+| Statement | Flags | Arguments after *Flags* |
+|-----------|------:|-------------------------|
+| `(1, 2)-(3, 4)` | 4 | `1, 2, 3, 4, 0` |
+| `(1, 2)-(3, 4), 5` | 6 | `1, 2, 3, 4, 5` |
+| `(1, 2)-(3, 4), 5, B` | 22 | `1, 2, 3, 4, 5` |
+| `(1, 2)-(3, 4), 5, BF` | 38 | `1, 2, 3, 4, 5` |
+| `(1, 2)-(3, 4), , B` | 20 | `1, 2, 3, 4, 0` |
+| `Step(1, 2)-(3, 4)` | 5 | `1, 2, 3, 4, 0` |
+| `(1, 2)-Step(3, 4)` | 12 | `1, 2, 3, 4, 0` |
+| `Step(1, 2)-Step(3, 4), 5, BF` | 47 | `1, 2, 3, 4, 5` |
+| `-(3, 4)` | 0 | `0, 0, 3, 4, 0` |
+| `-Step(3, 4)` | 8 | `0, 0, 3, 4, 0` |
+| `-(3, 4), 7, B` | 18 | `0, 0, 3, 4, 7` |
+
+**B** and **BF** are case-insensitive. They are recognised only in the slot after the colour: a local variable named `B` or `F` does not change them, and in the colour slot itself `, B` is an ordinary expression that supplies the colour.
+
+## Circle
+
+**Circle** never sets flag 4, because its centre is not optional. *Start*, *End* and *Aspect* each set their flag when written, even for a value of `0`, so a method can tell a *Start* of `0` from an omitted one. The values pass through unchanged, negative angles included.
+
+| Statement | Flags | Arguments after *Flags* |
+|-----------|------:|-------------------------|
+| `(1, 2), 3` | 0 | `1, 2, 3, 0, 0, 0, 0` |
+| `Step(1, 2), 3` | 1 | `1, 2, 3, 0, 0, 0, 0` |
+| `(1, 2), 3, 4` | 2 | `1, 2, 3, 4, 0, 0, 0` |
+| `(1, 2), 3, 4, 0.5` | 66 | `1, 2, 3, 4, 0.5, 0, 0` |
+| `(1, 2), 3, 4, 0.5, 1.5` | 194 | `1, 2, 3, 4, 0.5, 1.5, 0` |
+| `(1, 2), 3, , , 1.5` | 128 | `1, 2, 3, 0, 0, 1.5, 0` |
+| `(1, 2), 3, , , , 2.5` | 256 | `1, 2, 3, 0, 0, 0, 2.5` |
+| `(1, 2), 3, , 0` | 64 | `1, 2, 3, 0, 0, 0, 0` |
+| `Step(1, 2), 3, 4, -0.5, -1.5, 2.5` | 451 | `1, 2, 3, 4, -0.5, -1.5, 2.5` |
+
+## PSet
+
+**PSet** never sets flag 4.
+
+| Statement | Flags | Arguments after *Flags* |
+|-----------|------:|-------------------------|
+| `(1, 2)` | 0 | `1, 2, 0` |
+| `(1, 2), 5` | 2 | `1, 2, 5` |
+| `Step(1, 2)` | 1 | `1, 2, 0` |
+| `Step(1, 2), 5` | 3 | `1, 2, 5` |
+
+## Scale
+
+**Scale** takes either two points or nothing. **Step** is not accepted: `o.Scale Step(1, 2)-(3, 4)` is error TB5079.
+
+| Statement | Flags | Arguments after *Flags* |
+|-----------|------:|-------------------------|
+| `(1, 2)-(3, 4)` | 4 | `1, 2, 3, 4` |
+| *(no arguments)* | 0 | `0, 0, 0, 0` |
+
+## Any object can take the syntax
+
+The compiler reads the syntax from the method name alone: **Line**, **Circle**, **PSet** or **Scale**. It does not look at the type of the object. All of these use it:
+
+- a method of a class declared in the project, called through a variable of that class;
+- a variable declared **As Object** or **As Variant**, where the call is late-bound;
+- a variable of an **Interface** type;
+- the object of a **With** block, `Me.Line`, and a bare `Line` inside the class;
+- a **Public Sub** in a module, called bare or as `ModuleName.Line`.
+
+A method of any other name gets ordinary syntax errors: `o.Foo (1, 2)-(3, 4)` does not compile.
+
+The method must accept the whole argument list: six arguments for **Line**, eight for **Circle**, four for **PSet** and five for **Scale**. A method with fewer parameters is error TB5103, *Too many arguments*. The parameter types and **ByRef** or **ByVal** are not checked against a fixed signature; the usual conversions apply. A method with extra trailing **Optional** parameters is accepted, and they take their defaults.
+
+> [!IMPORTANT]
+> The default value of an **Optional** parameter is not used for a part that was left out. The compiler passes `0`, so a parameter declared `Optional ByVal Color As Long = vbBlack` receives `0` whether or not *Color* was written. Test *Flags* to find out what was written.
+
+The plain call forms are not rewritten. `o.Line 99, 1, 2, 3, 4, 5` and `Call o.Line(99, 1, 2, 3, 4, 5)` pass their arguments through unchanged. A trailing comma is accepted after the second point of **Line** and after the point of **PSet**, but not after the radius of **Circle**, where it is error TB5075.
+
+> [!NOTE]
+> VB6 reserves some of these names. It accepts a **Public Sub Line** in a module and a qualified call such as `Module1.Line (1, 2)-(3, 4), 5, B`, and passes the same flags as above to it. It refuses a bare `Line (1, 2)-(3, 4)` in a module, with the error *Method not valid without suitable object*, and it does not accept a procedure named **Circle**, **PSet** or **Scale** at all. In twinBASIC a procedure may have any of the four names, and a bare call in a module reaches the module's procedure.
+
+## What the built-in surfaces do with the flags
+
+The six drawing classes of the VB package implement these methods. [**Printer**](../Packages/VB/Printer/) declares its own version, with a *Flags* parameter of type **Long**, and passes each call on to the same implementation; the other five inherit one shared declaration. They act on the flags like this:
+
+- With flag 2 clear, the line, outline or point is drawn in [**ForeColor**](../Packages/VB/Form/#forecolor).
+- **Line** without flag 4 starts at (**CurrentX**, **CurrentY**). **Step** on the first point adds those values to it. **Step** on the second point is relative to the first point, or to (**CurrentX**, **CurrentY**) when there is no first point. Afterwards (**CurrentX**, **CurrentY**) is the end point.
+- **B** draws a rectangle outline using [**FillColor**](../Packages/VB/Form/#fillcolor) and [**FillStyle**](../Packages/VB/Form/#fillstyle) for the interior. **BF** draws a solid rectangle in the line colour.
+- **PSet** with **Step** adds (**CurrentX**, **CurrentY**) to the point. Afterwards (**CurrentX**, **CurrentY**) is the point.
+- **Circle** with **Step** adds (**CurrentX**, **CurrentY**) to the centre, and afterwards (**CurrentX**, **CurrentY**) is the centre. Without *Start* and *End* it draws a full ellipse, filled with [**FillColor**](../Packages/VB/Form/#fillcolor) and [**FillStyle**](../Packages/VB/Form/#fillstyle). *Start* and *End* are angles in radians, counter-clockwise from the 3 o'clock position. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. When both are negative the shape is a pie, filled like the ellipse; an arc with one radius or none is not filled. A negative zero is zero and draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5 and draws nothing. With flag 256 clear, *Aspect* is ignored.
+
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*. VB6 raises error 5 for an angle above 2 pi and draws nothing. BETA 995 raises no error and draws the arc as if 2 pi had been subtracted, so `Form1.Circle (100, 100), 50, , 7, 1` draws a short arc where VB6 stops with an error. Keep both angles between -2 pi and 2 pi.
+
+For example, after `Form1.PSet (100, 100)` followed by `Form1.PSet Step(3, 4)`, the position is (103, 104). A call through an **As Object** variable draws in the same way.
+
+The full description of each method on each class is in that class's own section: [**Line**](../Packages/VB/Form/#line), [**Circle**](../Packages/VB/Form/#circle), [**PSet**](../Packages/VB/Form/#pset) and [**Scale**](../Packages/VB/Form/#scale) on **Form**, and the same sections on the other five.
+
+## Colour values
+
+The built-in surfaces read *Color* as a **Long**. When *Color* is left out they read [**ForeColor**](../Packages/VB/Form/#forecolor) in the same way. A **Double** or **String** argument is converted to **Long** first, as for any **Long** parameter: `255.7` draws as 256, `"255"` draws as 255, a value beyond the **Long** range raises error 6, and a **String** that is not a number raises error 13. The top byte of the **Long** then decides what the value means:
+
+- **&H80**: a system colour. A value from `&H80000000` to `&H8000001E` draws the current system colour of that index, as **GetSysColor** returns it, so `vbButtonFace` (`&H8000000F`) draws in the colour of a button face. Any other value with `&H80` as its top byte, such as `&H8000001F` or `&H80010003`, draws black.
+- **Any other top byte**: an RGB colour held in the low 24 bits as `&HBBGGRR`. The top byte is ignored, so `-1` and `&H7FFFFFFF` draw white, `&H1000000` draws black and `&H10000FF` draws red. No such value raises an error.
+
+The line of a **Line** and the fill of **BF** use the same rule, as does the circle of **Circle** and the point of **PSet**. Since BETA 984 an out-of-range value draws instead of raising an error: in BETA 983, a value such as `-1`, a top byte other than 0, 1, 2 or `&H80`, or a system colour index above 30 raised error 5.
+
+> [!WARNING]
+> BETA 995 has a defect in system colours. VB6 takes the system colour index from the low 16 bits of the value, so that `&H80010003` draws system colour 3 and `&H80FF000F` draws system colour 15. BETA 995 draws both black, without raising an error, because it reads the value as a system colour only when it lies between `&H80000000` and `&H8000001E`. BETA 983 drew them as VB6 does. Pass a system colour as one of the `vb` constants, such as `vbButtonFace`, or as `&H800000nn` with nothing in the second and third bytes.
+
+> [!NOTE]
+> VB6 draws `&H80000019` to `&H8000001E` black, where twinBASIC draws the system colour of that index. The rest of the rule, including the truncation of every other value to 24 bits, is the same.
+
+## Example
+
+This example is a class that is not a drawing surface. **Plotter** implements **Line**, **Circle** and **PSet** as ordinary methods that print what they receive, so the program shows the *Flags* value and the arguments that each form of the syntax produces.
+
+```tb check_build projname=graphics-plotter slot=file
+Class Plotter
+    Public Sub Line(ByVal Flags As Long, ByVal X1 As Single, ByVal Y1 As Single, _
+                    ByVal X2 As Single, ByVal Y2 As Single, ByVal Color As Long)
+        Debug.Print "Line F=" & Flags & " (" & X1 & "," & Y1 & ")-(" & X2 & "," & Y2 & ") C=" & Color
+    End Sub
+
+    Public Sub Circle(ByVal Flags As Long, ByVal X As Single, ByVal Y As Single, ByVal Radius As Single, _
+                      ByVal Color As Long, ByVal Start As Single, ByVal ArcEnd As Single, ByVal Aspect As Single)
+        Debug.Print "Circle F=" & Flags & " (" & X & "," & Y & ") R=" & Radius & " C=" & Color & _
+                    " S=" & Start & " E=" & ArcEnd & " A=" & Aspect
+    End Sub
+
+    Public Sub PSet(ByVal Flags As Long, ByVal X As Single, ByVal Y As Single, ByVal Color As Long)
+        Debug.Print "PSet F=" & Flags & " (" & X & "," & Y & ") C=" & Color
+    End Sub
+End Class
+```
+
+```tb check_run projname=graphics-plotter
+Dim p As New Plotter
+
+p.Line (1, 2)-(3, 4)
+p.Line (1, 2)-(3, 4), 5, BF
+p.Line Step(1, 2)-Step(3, 4), , B
+p.Line -(3, 4), 7
+p.Line 99, 1, 2, 3, 4, 5
+
+p.Circle (1, 2), 3
+p.Circle Step(1, 2), 3, 4, 0.5, 1.5, 2.5
+
+p.PSet (1, 2)
+p.PSet Step(1, 2), 5
+' Output:
+' Line F=4 (1,2)-(3,4) C=0
+' Line F=38 (1,2)-(3,4) C=5
+' Line F=29 (1,2)-(3,4) C=0
+' Line F=2 (0,0)-(3,4) C=7
+' Line F=99 (1,2)-(3,4) C=5
+' Circle F=0 (1,2) R=3 C=0 S=0 E=0 A=0
+' Circle F=451 (1,2) R=3 C=4 S=0.5 E=1.5 A=2.5
+' PSet F=0 (1,2) C=0
+' PSet F=3 (1,2) C=5
+```
+
+### Reading back what a surface drew
+
+This example draws on **Form1**, a form with no controls, and reads single pixels back to show what a negative angle does. **Point** is not implemented in twinBASIC (see [**Point**](../Packages/VB/Form/#point)), which is why the example reads pixels with the Windows **GetPixel** function, declared in a module of its own.
+
+```tb check_build projname=graphics-pixels project=form slot=file
+Module PixelReader
+    Public Declare PtrSafe Function GetPixel Lib "gdi32" (ByVal hdc As LongPtr, ByVal x As Long, ByVal y As Long) As Long
+End Module
+```
+
+The pixel at (100, 75) is half-way along the radius from the centre (100, 100) to the 12 o'clock position, an angle of pi/2. It is red when *Start* and *End* are negative, because a negative angle draws the radius to that end of the arc, and it is not red when they are positive. The last call has an angle below -2 pi, which raises error 5.
+
+```tb check_run projname=graphics-pixels project=form
+Const Pi As Double = 3.14159265358979
+Load Form1
+Form1.ScaleMode = vbPixels
+Form1.AutoRedraw = True
+Form1.BackColor = vbWhite
+
+Form1.Circle (100, 100), 50, vbRed, Pi / 4, Pi / 2
+Debug.Print GetPixel(Form1.hDC, 100, 75) = vbRed    ' False
+
+Form1.Cls
+Form1.Circle (100, 100), 50, vbRed, -Pi / 4, -Pi / 2
+Debug.Print GetPixel(Form1.hDC, 100, 75) = vbRed    ' True
+
+On Error Resume Next
+Form1.Circle (100, 100), 50, vbRed, -7, 1
+Debug.Print Err.Number                              ' 5
+```
+
+## See Also
+
+- [**Form**](../Packages/VB/Form/#line) class -- the **Line**, **Circle**, **PSet** and **Scale** methods
+- [**PictureBox**](../Packages/VB/PictureBox/#line), [**Printer**](../Packages/VB/Printer/#line), [**UserControl**](../Packages/VB/UserControl/#line), [**PropertyPage**](../Packages/VB/PropertyPage/#line) and [**Report**](../Packages/VB/Report/#line) classes -- the other drawing surfaces
+- [**Print** statement](Print) -- the other language-level syntax a drawing surface accepts
+- [**CurrentX**](../Packages/VB/Form/#currentx), [**CurrentY**](../Packages/VB/Form/#currenty) properties -- the drawing position these methods read and set
diff --git a/docs/Reference/Core/LSet.md b/docs/Reference/Core/LSet.md
index b5e095df1..e32a009b8 100644
--- a/docs/Reference/Core/LSet.md
+++ b/docs/Reference/Core/LSet.md
@@ -29,6 +29,16 @@ Syntax:
 
 If *string* is longer than *stringvar*, **LSet** places only the leftmost characters, up to the length of the *stringvar*, in *stringvar*.
 
+**LSet** never changes the length of *stringvar*, so a *stringvar* of zero length stays empty. *stringvar* can be a variable-length string, a fixed-length string, or a **Variant** that holds a string. A *string* that is **Null** raises error 94.
+
+> [!WARNING]
+> BETA 995 has a defect: **LSet** on an element of a **Variant** that holds an array, such as `LSet v(0) = "zz"` with `v = Array("0123456789", "abcde")` or a **Variant** that was given its bounds with **ReDim**, changes nothing and raises no error. VB6 changes the element. An element of an array declared `Dim w(0 To 1) As Variant` works. To change an element of a **Variant** array, copy it to a **String** variable, use **LSet** on the variable and assign the variable back.
+
+> [!NOTE]
+> Since BETA 984, **LSet** fills the leftover characters with spaces as described above. In BETA 983 and earlier it left the old characters of *stringvar* in place, so `LSet s = "ab"` on `"0123456789"` gave `"ab23456789"`.
+
+When copying between user-defined types, **LSet** copies as many bytes as the smaller of the two types holds. If *varname1* is larger than *varname2*, its bytes beyond the end of the source keep their old values. Both types must be free of variable-length **String**, **Variant**, **Object** and dynamic-array fields; the compiler refuses the statement otherwise (error TB5249). Fixed-length **String** fields are allowed.
+
 > [!WARNING]
 > Using **LSet** to copy a variable of one user-defined type into a variable of a different user-defined type is not recommended. Copying data of one data type into space reserved for a different data type can cause unpredictable results. When a variable is copied from one user-defined type to another, the binary data from one variable is copied into the memory space of the other, without regard for the data types specified for the elements.
 
@@ -42,6 +52,44 @@ MyString = "0123456789" ' Initialize string.
 LSet MyString = "<-Left" ' MyString contains "<-Left    ".
 ```
 
+This example shows the padding, the truncation, a fixed-length string and an empty destination.
+
+```tb check_run
+Dim s As String
+Dim fixed As String * 5
+s = "0123456789"
+LSet s = "ab"
+Debug.Print "[" & s & "]"        ' [ab        ]
+LSet s = "abcdefghijklm"
+Debug.Print "[" & s & "]"        ' [abcdefghij]
+fixed = "01234"
+LSet fixed = "ab"
+Debug.Print "[" & fixed & "]"    ' [ab   ]
+s = ""
+LSet s = "abc"
+Debug.Print Len(s)               ' 0
+```
+
+This example copies a **Long** into a pair of **Integer** values of a different type. The low half of the **Long** becomes the first **Integer**.
+
+```tb check_build
+Private Type Whole
+    Value As Long
+End Type
+
+Private Type Pair
+    Lo As Integer
+    Hi As Integer
+End Type
+
+Private Sub Demo()
+    Dim w As Whole, p As Pair
+    w.Value = &H12345678
+    LSet p = w
+    Debug.Print Hex$(p.Lo), Hex$(p.Hi)   ' 5678  1234
+End Sub
+```
+
 ### See Also
 
 - [**RSet** statement](RSet)
diff --git a/docs/Reference/Core/RSet.md b/docs/Reference/Core/RSet.md
index b2207c1e3..a99e10543 100644
--- a/docs/Reference/Core/RSet.md
+++ b/docs/Reference/Core/RSet.md
@@ -20,8 +20,15 @@ Syntax:
 
 If *stringvar* is longer than *string*, **RSet** replaces any leftover characters in *stringvar* with spaces, back to its beginning.
 
+If *string* is longer than *stringvar*, **RSet** places only the leftmost characters, up to the length of *stringvar*, in *stringvar*. The rightmost characters of *string* are the ones dropped, as with [**LSet**](LSet).
+
+**RSet** never changes the length of *stringvar*, so a *stringvar* of zero length stays empty. *stringvar* can be a variable-length string, a fixed-length string, or a **Variant** that holds a string. A *string* that is **Null** raises error 94.
+
+> [!WARNING]
+> BETA 995 has a defect: **RSet** on an element of a **Variant** that holds an array, such as `RSet v(1) = "zz"` with `v = Array("0123456789", "abcde")` or a **Variant** that was given its bounds with **ReDim**, changes nothing and raises no error. VB6 changes the element. An element of an array declared `Dim w(0 To 1) As Variant` works. To change an element of a **Variant** array, copy it to a **String** variable, use **RSet** on the variable and assign the variable back.
+
 > [!NOTE]
-> **RSet** can't be used with user-defined types.
+> **RSet** can't be used with user-defined types. The compiler refuses the statement.
 
 ### Example
 
@@ -33,6 +40,24 @@ MyString = "0123456789"   ' Initialize string.
 RSet MyString = "Right->" ' MyString contains "   Right->".
 ```
 
+This example shows the padding, the truncation, a fixed-length string and an empty destination.
+
+```tb check_run
+Dim s As String
+Dim fixed As String * 5
+s = "0123456789"
+RSet s = "ab"
+Debug.Print "[" & s & "]"        ' [        ab]
+RSet s = "abcdefghijklm"
+Debug.Print "[" & s & "]"        ' [abcdefghij]
+fixed = "01234"
+RSet fixed = "ab"
+Debug.Print "[" & fixed & "]"    ' [   ab]
+s = ""
+RSet s = "abc"
+Debug.Print Len(s)               ' 0
+```
+
 ### See Also
 
 - [**LSet** statement](LSet)
diff --git a/docs/Reference/Default/VB/CheckBox/index.md b/docs/Reference/Default/VB/CheckBox/index.md
index 861df4339..d0fe4d6da 100644
--- a/docs/Reference/Default/VB/CheckBox/index.md
+++ b/docs/Reference/Default/VB/CheckBox/index.md
@@ -80,6 +80,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour, as an **OLE_COLOR**. Defaults to the system 3-D face colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Caption
 {: .no_toc }
 
@@ -142,6 +145,9 @@ The **StdFont** used to render [**Caption**](#caption). The convenience properti
 
 The text colour for the caption, as an **OLE_COLOR**. Defaults to the system button-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/CheckMark/index.md b/docs/Reference/Default/VB/CheckMark/index.md
index 6aa12539a..5b33b55b7 100644
--- a/docs/Reference/Default/VB/CheckMark/index.md
+++ b/docs/Reference/Default/VB/CheckMark/index.md
@@ -72,6 +72,9 @@ How the glyph is shaded when [**VisualStyles**](#visualstyles) is **False**. A m
 
 The background colour, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Used only when [**BackStyle**](#backstyle) is **vbBFOpaque**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. Check a colour that comes from user input before assigning it.
+
 ### BackStyle
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/ComboBox/index.md b/docs/Reference/Default/VB/ComboBox/index.md
index e05566a7a..026cd889f 100644
--- a/docs/Reference/Default/VB/ComboBox/index.md
+++ b/docs/Reference/Default/VB/ComboBox/index.md
@@ -75,6 +75,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The colour of the edit area and the list background, as an **OLE_COLOR**. Defaults to the system window-background colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -115,6 +118,9 @@ The **StdFont** used to render text in the edit area and the drop-down list. The
 
 The text colour, as an **OLE_COLOR**. Defaults to the system window-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/CommandButton/index.md b/docs/Reference/Default/VB/CommandButton/index.md
index 80a715917..70054e74e 100644
--- a/docs/Reference/Default/VB/CommandButton/index.md
+++ b/docs/Reference/Default/VB/CommandButton/index.md
@@ -65,6 +65,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Honoured only when [**Style**](#style) is **vbButtonGraphical** --- the standard Win32 button always paints with the theme colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Cancel
 {: .no_toc }
 
@@ -127,6 +130,9 @@ The **StdFont** used to render [**Caption**](#caption). The convenience properti
 
 The text colour for the caption, as an **OLE_COLOR**. Defaults to the system button-text colour. Honoured only when [**Style**](#style) is **vbButtonGraphical**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/Data/index.md b/docs/Reference/Default/VB/Data/index.md
index 0f3da6c0a..63db2d49c 100644
--- a/docs/Reference/Default/VB/Data/index.md
+++ b/docs/Reference/Default/VB/Data/index.md
@@ -80,6 +80,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The fill colour of the band behind the [**Caption**](#caption), as an **OLE_COLOR**. Defaults to the system window-background colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. Check a colour that comes from user input before assigning it.
+
 ### BOFAction
 {: .no_toc }
 
@@ -162,6 +165,9 @@ The **StdFont** used to render [**Caption**](#caption). The convenience properti
 
 The text colour for the caption, as an **OLE_COLOR**. Defaults to the system window-text colour. A disabled control draws the caption in the system grey-text colour instead.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/DirListBox/index.md b/docs/Reference/Default/VB/DirListBox/index.md
index ad415afb0..1f34ee573 100644
--- a/docs/Reference/Default/VB/DirListBox/index.md
+++ b/docs/Reference/Default/VB/DirListBox/index.md
@@ -66,6 +66,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour, as an **OLE_COLOR**. Defaults to the system window-background colour. Used as the fill behind every list item except the selected one (which paints with the system highlight colour).
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -106,6 +109,9 @@ The **StdFont** used to render directory names. The convenience properties **Fon
 
 The text colour for entries that are not currently selected, as an **OLE_COLOR**. Defaults to the system window-text colour. Disabled entries draw in the system grey-text colour, and selected entries draw in the system highlight-text colour, regardless of this setting.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/DriveListBox/index.md b/docs/Reference/Default/VB/DriveListBox/index.md
index 3d1a9b287..802d91e27 100644
--- a/docs/Reference/Default/VB/DriveListBox/index.md
+++ b/docs/Reference/Default/VB/DriveListBox/index.md
@@ -66,6 +66,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour of the drop-down list entries, as an **OLE_COLOR**. Defaults to the system window-background colour. Selected entries paint with the system highlight colour regardless of this setting. Changing this calls [**Refresh**](#refresh) so the new colour takes effect immediately.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### CausesValidation
 {: .no_toc }
 
@@ -110,6 +113,9 @@ The **StdFont** used to render the drive entries. The convenience properties **F
 
 The text colour for entries that are not currently selected, as an **OLE_COLOR**. Defaults to the system window-text colour. Disabled entries draw in the system grey-text colour, and selected entries draw in the system highlight-text colour, regardless of this setting. Changing this calls [**Refresh**](#refresh).
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/FileListBox/index.md b/docs/Reference/Default/VB/FileListBox/index.md
index 4afe1c516..59bb77fd2 100644
--- a/docs/Reference/Default/VB/FileListBox/index.md
+++ b/docs/Reference/Default/VB/FileListBox/index.md
@@ -93,6 +93,9 @@ When **True** (default), files with the archive attribute are included in the li
 
 The background colour, as an **OLE_COLOR**. Defaults to the system window-background colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -142,6 +145,9 @@ The **StdFont** used to render file names. The convenience properties **FontName
 
 The text colour for entries that are not currently selected, as an **OLE_COLOR**. Defaults to the system window-text colour. Disabled entries draw in the system grey-text colour, and selected entries draw in the system highlight-text colour, regardless of this setting.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/Form/index.md b/docs/Reference/Default/VB/Form/index.md
index 215d95326..0117421d6 100644
--- a/docs/Reference/Default/VB/Form/index.md
+++ b/docs/Reference/Default/VB/Form/index.md
@@ -149,6 +149,9 @@ When **False**, drawing primitives --- [**Cls**](#cls), [**Circle**](#circle), [
 
 The background colour of the form's client area, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Used as the fill colour for [**Cls**](#cls) and as the canvas behind [**Picture**](#picture).
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -240,6 +243,9 @@ Determines whether the form accepts user input. A disabled form ignores keyboard
 
 The fill colour for closed shapes drawn by [**Circle**](#circle) and the rectangle form of [**Line**](#line) without **F**. **OLE_COLOR**, default `0` (black). Used only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -260,6 +266,9 @@ When **True** (default), text drawn on the form has a transparent background, le
 
 The pen colour used by [**Circle**](#circle), [**Line**](#line), [**PSet**](#pset), and the text drawn by [**Print**](#print). **OLE_COLOR**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### hDC
 {: .no_toc }
 
@@ -510,6 +519,8 @@ Draws a circle, ellipse, or arc on the form using [**ForeColor**](#forecolor) fo
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [, [ *Start* ] [, [ *End* ] [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* The centre, in [**ScaleMode**](#scalemode) units. **Step** makes the centre relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
@@ -517,14 +528,38 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [
 : *required* A **Single** giving the radius in **ScaleMode** units.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Angles in radians, used to draw an arc rather than a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* Ratio of vertical to horizontal radius. `1.0` is circular; values away from `1.0` produce ellipses.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
+This example draws a filled pie slice on **Form1** and reads a pixel inside it. **Point** is not implemented in twinBASIC (see [**Point**](#point)), so the example reads the pixel with the Windows **GetPixel** function, declared in a module of its own.
+
+```tb check_build projname=form-circle-pixel project=form slot=file
+Module PixelReader
+    Public Declare PtrSafe Function GetPixel Lib "gdi32" (ByVal hdc As LongPtr, ByVal x As Long, ByVal y As Long) As Long
+End Module
+```
+
+```tb check_run projname=form-circle-pixel project=form
+Const Pi As Double = 3.14159265358979
+Load Form1
+Form1.ScaleMode = vbPixels
+Form1.AutoRedraw = True
+Form1.BackColor = vbWhite
+Form1.FillStyle = vbFSSolid
+Form1.FillColor = vbRed
+Form1.Circle (100, 100), 50, vbBlue, -Pi / 4, -Pi / 2
+Debug.Print GetPixel(Form1.hDC, 110, 77) = vbRed   ' True
+Unload Form1
+```
+
 ### Cls
 {: .no_toc }
 
@@ -553,6 +588,8 @@ Draws a line, or a rectangle, on the form using [**ForeColor**](#forecolor) (or
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*, *Y2* ) [, [ *Color* ] [, **B** [ **F** ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* The start point, in [**ScaleMode**](#scalemode) units. **Step** makes the point relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)). When omitted, drawing begins from the current pen position.
 
@@ -560,7 +597,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*,
 : *required* The end point, in **ScaleMode** units. **Step** makes the point relative to (*X1*, *Y1*).
 
 *Color*
-: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 **B**
 : *optional* Draw a rectangle whose opposite corners are (*X1*, *Y1*) and (*X2*, *Y2*) instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -636,7 +673,7 @@ Syntax: *object*.**PopUpMenu** *Menu* [, *Flags* [, *X* [, *Y* [, *DefaultMenu*
 {: .no_toc }
 
 > [!NOTE]
-> Reserved for compatibility with VB6; not currently implemented in twinBASIC. In VB6 this returns the **OLE_COLOR** of a single pixel of the drawing surface.
+> Not implemented in twinBASIC: **Point** returns 0 whatever the pixel, and the compiler gives warning TB0009 at each call. In VB6 it returns the **OLE_COLOR** of a single pixel of the drawing surface, or -1 for a point outside it. To read a pixel, call the Windows **GetPixel** function on the [**hDC**](#hdc), with the coordinates in pixels.
 
 Syntax: *object*.**Point**( *X*, *Y* )
 
@@ -677,11 +714,13 @@ Sets a single pixel on the form to a specified colour.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* The pixel position, in [**ScaleMode**](#scalemode) units. **Step** makes the position relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
 *Color*
-: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 ### Refresh
 {: .no_toc }
@@ -693,10 +732,12 @@ Syntax: *object*.**Refresh**
 ### Scale
 {: .no_toc }
 
-Sets the form's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets the rectangle to a 1-to-1 mapping with the client area in pixels.
+Sets the form's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets [**ScaleMode**](#scalemode) to **vbTwips**, with [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop) at 0.
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* )-( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *optional* The logical coordinate at the top-left corner.
 
diff --git a/docs/Reference/Default/VB/Frame/index.md b/docs/Reference/Default/VB/Frame/index.md
index 1bd04d1c0..dc398cf20 100644
--- a/docs/Reference/Default/VB/Frame/index.md
+++ b/docs/Reference/Default/VB/Frame/index.md
@@ -77,6 +77,9 @@ Determines how the frame's border is drawn by the OS. A member of [**AppearanceC
 
 The background colour of the frame's client area, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Painted behind contained controls.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -166,6 +169,9 @@ Shortcut for `Font.Underline`. **Boolean**.
 
 The colour used to draw [**Caption**](#caption), as an **OLE_COLOR**. Defaults to the system button-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/Label/index.md b/docs/Reference/Default/VB/Label/index.md
index cbc41abcf..3660794d6 100644
--- a/docs/Reference/Default/VB/Label/index.md
+++ b/docs/Reference/Default/VB/Label/index.md
@@ -126,6 +126,9 @@ Whether the label resizes itself to fit its [**Caption**](#caption), [**Font**](
 
 The colour painted behind the caption when [**BackStyle**](#backstyle) is **vbBFOpaque**. **OLE_COLOR**, defaults to the system 3-D face colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BackStyle
 {: .no_toc }
 
@@ -264,6 +267,9 @@ Shortcut for `Font.Underline`. **Boolean**.
 
 The text colour for [**Caption**](#caption), as an **OLE_COLOR**. Defaults to the system button-text colour. Replaced with the system grey-text colour when [**Enabled**](#enabled) is **False**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/ListBox/index.md b/docs/Reference/Default/VB/ListBox/index.md
index a546c71df..d131fc00e 100644
--- a/docs/Reference/Default/VB/ListBox/index.md
+++ b/docs/Reference/Default/VB/ListBox/index.md
@@ -108,6 +108,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour of the list area, as an **OLE_COLOR**. Defaults to the system window-background colour. Items drawn in the selected state ignore **BackColor** in favour of the system highlight colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -194,6 +197,9 @@ The **StdFont** used to render item text. The convenience properties **FontName*
 
 The text colour for entries that are not currently selected, as an **OLE_COLOR**. Defaults to the system window-text colour. Disabled entries draw in the system grey-text colour, and selected entries draw in the system highlight-text colour, regardless of this setting.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/MultiFrame/index.md b/docs/Reference/Default/VB/MultiFrame/index.md
index f2ecc4a5a..80df83e52 100644
--- a/docs/Reference/Default/VB/MultiFrame/index.md
+++ b/docs/Reference/Default/VB/MultiFrame/index.md
@@ -78,6 +78,9 @@ The set of edges of the parent that the **MultiFrame**'s corresponding edges fol
 
 The background colour of the **MultiFrame**'s drawing surface, as an **OLE_COLOR**. Defaults to the system window-background colour. Visible only where the contained frames do not fully cover the extent --- e.g. when their **MultiFrameSize**s sum to less than 100%.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. Check a colour that comes from user input before assigning it.
+
 ### Container
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/OLE/index.md b/docs/Reference/Default/VB/OLE/index.md
index 28391709e..3451faf16 100644
--- a/docs/Reference/Default/VB/OLE/index.md
+++ b/docs/Reference/Default/VB/OLE/index.md
@@ -107,6 +107,9 @@ When **True** (default), right-clicking the container automatically pops up a me
 
 The background colour, as an **OLE_COLOR**. Defaults to the system window-background colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BackStyle
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/OptionButton/index.md b/docs/Reference/Default/VB/OptionButton/index.md
index 0edf4b54e..e3282cfbc 100644
--- a/docs/Reference/Default/VB/OptionButton/index.md
+++ b/docs/Reference/Default/VB/OptionButton/index.md
@@ -84,6 +84,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour, as an **OLE_COLOR**. Defaults to the system 3-D face colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Caption
 {: .no_toc }
 
@@ -146,6 +149,9 @@ The **StdFont** used to render [**Caption**](#caption). The convenience properti
 
 The text colour for the caption, as an **OLE_COLOR**. Defaults to the system button-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/PictureBox/index.md b/docs/Reference/Default/VB/PictureBox/index.md
index 8dbdd7622..25c090b7a 100644
--- a/docs/Reference/Default/VB/PictureBox/index.md
+++ b/docs/Reference/Default/VB/PictureBox/index.md
@@ -103,6 +103,9 @@ When **True**, the control resizes itself to fit the assigned [**Picture**](#pic
 
 The background colour of the control's drawing surface, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Assigning a new value invalidates the surface and triggers a repaint.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -203,6 +206,9 @@ Determines whether the control accepts user input. **Boolean**, default **True**
 
 The colour used to fill closed shapes drawn by [**Line**](#line) with **B** and without **F**, and by [**Circle**](#circle), as an **OLE_COLOR**. Default **0** (black). Honoured only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -253,6 +259,9 @@ Shortcut for [**Font**](#font)`.Underline`. **Boolean**.
 
 The colour used by the graphics-method pen (lines, circles, points) and by [**Print**](#print) text, as an **OLE_COLOR**. Defaults to the system button-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### HasDC
 {: .no_toc }
 
@@ -453,6 +462,8 @@ Draws a circle, ellipse, or elliptical arc on the drawing surface.
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, *Color* [, *Start* [, *End* [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* Coordinates of the centre in [**ScaleMode**](#scalemode) units. **Single**. When prefixed with **Step**, they are interpreted relative to [**CurrentX**](#currentx) / [**CurrentY**](#currenty).
 
@@ -460,14 +471,17 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, *Color* [, *S
 : *required* The radius along the X axis. **Single**.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Start and end angles in radians (0 to 2π). Negative values are interpreted as full radians and connect the arc end-point to the centre with a chord. Omitted draws a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* The Y/X aspect ratio. **1.0** for a circle (default); other values give an ellipse.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
 [**CurrentX**](#currentx) and [**CurrentY**](#currenty) are left at the centre.
 
 ### Cls
@@ -494,6 +508,8 @@ Draws a straight line, a rectangle outline, or a filled rectangle.
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] **-** [ **Step** ] ( *X2*, *Y2* ) [, *Color* [, **B** [**F**] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* Start coordinates. **Single**. If omitted, the line starts at [**CurrentX**](#currentx) / [**CurrentY**](#currenty). **Step** makes them relative to the current pen position.
 
@@ -501,7 +517,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] **-** [ **Step** ] ( *
 : *required* End coordinates. **Single**. **Step** makes them relative to the start point.
 
 *Color*
-: *optional* An **OLE_COLOR** for the line. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *B*
 : *optional* When present, draws a rectangle whose opposite corners are *(X1, Y1)* and *(X2, Y2)* instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -560,9 +576,7 @@ Syntax: *object*.**PaintPicture** *Picture*, *X1*, *Y1* [, *Width1* [, *Height1*
 {: .no_toc }
 
 > [!NOTE]
-> Reserved for compatibility with VB6; not currently implemented in twinBASIC.
-
-In VB6, returns the colour of the pixel at the given coordinates as a **Long**, or **-1** if the point is outside the drawing surface.
+> Not implemented in twinBASIC: **Point** returns 0 whatever the pixel, and the compiler gives warning TB0009 at each call. In VB6 it returns the **OLE_COLOR** of a single pixel of the drawing surface, or -1 for a point outside it. To read a pixel, call the Windows **GetPixel** function on the [**hDC**](#hdc), with the coordinates in pixels.
 
 Syntax: *object*.**Point**( *X* **As Single**, *Y* **As Single** ) **As Long**
 
@@ -582,11 +596,13 @@ Sets a single pixel.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* Coordinates in [**ScaleMode**](#scalemode) units. **Step** makes them relative to [**CurrentX**](#currentx) / [**CurrentY**](#currenty).
 
 *Color*
-: *optional* An **OLE_COLOR**. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 [**CurrentX**](#currentx) / [**CurrentY**](#currenty) are left at the set point.
 
@@ -604,6 +620,8 @@ Defines a user coordinate system for the surface. Calling **Scale** with no argu
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* ) **-** ( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *required* (with the second pair) The coordinate that maps to the top-left corner --- sets [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop).
 
diff --git a/docs/Reference/Default/VB/Printer/index.md b/docs/Reference/Default/VB/Printer/index.md
index 098a1a3a5..48a5a7c2d 100644
--- a/docs/Reference/Default/VB/Printer/index.md
+++ b/docs/Reference/Default/VB/Printer/index.md
@@ -147,6 +147,9 @@ Syntax: *object*.**Duplex** [ = *value* ]
 
 The colour used to fill closed shapes drawn by [**Line**](#line) with **B** and without **F**, and by [**Circle**](#circle), as an **OLE_COLOR**. Default **0** (black). Honoured only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -214,6 +217,9 @@ Shortcut for [**Font**](#font)`.Underline`. **Boolean**.
 
 The colour used by the drawing-method pen (lines, circles, points) and by [**Print**](#print) text. **OLE_COLOR**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### hDC
 {: .no_toc }
 
@@ -348,6 +354,8 @@ Draws a circle, ellipse, or elliptical arc on the current page.
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, *Color* [, *Start* [, *End* [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* Coordinates of the centre in [**ScaleMode**](#scalemode) units. **Single**. **Step** makes them relative to [**CurrentX**](#currentx) / [**CurrentY**](#currenty).
 
@@ -355,14 +363,17 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, *Color* [, *S
 : *required* The radius along the X axis. **Single**.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Start and end angles in radians (0 to 2π). Negative values connect the arc end-point to the centre with a chord. Omitted draws a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* The Y/X aspect ratio. **1.0** for a circle (default); other values give an ellipse.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
 If no job is in progress, **Circle** implicitly starts one.
 
 ### EndDoc
@@ -386,6 +397,8 @@ Draws a straight line, a rectangle outline, or a filled rectangle.
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] **-** [ **Step** ] ( *X2*, *Y2* ) [, *Color* [, **B** [**F**] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* Start coordinates. **Single**. If omitted, the line starts at [**CurrentX**](#currentx) / [**CurrentY**](#currenty). **Step** makes them relative to the pen.
 
@@ -393,7 +406,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] **-** [ **Step** ] ( *
 : *required* End coordinates. **Single**. **Step** makes them relative to the start point.
 
 *Color*
-: *optional* An **OLE_COLOR** for the line. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *B*
 : *optional* Draws a rectangle whose opposite corners are *(X1, Y1)* and *(X2, Y2)* instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -450,11 +463,13 @@ Sets a single pixel on the current page.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* Coordinates in [**ScaleMode**](#scalemode) units. **Single**. **Step** makes them relative to [**CurrentX**](#currentx) / [**CurrentY**](#currenty).
 
 *Color*
-: *optional* An **OLE_COLOR**. Defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**. Defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 If no job is in progress, **PSet** implicitly starts one.
 
@@ -465,6 +480,8 @@ Defines a user coordinate system for the page. Calling **Scale** with no argumen
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* ) **-** ( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *required* (with the second pair) The coordinate that maps to the top-left corner --- sets [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop).
 
diff --git a/docs/Reference/Default/VB/PropertyPage/index.md b/docs/Reference/Default/VB/PropertyPage/index.md
index 100a2e84d..71d22040d 100644
--- a/docs/Reference/Default/VB/PropertyPage/index.md
+++ b/docs/Reference/Default/VB/PropertyPage/index.md
@@ -96,6 +96,9 @@ When **False**, drawing primitives --- [**Cls**](#cls), [**Circle**](#circle), [
 
 The background colour of the page's client area, as an **OLE_COLOR**. Defaults to the system 3-D face colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Caption
 {: .no_toc }
 
@@ -179,6 +182,9 @@ The pen width in pixels for drawing primitives. **Long**, default `1`. Widths gr
 
 The fill colour for closed shapes drawn by [**Circle**](#circle) and the rectangle form of [**Line**](#line) without **F**. **OLE_COLOR**, default `0` (black). Used only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -229,6 +235,9 @@ Shortcut for [**Font**](#font)`.Underline`. **Boolean**.
 
 The pen colour used by [**Circle**](#circle), [**Line**](#line), [**PSet**](#pset), and the text drawn by [**Print**](#print). **OLE_COLOR**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### HasDC
 {: .no_toc }
 
@@ -390,6 +399,8 @@ Draws a circle, ellipse, or arc on the page using [**ForeColor**](#forecolor) fo
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [, [ *Start* ] [, [ *End* ] [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* The centre, in [**ScaleMode**](#scalemode) units. **Step** makes the centre relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
@@ -397,14 +408,17 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [
 : *required* A **Single** giving the radius in **ScaleMode** units.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Angles in radians, used to draw an arc rather than a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* Ratio of vertical to horizontal radius. `1.0` is circular; values away from `1.0` produce ellipses.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
 ### Cls
 {: .no_toc }
 
@@ -419,6 +433,8 @@ Draws a line, or a rectangle, on the page using [**ForeColor**](#forecolor) (or
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*, *Y2* ) [, [ *Color* ] [, **B** [ **F** ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* The start point, in [**ScaleMode**](#scalemode) units. **Step** makes the point relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)). When omitted, drawing begins from the current pen position.
 
@@ -426,7 +442,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*,
 : *required* The end point, in **ScaleMode** units. **Step** makes the point relative to (*X1*, *Y1*).
 
 *Color*
-: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 **B**
 : *optional* Draw a rectangle whose opposite corners are (*X1*, *Y1*) and (*X2*, *Y2*) instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -470,7 +486,7 @@ Syntax: *object*.**PaintPicture** *Picture*, *X1*, *Y1* [, *Width1* [, *Height1*
 {: .no_toc }
 
 > [!NOTE]
-> Reserved for compatibility with VB6; not currently implemented in twinBASIC. In VB6 this returns the **OLE_COLOR** of a single pixel of the drawing surface.
+> Not implemented in twinBASIC: **Point** returns 0 whatever the pixel, and the compiler gives warning TB0009 at each call. In VB6 it returns the **OLE_COLOR** of a single pixel of the drawing surface, or -1 for a point outside it. To read a pixel, call the Windows **GetPixel** function on the [**hDC**](#hdc), with the coordinates in pixels.
 
 Syntax: *object*.**Point**( *X*, *Y* )
 
@@ -490,11 +506,13 @@ Sets a single pixel on the page to a specified colour.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* The pixel position, in [**ScaleMode**](#scalemode) units. **Step** makes the position relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
 *Color*
-: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 ### Refresh
 {: .no_toc }
@@ -506,10 +524,12 @@ Syntax: *object*.**Refresh**
 ### Scale
 {: .no_toc }
 
-Sets the page's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets the rectangle to a 1-to-1 mapping with the client area in pixels.
+Sets the page's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets [**ScaleMode**](#scalemode) to **vbTwips**, with [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop) at 0.
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* )-( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *optional* The logical coordinate at the top-left corner.
 
diff --git a/docs/Reference/Default/VB/QRCode/index.md b/docs/Reference/Default/VB/QRCode/index.md
index 12d9ab290..76be6e0e6 100644
--- a/docs/Reference/Default/VB/QRCode/index.md
+++ b/docs/Reference/Default/VB/QRCode/index.md
@@ -194,6 +194,9 @@ Determines whether the control accepts mouse input. A disabled **QRCode** still
 
 The colour of the dark modules in the generated QR code, as an **OLE_COLOR**. Default **vbBlack**. The light modules are always transparent --- the control's parent shows through them, so place the **QRCode** over a contrasting background.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/Report/index.md b/docs/Reference/Default/VB/Report/index.md
index 1c6c3c965..801fec174 100644
--- a/docs/Reference/Default/VB/Report/index.md
+++ b/docs/Reference/Default/VB/Report/index.md
@@ -164,6 +164,9 @@ Whether drawing performed on the report's window persists across invalidations.
 
 The background colour of the report window's drawing surface, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Most of the window is occupied by the page preview (which uses [**PaperColor**](#papercolor)) and the toolbar, so this colour is only visible briefly during paint.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -252,6 +255,9 @@ Determines whether the report window accepts user input. A disabled report ignor
 
 The fill colour for closed shapes drawn by [**Circle**](#circle) and the rectangle form of [**Line**](#line) without **F**. **OLE_COLOR**, default `0` (black). Used only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -272,6 +278,9 @@ When **True** (default), text drawn on the report has a transparent background,
 
 The pen colour used by [**Circle**](#circle), [**Line**](#line), [**PSet**](#pset), and the text drawn by [**Print**](#print). **OLE_COLOR**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### hDC
 {: .no_toc }
 
@@ -552,6 +561,8 @@ Draws a circle, ellipse, or arc on the current drawing surface (see [**hDC**](#h
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [, [ *Start* ] [, [ *End* ] [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* The centre, in [**ScaleMode**](#scalemode) units. **Step** makes the centre relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
@@ -559,14 +570,17 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [
 : *required* A **Single** giving the radius in **ScaleMode** units.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Angles in radians, used to draw an arc rather than a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* Ratio of vertical to horizontal radius. `1.0` is circular; values away from `1.0` produce ellipses.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
 ### Close
 {: .no_toc }
 
@@ -595,6 +609,8 @@ Draws a line, or a rectangle, on the current drawing surface (see [**hDC**](#hdc
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*, *Y2* ) [, [ *Color* ] [, **B** [ **F** ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* The start point, in [**ScaleMode**](#scalemode) units. When omitted, drawing begins from the current pen position.
 
@@ -602,7 +618,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*,
 : *required* The end point, in **ScaleMode** units. **Step** makes the point relative to (*X1*, *Y1*).
 
 *Color*
-: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 **B**
 : *optional* Draw a rectangle whose opposite corners are (*X1*, *Y1*) and (*X2*, *Y2*) instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -686,11 +702,13 @@ Sets a single pixel on the current drawing surface to a specified colour.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* The pixel position, in [**ScaleMode**](#scalemode) units. **Step** makes the position relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
 *Color*
-: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 ### Refresh
 {: .no_toc }
@@ -702,10 +720,12 @@ Syntax: *object*.**Refresh**
 ### Scale
 {: .no_toc }
 
-Sets the report window's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets the rectangle to a 1-to-1 mapping with the client area in pixels.
+Sets the report window's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets [**ScaleMode**](#scalemode) to **vbTwips**, with [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop) at 0.
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* )-( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *optional* The logical coordinate at the top-left corner.
 
diff --git a/docs/Reference/Default/VB/Shape/index.md b/docs/Reference/Default/VB/Shape/index.md
index 07de2a6b8..43b6e7e0b 100644
--- a/docs/Reference/Default/VB/Shape/index.md
+++ b/docs/Reference/Default/VB/Shape/index.md
@@ -136,6 +136,9 @@ The rotation of the rendered shape, in degrees, anti-clockwise around the contro
 
 The colour painted into the **Shape**'s bounding rectangle (outside the shape's own outline) when [**BackStyle**](#backstyle) is **vbBFOpaque**. **OLE_COLOR**, defaults to the system window-background colour. Has no effect when [**BackStyle**](#backstyle) is **vbBFTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BackStyle
 {: .no_toc }
 
@@ -181,6 +184,9 @@ The raster operation that the shape drawing applies when combining its pixels wi
 
 The primary colour used to fill the shape's interior. **OLE_COLOR**, defaults to the system scrollbar colour. Used as the only colour for solid and hatched fills, and as the start colour for gradient fills. Has no effect when [**FillStyle**](#fillstyle) is **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillColorAlt
 {: .no_toc }
 
diff --git a/docs/Reference/Default/VB/TextBox/index.md b/docs/Reference/Default/VB/TextBox/index.md
index 4756797fa..abae16d0e 100644
--- a/docs/Reference/Default/VB/TextBox/index.md
+++ b/docs/Reference/Default/VB/TextBox/index.md
@@ -97,6 +97,9 @@ Determines how the control's border is drawn by the OS. A member of [**Appearanc
 
 The background colour of the edit area, as an **OLE_COLOR**. Defaults to the system window-background colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BorderStyle
 {: .no_toc }
 
@@ -208,6 +211,9 @@ Shortcut for [**Font**](#font)`.Underline`. **Boolean**.
 
 The text colour, as an **OLE_COLOR**. Defaults to the system window-text colour.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### Height
 {: .no_toc }
 
@@ -274,6 +280,9 @@ When **True**, the user can scroll, select, and copy text but cannot modify it.
 
 The maximum number of characters the user can type into the control. **Long**, default `0` --- when zero, the OS imposes its own limit (typically 32 767 characters for single-line, much larger for multi-line). Setting **MaxLength** below the current text length does not truncate what is already there, but blocks further typing until the user deletes enough characters.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning [**Text**](#text) in code is not limited by **MaxLength**. The whole string is stored, and no error is raised. VB6 truncates the string to **MaxLength** characters. Truncate the string in code before assigning it, with **Left$**.
+
 ### MouseIcon
 {: .no_toc }
 
@@ -352,6 +361,8 @@ The zero-based position of the start of the selection, or the caret position whe
 
 The text currently selected. Assigning a string replaces the selection with that string and positions the caret immediately after the inserted text. **String**.
 
+The replacement is made by assigning [**Text**](#text), so it raises [**Change**](#change) once when the text changes and not at all when the new text is identical to the old. VB6 also raises the event when the replacement leaves the text unchanged.
+
 ### TabFocusAutoSelect
 {: .no_toc }
 
@@ -379,7 +390,7 @@ The text shown in the control. **String**. **Default property.**
 
 Syntax: *object*.**Text** [ = *string* ]
 
-Assigning a value that differs from the current one raises a [**Change**](#change) event and refreshes the display. Assigning the same value is a no-op. In multi-line mode, line breaks are stored using the platform's native newline encoding (`vbCrLf` on Windows).
+Assigning a value that differs from the current one raises one [**Change**](#change) event and refreshes the display. The comparison is case-sensitive, so changing `"abc"` to `"ABC"` raises the event. Assigning the same value, an empty string to an empty text box included, is a no-op and raises no event. Before BETA 984 an assignment raised **Change** twice. In multi-line mode, line breaks are stored using the platform's native newline encoding (`vbCrLf` on Windows).
 
 ### TextHint
 {: .no_toc }
@@ -523,7 +534,7 @@ Syntax: *object*.**ZOrder** [ *Position* ]
 ### Change
 {: .no_toc }
 
-Raised whenever [**Text**](#text) changes --- either through user input or by code assigning a new value. Not raised during [**Initialize**](#initialize); the very first text load from the serialized form does not produce a **Change** event. **Default-designer event.**
+Raised whenever [**Text**](#text) changes --- either through user input or by code assigning a new value. An assignment raises it once, including one made in a form's **Load** event. Not raised during [**Initialize**](#initialize); the very first text load from the serialized form does not produce a **Change** event. **Default-designer event.**
 
 Syntax: *object*\_**Change**( )
 
diff --git a/docs/Reference/Default/VB/UserControl/index.md b/docs/Reference/Default/VB/UserControl/index.md
index 24a08ad1f..396255987 100644
--- a/docs/Reference/Default/VB/UserControl/index.md
+++ b/docs/Reference/Default/VB/UserControl/index.md
@@ -142,6 +142,9 @@ When **False**, drawing primitives --- [**Cls**](#cls), [**Circle**](#circle), [
 
 The background colour of the control's surface, as an **OLE_COLOR**. Defaults to the system 3-D face colour. Has no visible effect when [**BackStyle**](#backstyle) is **vbBFTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so a later read returns it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### BackStyle
 {: .no_toc }
 
@@ -278,6 +281,9 @@ The host's extender wrapper around this **UserControl**, as an **Object**. Read-
 
 The fill colour for closed shapes drawn by [**Circle**](#circle) and the rectangle form of [**Line**](#line) without **F**. **OLE_COLOR**, default `0` (black). Used only when [**FillStyle**](#fillstyle) is not **vbFSTransparent**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1`, raises no error and stores the value, so [**Circle**](#circle) and [**Line**](#line) then draw with it. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### FillStyle
 {: .no_toc }
 
@@ -333,6 +339,9 @@ Whether the control automatically resizes itself to fill the host's container ar
 
 The pen colour used by [**Circle**](#circle), [**Line**](#line), [**PSet**](#pset), and the text drawn by [**Print**](#print). **OLE_COLOR**.
 
+> [!WARNING]
+> BETA 995 has a defect: assigning a value that is not a colour, such as `-1` or `&H8000001F`, raises error 5 and still stores the value, so a later read returns it and a handled error leaves the invalid colour in force. VB6 raises error 380, *Invalid property value*, and keeps the old colour. Check a colour that comes from user input before assigning it.
+
 ### ForwardFocus
 {: .no_toc }
 
@@ -597,6 +606,8 @@ Draws a circle, ellipse, or arc on the control using [**ForeColor**](#forecolor)
 
 Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [, [ *Start* ] [, [ *End* ] [, *Aspect* ] ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#circle).
+
 *X*, *Y*
 : *required* The centre, in [**ScaleMode**](#scalemode) units. **Step** makes the centre relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
@@ -604,14 +615,17 @@ Syntax: *object*.**Circle** [ **Step** ] ( *X*, *Y* ), *Radius* [, [ *Color* ] [
 : *required* A **Single** giving the radius in **ScaleMode** units.
 
 *Color*
-: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the outline; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 *Start*, *End*
-: *optional* Angles in radians, used to draw an arc rather than a full circle.
+: *optional* Angles in radians, from -2 pi to 2 pi, counter-clockwise from the 3 o'clock position. With either one given, an arc is drawn rather than a full circle. A negative angle is used as its absolute value, and the radius from the centre to that end of the arc is drawn as well. With both negative the shape is a pie, filled with [**FillColor**](#fillcolor) and [**FillStyle**](#fillstyle); an arc with one radius or none is not filled. A negative zero draws no radius, so a pie that starts at angle 0 is written with a *Start* of `-2 * pi`. A negative angle below -2 pi raises error 5.
 
 *Aspect*
 : *optional* Ratio of vertical to horizontal radius. `1.0` is circular; values away from `1.0` produce ellipses.
 
+> [!WARNING]
+> BETA 995 does not check a positive *Start* or *End*: an angle above 2 pi raises no error and draws as if 2 pi had been subtracted, where VB6 raises error 5. See [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#what-the-built-in-surfaces-do-with-the-flags).
+
 ### Cls
 {: .no_toc }
 
@@ -639,6 +653,8 @@ Draws a line, or a rectangle, on the control using [**ForeColor**](#forecolor) (
 
 Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*, *Y2* ) [, [ *Color* ] [, **B** [ **F** ] ] ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#line).
+
 *X1*, *Y1*
 : *optional* The start point, in [**ScaleMode**](#scalemode) units. **Step** makes the point relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)). When omitted, drawing begins from the current pen position.
 
@@ -646,7 +662,7 @@ Syntax: *object*.**Line** [ [ **Step** ] ( *X1*, *Y1* ) ] -[ **Step** ] ( *X2*,
 : *required* The end point, in **ScaleMode** units. **Step** makes the point relative to (*X1*, *Y1*).
 
 *Color*
-: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR** for the line; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 **B**
 : *optional* Draw a rectangle whose opposite corners are (*X1*, *Y1*) and (*X2*, *Y2*) instead of a line. Without **F**, the interior is filled with [**FillColor**](#fillcolor) in the current [**FillStyle**](#fillstyle); **vbFSTransparent** leaves it unfilled.
@@ -690,7 +706,7 @@ Syntax: *object*.**PaintPicture** *Picture*, *X1*, *Y1* [, *Width1* [, *Height1*
 {: .no_toc }
 
 > [!NOTE]
-> Reserved for compatibility with VB6; not currently implemented in twinBASIC. In VB6 this returns the **OLE_COLOR** of a single pixel of the drawing surface.
+> Not implemented in twinBASIC: **Point** returns 0 whatever the pixel, and the compiler gives warning TB0009 at each call. In VB6 it returns the **OLE_COLOR** of a single pixel of the drawing surface, or -1 for a point outside it. To read a pixel, call the Windows **GetPixel** function on the [**hDC**](#hdc), with the coordinates in pixels.
 
 Syntax: *object*.**Point**( *X*, *Y* )
 
@@ -728,11 +744,13 @@ Sets a single pixel on the control to a specified colour.
 
 Syntax: *object*.**PSet** [ **Step** ] ( *X*, *Y* ) [, *Color* ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#pset).
+
 *X*, *Y*
 : *required* The pixel position, in [**ScaleMode**](#scalemode) units. **Step** makes the position relative to ([**CurrentX**](#currentx), [**CurrentY**](#currenty)).
 
 *Color*
-: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor).
+: *optional* An **OLE_COLOR**; defaults to [**ForeColor**](#forecolor). See [colour values](../../../Core/Graphics-Methods#colour-values) for how the value is read.
 
 ### Refresh
 {: .no_toc }
@@ -744,10 +762,12 @@ Syntax: *object*.**Refresh**
 ### Scale
 {: .no_toc }
 
-Sets the control's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets the rectangle to a 1-to-1 mapping with the client area in pixels.
+Sets the control's logical drawing rectangle in a single call by assigning [**ScaleLeft**](#scaleleft), [**ScaleTop**](#scaletop), [**ScaleWidth**](#scalewidth), and [**ScaleHeight**](#scaleheight). Switches [**ScaleMode**](#scalemode) to **vbUser**. Calling **Scale** with no arguments resets [**ScaleMode**](#scalemode) to **vbTwips**, with [**ScaleLeft**](#scaleleft) and [**ScaleTop**](#scaletop) at 0.
 
 Syntax: *object*.**Scale** [ ( *X1*, *Y1* )-( *X2*, *Y2* ) ]
 
+The compiler turns this syntax into a call with a flags argument; see [Line, Circle, PSet, Scale](../../../Core/Graphics-Methods#scale).
+
 *X1*, *Y1*
 : *optional* The logical coordinate at the top-left corner.
 
diff --git a/docs/Reference/Default/VBA/ErrObject/Description.md b/docs/Reference/Default/VBA/ErrObject/Description.md
index 79c6f3c09..e282d8b70 100644
--- a/docs/Reference/Default/VBA/ErrObject/Description.md
+++ b/docs/Reference/Default/VBA/ErrObject/Description.md
@@ -20,8 +20,8 @@ The **Description** setting consists of a short description of the error. Use th
 
 When generating a user-defined error, assign a short description of the error to the **Description** property. If **Description** isn't filled in and the value of [**Number**](Number) corresponds to a built-in run-time error, the string returned by the [**Error**](../Conversion/Error) function is placed in **Description** when the error is generated.
 
-> [!NOTE]
-> For a number that has no built-in message, VBA places `Application-defined or object-defined error` in **Description**. twinBASIC places an empty string, a Windows system message or `Automation error`, depending on the number. [**Raise**](Raise) has the table.
+> [!WARNING]
+> BETA 995 has a defect: for a number that has no built-in message, **Raise** without a *description* leaves **Description** as an empty string, a Windows system message or `Automation error`, depending on the number, and raises no error. VBA and VB6 place `Application-defined or object-defined error` there. [**Raise**](Raise) has the table.
 
 ### Example
 
diff --git a/docs/Reference/Default/VBA/ErrObject/Raise.md b/docs/Reference/Default/VBA/ErrObject/Raise.md
index 4ed364513..65bad96d2 100644
--- a/docs/Reference/Default/VBA/ErrObject/Raise.md
+++ b/docs/Reference/Default/VBA/ErrObject/Raise.md
@@ -41,8 +41,8 @@ A *description* of an empty string gives an empty **Description** for every numb
 
 When the error is raised in a method of a class and the caller handles it, an empty **Description** reaches the caller as `Application-defined or object-defined error`. The other texts arrive unchanged.
 
-> [!NOTE]
-> VBA differs in three ways. Without *source*, VBA sets **Source** to the name of the project, and twinBASIC leaves it empty. Without *description*, VBA gives every number that has no built-in message the text `Application-defined or object-defined error`, from 1 up to 65535, and twinBASIC gives an empty string or one of the texts above. And an omitted argument keeps the value left by an earlier error in VBA, and is reset in twinBASIC. A program that relies on **Err.Source** being the project name, or on **Err.Description** being non-empty, has to pass those arguments.
+> [!WARNING]
+> BETA 995 has a defect: **Raise** differs from VBA and VB6 in three ways, and none of them raises an error. Without *source*, VBA sets **Source** to the name of the project, and twinBASIC leaves it empty. Without *description*, VBA gives every number that has no built-in message the text `Application-defined or object-defined error`, from 1 up to 65535, and twinBASIC gives an empty string or one of the texts above. And an omitted argument keeps the value left by an earlier error in VBA, and is reset in twinBASIC. A program that relies on **Err.Source** being the project name, or on **Err.Description** being non-empty, has to pass those arguments.
 
 **Raise** is preferred over the [**Error**](../../Core/Error) statement when generating run-time errors, particularly inside class modules: the **Err** object holds richer information than the **Error** statement can supply. With **Raise** the source that generated the error can be specified in the [**Source**](Source) property, online Help for the error can be referenced through [**HelpFile**](HelpFile) and [**HelpContext**](HelpContext), and so on.
 
diff --git a/docs/Reference/Default/VBA/ErrObject/Source.md b/docs/Reference/Default/VBA/ErrObject/Source.md
index 7d490d9aa..993478ec0 100644
--- a/docs/Reference/Default/VBA/ErrObject/Source.md
+++ b/docs/Reference/Default/VBA/ErrObject/Source.md
@@ -24,8 +24,8 @@ When generating an error from user code, pass the source to [**Raise**](Raise).
 
 When an error occurs that twinBASIC raises itself, such as a division by zero, **Source** is an empty string too, in a standard module and in a class module alike.
 
-> [!NOTE]
-> In VBA, **Source** is filled in automatically with the name of the project, for an error that VBA raises and for **Raise** without a source argument. twinBASIC does not fill it in.
+> [!WARNING]
+> BETA 995 has a defect: it does not fill in **Source**, and raises no error. VBA and VB6 fill it in automatically with the name of the project, for an error that the runtime raises and for **Raise** without a source argument. A program that reads **Err.Source** to find where an error came from gets an empty string.
 
 ### Example
 
diff --git a/docs/Reference/Default/VBA/Strings/StrConv.md b/docs/Reference/Default/VBA/Strings/StrConv.md
index e32317383..d5d6e860e 100644
--- a/docs/Reference/Default/VBA/Strings/StrConv.md
+++ b/docs/Reference/Default/VBA/Strings/StrConv.md
@@ -18,7 +18,7 @@ Syntax: **StrConv(** *string*, *conversion* [ **,** *LCID* ] **)**
 : *required* **Integer**. The sum of values specifying the type of conversion to perform.
 
 *LCID*
-: *optional* The LocaleID, if different than the system LocaleID. (The system LocaleID is the default.)
+: *optional* The LocaleID, if different than the system LocaleID. (The system LocaleID is the default.) An *LCID* that is not a valid locale identifier raises error 5.
 
 The *conversion* argument settings are:
 
@@ -26,18 +26,29 @@ The *conversion* argument settings are:
 |-------------------|-------|--------------------------------------------------------------------------------------------|
 | **vbUpperCase**   | 1     | Converts the string to uppercase characters.                                               |
 | **vbLowerCase**   | 2     | Converts the string to lowercase characters.                                               |
-| **vbProperCase**  | 3     | Converts the first letter of every word in a string to uppercase.                          |
+| **vbProperCase**  | 3     | Converts the first letter of every word in a string to uppercase and the other letters to lowercase. |
 | **vbWide**        | 4     | Converts narrow (single-byte) characters in a string to wide (double-byte) characters.     |
 | **vbNarrow**      | 8     | Converts wide (double-byte) characters in a string to narrow (single-byte) characters.     |
 | **vbKatakana**    | 16    | Converts Hiragana characters in a string to Katakana characters.                           |
 | **vbHiragana**    | 32    | Converts Katakana characters in a string to Hiragana characters.                           |
 | **vbUnicode**     | 64    | Converts the string to Unicode using the default code page of the system.                  |
 | **vbFromUnicode** | 128   | Converts the string from Unicode to the default code page of the system.                   |
+| **vbUTF8**        | 256   | Converts the string to UTF-8. Assign the result to a **Byte** array to get the UTF-8 bytes. |
+| **vbFromUTF8**    | 512   | Converts UTF-8 text held in a **Byte** array to a string. An invalid byte sequence becomes the replacement character U+FFFD. |
 
 > [!NOTE]
 > These constants are specified by twinBASIC. As a result, they may be used anywhere in code in place of the actual values. Most can be combined, for example, **vbUpperCase + vbWide**, except when they are mutually exclusive, for example, **vbUnicode + vbFromUnicode**. The constants **vbWide**, **vbNarrow**, **vbKatakana**, and **vbHiragana** cause run-time errors when used in locales where they don't apply.
 
-The following are valid word separators for proper casing: **Null** (`Chr$(0)`), horizontal tab (`Chr$(9)`), linefeed (`Chr$(10)`), vertical tab (`Chr$(11)`), form feed (`Chr$(12)`), carriage return (`Chr$(13)`), space (SBCS) (`Chr$(32)`). The actual value for a space varies by country/region for DBCS.
+The following are valid word separators for proper casing: **Null** (`Chr$(0)`), horizontal tab (`Chr$(9)`), linefeed (`Chr$(10)`), vertical tab (`Chr$(11)`), form feed (`Chr$(12)`), carriage return (`Chr$(13)`), space (SBCS) (`Chr$(32)`). The actual value for a space varies by country/region for DBCS. No other character, such as a hyphen or an apostrophe, starts a word: `"mc-donald"` becomes `"Mc-donald"`.
+
+> [!WARNING]
+> BETA 995 has a defect in **vbProperCase**: it leaves a word in lowercase when the word follows an even number of consecutive separators, such as two spaces or the carriage return and linefeed of **vbCrLf**. `StrConv("a  b", vbProperCase)` returns `"A  b"`, where it should return `"A  B"`. A word after one separator, or after three, is capitalised. BETA 983 capitalised every word, as Visual Basic 6 does.
+
+If *string* is **Null**, **StrConv** returns **Null**.
+
+The case conversions map each character by the Windows rules for the character itself, and do not apply the language-specific rules of *LCID*. With an *LCID* of 1055 (Turkish), `"i"` becomes `"I"`, not the dotted capital I. The case conversions also work on characters outside the system code page, such as Greek and Cyrillic letters on a system with a Western European code page.
+
+**vbUnicode** and **vbFromUnicode** use the default code page of the system, whatever *LCID* is given. **vbWide**, **vbNarrow**, **vbKatakana** and **vbHiragana** depend on the system locale as well: on a system whose locale is not East Asian they raise error 5 even when *LCID* names a Japanese locale. Visual Basic 6 applies the code page and locale of *LCID* to all six.
 
 When converting from a **Byte** array in ANSI format to a string, use the **StrConv** function. When converting from such an array in Unicode format, use an assignment statement.
 
@@ -54,6 +65,19 @@ For i = 0 To UBound(x)
 Next
 ```
 
+This example shows the case conversions, an *LCID*, a **Null** argument and an invalid *LCID*.
+
+```tb check_run
+Debug.Print StrConv("hello wORLD", vbProperCase)       ' Hello World
+Debug.Print StrConv("o'neil mc-donald", vbProperCase)  ' O'neil Mc-donald
+Debug.Print StrConv("i", vbUpperCase, 1055)            ' I
+Debug.Print AscW(StrConv(ChrW(&HE9), vbUpperCase))     ' 201
+Debug.Print IsNull(StrConv(Null, vbUpperCase))         ' True
+On Error Resume Next
+Debug.Print StrConv("abc", vbUpperCase, 99999)
+Debug.Print Err.Number                                 ' 5
+```
+
 ### See Also
 
 - [Asc](Asc), [Chr](Chr), [LCase](LCase), [UCase](UCase) functions
diff --git a/docs/Reference/Glossary.md b/docs/Reference/Glossary.md
index eb4fcbc07..de18ea837 100644
--- a/docs/Reference/Glossary.md
+++ b/docs/Reference/Glossary.md
@@ -334,7 +334,7 @@ A [procedure](#procedure) that must be explicitly called by another procedure. I
 
 ## graphics method
 
-A method that operates on an object such as a **Form**, **PictureBox**, or **Printer**, and performs run-time drawing operations such as animation or simulation. Graphics methods include **Circle**, **Cls**, **Line**, **PaintPicture**, **Point**, **Print**, and **PSet**.
+A method that operates on an object such as a **Form**, **PictureBox**, or **Printer**, and performs run-time drawing operations such as animation or simulation. Graphics methods include **Circle**, **Cls**, **Line**, **PaintPicture**, **Point**, **Print**, and **PSet**. The drawing syntax of **Circle**, **Line**, **PSet** and **Scale** is described on the [Line, Circle, PSet, Scale](../tB/Core/Graphics-Methods) page.
 
 ## host application
 
diff --git a/docs/Reference/Statements.md b/docs/Reference/Statements.md
index b7c3b6582..494421500 100644
--- a/docs/Reference/Statements.md
+++ b/docs/Reference/Statements.md
@@ -72,6 +72,8 @@ These statements are built into the language itself. They are understood by the
 
 * [Let](../tB/Core/Let) -- assigns the value of an expression to a variable or property
 
+* [Line, Circle, PSet, Scale](../tB/Core/Graphics-Methods) -- the drawing syntax of these four methods, which the compiler turns into a call with a flags argument
+
 * [Line Input #](../tB/Core/Line-Input) -- reads a single line from an open sequential file into a string variable
 
 * [Load](../tB/Core/Load) -- loads an object (typically a form) into memory without showing it
diff --git a/scripts/bug_repro.mjs b/scripts/bug_repro.mjs
index 60ce2e54c..cbaa18190 100644
--- a/scripts/bug_repro.mjs
+++ b/scripts/bug_repro.mjs
@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Reproducer projects for the entries of BUGS-TO-REPORT.md, under bugs/<slug>/.
 //
-//     node scripts/bug_repro.mjs new <slug> "<entry title>"
+//     node scripts/bug_repro.mjs new <slug> "<entry title>" [--with-vb6] [--with-images]
 //     node scripts/bug_repro.mjs pack <slug>
 //     node scripts/bug_repro.mjs compile|build|run <slug> [options]
 //     node scripts/bug_repro.mjs vb6 <slug> [--vb6 <VB6.EXE>] [--timeout S] [--keep]
@@ -50,8 +50,16 @@
 //     reproducer that has a VB6 project beside the twinBASIC one, in
 //     bugs/<slug>/vb6/, gets a second zip, <slug>-vb6.zip, of that folder's
 //     sources, written the same way; `vb6` builds the project in a temp copy
-//     (scripts/lib/vb6.mjs, runRepro) and prints the out.txt it writes. VB6.EXE
+//     (scripts/lib/vb6.mjs, runRepro), runs its exe on a private desktop, as
+//     tbrun --exe does, and prints the out.txt it writes. VB6.EXE
 //     is only ever started from there, with an argument array and no shell.
+//     A graphical defect carries pictures: repro.json's `images` names them, the
+//     PngDump modules (test/repro-templates/png/) save each as <name>.png in the
+//     folder BUGREPRO_IMAGES names, `run` and `vb6` keep them in
+//     bugs/<slug>/images/ as <name>-tb.png and <name>-vb6.png, and
+//     <name>-compare.png (lib/repro-images.mjs, lib/png.mjs) shows both and their
+//     difference. `verify` can judge by them (expect.imagesDiffer), and stages its
+//     pictures in the temp folder, so it never changes the tree.
 //  2. impexp EXITS 6 WHEN IT WARNS. `import` that finished with a warning is
 //     still a pack, so 0 and 6 are both success, and its output is printed.
 //  3. AN IDE THAT RUNS MANY REPRODUCERS OWNS THE REGISTRY TIDY ONCE. Under
@@ -69,6 +77,15 @@
 //     compares its exit code and output. Paths are given backslashed and in full:
 //     `export` prefixes \\?\ to its project path, and cannot find a folder named
 //     with forward slashes (WIP.md, "Driving the twinBASIC compiler").
+//  6. EACH `cli` COMMAND RUNS ON A PRIVATE DESKTOP, in a kill-on-close job, as
+//     the IDE does (scripts/lib/tb-launch.ps1), with its output in files. The
+//     compiler opens a modal message box for a damaged project and waits on it
+//     for ever; on the user's desktop that box is theirs to close, and on a
+//     private one nobody could. The launcher reads each box (title, text) and
+//     presses OK, and the output the reproducer's `expect` is matched against
+//     starts with one `dialog: <title>: <text>` line per box. `attach` files
+//     are copied into the command's temp folder, so {tmp}/<attach path> is a
+//     copy a command may damage further.
 import { spawn, spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
@@ -97,8 +114,27 @@ import {
   withUsageError,
 } from "../lib/cli.mjs";
 import { REPO_ROOT } from "../lib/repo-paths.mjs";
-import { keptIdeLines, summaryLine, TARGETS } from "./lib/tb-ide.mjs";
-import { compilerExe, findIde } from "./lib/tb-install.mjs";
+import { keptIdeLines, killTree, launchOnDesktop, summaryLine, TARGETS } from "./lib/tb-ide.mjs";
+import {
+  BETA_FILE,
+  IMAGES_DIR,
+  IMAGES_ENV,
+  ImageError,
+  PNG_TEMPLATES,
+  PNGDUMP_BAS,
+  PNGDUMP_TWIN,
+  collectImages,
+  compareWithKept,
+  copyImageTemplates,
+  embedProblems,
+  imageFile,
+  imageSourceCheck,
+  imageZipEntries,
+  imagesDifferProblems,
+  imagesKeyProblem,
+  writeComparison,
+} from "./lib/repro-images.mjs";
+import { buildNumber, compilerExe, findIde } from "./lib/tb-install.mjs";
 import { finishTidy, startTidy } from "./lib/tb-registry.mjs";
 import {
   NO_VB6,
@@ -115,7 +151,7 @@ import { fileEntry, zipFiles } from "./lib/zip.mjs";
 let tidy = null;
 exitOnCrash(() => finishTidy(tidy));
 
-const USAGE = `usage: node scripts/bug_repro.mjs <command> [slug ...] [--ide <twinBASIC.exe>] [--port N] [--arch win32|win64] [--timeout S] [--llvm] [--exe] [--jobs N] [--keep] [--show|--hide] [--template <name>] [--with-vb6] [--vb6 <VB6.EXE>] [--existing] [--marked] [-h, --help]
+const USAGE = `usage: node scripts/bug_repro.mjs <command> [slug ...] [--ide <twinBASIC.exe>] [--port N] [--arch win32|win64] [--timeout S] [--llvm] [--exe] [--jobs N] [--keep] [--show|--hide] [--template <name>] [--with-vb6] [--with-images] [--vb6 <VB6.EXE>] [--existing] [--marked] [-h, --help]
 
 Reproducer projects for the entries of BUGS-TO-REPORT.md, under bugs/<slug>/, or
 under bugs/filed/<slug>/ once the entry has been filed upstream.
@@ -123,8 +159,15 @@ under bugs/filed/<slug>/ once the entry has been filed upstream.
 is never "filed".
 
 A reproducer may also have a VB6 project in vb6/, to show what VB6 does. It holds
-sources only (Probe.vbp and its .bas, .cls and .frm files), builds Probe.exe, and
-writes what it finds to out.txt beside the exe, handling every error itself.
+sources only (Probe.vbp and its .bas, .cls, .frm and .ctl files, with their
+.frx and .ctx), builds Probe.exe, and writes what it finds to out.txt beside the
+exe, handling every error itself.
+
+A graphical defect also carries pictures. repro.json's "images" lists their names; the
+PngDump modules (PngDump.twin in src/Sources/, PngDump.bas in vb6/) save each as <name>.png
+in the folder named by the BUGREPRO_IMAGES environment variable, which run and vb6 set. They
+are kept in images/ as <name>-tb.png (run) and <name>-vb6.png (vb6), and when both exist
+<name>-compare.png shows twinBASIC, VB6 and their difference: the picture for the issue.
 
 Commands:
   new <slug> "<title>"  create bugs/<slug>/src/ from the console template, with a
@@ -132,25 +175,35 @@ Commands:
                         bugs/<slug>/repro.json with "mode": "manual"; with
                         --template, from that template's Settings and Sources;
                         with --with-vb6, also bugs/<slug>/vb6/, from the VB6
-                        template under test/repro-templates/vb6/
+                        template under test/repro-templates/vb6/; with
+                        --with-images, also the PngDump modules from
+                        test/repro-templates/png/, and "images": ["main"] in repro.json
   pack <slug>           pack src/ into <slug>.twinproj with scripts/impexp.mjs, and
                         write <slug>.zip, the file a GitHub issue accepts, with the
-                        files repro.json's "attach" names; when vb6/ exists, also
-                        write <slug>-vb6.zip, holding its source files only
+                        files repro.json's "attach" names and the files of images/;
+                        when vb6/ exists, also write <slug>-vb6.zip, holding its
+                        source files only; print the -compare.png pictures that go
+                        into the issue
   compile <slug>        pack, then compile the project in the IDE (tbbuild) and
                         print its diagnostics
   build <slug>          pack, then compile and build it (tbbuild --build)
   run <slug>            run a copy of src/ whose [RunAfterBuild] probe calls Sub
-                        Main, and print what it writes to the DEBUG CONSOLE (tbrun)
+                        Main, and print what it writes to the DEBUG CONSOLE (tbrun);
+                        with "images" in repro.json, keep each picture as
+                        images/<name>-tb.png
   vb6 <slug>            build vb6/ with VB6 in a copy under the temp folder (never
-                        in the repository), run Probe.exe, and print out.txt. A
-                        project that calls MsgBox or InputBox is refused. Needs
-                        VB6; no IDE
+                        in the repository), run Probe.exe on a private desktop,
+                        and print out.txt. A project may have forms. A project
+                        that calls MsgBox or InputBox is refused. Needs VB6; no IDE.
+                        With "images" in repro.json, keep each picture as
+                        images/<name>-vb6.png
   verify [slug ...]     run what each repro.json says, for the named reproducers or
                         all of bugs/* and bugs/filed/*, and report per reproducer
                         whether it reproduces; a filed one is labelled with its
                         issue, and one that no longer reproduces is probably fixed.
-                        Needs a twinBASIC install; run by a person only
+                        Needs a twinBASIC install; run by a person only. A run-mode
+                        reproducer with expect.imagesDiffer compares its fresh
+                        pictures (kept in the temp folder) with images/<name>-vb6.png
   file <slug> <issue>   move the entry whose reproducer is <slug> out of
                         BUGS-TO-REPORT.md into bugs/filed/<slug>/REPORT.md, move
                         bugs/<slug>/ to bugs/filed/<slug>/, and record the issue in
@@ -166,8 +219,10 @@ Options:
                     the first of the lanes' ports
   --arch <target>   win32 or win64 (default win32); compile, build and run
   --timeout <secs>  as tbbuild's and tbrun's; with a cli reproducer, the time
-                    limit on the compiler executable; with vb6, the limit on
-                    Probe.exe (default 30)
+                    limit on each command of the compiler executable, which runs
+                    on a private desktop, and whose dialog boxes are read and
+                    closed (default 120); with vb6, the limit on Probe.exe
+                    (default 30)
   --llvm            build with LLVM; build and run
   --exe             run also runs the built exe and prints what it writes; run
   --jobs <n>        reproducers to run at once, on ports base, base+1, ... (default
@@ -179,6 +234,7 @@ Options:
   --template <name> new: the project to start from, console (the default) or a
                     folder of test/repro-templates/, such as webview2-form
   --with-vb6        new: also create vb6/ from the VB6 template
+  --with-images     new: also copy the PngDump modules, and list "main" under images
   --vb6 <path>      vb6: VB6.EXE (default: $VB6_EXE, else VB98\\VB6.EXE under
                     Program Files (x86) or Program Files)
   --existing        file: the issue was already open, and covers this bug; recorded
@@ -207,13 +263,15 @@ Exit codes:
   6  run, vb6: the probe printed nothing (vb6: no out.txt, or an empty one)
   7  run: the probe ended before it returned
   8  run --exe, vb6: the exe exited with a code other than 0, or was still running
-     after --timeout`;
+     after --timeout
+  9  run, vb6: a picture that repro.json's "images" names was not written, or could
+     not be read`;
 
 const usageError = { format: (err) => `${err.message}\n${USAGE}` };
 
 // What each command takes besides -h; anything else given is refused.
 const APPLIES = {
-  new: ["template", "withVb6"],
+  new: ["template", "withVb6", "withImages"],
   pack: [],
   compile: ["ide", "port", "arch", "timeout", "keep", "show", "hide"],
   build: ["ide", "port", "arch", "timeout", "keep", "show", "hide", "llvm"],
@@ -245,6 +303,7 @@ const { values, positionals } = withUsageError(
         hide: { type: "boolean", default: false },
         template: { type: "string" },
         "with-vb6": { type: "boolean", default: false },
+        "with-images": { type: "boolean", default: false },
         vb6: { type: "string" },
         existing: { type: "boolean", default: false },
         marked: { type: "boolean", default: false },
@@ -337,7 +396,9 @@ const { port, arch, timeout, jobs, template, slugs, title, issue } = withUsageEr
 
 // ------------------------------------------------------------------ the files
 
-const BUGS = path.join(REPO_ROOT, "bugs");
+// BUG_REPRO_BUGS names another folder to hold the reproducers, so that test/png.test.mjs can run
+// `new` and `verify` over fixtures without touching bugs/. Nothing else sets it.
+const BUGS = process.env.BUG_REPRO_BUGS ? path.resolve(process.env.BUG_REPRO_BUGS) : path.join(REPO_ROOT, "bugs");
 const TEMPLATE = path.join(REPO_ROOT, "test", "example-projects", "console", "Settings");
 
 // The templates new --template takes besides console: each folder of
@@ -450,7 +511,7 @@ const VB6_TEMPLATE = path.join(REPO_ROOT, "test", "repro-templates", "vb6");
 // `template` is null for the console template, else a folder of
 // test/repro-templates/, whose Sources/ are copied as they are. `withVb6` also
 // makes vb6/.
-function newReproducer(slug, entryTitle, template = null, withVb6 = false) {
+function newReproducer(slug, entryTitle, template = null, withVb6 = false, withImages = false) {
   for (const dir of [path.join(BUGS, slug), path.join(FILED_DIR, slug)]) {
     if (existsSync(dir)) throw new Fail(`${rel(dir)} already exists`, 3);
   }
@@ -460,6 +521,10 @@ function newReproducer(slug, entryTitle, template = null, withVb6 = false) {
   if (withVb6 && !existsSync(path.join(VB6_TEMPLATE, `${REPRO_PROJECT}.vbp`))) {
     throw new Fail(`no VB6 template project at ${rel(VB6_TEMPLATE)}`);
   }
+  for (const file of withImages ? [PNGDUMP_TWIN, ...(withVb6 ? [PNGDUMP_BAS] : [])] : []) {
+    if (!existsSync(path.join(PNG_TEMPLATES, file)))
+      throw new Fail(`no picture module at ${rel(PNG_TEMPLATES)}/${file}`);
+  }
   const name = pascal(slug);
   const vb6Note = withVb6 ? " and vb6/" : "";
   let settings = readFileSync(from, "utf8");
@@ -467,28 +532,29 @@ function newReproducer(slug, entryTitle, template = null, withVb6 = false) {
   settings = setKey(settings, "project.appTitle", name, from);
   settings = setKey(settings, "project.description", `Reproduces: ${entryTitle}`, from);
   settings = setKey(settings, "project.id", `{${randomUUID().toUpperCase()}}`, from);
+  mkdirSync(p.src, { recursive: true });
+  writeFileSync(path.join(p.src, "Settings"), settings);
   if (template) {
-    mkdirSync(p.src, { recursive: true });
-    writeFileSync(path.join(p.src, "Settings"), settings);
     cpSync(path.join(reproTemplatesDir(), template, "Sources"), path.join(p.src, "Sources"), { recursive: true });
-    const steps = "Describe what a person does to see the bug, or set mode to compile, build, run or cli.";
-    writeFileSync(p.repro, `${JSON.stringify({ mode: "manual", steps }, null, 2)}\n`);
-    if (withVb6) cpSync(VB6_TEMPLATE, p.vb6, { recursive: true });
-    console.log(
-      `created ${rel(p.dir)}/ (project ${name}, from template ${template}): ` +
-        `edit src/Sources${vb6Note}, then pack; repro.json is manual until set`,
-    );
-    return;
+  } else {
+    mkdirSync(path.join(p.src, "Sources"), { recursive: true });
+    writeFileSync(path.join(p.src, "Sources", "Startup.twin"), STARTUP);
   }
-  mkdirSync(path.join(p.src, "Sources"), { recursive: true });
-  writeFileSync(path.join(p.src, "Settings"), settings);
-  writeFileSync(path.join(p.src, "Sources", "Startup.twin"), STARTUP);
   const steps = "Describe what a person does to see the bug, or set mode to compile, build, run or cli.";
-  writeFileSync(p.repro, `${JSON.stringify({ mode: "manual", steps }, null, 2)}\n`);
+  const repro = { mode: "manual", steps, ...(withImages ? { images: ["main"] } : {}) };
+  writeFileSync(p.repro, `${JSON.stringify(repro, null, 2)}\n`);
   if (withVb6) cpSync(VB6_TEMPLATE, p.vb6, { recursive: true });
+  if (withImages) copyImageTemplates(p.dir, { withVb6 });
   console.log(
-    `created ${rel(p.dir)}/ (project ${name}): edit src/Sources${vb6Note}, then pack; repro.json is manual until set`,
+    `created ${rel(p.dir)}/ (project ${name}${template ? `, from template ${template}` : ""}): ` +
+      `edit src/Sources${vb6Note}, then pack; repro.json is manual until set`,
   );
+  if (withImages) {
+    console.log(
+      `pictures: src/Sources/${PNGDUMP_TWIN}${withVb6 ? ` and vb6/${PNGDUMP_BAS}` : ""} save what a surface shows; ` +
+        `call PngDump.Surface Form1, "main" (or PngDump.Window for a control with no hDC), then run${withVb6 ? " and vb6" : ""}`,
+    );
+  }
 }
 
 // ------------------------------------------------------------------------ pack
@@ -499,7 +565,8 @@ function newReproducer(slug, entryTitle, template = null, withVb6 = false) {
 function pack(slug) {
   const p = where(slug);
   if (!existsSync(path.join(p.src, "Settings"))) throw new Fail(`no ${rel(p.src)}/Settings: nothing to pack`);
-  const attach = existsSync(p.repro) ? (loadRepro(slug).attach ?? []) : [];
+  const repro = existsSync(p.repro) ? loadRepro(slug) : {};
+  const attach = repro.attach ?? [];
   const r = spawnSync(process.execPath, [IMPEXP, "import", p.twinproj, p.src, "--overwrite"], {
     encoding: "utf8",
     cwd: REPO_ROOT,
@@ -511,10 +578,25 @@ function pack(slug) {
       `impexp import ${r.error ? `failed (${r.error.message})` : `exited ${r.status}`}:\n${said.trimEnd()}`,
     );
   }
-  const files = [fileEntry(`${slug}.twinproj`, p.twinproj), ...attach.map((a) => fileEntry(a, path.join(p.dir, a)))];
+  const pictures = imageZipEntries(p.dir);
+  const files = [
+    fileEntry(`${slug}.twinproj`, p.twinproj),
+    ...attach.map((a) => fileEntry(a, path.join(p.dir, a))),
+    ...pictures,
+  ];
   writeFileSync(p.zip, zipFiles(files));
-  const also = attach.length ? `, with ${attach.join(", ")}` : "";
+  const withs = [...attach, ...(pictures.length ? [`${pictures.length} files of ${IMAGES_DIR}/`] : [])];
+  const also = withs.length ? `, with ${withs.join(", ")}` : "";
   let packed = `${said}packed ${rel(p.twinproj)} and ${rel(p.zip)}${also}`;
+  // The pictures that go into the issue itself, beside the zip that holds the rest.
+  for (const name of repro.images ?? []) {
+    const compare = imageFile(path.join(p.dir, IMAGES_DIR), name, "compare");
+    packed += existsSync(compare)
+      ? `\npicture for the issue: ${rel(compare)}`
+      : `\nno ${rel(compare)} yet: it is written when run has made ${name}-tb.png and vb6 has made ${name}-vb6.png`;
+  }
+  if (repro.images?.length)
+    for (const problem of reportEmbedProblems(slug, repro.images)) packed += `\nwarning: ${problem}`;
   if (existsSync(p.vb6)) {
     const problem = vb6Problem(slug);
     if (problem) throw new Fail(`${rel(p.vb6)}/ ${problem}`);
@@ -529,11 +611,13 @@ function pack(slug) {
 // ------------------------------------------------------------ repro.json
 
 const MODES = ["compile", "build", "run", "cli", "manual"];
+// The warnings loadRepro has printed, so that a reproducer read by several commands warns once.
+const warned = new Set();
 // What `expect` may hold in each mode.
 const EXPECT_KEYS = {
   compile: ["exit", "diagnostics", "noDiagnostics"],
   build: ["exit", "message"],
-  run: ["exit", "output", "absent"],
+  run: ["exit", "output", "absent", "imagesDiffer"],
   cli: ["exit", "output", "absent"],
 };
 
@@ -541,8 +625,11 @@ const EXPECT_KEYS = {
  * Reads and strictly checks bugs/<slug>/repro.json. A fault is a Fail that names
  * the file and the key. Returns the file's content with each regular expression
  * compiled (`expect.output` as RegExp objects, `expect.message` as one).
+ *
+ * `makingPictures` is for `run` and `vb6`, which make the pictures: the VB6 picture that
+ * `expect.imagesDiffer` compares with need not be there yet, since `vb6` is what writes it.
  */
-function loadRepro(slug) {
+function loadRepro(slug, { makingPictures = false } = {}) {
   const file = where(slug).repro;
   const name = rel(file);
   const bad = (key, why) => {
@@ -557,7 +644,7 @@ function loadRepro(slug) {
   }
   const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
   if (!isObject(json)) return bad("", "must be a JSON object");
-  const keys = ["mode", "arch", "llvm", "exe", "expect", "cli", "steps", "attach", "issue", "existing"];
+  const keys = ["mode", "arch", "llvm", "exe", "expect", "cli", "steps", "attach", "images", "issue", "existing"];
   for (const key of Object.keys(json)) if (!keys.includes(key)) bad(key, "is not a key repro.json has");
   if (!MODES.includes(json.mode)) bad("mode", `must be one of ${MODES.join(", ")}`);
   const { mode } = json;
@@ -581,6 +668,8 @@ function loadRepro(slug) {
       }
       if (own.includes(a)) bad(key, `names ${a}, which is not an attachment`);
       if (a.startsWith("vb6/")) bad(key, `names ${a}, which goes into ${slug}-vb6.zip with the rest of vb6/`);
+      if (a.startsWith(`${IMAGES_DIR}/`))
+        bad(key, `names ${a}, which goes into ${slug}.zip with the rest of ${IMAGES_DIR}/`);
       if (json.attach.indexOf(a) !== i) bad(key, `names ${a} twice`);
       const file = path.join(p.dir, a);
       if (!existsSync(file) || !statSync(file).isFile()) bad(key, `names ${a}, which is not a file in ${rel(p.dir)}/`);
@@ -592,6 +681,21 @@ function loadRepro(slug) {
     const why = vb6Problem(slug);
     if (why) throw new Fail(`${rel(p.vb6)}/ ${why}`);
   }
+  // `images` names the pictures a run and a vb6 build keep in images/. The modules that draw them
+  // must be in the project, which is an error; a copy that has drifted from the template only warns.
+  if ("images" in json) {
+    if (!["run", "manual"].includes(mode)) bad("images", "applies to the run and manual modes only");
+    if (!hasSrc) bad("images", `names pictures that ${rel(p.src)}/Settings should draw, and it is not there`);
+    const problem = imagesKeyProblem(json.images);
+    if (problem) bad(problem.key, problem.why);
+    const { errors, warnings } = imageSourceCheck(p.dir);
+    if (errors.length) bad("images", errors.join("; "));
+    for (const warning of warnings) {
+      const said = `warning: ${name}: ${warning}`;
+      if (!warned.has(said)) console.error(said);
+      warned.add(said);
+    }
+  }
   if ("issue" in json && !(Number.isInteger(json.issue) && json.issue > 0)) {
     bad("issue", "must be a positive whole number, the number of a twinbasic/twinbasic issue");
   }
@@ -628,7 +732,7 @@ function loadRepro(slug) {
   if (!isObject(json.expect)) bad("expect", "is required, an object, for every mode but manual");
   const e = json.expect;
   for (const key of Object.keys(e)) {
-    if (!["exit", "diagnostics", "noDiagnostics", "output", "absent", "message"].includes(key)) {
+    if (!["exit", "diagnostics", "noDiagnostics", "output", "absent", "message", "imagesDiffer"].includes(key)) {
       bad(`expect.${key}`, "is not a key expect has");
     }
     if (!EXPECT_KEYS[mode].includes(key)) bad(`expect.${key}`, `does not apply to the ${mode} mode`);
@@ -654,6 +758,16 @@ function loadRepro(slug) {
     expect[key] = e[key].map((text, i) => regex(`expect.${key}[${i}]`, text));
   }
   if ("message" in e) expect.message = regex("expect.message", e.message);
+  if ("imagesDiffer" in e) {
+    if (typeof e.imagesDiffer !== "boolean") bad("expect.imagesDiffer", "must be true or false");
+    if (!("images" in json)) bad("expect.imagesDiffer", "needs an images list in repro.json, which names the pictures");
+    for (const picture of makingPictures ? [] : json.images) {
+      const kept = imageFile(path.join(p.dir, IMAGES_DIR), picture, "vb6");
+      if (!existsSync(kept)) {
+        bad("expect.imagesDiffer", `needs ${rel(kept)}, the VB6 picture to compare with: vb6 makes it`);
+      }
+    }
+  }
   if (!Object.keys(e).length) bad("expect", "is empty: say what a reproduction looks like");
   out.expect = expect;
   return out;
@@ -681,11 +795,11 @@ function findTools(ide) {
 
 // A tool run as a child, with its output collected. A tool that outlives its
 // time limit is ended with its process tree, by pid.
-function runNode(scriptArgs, limitMs) {
+function runNode(scriptArgs, limitMs, env = {}) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, scriptArgs, {
       cwd: REPO_ROOT,
-      env: process.env,
+      env: { ...process.env, ...env },
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
     });
@@ -741,29 +855,105 @@ async function compileOrBuild(slug, o) {
   return { ...r, json, message: r.stderr.trim(), output: r.stdout };
 }
 
-/** tbrun on a staged copy of src/, with the probe module added unless --exe runs Sub Main in the exe. */
+/**
+ * tbrun on a staged copy of src/, with the probe module added unless --exe runs Sub Main in the exe.
+ *
+ * With `o.images`, the names of the pictures the probe draws, an empty folder beside the stage is
+ * named in BUGREPRO_IMAGES in tbrun's environment, which the IDE and, under --exe, the exe inherit
+ * from it (launchIde and runExe both start from process.env). The result's `imagesDir` is that
+ * folder, which the caller removes; it is beside the stage, not in it, because the stage is
+ * the project and is imported whole.
+ */
 async function runProbe(slug, o) {
   const p = where(slug);
   const stage = path.join(tmpdir(), "bugrepro", String(o.port), slug);
+  const imagesDir = o.images ? `${stage}.images` : null;
   rmSync(stage, { recursive: true, force: true });
+  if (imagesDir) {
+    rmSync(imagesDir, { recursive: true, force: true });
+    mkdirSync(imagesDir, { recursive: true });
+  }
   try {
     cpSync(p.src, stage, { recursive: true });
     mkdirSync(path.join(stage, "Sources"), { recursive: true });
     if (!o.exe) writeFileSync(path.join(stage, "Sources", "TbRunProbe.twin"), PROBE);
     const flags = [...ideFlags(o), ...(o.llvm ? ["--llvm"] : []), ...(o.exe ? ["--exe"] : [])];
-    const r = await runNode([TBRUN, stage, ...flags], limitFor(o.timeout, 120));
-    return { ...r, json: null, message: r.stderr.trim(), output: r.stdout };
+    const env = imagesDir ? { [IMAGES_ENV]: imagesDir } : {};
+    const r = await runNode([TBRUN, stage, ...flags], limitFor(o.timeout, 120), env);
+    return { ...r, json: null, message: r.stderr.trim(), output: r.stdout, imagesDir };
+  } catch (e) {
+    if (imagesDir) rmSync(imagesDir, { recursive: true, force: true });
+    throw e;
   } finally {
     rmSync(stage, { recursive: true, force: true });
   }
 }
 
+/**
+ * The names under "images" in a reproducer's repro.json, checked as loadRepro checks them, or
+ * null when it has none. A repro.json that cannot be read is not this function's to report: the
+ * commands that need the rest of it say so.
+ */
+function reproImages(slug) {
+  const { repro } = where(slug);
+  if (!existsSync(repro)) return null;
+  try {
+    if (!("images" in JSON.parse(readFileSync(repro, "utf8").replace(/^\u{FEFF}/u, "")))) return null;
+  } catch {
+    return null;
+  }
+  return loadRepro(slug, { makingPictures: true }).images;
+}
+
+/**
+ * After `run`: keeps each picture the probe wrote as images/<name>-tb.png, notes the beta that drew it
+ * for the comparison's label, and writes <name>-compare.png where the VB6 picture is already there.
+ * Prints a line a picture. Returns 0, or 9 when a picture is missing or cannot be read.
+ */
+function keepRunImages(slug, names, fromDir, ide) {
+  const dir = path.join(where(slug).dir, IMAGES_DIR);
+  const { found, missing } = collectImages(fromDir, dir, names, "tb");
+  const beta = buildNumber(findIde(ide));
+  if (found.length) {
+    if (beta) writeFileSync(path.join(dir, BETA_FILE), `${beta}\n`);
+    else rmSync(path.join(dir, BETA_FILE), { force: true });
+  }
+  let code = 0;
+  for (const name of missing) {
+    console.error(
+      `image ${name}: the probe wrote no ${name}.png: call PngDump.Surface or PngDump.Window with that name`,
+    );
+    code = 9;
+  }
+  for (const name of found) {
+    console.log(`image ${name}: kept as ${rel(imageFile(dir, name, "tb"))}`);
+    try {
+      const compared = writeComparison(dir, name, beta);
+      if (compared) console.log(`${compared.line} (${rel(compared.file)})`);
+    } catch (e) {
+      if (!(e instanceof ImageError)) throw e;
+      console.error(`image ${name}: ${e.message}`);
+      code = 9;
+    }
+  }
+  return code;
+}
+
 /**
  * The compiler executable, as a cli repro.json says: one command, or several in
  * turn in the one temp folder. Their output is joined, and their exit code is
  * the one they all gave, or the codes joined by commas when they differ.
+ *
+ * Each command runs on a private desktop, in a kill-on-close job, with its
+ * standard output and error in files (launchOnDesktop). The compiler opens a
+ * modal message box for some inputs, a damaged project among them, and waits for
+ * it to be closed: on the user's own desktop that is a box to dismiss by hand, on
+ * a private one nobody sees it. So the launcher records every dialog box the
+ * command opens and presses its OK button, which lets the command go on. A
+ * command's output is one `dialog: <title>: <text>` line per box, in the order
+ * they opened, then its standard output, then its standard error.
  */
-function runCli(slug, repro, o) {
+async function runCli(slug, repro, o) {
   const ide = findTools(o.ide);
   const exe = compilerExe(ide);
   if (!existsSync(exe)) throw new Fail(`no compiler beside the IDE at ${exe}`);
@@ -779,13 +969,19 @@ function runCli(slug, repro, o) {
       copyFileSync(p.twinproj, project);
       cpSync(p.src, src, { recursive: true });
     }
+    // The attachments, at their own relative paths: {tmp}/<attach path> is a copy.
+    for (const a of repro.attach ?? []) {
+      const to = path.join(scratch, ...a.split("/"));
+      mkdirSync(path.dirname(to), { recursive: true });
+      copyFileSync(path.join(p.dir, a), to);
+    }
     const commands = repro.cli.every(Array.isArray) ? repro.cli : [repro.cli];
     const limit = (o.timeout ?? 120) * 1000;
     const codes = [];
     let stdout = "";
     let stderr = "";
     let output = "";
-    for (const command of commands) {
+    for (const [n, command] of commands.entries()) {
       const argv = command.map((a) =>
         a
           .replaceAll("{project}", project)
@@ -793,21 +989,47 @@ function runCli(slug, repro, o) {
           .replaceAll("{tmp}", scratch)
           .replaceAll("{ide}", path.resolve(path.dirname(ide))),
       );
-      const r = spawnSync(exe, argv, {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: limit,
-        windowsHide: true,
-      });
-      if (r.error) {
-        throw new Fail(
-          r.error.code === "ETIMEDOUT" ? `the compiler executable ran past ${limit / 1000} s` : r.error.message,
-        );
+      // The scratch folder is deleted at the end, and holds these files.
+      const outFile = path.join(scratch, `.cli-${n}.out`);
+      const errFile = path.join(scratch, `.cli-${n}.err`);
+      let run;
+      try {
+        run = await launchOnDesktop({
+          exe,
+          args: argv,
+          desktop: `bugrepro-cli-${process.pid}`,
+          env: process.env,
+          stdout: outFile,
+          stderr: errFile,
+          dialogs: "close",
+        });
+      } catch (e) {
+        throw new Fail(`could not run the compiler executable on a private desktop: ${e.message}`);
+      }
+      let timer;
+      const timedOut = await Promise.race([
+        run.exited.then(() => false),
+        new Promise((r) => {
+          timer = setTimeout(() => r(true), limit);
+        }),
+      ]);
+      clearTimeout(timer);
+      if (timedOut) {
+        // By pid with its tree; the launcher's end closes the job, which takes whatever the kill missed.
+        killTree(run.pid);
+        run.launcher.kill();
+      }
+      const { code, dialogs } = await run.finished;
+      if (timedOut) {
+        const boxes = dialogs.length ? `; it opened ${dialogs.map((d) => `"${d.title}"`).join(", ")}` : "";
+        throw new Fail(`the compiler executable ran past ${limit / 1000} s${boxes}`);
       }
-      codes.push(r.status);
-      stdout += r.stdout ?? "";
-      stderr += r.stderr ?? "";
-      output += `${r.stdout ?? ""}${r.stderr ?? ""}`;
+      const read = (f) => (existsSync(f) ? readFileSync(f, "utf8") : "");
+      const said = dialogs.map((d) => `dialog: ${d.title}: ${d.text.replace(/\s*\r?\n\s*/g, " ")}\n`).join("");
+      codes.push(code);
+      stdout += read(outFile);
+      stderr += read(errFile);
+      output += `${said}${read(outFile)}${read(errFile)}`;
     }
     const code = codes.every((c) => c === codes[0]) ? codes[0] : codes.join(",");
     return { code, stdout, stderr, json: null, message: "", output };
@@ -855,9 +1077,25 @@ async function runVb6(slug) {
   if (why) throw new Fail(`${rel(p.vb6)}/ ${why}`);
   const exe = findVb6(values.vb6);
   if (!exe) throw new Fail(values.vb6 ? `no such file: ${values.vb6}\n${NO_VB6}` : NO_VB6);
+  // The pictures Probe.exe draws are written to a folder of ours, named in BUGREPRO_IMAGES.
+  const names = reproImages(slug);
+  const imagesDir = names ? mkdtempSync(path.join(tmpdir(), "bugrepro-vb6-images-")) : null;
+  try {
+    return await buildAndRunVb6(slug, exe, names, imagesDir);
+  } finally {
+    if (imagesDir) rmSync(imagesDir, { recursive: true, force: true });
+  }
+}
+
+async function buildAndRunVb6(slug, exe, names, imagesDir) {
+  const p = where(slug);
   let r;
   try {
-    r = await runRepro(exe, p.vb6, { timeoutMs: (timeout ?? 30) * 1000, keep: values.keep });
+    r = await runRepro(exe, p.vb6, {
+      timeoutMs: (timeout ?? 30) * 1000,
+      keep: values.keep,
+      env: imagesDir ? { [IMAGES_ENV]: imagesDir } : {},
+    });
   } catch (e) {
     throw new Fail(`vb6: ${e.message}`);
   }
@@ -879,7 +1117,36 @@ async function runVb6(slug) {
     console.error(`vb6: ${REPRO_PROJECT}.exe exited with code ${r.status}`);
     return 8;
   }
-  return 0;
+  return names ? keepVb6Images(slug, names, imagesDir) : 0;
+}
+
+/**
+ * After `vb6`: keeps each picture Probe.exe wrote as images/<name>-vb6.png, and writes
+ * <name>-compare.png where the twinBASIC picture is already there, labelled with the beta that
+ * `run` recorded. Prints a line a picture. Returns 0, or 9 when a picture is missing or unreadable.
+ */
+function keepVb6Images(slug, names, fromDir) {
+  const dir = path.join(where(slug).dir, IMAGES_DIR);
+  const { found, missing } = collectImages(fromDir, dir, names, "vb6");
+  let code = 0;
+  for (const name of missing) {
+    console.error(
+      `image ${name}: Probe.exe wrote no ${name}.png: call PngDump.Surface or PngDump.Window with that name`,
+    );
+    code = 9;
+  }
+  for (const name of found) {
+    console.log(`image ${name}: kept as ${rel(imageFile(dir, name, "vb6"))}`);
+    try {
+      const compared = writeComparison(dir, name);
+      if (compared) console.log(`${compared.line} (${rel(compared.file)})`);
+    } catch (e) {
+      if (!(e instanceof ImageError)) throw e;
+      console.error(`image ${name}: ${e.message}`);
+      code = 9;
+    }
+  }
+  return code;
 }
 
 // A reproducer is a folder with src/Settings; for verify, one with a repro.json
@@ -911,6 +1178,7 @@ function mismatches(repro, r) {
   for (const re of e.output ?? []) if (!re.test(r.output)) problems.push(`the output does not match /${re.source}/`);
   for (const re of e.absent ?? []) if (re.test(r.output)) problems.push(`the output matches /${re.source}/`);
   if (e.message && !e.message.test(r.message)) problems.push(`the message does not match /${e.message.source}/`);
+  if ("imagesDiffer" in e) problems.push(...imagesDifferProblems(e.imagesDiffer, r.images ?? []));
   return problems;
 }
 
@@ -918,13 +1186,17 @@ function mismatches(repro, r) {
 async function verifyOne(slug, repro, lane) {
   if (repro.mode === "manual") return { slug, status: "manual", detail: repro.steps ?? "(no steps recorded)" };
   const o = { ide: values.ide, port: lane, arch: repro.arch, timeout, show: values.show, hide: values.hide };
+  // The pictures of a run that is judged by them are staged in the temp folder, and never kept in the tree.
+  let imagesDir = null;
   try {
     if (existsSync(path.join(where(slug).src, "Settings"))) pack(slug);
     let r;
     let table;
-    if (repro.mode === "cli") r = runCli(slug, repro, o);
+    if (repro.mode === "cli") r = await runCli(slug, repro, o);
     else if (repro.mode === "run") {
-      r = await runProbe(slug, { ...o, llvm: repro.llvm, exe: repro.exe });
+      const judged = "imagesDiffer" in repro.expect;
+      r = await runProbe(slug, { ...o, llvm: repro.llvm, exe: repro.exe, images: judged ? repro.images : null });
+      imagesDir = r.imagesDir;
       table = TBRUN_EXIT;
     } else {
       r = await compileOrBuild(slug, { ...o, build: repro.mode === "build", llvm: repro.llvm });
@@ -939,6 +1211,14 @@ async function verifyOne(slug, repro, lane) {
       const said = (r.message || r.stdout || "no output").trim().split("\n").slice(-3).join(" | ");
       return { slug, status: "harness", detail: `exit ${r.code}: ${said}` };
     }
+    if (imagesDir) {
+      try {
+        r = { ...r, images: compareWithKept(imagesDir, path.join(where(slug).dir, IMAGES_DIR), repro.images) };
+      } catch (e) {
+        if (!(e instanceof ImageError)) throw e;
+        return { slug, status: "harness", detail: e.message };
+      }
+    }
     const problems = mismatches(repro, r);
     return problems.length
       ? { slug, status: "no-longer", detail: problems.join("; ") }
@@ -946,6 +1226,8 @@ async function verifyOne(slug, repro, lane) {
   } catch (e) {
     if (!(e instanceof Fail)) throw e;
     return { slug, status: "harness", detail: e.message.split("\n").join(" | ") };
+  } finally {
+    if (imagesDir) rmSync(imagesDir, { recursive: true, force: true });
   }
 }
 
@@ -1178,10 +1460,34 @@ function prepareFiling(slug, issue, existing, original, text) {
   const head = existing
     ? `Covered by the existing issue [twinbasic/twinbasic#${issue}](${issueUrl(issue)}).`
     : `Filed as [twinbasic/twinbasic#${issue}](${issueUrl(issue)}).`;
-  const report = `${[head, "", ...reportLines(current, entry)].join(current.eol)}${current.eol}`;
+  // REPORT.md sits beside the pictures it embeds, so their paths lose bugs/<slug>/.
+  const lines = reportLines(current, entry).map((line) => line.replaceAll(`](bugs/${slug}/images/`, "](images/"));
+  const report = `${[head, "", ...lines].join(current.eol)}${current.eol}`;
   return { slug, issue, existing, queued, filed, report, text: withoutEntry(current, entry), title: entry.title };
 }
 
+/**
+ * What keeps a reproducer's pictures out of its report: its entry in the queue file, or the
+ * REPORT.md of a filed one, must embed each `<name>-compare.png` (lib/repro-images.mjs's
+ * embedProblems). Each line names the report.
+ */
+function reportEmbedProblems(slug, names) {
+  const p = where(slug);
+  const imagesDir = path.join(p.dir, IMAGES_DIR);
+  const report = path.join(p.dir, "REPORT.md");
+  if (existsSync(report)) {
+    return embedProblems(readFileSync(report, "utf8"), p.dir, imagesDir, names).map((x) => `${rel(report)}: ${x}`);
+  }
+  const { queue } = readQueue();
+  const named = entriesNaming(queue, slug);
+  if (named.length !== 1) {
+    const what = named.length ? `${named.length} entries name` : "no entry names";
+    return [`${rel(QUEUE)}: ${what} ${slug}, so whether it shows its pictures is not known`];
+  }
+  const text = queue.lines.slice(named[0].from, named[0].to).join("");
+  return embedProblems(text, REPO_ROOT, imagesDir, names).map((x) => `${rel(QUEUE)}, ${named[0].title}: ${x}`);
+}
+
 /** Moves the reproducer, writes REPORT.md and repro.json's issue, and rewrites the queue file. */
 function carryOutFiling(plan) {
   mkdirSync(FILED_DIR, { recursive: true });
@@ -1189,7 +1495,7 @@ function carryOutFiling(plan) {
   writeFileSync(path.join(plan.filed, "REPORT.md"), plan.report);
   const file = path.join(plan.filed, "repro.json");
   const raw = readFileSync(file, "utf8");
-  const json = JSON.parse(raw.replace(/^/, ""));
+  const json = JSON.parse(raw.replace(/^\u{FEFF}/u, ""));
   json.issue = plan.issue;
   if (plan.existing) json.existing = true;
   else delete json.existing;
@@ -1286,7 +1592,7 @@ async function main() {
   };
   switch (command) {
     case "new":
-      newReproducer(slug, title, template, values.withVb6);
+      newReproducer(slug, title, template, values.withVb6, values.withImages);
       return 0;
     case "vb6":
       return runVb6(slug);
@@ -1311,10 +1617,17 @@ async function main() {
     case "run": {
       requireReproducer(slug);
       findTools(o.ide);
-      const r = await runProbe(slug, o);
-      printRun(r);
-      if (r.timedOut) throw new Fail("tbrun outlived its time limit and was ended");
-      return mapped(TBRUN_EXIT, r.code);
+      const names = reproImages(slug);
+      const r = await runProbe(slug, { ...o, images: names });
+      try {
+        printRun(r);
+        if (r.timedOut) throw new Fail("tbrun outlived its time limit and was ended");
+        const code = mapped(TBRUN_EXIT, r.code);
+        // A probe that did not finish has no pictures worth keeping, and its own exit code is the finding.
+        return names && code === 0 ? keepRunImages(slug, names, r.imagesDir, o.ide) : code;
+      } finally {
+        if (r.imagesDir) rmSync(r.imagesDir, { recursive: true, force: true });
+      }
     }
     default:
       return verify();
diff --git a/scripts/check_examples.mjs b/scripts/check_examples.mjs
index 26140271d..c157f4e30 100644
--- a/scripts/check_examples.mjs
+++ b/scripts/check_examples.mjs
@@ -124,6 +124,8 @@ import {
   runBatch,
   runProbes,
   sectionOf,
+  templateChain,
+  templateResolves,
   unresolvedName,
 } from "./lib/example-batches.mjs";
 import {
@@ -281,46 +283,9 @@ function defaultProject(rel) {
   return "console";
 }
 
-/**
- * Which template a template is a delta of.
- *
- * A template is not a whole exported tree, which would repeat a stage set that
- * is mostly the same list in every copy.
- * A template named here holds only the files that DIFFER from its base:
- * `vb-private` is a Settings with one reference rewritten, `cef` and
- * `webview2` are one stage file each.
- *
- * The relation lives in the tool rather than in the tree on purpose. The
- * alternative was a marker file in the template directory, and a template
- * directory is an exported twinBASIC project that the compiler's `import` verb
- * has to accept -- so a stray file there is a thing to test rather than a thing
- * to declare.
- */
-const TEMPLATE_BASE = {
-  "vb-private": "console",
-  "cc-private": "packages",
-  "wnc-private": "packages",
-  "cef-private": "cef",
-  implicit: "console",
-  cef: "packages",
-  webview2: "packages",
-};
-
-/** A template and everything it inherits from, base first. */
-function templateChain(name) {
-  const chain = [];
-  for (let n = name, guard = 0; n; n = TEMPLATE_BASE[n]) {
-    if (guard++ > 8) throw new Error(`template inheritance cycle at ${name}`);
-    chain.unshift(n);
-  }
-  return chain;
-}
-
-/** Does this template resolve to a project with a Settings anywhere in its chain? */
-function templateResolves(name) {
-  if (!existsSync(path.join(TEMPLATES, name))) return false;
-  return templateChain(name).some((n) => existsSync(path.join(TEMPLATES, n, "Settings")));
-}
+// Which template a template is a delta of, the chain of them, and whether a
+// name resolves to a project: lib/example-batches.mjs (TEMPLATE_BASE,
+// templateChain, templateResolves), where the probes read them.
 
 // What `inherits=` does to a slot that was inferred for a Module container. A
 // sample naming a base is class code-behind whatever the classifier thought,
@@ -448,7 +413,7 @@ function select(fences) {
       }
       continue;
     }
-    if (!templateResolves(fence.project)) {
+    if (!templateResolves(TEMPLATES, fence.project)) {
       addFinding(
         fence,
         `no such template project: ${fence.project}`,
diff --git a/scripts/lib/cli-cases.mjs b/scripts/lib/cli-cases.mjs
index 4a00a9a57..45bc9dd88 100644
--- a/scripts/lib/cli-cases.mjs
+++ b/scripts/lib/cli-cases.mjs
@@ -618,6 +618,10 @@ bad("scripts/tbrun.mjs", ["no-such-dir", "--quiet", "1.5"], thenUsage(NOT_WHOLE(
   bad(tool, ["run", "no-such-bug", "--vb6", "x"], thenUsage("--vb6 does not apply to run", tool));
   bad(tool, ["verify", "--vb6", "x"], thenUsage("--vb6 does not apply to verify", tool));
   bad(tool, ["pack", "no-such-bug", "--with-vb6"], thenUsage("--with-vb6 does not apply to pack", tool));
+  bad(tool, ["pack", "no-such-bug", "--with-images"], thenUsage("--with-images does not apply to pack", tool));
+  bad(tool, ["run", "no-such-bug", "--with-images"], thenUsage("--with-images does not apply to run", tool));
+  bad(tool, ["vb6", "no-such-bug", "--with-images"], thenUsage("--with-images does not apply to vb6", tool));
+  bad(tool, ["verify", "--with-images"], thenUsage("--with-images does not apply to verify", tool));
   bad(tool, ["new", "no-such-bug", "title", "--vb6", "x"], thenUsage("--vb6 does not apply to new", tool));
   bad(tool, ["vb6", "no-such-bug"], "no such reproducer: bugs/no-such-bug (no src/Settings and no repro.json)\n");
   // `file` moves things, so these are the refusals only: every one is decided from the
diff --git a/scripts/lib/example-batches.mjs b/scripts/lib/example-batches.mjs
index bd2dd84ab..fcd2bd7bc 100644
--- a/scripts/lib/example-batches.mjs
+++ b/scripts/lib/example-batches.mjs
@@ -8,6 +8,9 @@
 // run. The lane that stages and builds for real stays in check_examples.mjs,
 // with everything else that reads the command line.
 
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { REPO_ROOT } from "../../lib/repo-paths.mjs";
 import {
   BODY_SLOTS,
   CONCAT_KEY,
@@ -24,6 +27,7 @@ import {
 } from "./tb-fences.mjs";
 import {
   RUN_DONE,
+  UNLOAD_SUB,
   dispatcherText,
   expectedOutput,
   isRunFence,
@@ -37,6 +41,51 @@ import {
 export const DEFAULT_JOBS = 4;
 export const DEFAULT_BATCH = 120;
 
+// ------------------------------------------------------------------ templates
+
+/**
+ * Which template a template is a delta of.
+ *
+ * A template is not a whole exported tree, which would repeat a stage set that
+ * is mostly the same list in every copy.
+ * A template named here holds only the files that DIFFER from its base:
+ * `vb-private` is a Settings with one reference rewritten, `cef` and
+ * `webview2` are one stage file each, and `form` is a real Form1 and the
+ * console's stage set less its stand-in for that form.
+ *
+ * The relation lives in the tool rather than in the tree on purpose. The
+ * alternative was a marker file in the template directory, and a template
+ * directory is an exported twinBASIC project that the compiler's `import` verb
+ * has to accept -- so a stray file there is a thing to test rather than a thing
+ * to declare.
+ */
+export const TEMPLATE_BASE = {
+  "vb-private": "console",
+  "cc-private": "packages",
+  "wnc-private": "packages",
+  "cef-private": "cef",
+  implicit: "console",
+  form: "console",
+  cef: "packages",
+  webview2: "packages",
+};
+
+/** A template and everything it inherits from, base first. */
+export function templateChain(name) {
+  const chain = [];
+  for (let n = name, guard = 0; n; n = TEMPLATE_BASE[n]) {
+    if (guard++ > 8) throw new Error(`template inheritance cycle at ${name}`);
+    chain.unshift(n);
+  }
+  return chain;
+}
+
+/** Does this template resolve to a project with a Settings anywhere in its chain? */
+export function templateResolves(templatesDir, name) {
+  if (!existsSync(path.join(templatesDir, name))) return false;
+  return templateChain(name).some((n) => existsSync(path.join(templatesDir, n, "Settings")));
+}
+
 /**
  * Join every `concat_group` into one fence before anything else looks at them.
  *
@@ -1451,10 +1500,23 @@ export async function runProbes(say) {
         dLines.includes(`Resume tbxNext${i}`) &&
         dLines.includes(`tbxNext${i}:`),
     ) &&
-      !dLines.includes("On Error Resume Next") &&
-      dLines.at(-4) === `Debug.Print "${RUN_DONE}"`,
+      dLines[dLines.indexOf(`Debug.Print "${RUN_DONE}"`) + 1] === "End Sub" &&
+      // The only `On Error Resume Next` is the unload Sub's own, after the Sub that runs the samples.
+      dLines.indexOf("On Error Resume Next") > dLines.indexOf(`Debug.Print "${RUN_DONE}"`),
     "dispatcher: each call does not have a handler of its own (On Error GoTo, label, Resume), or the done line is missing",
   );
+  // Each sample's forms are unloaded before its end marker, so a form it left loaded neither keeps
+  // the run waiting (`[DEBUGGER] Waiting for remaining forms to close...`) nor reaches the next sample.
+  expect(
+    [0, 1].every((i) => {
+      const call = dLines.indexOf(`tbx_${i ? "bbb" : "aaa"}.tbxBody`);
+      const unload = dLines.indexOf(UNLOAD_SUB, call);
+      return unload > call && unload < dLines.indexOf(`Debug.Print "[tbx-run] end ${i}"`);
+    }) &&
+      dLines.includes(`Private Sub ${UNLOAD_SUB}()`) &&
+      dLines.includes("Unload Forms(i)"),
+    "dispatcher: a form a sample left loaded is not unloaded before the sample's end marker",
+  );
   // The markers are what parseRun reads, so the dispatcher's own text is run
   // through it: what it prints for a sample that returns is a match.
   const marker = (s) => `[tbx-run] ${s}`;
@@ -1569,6 +1631,102 @@ export async function runProbes(say) {
     "run batching: a selection with no run sample made run batches",
   );
 
+  // `project=form`: a run fence is built in a project made from the `form` template, apart from the
+  // fences of every other template, and a projname group whose fences say it keeps that template.
+  const inForm = (f) => ({ ...f, project: "form" });
+  const formRunner = inForm(sample("formrunner", { run: true, rel: "F.md" })),
+    formCtx = inForm(sample("formctx", { hidden: true, rel: "F.md" })),
+    formFile = inForm(sample("formfile", { group: "gf", slot: "module", rel: "F.md" })),
+    formGroupRunner = inForm(sample("formgrunner", { group: "gf", run: true, rel: "F.md" }));
+  const formSel = [runner, formRunner, formCtx, formFile, formGroupRunner];
+  const formPart = partitionRun(formSel);
+  const formBatches = makeBatches(formPart.run);
+  const batchOf = (id) => formBatches.find((b) => b.fences.some((f) => f.id === id));
+  expect(
+    ids(formPart.run) === "runner,formrunner,formctx,formfile,formgrunner",
+    `form batching: the run list is ${ids(formPart.run)}`,
+  );
+  expect(
+    batchOf("formrunner")?.project === "form" &&
+      batchOf("runner")?.project === "console" &&
+      batchOf("formrunner") !== batchOf("runner") &&
+      !batchOf("formrunner").fences.some((f) => f.id === "runner"),
+    "form batching: a project=form run fence shared a project with a console one, or lost its template",
+  );
+  expect(
+    batchOf("formgrunner")?.project === "form" &&
+      batchOf("formgrunner").group === "gf" &&
+      batchOf("formgrunner").fences.some((f) => f.id === "formfile") &&
+      ids(batchOf("formgrunner").fences.filter(isRunFence)) === "formgrunner",
+    "form batching: a projname group of a module and a run fence in the form template was not one form project of its own",
+  );
+  expect(
+    batchOf("formrunner").fences.some((f) => f.id === "formctx"),
+    "form batching: a page's hidden context did not travel into its form project",
+  );
+
+  // The templates, read from the tree: a name in TEMPLATE_BASE has a directory and a base that
+  // resolves, `form` is a delta over `console`, and its stage set is console's less the Form1 stand-in.
+  const templates = path.join(REPO_ROOT, "test", "example-projects");
+  expect(
+    Object.entries(TEMPLATE_BASE).every(
+      ([name, base]) => existsSync(path.join(templates, name)) && templateResolves(templates, base),
+    ),
+    "templates: a template named in TEMPLATE_BASE has no directory, or a base that does not resolve",
+  );
+  expect(
+    templateChain("form").join() === "console,form" &&
+      templateChain("cef-private").join() === "packages,cef,cef-private" &&
+      templateChain("console").join() === "console",
+    `templates: chains are ${templateChain("form")} / ${templateChain("cef-private")} / ${templateChain("console")}`,
+  );
+  expect(
+    templateResolves(templates, "form") && !templateResolves(templates, "no-such-template"),
+    "templates: `form` does not resolve, or a name with no directory does",
+  );
+  let cycleThrown = false;
+  TEMPLATE_BASE["probe-a"] = "probe-b";
+  TEMPLATE_BASE["probe-b"] = "probe-a";
+  try {
+    templateChain("probe-a");
+  } catch {
+    cycleThrown = true;
+  } finally {
+    delete TEMPLATE_BASE["probe-a"];
+    delete TEMPLATE_BASE["probe-b"];
+  }
+  expect(cycleThrown, "templates: a cycle in TEMPLATE_BASE did not throw");
+  const readTemplate = (name, file) => readFileSync(path.join(templates, name, "Sources", file), "utf8");
+  // The declarations of a stage set: its lines that are neither blank nor a comment.
+  const declarationsOf = (text) => text.split(/\r?\n/).filter((l) => l.trim() && !l.trim().startsWith("'"));
+  const consoleStage = declarationsOf(readTemplate("console", "tbxStage.twin"));
+  const formStage = declarationsOf(readTemplate("form", "tbxStage.twin"));
+  const standIn = "    Public Form1 As Form";
+  expect(
+    consoleStage.filter((l) => l === standIn).length === 1 &&
+      !formStage.includes(standIn) &&
+      consoleStage.filter((l) => l !== standIn).join("\n") === formStage.join("\n"),
+    "templates: the form template's stage set is not the console's less `Public Form1 As Form`",
+  );
+  const formClass = readTemplate("form", "Form1.twin");
+  const formDesigner = JSON.parse(readTemplate("form", "Form1.tbform"));
+  const classId = /\[FormDesignerId\("([0-9A-F-]+)"\)\]/i.exec(formClass)?.[1];
+  expect(
+    classId &&
+      formDesigner.length === 1 &&
+      formDesigner[0].FormDesignerId === `{${classId}}` &&
+      formDesigner[0].Name === "Form1" &&
+      /^\s*Class Form1\s*$/m.test(formClass) &&
+      /\[PredeclaredId\]/.test(formClass),
+    "templates: Form1.twin and Form1.tbform do not name one designer id, or Form1 is not a predeclared class",
+  );
+  // An empty `_children` array makes the compiler report TB5247 (no designer found for the form): an
+  // empty form has no `_children` key at all.
+  expect(
+    !("_children" in formDesigner[0]),
+    "templates: Form1.tbform has a `_children` key, and an empty array fails with TB5247",
+  );
+
   // The markup must be invisible to the site. Verified against the REAL
   // pipeline -- createMarkdownIt plus the highlighter -- because a bare
   // markdown-it is a different renderer, which is the mistake WIP.md's
diff --git a/scripts/lib/example-run.mjs b/scripts/lib/example-run.mjs
index 400d066f7..9ec077f18 100644
--- a/scripts/lib/example-run.mjs
+++ b/scripts/lib/example-run.mjs
@@ -19,6 +19,8 @@ import { logicalLines } from "./twin-api.mjs";
 export const RUN_MODULE = "tbxRun";
 export const RUN_SUB = "tbxRunAll";
 export const RUN_FILE = "tbxRun.twin";
+/** The generated Sub that unloads every form a sample left loaded. */
+export const UNLOAD_SUB = "tbxUnloadForms";
 
 /** What a marker line starts with, and the line that says the dispatcher finished. */
 export const RUN_TAG = "[tbx-run]";
@@ -209,6 +211,13 @@ export function judgeOutput(expected, output) {
  * erases the IDE's own build log from the console, so what is left is the
  * dispatcher's.
  *
+ * After each call every form the sample left loaded is unloaded (`tbxUnloadForms`),
+ * before the sample's end marker. A project with a loaded form does not end: the
+ * run prints `[DEBUGGER] Waiting for remaining forms to close...` and waits, and
+ * the next sample would find the form with what the last one drew on it. A
+ * sample that forgets `Unload Form1` therefore costs nothing, and none sees
+ * another's form.
+ *
  * @param {string[]} modules  the generated module names, in the order the
  *   samples are numbered
  */
@@ -226,10 +235,24 @@ export function dispatcherText(modules) {
       `        Resume tbxNext${i}`,
       `tbxNext${i}:`,
       "        On Error GoTo 0",
+      `        ${UNLOAD_SUB}`,
       `        Debug.Print "${RUN_TAG} end ${i}"`,
     );
   });
-  out.push(`        Debug.Print "${RUN_DONE}"`, "    End Sub", "End Module", "");
+  out.push(
+    `        Debug.Print "${RUN_DONE}"`,
+    "    End Sub",
+    "",
+    `    Private Sub ${UNLOAD_SUB}()`,
+    "        Dim i As Long",
+    "        On Error Resume Next",
+    "        For i = Forms.Count - 1 To 0 Step -1",
+    "            Unload Forms(i)",
+    "        Next i",
+    "    End Sub",
+    "End Module",
+    "",
+  );
   return out.join("\n");
 }
 
diff --git a/scripts/lib/png.mjs b/scripts/lib/png.mjs
new file mode 100644
index 000000000..0e5866a73
--- /dev/null
+++ b/scripts/lib/png.mjs
@@ -0,0 +1,435 @@
+// PNG files in Node, for scripts/bug_repro.mjs: a graphical bug report is best shown
+// by what twinBASIC drew beside what VB6 drew, and `verify` can judge by the same
+// two pictures. The capture modules (test/repro-templates/png/PngDump.twin and
+// PngDump.bas) write the pictures; this reads them, compares them and writes the
+// side-by-side image that goes into the issue.
+//
+// Only `zlib` is used, no dependency. zlib.crc32 is the checksum PNG chunks carry.
+//
+//   decodePng(buf)       -> { width, height, rgba }   8-bit RGB, RGBA and palette, not interlaced
+//   encodePng(image)     -> Buffer                    RGBA, filter 0 on every row
+//   comparePngs(a, b)    -> { sameSize, differing }
+//   composeComparison(tb, vb6, labels, options)       three panels with labels, as an image
+//
+// WHAT IT REFUSES. A PNG that is not 8 bits to the channel, is grey, grey with alpha,
+// interlaced or truncated, has a chunk whose CRC is wrong, or whose pixel data does not
+// inflate to the size its header says. GDI+ writes none of those from PngDump's 24-bit
+// bitmap, so refusing is a statement that the file is not what the capture module
+// wrote, and each refusal says which of these it was.
+
+import zlib from "node:zlib";
+
+const SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+// Colour types decoded, and the channels each stores per pixel.
+const CHANNELS = { 2: 3, 3: 1, 6: 4 };
+const COLOUR_NAMES = { 0: "greyscale", 4: "greyscale with alpha" };
+const MAX_PIXELS = 100_000_000;
+
+const isImage = (x) => x !== null && typeof x === "object" && !Buffer.isBuffer(x) && !(x instanceof Uint8Array);
+
+/** An image `{ width, height, rgba }`, from one as it is or from the bytes of a PNG file. */
+function asImage(x) {
+  return isImage(x) ? x : decodePng(x);
+}
+
+function chunk(type, data) {
+  const out = Buffer.alloc(12 + data.length);
+  out.writeUInt32BE(data.length, 0);
+  out.write(type, 4, "latin1");
+  data.copy(out, 8);
+  out.writeUInt32BE(zlib.crc32(out.subarray(4, 8 + data.length)), 8 + data.length);
+  return out;
+}
+
+/**
+ * The pixels of a PNG file.
+ *
+ * @param {Buffer | Uint8Array} input  the file's bytes
+ * @returns {{ width: number, height: number, rgba: Uint8Array }}  four bytes a pixel, rows from the top
+ * @throws {Error} with a message that says what is wrong with the file
+ */
+export function decodePng(input) {
+  const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
+  if (buf.length < 8 || !buf.subarray(0, 8).equals(SIGNATURE)) throw new Error("not a PNG: the signature is wrong");
+  let pos = 8;
+  let header = null;
+  let palette = null;
+  let alphas = null;
+  let ended = false;
+  const idat = [];
+  while (pos < buf.length && !ended) {
+    if (pos + 12 > buf.length) throw new Error("the PNG is truncated inside a chunk header");
+    const length = buf.readUInt32BE(pos);
+    const type = buf.toString("latin1", pos + 4, pos + 8);
+    if (pos + 12 + length > buf.length) throw new Error(`the PNG is truncated inside its ${type} chunk`);
+    const data = buf.subarray(pos + 8, pos + 8 + length);
+    const stored = buf.readUInt32BE(pos + 8 + length);
+    if (zlib.crc32(buf.subarray(pos + 4, pos + 8 + length)) !== stored) throw new Error(`bad CRC in the ${type} chunk`);
+    if (!header && type !== "IHDR") throw new Error(`the first chunk is ${type}, not IHDR`);
+    if (type === "IHDR") {
+      if (header) throw new Error("a second IHDR chunk");
+      if (length !== 13) throw new Error(`the IHDR chunk is ${length} bytes, not 13`);
+      header = {
+        width: data.readUInt32BE(0),
+        height: data.readUInt32BE(4),
+        depth: data[8],
+        colour: data[9],
+        compression: data[10],
+        filter: data[11],
+        interlace: data[12],
+      };
+    } else if (type === "PLTE") palette = data;
+    else if (type === "tRNS") alphas = data;
+    else if (type === "IDAT") idat.push(data);
+    else if (type === "IEND") ended = true;
+    pos += 12 + length;
+  }
+  if (!header) throw new Error("the PNG has no IHDR chunk");
+  if (!ended) throw new Error("the PNG has no IEND chunk: it is truncated");
+  const { width, height, depth, colour } = header;
+  if (depth !== 8) throw new Error(`bit depth ${depth} is not supported: only 8 bits to the channel`);
+  if (!(colour in CHANNELS)) {
+    throw new Error(
+      `colour type ${colour} (${COLOUR_NAMES[colour] ?? "unknown"}) is not supported: only RGB, RGBA and palette`,
+    );
+  }
+  if (header.interlace !== 0) throw new Error("an interlaced PNG is not supported");
+  if (header.compression !== 0 || header.filter !== 0)
+    throw new Error("the PNG uses a compression or filter method this reader does not know");
+  if (!width || !height) throw new Error(`the PNG is ${width} by ${height} pixels`);
+  if (width * height > MAX_PIXELS) throw new Error(`the PNG is ${width} by ${height} pixels, too large to read`);
+  if (colour === 3) {
+    if (!palette || palette.length % 3 !== 0 || palette.length === 0)
+      throw new Error("a palette PNG with no usable PLTE chunk");
+  } else if (alphas && colour === 2) {
+    throw new Error("a tRNS colour key on an RGB PNG is not supported");
+  }
+
+  const channels = CHANNELS[colour];
+  const stride = width * channels;
+  let raw;
+  try {
+    raw = zlib.inflateSync(Buffer.concat(idat));
+  } catch (e) {
+    throw new Error(`the PNG's pixel data does not inflate: ${e.message}`);
+  }
+  if (raw.length !== height * (stride + 1)) {
+    throw new Error(`the PNG's pixel data is ${raw.length} bytes, where its header needs ${height * (stride + 1)}`);
+  }
+  const rows = Buffer.alloc(height * stride);
+  const zero = Buffer.alloc(stride);
+  for (let y = 0; y < height; y++) {
+    const kind = raw[y * (stride + 1)];
+    const line = raw.subarray(y * (stride + 1) + 1, (y + 1) * (stride + 1));
+    const cur = rows.subarray(y * stride, (y + 1) * stride);
+    const prev = y > 0 ? rows.subarray((y - 1) * stride, y * stride) : zero;
+    if (kind > 4) throw new Error(`row ${y} has filter type ${kind}, which PNG does not define`);
+    for (let x = 0; x < stride; x++) {
+      const a = x >= channels ? cur[x - channels] : 0;
+      const b = prev[x];
+      const c = x >= channels ? prev[x - channels] : 0;
+      let predict = 0;
+      if (kind === 1) predict = a;
+      else if (kind === 2) predict = b;
+      else if (kind === 3) predict = (a + b) >> 1;
+      else if (kind === 4) {
+        const p = a + b - c;
+        const pa = Math.abs(p - a);
+        const pb = Math.abs(p - b);
+        const pc = Math.abs(p - c);
+        predict = pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+      }
+      cur[x] = line[x] + predict;
+    }
+  }
+
+  const rgba = new Uint8Array(width * height * 4);
+  const count = width * height;
+  if (colour === 6) rgba.set(rows);
+  else if (colour === 2) {
+    for (let i = 0; i < count; i++) {
+      rgba[i * 4] = rows[i * 3];
+      rgba[i * 4 + 1] = rows[i * 3 + 1];
+      rgba[i * 4 + 2] = rows[i * 3 + 2];
+      rgba[i * 4 + 3] = 255;
+    }
+  } else {
+    const entries = palette.length / 3;
+    for (let i = 0; i < count; i++) {
+      const index = rows[i];
+      if (index >= entries) throw new Error(`pixel ${i} uses palette entry ${index}, and the palette has ${entries}`);
+      rgba[i * 4] = palette[index * 3];
+      rgba[i * 4 + 1] = palette[index * 3 + 1];
+      rgba[i * 4 + 2] = palette[index * 3 + 2];
+      rgba[i * 4 + 3] = alphas && index < alphas.length ? alphas[index] : 255;
+    }
+  }
+  return { width, height, rgba };
+}
+
+/**
+ * A PNG file: colour type 6 (RGBA), 8 bits, filter 0 on every row.
+ *
+ * @param {{ width: number, height: number, rgba: Uint8Array }} image
+ * @returns {Buffer}
+ */
+export function encodePng({ width, height, rgba }) {
+  if (!Number.isInteger(width) || !Number.isInteger(height) || width < 1 || height < 1) {
+    throw new Error(`cannot encode an image ${width} by ${height} pixels`);
+  }
+  if (rgba.length !== width * height * 4) {
+    throw new Error(`the image is ${width} by ${height} but holds ${rgba.length} bytes, not ${width * height * 4}`);
+  }
+  const stride = width * 4;
+  const raw = Buffer.alloc(height * (stride + 1));
+  for (let y = 0; y < height; y++) {
+    // The filter byte stays 0.
+    Buffer.from(rgba.buffer, rgba.byteOffset + y * stride, stride).copy(raw, y * (stride + 1) + 1);
+  }
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(width, 0);
+  ihdr.writeUInt32BE(height, 4);
+  ihdr[8] = 8; // bit depth
+  ihdr[9] = 6; // colour type: RGBA
+  return Buffer.concat([
+    SIGNATURE,
+    chunk("IHDR", ihdr),
+    chunk("IDAT", zlib.deflateSync(raw)),
+    chunk("IEND", Buffer.alloc(0)),
+  ]);
+}
+
+/**
+ * Whether two pictures are the same and, if not, how many pixels differ. Each is
+ * an image or the bytes of a PNG file. Alpha is compared with the colour, which
+ * changes nothing for the opaque pictures PngDump writes.
+ *
+ * When the sizes differ, the pictures are laid on one canvas as large as the
+ * larger of each dimension, and a pixel that only one of them has counts as
+ * differing, so that `differing` is never 0 for pictures of different sizes.
+ *
+ * @returns {{ sameSize: boolean, differing: number }}
+ */
+export function comparePngs(a, b) {
+  const A = asImage(a);
+  const B = asImage(b);
+  const w = Math.max(A.width, B.width);
+  const h = Math.max(A.height, B.height);
+  let differing = 0;
+  for (let y = 0; y < h; y++) {
+    for (let x = 0; x < w; x++) {
+      if (x >= A.width || y >= A.height || x >= B.width || y >= B.height) {
+        differing++;
+        continue;
+      }
+      const i = (y * A.width + x) * 4;
+      const j = (y * B.width + x) * 4;
+      if (
+        A.rgba[i] !== B.rgba[j] ||
+        A.rgba[i + 1] !== B.rgba[j + 1] ||
+        A.rgba[i + 2] !== B.rgba[j + 2] ||
+        A.rgba[i + 3] !== B.rgba[j + 3]
+      ) {
+        differing++;
+      }
+    }
+  }
+  return { sameSize: A.width === B.width && A.height === B.height, differing };
+}
+
+// ------------------------------------------------------------------ the label font
+
+// A 5 by 7 bitmap font, for the labels above the panels. `#` is a lit pixel. It covers
+// what the labels use: A to Z, 0 to 9, space and . - : ( ) /, and , and ? besides, ?
+// being what any other character is drawn as.
+// biome-ignore format: a table, one glyph to a line, each of its seven rows five characters
+const GLYPHS = {
+  A: [".###.", "#...#", "#...#", "#####", "#...#", "#...#", "#...#"],
+  B: ["####.", "#...#", "#...#", "####.", "#...#", "#...#", "####."],
+  C: [".###.", "#...#", "#....", "#....", "#....", "#...#", ".###."],
+  D: ["####.", "#...#", "#...#", "#...#", "#...#", "#...#", "####."],
+  E: ["#####", "#....", "#....", "####.", "#....", "#....", "#####"],
+  F: ["#####", "#....", "#....", "####.", "#....", "#....", "#...."],
+  G: [".###.", "#...#", "#....", "#.###", "#...#", "#...#", ".###."],
+  H: ["#...#", "#...#", "#...#", "#####", "#...#", "#...#", "#...#"],
+  I: [".###.", "..#..", "..#..", "..#..", "..#..", "..#..", ".###."],
+  J: ["..###", "...#.", "...#.", "...#.", "...#.", "#..#.", ".##.."],
+  K: ["#...#", "#..#.", "#.#..", "##...", "#.#..", "#..#.", "#...#"],
+  L: ["#....", "#....", "#....", "#....", "#....", "#....", "#####"],
+  M: ["#...#", "##.##", "#.#.#", "#.#.#", "#...#", "#...#", "#...#"],
+  N: ["#...#", "##..#", "#.#.#", "#..##", "#...#", "#...#", "#...#"],
+  O: [".###.", "#...#", "#...#", "#...#", "#...#", "#...#", ".###."],
+  P: ["####.", "#...#", "#...#", "####.", "#....", "#....", "#...."],
+  Q: [".###.", "#...#", "#...#", "#...#", "#.#.#", "#..#.", ".##.#"],
+  R: ["####.", "#...#", "#...#", "####.", "#.#..", "#..#.", "#...#"],
+  S: [".####", "#....", "#....", ".###.", "....#", "....#", "####."],
+  T: ["#####", "..#..", "..#..", "..#..", "..#..", "..#..", "..#.."],
+  U: ["#...#", "#...#", "#...#", "#...#", "#...#", "#...#", ".###."],
+  V: ["#...#", "#...#", "#...#", "#...#", "#...#", ".#.#.", "..#.."],
+  W: ["#...#", "#...#", "#...#", "#.#.#", "#.#.#", "##.##", "#...#"],
+  X: ["#...#", "#...#", ".#.#.", "..#..", ".#.#.", "#...#", "#...#"],
+  Y: ["#...#", "#...#", ".#.#.", "..#..", "..#..", "..#..", "..#.."],
+  Z: ["#####", "....#", "...#.", "..#..", ".#...", "#....", "#####"],
+  0: [".###.", "#...#", "#..##", "#.#.#", "##..#", "#...#", ".###."],
+  1: ["..#..", ".##..", "..#..", "..#..", "..#..", "..#..", ".###."],
+  2: [".###.", "#...#", "....#", "...#.", "..#..", ".#...", "#####"],
+  3: [".###.", "#...#", "....#", "..##.", "....#", "#...#", ".###."],
+  4: ["...#.", "..##.", ".#.#.", "#..#.", "#####", "...#.", "...#."],
+  5: ["#####", "#....", "####.", "....#", "....#", "#...#", ".###."],
+  6: [".###.", "#....", "#....", "####.", "#...#", "#...#", ".###."],
+  7: ["#####", "....#", "...#.", "..#..", ".#...", ".#...", ".#..."],
+  8: [".###.", "#...#", "#...#", ".###.", "#...#", "#...#", ".###."],
+  9: [".###.", "#...#", "#...#", ".####", "....#", "....#", ".###."],
+  " ": [".....", ".....", ".....", ".....", ".....", ".....", "....."],
+  ".": [".....", ".....", ".....", ".....", ".....", ".##..", ".##.."],
+  "-": [".....", ".....", ".....", "#####", ".....", ".....", "....."],
+  ":": [".....", ".##..", ".##..", ".....", ".##..", ".##..", "....."],
+  "(": ["...#.", "..#..", ".#...", ".#...", ".#...", "..#..", "...#."],
+  ")": [".#...", "..#..", "...#.", "...#.", "...#.", "..#..", ".#..."],
+  "/": ["....#", "....#", "...#.", "..#..", ".#...", "#....", "#...."],
+  ",": [".....", ".....", ".....", ".....", ".##..", "..#..", ".#..."],
+  "?": [".###.", "#...#", "....#", "...#.", "..#..", ".....", "..#.."],
+};
+
+/** The characters the label font draws as themselves (any other is drawn as ?). Lower case is drawn as upper. */
+export const LABEL_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 .-:()/,?";
+
+/** The glyph rows for a character: five-character strings, seven of them, `#` lit. */
+export function glyphRows(ch) {
+  return GLYPHS[ch.toUpperCase()] ?? GLYPHS["?"];
+}
+
+const GLYPH_W = 5;
+const GLYPH_H = 7;
+
+/** The width in pixels of `text` drawn at `scale`: five columns a character and one between. */
+const textWidth = (text, scale) => (text.length ? (text.length * (GLYPH_W + 1) - 1) * scale : 0);
+
+/** Draws text into an RGBA buffer `width` pixels wide, with its top left at (x, y), each font pixel `scale` square. */
+function drawText(rgba, width, x, y, text, scale, [r, g, b]) {
+  const height = rgba.length / 4 / width;
+  let left = x;
+  for (const ch of text) {
+    glyphRows(ch).forEach((row, gy) => {
+      for (let gx = 0; gx < GLYPH_W; gx++) {
+        if (row[gx] !== "#") continue;
+        for (let dy = 0; dy < scale; dy++) {
+          for (let dx = 0; dx < scale; dx++) {
+            const px = left + gx * scale + dx;
+            const py = y + gy * scale + dy;
+            if (px < 0 || py < 0 || px >= width || py >= height) continue;
+            const i = (py * width + px) * 4;
+            rgba[i] = r;
+            rgba[i + 1] = g;
+            rgba[i + 2] = b;
+            rgba[i + 3] = 255;
+          }
+        }
+      }
+    });
+    left += (GLYPH_W + 1) * scale;
+  }
+}
+
+// -------------------------------------------------------------- the comparison image
+
+/** The gap between the panels, and the margin round them, in pixels. */
+export const GUTTER = 8;
+/** Colour of the part of a panel that its picture does not cover, where the other is larger. */
+const PAD = [224, 224, 224];
+const RED = [255, 0, 0];
+const INK = [32, 32, 32];
+
+/**
+ * One picture of the two: the twinBASIC picture, the VB6 picture and their difference
+ * side by side on a white ground, each under a label. Matching pixels of the difference
+ * panel are a faint grey copy of the VB6 picture, and every differing pixel is pure red.
+ *
+ * The panels are as large as the larger of the two pictures in each dimension, and a
+ * picture smaller than that leaves a light grey margin in its panel, and red in the
+ * difference panel, since a pixel only one picture has differs. The panel is also at
+ * least as wide as its widest label, which a small picture would otherwise cut.
+ * There is an 8-pixel margin round the whole and an 8-pixel gutter between panels.
+ *
+ * @param {{width: number, height: number, rgba: Uint8Array} | Buffer} tb   the twinBASIC picture, or its PNG file
+ * @param {{width: number, height: number, rgba: Uint8Array} | Buffer} vb6  the VB6 picture, or its PNG file
+ * @param {{tb?: string, vb6?: string, diff?: string}} [labels]  default TWINBASIC, VB6, and the count of
+ *   differing pixels (IDENTICAL, or SIZES DIFFER with both sizes when they do)
+ * @param {{scale?: number}} [options]  a whole number: each pixel is drawn that many pixels square. The
+ *   default is 2 when both pictures are under 200 pixels in both dimensions, else 1.
+ * @returns {{width: number, height: number, rgba: Uint8Array, sameSize: boolean, differing: number, scale: number}}
+ */
+export function composeComparison(tb, vb6, labels = {}, { scale } = {}) {
+  const A = asImage(tb);
+  const B = asImage(vb6);
+  const { sameSize, differing } = comparePngs(A, B);
+  const cw = Math.max(A.width, B.width);
+  const ch = Math.max(A.height, B.height);
+  const S = scale ?? (cw < 200 && ch < 200 ? 2 : 1);
+  if (!Number.isInteger(S) || S < 1) throw new Error(`scale must be a whole number of at least 1, got ${scale}`);
+  const noun = differing === 1 ? "PIXEL" : "PIXELS";
+  const diffLabel = !differing
+    ? "IDENTICAL"
+    : sameSize
+      ? `DIFFERENCE: ${differing} ${noun}`
+      : `SIZES DIFFER: ${A.width}X${A.height} VS ${B.width}X${B.height}, ${differing} ${noun}`;
+  const texts = [labels.tb ?? "TWINBASIC", labels.vb6 ?? "VB6", labels.diff ?? diffLabel];
+
+  // The font scales with the picture, so that a label under a doubled picture is as legible as it.
+  const fs = S;
+  const strip = GLYPH_H * fs + 6;
+  const panelW = Math.max(cw * S, ...texts.map((t) => textWidth(t, fs)));
+  const width = 2 * GUTTER + 3 * panelW + 2 * GUTTER;
+  const height = 2 * GUTTER + strip + ch * S;
+  const rgba = new Uint8Array(width * height * 4).fill(255);
+
+  const put = (x, y, [r, g, b]) => {
+    const i = (y * width + x) * 4;
+    rgba[i] = r;
+    rgba[i + 1] = g;
+    rgba[i + 2] = b;
+    rgba[i + 3] = 255;
+  };
+  // A pixel of an image over white, or null where the image has none.
+  const colourAt = (img, x, y) => {
+    if (x >= img.width || y >= img.height) return null;
+    const i = (y * img.width + x) * 4;
+    const a = img.rgba[i + 3];
+    const over = (c) => Math.round((c * a + 255 * (255 - a)) / 255);
+    return [over(img.rgba[i]), over(img.rgba[i + 1]), over(img.rgba[i + 2])];
+  };
+  const faint = ([r, g, b]) => {
+    const luma = Math.round(0.299 * r + 0.587 * g + 0.114 * b);
+    const v = 255 - Math.round((255 - luma) * 0.3);
+    return [v, v, v];
+  };
+
+  const top = GUTTER + strip;
+  for (let panel = 0; panel < 3; panel++) {
+    const left = GUTTER + panel * (panelW + GUTTER);
+    drawText(rgba, width, left, GUTTER + 3, texts[panel], fs, INK);
+    for (let y = 0; y < ch; y++) {
+      for (let x = 0; x < cw; x++) {
+        const p = colourAt(A, x, y);
+        const q = colourAt(B, x, y);
+        let colour;
+        if (panel === 0) colour = p ?? PAD;
+        else if (panel === 1) colour = q ?? PAD;
+        else if (!p || !q) colour = RED;
+        else {
+          // Differing as comparePngs counts it: any channel, alpha included.
+          const ia = (y * A.width + x) * 4;
+          const ib = (y * B.width + x) * 4;
+          const equal =
+            A.rgba[ia] === B.rgba[ib] &&
+            A.rgba[ia + 1] === B.rgba[ib + 1] &&
+            A.rgba[ia + 2] === B.rgba[ib + 2] &&
+            A.rgba[ia + 3] === B.rgba[ib + 3];
+          colour = equal ? faint(q) : RED;
+        }
+        for (let dy = 0; dy < S; dy++) for (let dx = 0; dx < S; dx++) put(left + x * S + dx, top + y * S + dy, colour);
+      }
+    }
+  }
+  return { width, height, rgba, sameSize, differing, scale: S };
+}
diff --git a/scripts/lib/repro-images.mjs b/scripts/lib/repro-images.mjs
new file mode 100644
index 000000000..86753fa41
--- /dev/null
+++ b/scripts/lib/repro-images.mjs
@@ -0,0 +1,288 @@
+// The pictures of a bug reproducer (scripts/bug_repro.mjs): what repro.json's `images` key
+// means, the files that must stand behind it, and the three PNG files each picture has.
+//
+// A graphical defect is shown best by what twinBASIC drew beside what VB6 drew. The two
+// capture modules in test/repro-templates/png/ (PngDump.twin, PngDump.bas) save a picture
+// as <name>.png in the folder bug_repro names in BUGREPRO_IMAGES, and bug_repro keeps
+// them in bugs/<slug>/images/:
+//
+//     <name>-tb.png       from `run`
+//     <name>-vb6.png      from `vb6`
+//     <name>-compare.png  both and their difference, written when both exist: the picture
+//                         that goes into the issue
+//
+// Everything here reads or writes files and judges, and starts nothing, so test/png.test.mjs
+// runs it without twinBASIC or VB6. PNG decoding, comparison and drawing are lib/png.mjs.
+
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { REPO_ROOT } from "../../lib/repo-paths.mjs";
+import { comparePngs, composeComparison, decodePng, encodePng } from "./png.mjs";
+import { fileEntry } from "./zip.mjs";
+
+/** The environment variable the capture modules read the folder from. */
+export const IMAGES_ENV = "BUGREPRO_IMAGES";
+/** The folder of a reproducer that holds its pictures. */
+export const IMAGES_DIR = "images";
+/** A picture's name: what PngDump accepts. */
+export const IMAGE_NAME = /^[A-Za-z0-9_-]+$/;
+/** The templates `new --with-images` copies, and the files a reproducer's copies are compared with. */
+export const PNG_TEMPLATES = path.join(REPO_ROOT, "test", "repro-templates", "png");
+export const PNGDUMP_TWIN = "PngDump.twin";
+export const PNGDUMP_BAS = "PngDump.bas";
+/** The line Probe.vbp needs to build PngDump.bas. */
+export const PNGDUMP_VBP_LINE = "Module=PngDump; PngDump.bas";
+/** The file `run` writes beside the pictures, saying which beta drew the twinBASIC ones. */
+export const BETA_FILE = "tb-beta.txt";
+
+/** A fault in a picture or its files that the command reports and ends on. */
+export class ImageError extends Error {}
+
+/**
+ * Why a value is not a valid `images` list, or null. The answer is `{ key, why }`, the key
+ * being `images` or one element of it.
+ */
+export function imagesKeyProblem(images) {
+  if (!Array.isArray(images) || !images.length) {
+    return { key: "images", why: "must be a non-empty list of picture names" };
+  }
+  for (const [i, name] of images.entries()) {
+    const key = `images[${i}]`;
+    if (typeof name !== "string" || !IMAGE_NAME.test(name)) {
+      return { key, why: `must be a name of letters, digits, - and _, got ${JSON.stringify(name)}` };
+    }
+    if (images.indexOf(name) !== i) return { key, why: `names ${name} twice` };
+  }
+  return null;
+}
+
+/** Text with every line ending as `\n`, so that a checkout's CRLF and an editor's LF compare equal. */
+export const normaliseEol = (text) => String(text).replace(/\r\n?/g, "\n");
+
+/** Every file called `name` under `dir`, as paths, in name order; none when `dir` is not there. */
+export function findFiles(dir, name) {
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) return [];
+  const found = [];
+  for (const e of readdirSync(dir, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+    const at = path.join(dir, e.name);
+    if (e.isDirectory()) found.push(...findFiles(at, name));
+    else if (e.name === name) found.push(at);
+  }
+  return found;
+}
+
+/** Whether a Probe.vbp builds PngDump.bas. */
+export const hasPngModule = (vbp) => /^[ \t]*Module[ \t]*=[ \t]*PngDump[ \t]*;[ \t]*PngDump\.bas[ \t]*$/im.test(vbp);
+
+/**
+ * A Probe.vbp with the line that builds PngDump.bas, after its last Module line (or, when it has
+ * none, after the Type line, or first). A project that has it is returned as it is. The line
+ * ending is the project's own.
+ */
+export function addPngModule(vbp) {
+  if (hasPngModule(vbp)) return vbp;
+  const eol = vbp.includes("\r\n") ? "\r\n" : "\n";
+  const lines = vbp.split(/\r?\n/);
+  const trailing = lines[lines.length - 1] === "" ? lines.pop() : null;
+  let at = -1;
+  lines.forEach((l, i) => {
+    if (/^\s*Module\s*=/i.test(l)) at = i;
+  });
+  if (at < 0) at = lines.findIndex((l) => /^\s*Type\s*=/i.test(l));
+  lines.splice(at + 1, 0, PNGDUMP_VBP_LINE);
+  return lines.join(eol) + (trailing === null ? "" : eol);
+}
+
+/**
+ * What stands wrong behind an `images` key in the reproducer at `dir`: `errors` stop the command,
+ * `warnings` do not, because a filed reproducer must stay as it was filed.
+ *
+ * The twinBASIC side needs a PngDump.twin under src/Sources/; a vb6/ folder, if there is one, needs
+ * PngDump.bas and a Probe.vbp that builds it. Each copy that differs from the template (line
+ * endings aside) draws a warning.
+ *
+ * @param {string} dir  the reproducer's folder
+ * @param {string} [templates]  where the templates are (a probe's own folder)
+ * @returns {{errors: string[], warnings: string[]}}
+ */
+export function imageSourceCheck(dir, templates = PNG_TEMPLATES) {
+  const errors = [];
+  const warnings = [];
+  const rel = (f) => path.relative(dir, f).replaceAll("\\", "/");
+  const drift = (file, templateName) => {
+    const template = path.join(templates, templateName);
+    if (!existsSync(template)) return;
+    if (normaliseEol(readFileSync(file, "latin1")) !== normaliseEol(readFileSync(template, "latin1"))) {
+      warnings.push(`${rel(file)} differs from test/repro-templates/png/${templateName}`);
+    }
+  };
+  const twins = findFiles(path.join(dir, "src", "Sources"), PNGDUMP_TWIN);
+  if (!twins.length) errors.push(`images needs a ${PNGDUMP_TWIN} under src/Sources/: new --with-images copies it`);
+  for (const file of twins) drift(file, PNGDUMP_TWIN);
+  const vb6 = path.join(dir, "vb6");
+  if (existsSync(vb6) && statSync(vb6).isDirectory()) {
+    const bas = path.join(vb6, PNGDUMP_BAS);
+    if (!existsSync(bas))
+      errors.push(`images needs vb6/${PNGDUMP_BAS}, because vb6/ exists: new --with-images copies it`);
+    else drift(bas, PNGDUMP_BAS);
+    const vbp = path.join(vb6, "Probe.vbp");
+    if (existsSync(vbp) && !hasPngModule(readFileSync(vbp, "latin1"))) {
+      errors.push(`vb6/Probe.vbp needs the line ${PNGDUMP_VBP_LINE}`);
+    }
+  }
+  return { errors, warnings };
+}
+
+/**
+ * `new --with-images`: PngDump.twin into src/Sources/ and, with `withVb6`, PngDump.bas into vb6/ and
+ * its line into Probe.vbp. The reproducer's folder must already have both.
+ */
+export function copyImageTemplates(dir, { withVb6, templates = PNG_TEMPLATES }) {
+  const sources = path.join(dir, "src", "Sources");
+  mkdirSync(sources, { recursive: true });
+  copyFileSync(path.join(templates, PNGDUMP_TWIN), path.join(sources, PNGDUMP_TWIN));
+  if (!withVb6) return;
+  copyFileSync(path.join(templates, PNGDUMP_BAS), path.join(dir, "vb6", PNGDUMP_BAS));
+  const vbp = path.join(dir, "vb6", "Probe.vbp");
+  writeFileSync(vbp, addPngModule(readFileSync(vbp, "latin1")), "latin1");
+}
+
+/** The path of one of a picture's three files in an images folder: kind is `tb`, `vb6` or `compare`. */
+export const imageFile = (imagesDir, name, kind) => path.join(imagesDir, `${name}-${kind}.png`);
+
+/** The label over the twinBASIC panel. */
+export const tbLabel = (beta) => (beta ? `TWINBASIC BETA ${beta}` : "TWINBASIC");
+
+/** The beta `run` recorded beside the pictures, or null. */
+export function recordedBeta(imagesDir) {
+  const file = path.join(imagesDir, BETA_FILE);
+  if (!existsSync(file)) return null;
+  const n = Number.parseInt(readFileSync(file, "utf8"), 10);
+  return Number.isInteger(n) && n > 0 ? n : null;
+}
+
+/** What a picture's comparison says, in the line the commands print. */
+export function comparisonLine(name, a, b, { sameSize, differing }) {
+  if (!differing) return `image ${name}: identical`;
+  const sizes = sameSize ? "" : `sizes differ (twinBASIC ${a.width}x${a.height}, VB6 ${b.width}x${b.height}), `;
+  return `image ${name}: ${sizes}${differing} pixels differ`;
+}
+
+function readPng(file, what) {
+  try {
+    return decodePng(readFileSync(file));
+  } catch (e) {
+    throw new ImageError(`${what} ${file} cannot be read: ${e.message}`);
+  }
+}
+
+/**
+ * When both `<name>-tb.png` and `<name>-vb6.png` are in `imagesDir`, writes `<name>-compare.png`
+ * beside them and says what they show; null when one is missing. `beta` labels the twinBASIC panel;
+ * the beta `run` recorded is used when it is not given.
+ *
+ * @returns {{line: string, sameSize: boolean, differing: number, file: string} | null}
+ */
+export function writeComparison(imagesDir, name, beta = recordedBeta(imagesDir)) {
+  const tbFile = imageFile(imagesDir, name, "tb");
+  const vb6File = imageFile(imagesDir, name, "vb6");
+  if (!existsSync(tbFile) || !existsSync(vb6File)) return null;
+  const tb = readPng(tbFile, "the twinBASIC picture");
+  const vb6 = readPng(vb6File, "the VB6 picture");
+  const composed = composeComparison(tb, vb6, { tb: tbLabel(beta) });
+  const file = imageFile(imagesDir, name, "compare");
+  writeFileSync(file, encodePng(composed));
+  return {
+    line: comparisonLine(name, tb, vb6, composed),
+    sameSize: composed.sameSize,
+    differing: composed.differing,
+    file,
+  };
+}
+
+/**
+ * Compares the pictures a run has just made, `<name>.png` in `freshDir`, with the VB6 pictures a
+ * reproducer has kept, `<name>-vb6.png` in `keptDir`. A picture missing on either side throws an
+ * ImageError that names it.
+ *
+ * @returns {{name: string, sameSize: boolean, differing: number}[]}
+ */
+export function compareWithKept(freshDir, keptDir, names) {
+  return names.map((name) => {
+    const fresh = path.join(freshDir, `${name}.png`);
+    const kept = imageFile(keptDir, name, "vb6");
+    if (!existsSync(fresh)) throw new ImageError(`the run wrote no picture ${name}.png`);
+    if (!existsSync(kept)) throw new ImageError(`there is no ${IMAGES_DIR}/${name}-vb6.png to compare with`);
+    const { sameSize, differing } = comparePngs(readPng(fresh, "the picture"), readPng(kept, "the picture"));
+    return { name, sameSize, differing };
+  });
+}
+
+/**
+ * Why a run does not reproduce what `expect.imagesDiffer` says, as problems, none when it does.
+ * `true` reproduces when at least one picture differs, a size difference counting; `false` when every
+ * picture matches.
+ */
+export function imagesDifferProblems(expected, results) {
+  const differs = (r) => !r.sameSize || r.differing > 0;
+  if (expected) {
+    return results.some(differs) ? [] : ["every picture matches its VB6 picture, and imagesDiffer is true"];
+  }
+  return results
+    .filter(differs)
+    .map((r) =>
+      r.sameSize
+        ? `picture ${r.name} differs from its VB6 picture in ${r.differing} pixels, and imagesDiffer is false`
+        : `picture ${r.name} is not the size of its VB6 picture, and imagesDiffer is false`,
+    );
+}
+
+/** The files of a reproducer's pictures folder, as zip entries named `images/<file>`; none without the folder. */
+export function imageZipEntries(dir) {
+  const images = path.join(dir, IMAGES_DIR);
+  if (!existsSync(images) || !statSync(images).isDirectory()) return [];
+  return readdirSync(images, { withFileTypes: true })
+    .filter((e) => e.isFile())
+    .map((e) => e.name)
+    .sort()
+    .map((file) => fileEntry(`${IMAGES_DIR}/${file}`, path.join(images, file)));
+}
+
+/**
+ * What keeps a reproducer's pictures from showing in its report, one line a picture: `text` is the
+ * entry in BUGS-TO-REPORT.md, or a filed REPORT.md, and `textDir` the folder its paths are read
+ * from. Each `<name>-compare.png` in `imagesDir` must be embedded as a markdown image, `![...](path)`,
+ * whose path reaches that file, and the file must exist. An empty list means every one shows.
+ */
+export function embedProblems(text, textDir, imagesDir, names) {
+  const embedded = new Set();
+  for (const m of String(text).matchAll(/!\[[^\]\n]*\]\(([^)\s]+)\)/g)) embedded.add(path.resolve(textDir, m[1]));
+  const problems = [];
+  for (const name of names) {
+    const file = path.resolve(imageFile(imagesDir, name, "compare"));
+    const shown = path.relative(textDir, file).split(path.sep).join("/");
+    if (!embedded.has(file)) problems.push(`${name}: no ![...](${shown}) embeds the picture`);
+    else if (!existsSync(file)) problems.push(`${name}: it embeds ${shown}, which does not exist`);
+  }
+  return problems;
+}
+
+/**
+ * Copies the pictures a probe wrote, `<name>.png` in `fromDir`, to `<name>-<kind>.png` in `toDir`.
+ * Returns the names it found and the names that are missing.
+ */
+export function collectImages(fromDir, toDir, names, kind) {
+  const found = [];
+  const missing = [];
+  for (const name of names) {
+    const file = path.join(fromDir, `${name}.png`);
+    if (!existsSync(file)) {
+      missing.push(name);
+      continue;
+    }
+    mkdirSync(toDir, { recursive: true });
+    copyFileSync(file, imageFile(toDir, name, kind));
+    found.push(name);
+  }
+  return { found, missing };
+}
diff --git a/scripts/lib/tb-ide.mjs b/scripts/lib/tb-ide.mjs
index dc71b8365..877ba9e0d 100644
--- a/scripts/lib/tb-ide.mjs
+++ b/scripts/lib/tb-ide.mjs
@@ -210,6 +210,23 @@ export async function launchIde({ exe, project, port, show = false, keep = false
   }
 }
 
+/**
+ * One argument as it goes into a Windows command line, quoted the way the C
+ * runtime reads it back (and Node writes it): an argument with a space, a tab or
+ * a quote, or an empty one, is wrapped in quotes; the backslashes before a quote,
+ * and at the end of a wrapped argument, are doubled. `C:\out\` stays `C:\out\`,
+ * and `C:\my out\` becomes `"C:\my out\\"`, which is what keeps the closing quote
+ * from being escaped.
+ */
+export function quoteArg(a) {
+  if (a !== "" && !/[\s"]/.test(a)) return a;
+  return `"${a.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1")}"`;
+}
+
+// What powershell runs for launchOnDesktop: the script in TBBUILD_SCRIPT, taken
+// out of the environment first.
+const BOOTSTRAP = "$s = $env:TBBUILD_SCRIPT; Remove-Item Env:TBBUILD_SCRIPT; & ([scriptblock]::Create($s))";
+
 /**
  * Start a program on a private desktop, inside a kill-on-close job, through
  * lib/tb-launch.ps1. launchIde starts the IDE this way, and tbrun's --exe the
@@ -222,20 +239,53 @@ export async function launchIde({ exe, project, port, show = false, keep = false
  * @param {boolean} [o.job]   false for no job, for a program that is to outlive
  *                            this Node process
  * @param {object} o.env      its whole environment
- * @returns {Promise<{pid: number, launcher: import("node:child_process").ChildProcess, exited: Promise<number | null>}>}
+ * @param {string[]} [o.args] more arguments, after `arg`, for a program that takes
+ *                            several; quoted as the C runtime reads them
+ * @param {string} [o.stdout] a file path: the program's standard output goes there
+ * @param {string} [o.stderr] the same for standard error. With either, the program's
+ *                            standard input is the null device, and an output left
+ *                            out goes to the null device
+ * @param {"close"} [o.dialogs] look for dialog boxes the program (or anything in its
+ *                            job) opens on the desktop, record each, and close it
+ *                            by pressing OK, so that the program can go on
+ * @returns {Promise<{pid: number, launcher: import("node:child_process").ChildProcess, exited: Promise<number | null>, finished: Promise<{code: number | null, dialogs: {title: string, text: string}[]}>}>}
  *   `exited` settles with the program's exit code when it ends, or null when
- *   the launcher ended without one -- killed, or failed. Throws, with the
- *   launcher's error, when the program did not start.
+ *   the launcher ended without one -- killed, or failed. `finished` settles at
+ *   the same time with that code and the dialogs recorded, in the order they
+ *   opened (empty without `dialogs`). Throws, with the launcher's error, when
+ *   the program did not start.
  */
-export async function launchOnDesktop({ exe, arg = "", desktop, job = true, env }) {
+export async function launchOnDesktop({ exe, arg = "", args, desktop, job = true, env, stdout, stderr, dialogs }) {
   const script = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "tb-launch.ps1"), "utf8");
+  // -EncodedCommand is UTF-16 in base64, 2.7 characters to each of the script's,
+  // and a command line stops at 32,767: the script outgrew that at about 12,000
+  // characters (ENAMETOOLONG). So the script travels in an environment variable,
+  // which stops at 32,767 characters of its own, and the command is a bootstrap
+  // that takes it out of the environment, so that the program it launches does
+  // not inherit it, and runs it.
+  if (script.length > 30000) {
+    throw new Error(`tb-launch.ps1 is ${script.length} characters, and an environment variable stops at 32,767`);
+  }
   const ps = spawn(
     "powershell",
-    ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")],
+    ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(BOOTSTRAP, "utf16le").toString("base64")],
     {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
-      env: { ...env, TBBUILD_EXE: exe, TBBUILD_ARG: arg, TBBUILD_DESKTOP: desktop, TBBUILD_JOB: job ? "1" : "0" },
+      // An option left out removes the variable, so that one in the caller's
+      // environment cannot switch it on.
+      env: {
+        ...env,
+        TBBUILD_SCRIPT: script,
+        TBBUILD_EXE: exe,
+        TBBUILD_ARG: arg,
+        TBBUILD_ARGS: args?.length ? args.map(quoteArg).join(" ") : undefined,
+        TBBUILD_DESKTOP: desktop,
+        TBBUILD_JOB: job ? "1" : "0",
+        TBBUILD_STDOUT: stdout || undefined,
+        TBBUILD_STDERR: stderr || undefined,
+        TBBUILD_DIALOGS: dialogs || undefined,
+      },
     },
   );
   let err = "",
@@ -256,11 +306,21 @@ export async function launchOnDesktop({ exe, arg = "", desktop, job = true, env
     ended.then(() => res(null));
   });
   if (!pid) throw new Error(err.trim());
-  const exited = ended.then(() => {
+  const finished = ended.then(() => {
     const m = /^exit (-?\d+)\s*$/m.exec(out);
-    return m ? Number(m[1]) : null;
+    const found = [];
+    for (const d of out.matchAll(/^dialog ([A-Za-z0-9+/=]+)\s*$/gm)) {
+      try {
+        const { title, text } = JSON.parse(Buffer.from(d[1], "base64").toString("utf8"));
+        found.push({ title: String(title ?? ""), text: String(text ?? "") });
+      } catch {
+        // a line the launcher did not finish writing
+      }
+    }
+    return { code: m ? Number(m[1]) : null, dialogs: found };
   });
-  return { pid, launcher: ps, exited };
+  const exited = finished.then((f) => f.code);
+  return { pid, launcher: ps, exited, finished };
 }
 
 /**
diff --git a/scripts/lib/tb-launch.ps1 b/scripts/lib/tb-launch.ps1
index 2e636f74b..8b0651861 100644
--- a/scripts/lib/tb-launch.ps1
+++ b/scripts/lib/tb-launch.ps1
@@ -11,6 +11,28 @@
 #   TBBUILD_DESKTOP  desktop name to create
 #   TBBUILD_JOB      "0" for no job -- a --keep IDE, which must outlive the run
 #
+# Optional, and without them nothing below changes:
+#
+#   TBBUILD_ARGS     more of the command line, already quoted, added after
+#                    TBBUILD_ARG: for a program that takes several arguments.
+#   TBBUILD_STDOUT   a file path: the process's standard output goes to that file.
+#   TBBUILD_STDERR   the same for standard error. When either is set the process
+#                    gets standard handles of its own: stdin is the null device,
+#                    and an output left unset is the null device too.
+#   TBBUILD_DIALOGS  "close": while the process runs, every 250 ms, look for
+#                    visible #32770 dialog boxes on the private desktop that
+#                    belong to the process or to anything in its job. Each one
+#                    seen for the first time is reported as a line
+#                    `dialog <base64 of UTF-8 JSON {"title":...,"text":...}>`,
+#                    text being its Static children's texts joined by a space,
+#                    and is then closed: BM_CLICK on its OK button, else on its
+#                    first button, else WM_CLOSE. A compiler that is given a
+#                    damaged project opens a modal message box and waits on it
+#                    for ever; on a private desktop nobody can answer it.
+#
+# The output is the pid on a line of its own, then any dialog lines, then
+# `exit <n>`.
+#
 # A launch that fails prints no pid, and its cause as one line on stderr.
 #
 # Why a desktop at all: the twinBASIC IDE calls HostForceFocus() from its own
@@ -60,10 +82,19 @@ $desktop = if ($env:TBBUILD_DESKTOP) { $env:TBBUILD_DESKTOP } else { "tbbuild" }
 # environment option that was entered".
 Add-Type -TypeDefinition @'
 using System;
+using System.Collections.Generic;
 using System.ComponentModel;
 using System.Runtime.InteropServices;
+using System.Text;
 
 public static class TbLaunch {
+  [StructLayout(LayoutKind.Sequential)]
+  public struct SECURITY_ATTRIBUTES {
+    public int nLength; public IntPtr lpSecurityDescriptor; public int bInheritHandle;
+  }
+  public delegate bool EnumProc(IntPtr hwnd, IntPtr lParam);
+  public class Dialog { public string Title, Text; }
+
   [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
   public struct STARTUPINFO {
     public int cb; public string lpReserved; public string lpDesktop; public string lpTitle;
@@ -126,6 +157,43 @@ public static class TbLaunch {
   [DllImport("kernel32.dll", SetLastError = true)]
   static extern bool GetExitCodeProcess(IntPtr process, out int exitCode);
 
+  [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+  static extern IntPtr CreateFile(string name, uint access, uint share,
+    ref SECURITY_ATTRIBUTES sa, uint disp, uint flags, IntPtr tmpl);
+
+  [DllImport("kernel32.dll", SetLastError = true)]
+  static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+
+  [DllImport("kernel32.dll", SetLastError = true)]
+  static extern bool IsProcessInJob(IntPtr process, IntPtr job, out bool result);
+
+  [DllImport("kernel32.dll", SetLastError = true)]
+  static extern bool CloseHandle(IntPtr h);
+
+  [DllImport("user32.dll", SetLastError = true)]
+  static extern bool EnumDesktopWindows(IntPtr desk, EnumProc cb, IntPtr lp);
+
+  [DllImport("user32.dll", SetLastError = true)]
+  static extern bool EnumChildWindows(IntPtr parent, EnumProc cb, IntPtr lp);
+
+  [DllImport("user32.dll", CharSet = CharSet.Unicode)]
+  static extern int GetClassName(IntPtr h, StringBuilder sb, int max);
+
+  [DllImport("user32.dll", CharSet = CharSet.Unicode)]
+  static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);
+
+  [DllImport("user32.dll")]
+  static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);
+
+  [DllImport("user32.dll")]
+  static extern bool IsWindowVisible(IntPtr h);
+
+  [DllImport("user32.dll")]
+  static extern bool PostMessage(IntPtr h, uint msg, IntPtr w, IntPtr l);
+
+  [DllImport("user32.dll")]
+  static extern IntPtr GetDlgItem(IntPtr dlg, int id);
+
   // The error of the call just made, with its text. Nothing may come between
   // that call and this one.
   static Exception Failed(string what) {
@@ -186,6 +254,111 @@ public static class TbLaunch {
     if (!GetExitCodeProcess(pi.hProcess, out code)) throw Failed("GetExitCodeProcess");
     return code;
   }
+
+  // An inheritable handle: for writing, a file created or truncated, or the null
+  // device when the path is "NUL"; for reading, the null device.
+  public static IntPtr OpenInheritable(string path, bool write) {
+    SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
+    sa.nLength = Marshal.SizeOf(sa);
+    sa.bInheritHandle = 1;
+    bool device = !write || path == "NUL";
+    // a device is opened with OPEN_EXISTING (3), a file with CREATE_ALWAYS (2)
+    IntPtr h = CreateFile(device ? "NUL" : path, write ? 0x40000000u : 0x80000000u, 3, ref sa,
+                          device ? 3u : 2u, 0x80, IntPtr.Zero);
+    if (h == new IntPtr(-1)) throw Failed("CreateFile " + (device ? "NUL" : path));
+    return h;
+  }
+
+  // Start with the standard handles given (STARTF_USESTDHANDLES). The handles
+  // must be inheritable, which makes CreateProcess inherit them.
+  public static PROCESS_INFORMATION StartWithHandles(string exe, string cmd, string cwd,
+                                                     string desktop, uint flags,
+                                                     IntPtr hIn, IntPtr hOut, IntPtr hErr) {
+    STARTUPINFO si = new STARTUPINFO();
+    si.cb = Marshal.SizeOf(si);
+    si.lpDesktop = desktop;
+    si.dwFlags = 0x100;
+    si.hStdInput = hIn;
+    si.hStdOutput = hOut;
+    si.hStdError = hErr;
+    PROCESS_INFORMATION pi;
+    if (!CreateProcess(exe, cmd, IntPtr.Zero, IntPtr.Zero, true, flags, IntPtr.Zero, cwd,
+                       ref si, out pi)) {
+      throw Failed("CreateProcess");
+    }
+    return pi;
+  }
+
+  // Waits up to ms; true when the process has ended, with its exit code.
+  public static bool WaitMs(PROCESS_INFORMATION pi, uint ms, out int code) {
+    code = 0;
+    if (WaitForSingleObject(pi.hProcess, ms) != 0) return false;
+    if (!GetExitCodeProcess(pi.hProcess, out code)) throw Failed("GetExitCodeProcess");
+    return true;
+  }
+
+  static string Cls(IntPtr h) {
+    StringBuilder sb = new StringBuilder(256); GetClassName(h, sb, 256); return sb.ToString();
+  }
+  static string Txt(IntPtr h) {
+    StringBuilder sb = new StringBuilder(4096); GetWindowText(h, sb, 4096); return sb.ToString();
+  }
+
+  // Whether a window's process is the launched one or is in its job (job is
+  // IntPtr.Zero when there is none).
+  static bool Belongs(IntPtr hwnd, uint pid, IntPtr job) {
+    uint owner;
+    GetWindowThreadProcessId(hwnd, out owner);
+    if (owner == pid) return true;
+    if (job == IntPtr.Zero) return false;
+    // PROCESS_QUERY_LIMITED_INFORMATION
+    IntPtr p = OpenProcess(0x1000, false, owner);
+    if (p == IntPtr.Zero) return false;
+    bool inJob;
+    bool ok = IsProcessInJob(p, job, out inJob);
+    CloseHandle(p);
+    return ok && inJob;
+  }
+
+  // The visible dialog boxes (#32770) on the desktop that belong to the launched
+  // process or to its job and are not in `seen`: each is read, then closed. A
+  // window is forgotten once it is gone, since window handles are reused.
+  public static List<Dialog> NewDialogs(IntPtr desk, IntPtr job, int pid, HashSet<long> seen) {
+    List<IntPtr> top = new List<IntPtr>();
+    EnumDesktopWindows(desk, delegate(IntPtr h, IntPtr l) { top.Add(h); return true; }, IntPtr.Zero);
+    HashSet<long> now = new HashSet<long>();
+    List<Dialog> found = new List<Dialog>();
+    foreach (IntPtr h in top) {
+      now.Add(h.ToInt64());
+      if (seen.Contains(h.ToInt64())) continue;
+      if (!IsWindowVisible(h) || Cls(h) != "#32770") continue;
+      if (!Belongs(h, (uint)pid, job)) continue;
+      List<string> texts = new List<string>();
+      IntPtr first = IntPtr.Zero;
+      EnumChildWindows(h, delegate(IntPtr c, IntPtr l) {
+        string cls = Cls(c);
+        if (cls == "Static") {
+          string t = Txt(c);
+          if (t.Length > 0) texts.Add(t);
+        } else if (cls == "Button" && first == IntPtr.Zero) {
+          first = c;
+        }
+        return true;
+      }, IntPtr.Zero);
+      Dialog d = new Dialog();
+      d.Title = Txt(h);
+      d.Text = string.Join(" ", texts.ToArray());
+      found.Add(d);
+      seen.Add(h.ToInt64());
+      // IDOK is control id 1.
+      IntPtr ok = GetDlgItem(h, 1);
+      IntPtr btn = (ok != IntPtr.Zero && Cls(ok) == "Button") ? ok : first;
+      if (btn != IntPtr.Zero) PostMessage(btn, 0xF5, IntPtr.Zero, IntPtr.Zero);  // BM_CLICK
+      else PostMessage(h, 0x10, IntPtr.Zero, IntPtr.Zero);                         // WM_CLOSE
+    }
+    seen.IntersectWith(now);
+    return found;
+  }
 }
 '@
 
@@ -205,11 +378,19 @@ if ($useJob) { $job = [TbLaunch]::KillOnCloseJob() }
 # syntax."
 $cmd = '"' + $exe + '"'
 if ($arg) { $cmd += ' "' + $arg + '"' }
+if ($env:TBBUILD_ARGS) { $cmd += ' ' + $env:TBBUILD_ARGS }
 
 # CREATE_SUSPENDED (0x4): the IDE goes into the job before it runs a single
 # instruction, so there is no moment in which it could start a child outside.
 $flags = if ($useJob) { 0x4 } else { 0 }
-$pi = [TbLaunch]::Start($exe, $cmd, [IO.Path]::GetDirectoryName($exe), $desktop, $flags)
+if ($env:TBBUILD_STDOUT -or $env:TBBUILD_STDERR) {
+  $hIn = [TbLaunch]::OpenInheritable("NUL", $false)
+  $hOut = [TbLaunch]::OpenInheritable($(if ($env:TBBUILD_STDOUT) { $env:TBBUILD_STDOUT } else { "NUL" }), $true)
+  $hErr = [TbLaunch]::OpenInheritable($(if ($env:TBBUILD_STDERR) { $env:TBBUILD_STDERR } else { "NUL" }), $true)
+  $pi = [TbLaunch]::StartWithHandles($exe, $cmd, [IO.Path]::GetDirectoryName($exe), $desktop, $flags, $hIn, $hOut, $hErr)
+} else {
+  $pi = [TbLaunch]::Start($exe, $cmd, [IO.Path]::GetDirectoryName($exe), $desktop, $flags)
+}
 if ($useJob) {
   # An IDE that cannot go into the job is ended, still suspended, rather than
   # resumed: the caller gets no pid from a failed launch, so an IDE resumed
@@ -222,4 +403,18 @@ Write-Output $pi.dwProcessId
 
 # The process's exit code, on a line of its own once it ends: tbrun's --exe
 # reads it for the probe's exe.
-Write-Output ("exit " + [TbLaunch]::Wait($pi))
+if ($env:TBBUILD_DIALOGS -eq "close") {
+  $jobHandle = if ($useJob) { $job } else { [IntPtr]::Zero }
+  $seen = New-Object 'System.Collections.Generic.HashSet[long]'
+  $code = 0
+  while ($true) {
+    foreach ($d in [TbLaunch]::NewDialogs($hDesk, $jobHandle, $pi.dwProcessId, $seen)) {
+      $json = ([ordered]@{ title = $d.Title; text = $d.Text } | ConvertTo-Json -Compress)
+      Write-Output ("dialog " + [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($json)))
+    }
+    if ([TbLaunch]::WaitMs($pi, 250, [ref]$code)) { break }
+  }
+  Write-Output ("exit " + $code)
+} else {
+  Write-Output ("exit " + [TbLaunch]::Wait($pi))
+}
diff --git a/scripts/lib/vb6.mjs b/scripts/lib/vb6.mjs
index f021ff1c4..466caec40 100644
--- a/scripts/lib/vb6.mjs
+++ b/scripts/lib/vb6.mjs
@@ -52,6 +52,19 @@
 //     keeps one in bugs/<slug>/vb6/ and builds it in a temp copy with the same `/make`
 //     and the same Unattended Execution (runRepro): Probe.vbp builds Probe.exe, which
 //     writes out.txt beside itself and handles its own errors.
+//  9. VB6 REFUSES UNATTENDED EXECUTION FOR A PROJECT WITH A FORM: "Unattended Project
+//     Cannot be visible at runtime", and no exe. A reproducer whose project names a
+//     form, a user control, a property page, a user document or a designer is built
+//     without it, so a box its exe shows is a real window. That is why runRepro starts
+//     every reproducer's exe as tbrun starts an exe, on a private desktop inside a
+//     kill-on-close job: a box there is on no desktop anyone uses, and the time limit
+//     ends the exe waiting on it.
+//
+// 10. A `project=form` FENCE GETS A BLANK Form1.frm, WITHOUT UNATTENDED EXECUTION (9),
+//     AND ITS EXE RUNS ON A PRIVATE DESKTOP. A form a sample leaves loaded keeps the exe
+//     running after Main returns, so the generated Main unloads every form after each
+//     sample, as the twinBASIC dispatcher does. A twinBASIC `Declare PtrSafe` is not VB6:
+//     declaresForVb6 drops PtrSafe and reads LongPtr as Long.
 //
 // The probes for the rewrite and the translation are in vb6Probes() at the end.
 
@@ -68,7 +81,9 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { PROMPTS, RUN_DONE, RUN_TAG, parseRun } from "./example-run.mjs";
+import { killTree, launchOnDesktop } from "./tb-ide.mjs";
 import { logicalLines } from "./twin-api.mjs";
 import { fileEntry, readZip, zipFiles } from "./zip.mjs";
 
@@ -306,6 +321,29 @@ export function moduleFor(src, { name, whole = false } = {}) {
 
 // ----------------------------------------------------- twinBASIC file to VB6
 
+// The first line of a Declare statement, up to where PtrSafe would stand.
+const DECLARE_START = /^(\s*(?:(?:Public|Private)\s+)?Declare\s+)PtrSafe\s+/i;
+
+/**
+ * A text with its API declarations as VB6 reads them: a `Declare` statement loses `PtrSafe`,
+ * which VB6 does not know, and its `LongPtr` is `Long`, which is what a pointer is in a
+ * 32-bit exe. The lines stay where they were, so a line number still names the same line.
+ * Nothing else is touched, and a `Declare` with no `PtrSafe` is left as it is.
+ */
+export function declaresForVb6(src) {
+  let continued = false;
+  return String(src)
+    .split("\n")
+    .map((line) => {
+      const start = DECLARE_START.test(line);
+      if (!start && !continued) return line;
+      const out = line.replace(DECLARE_START, "$1").replace(/\bLongPtr\b/gi, "Long");
+      continued = /_\s*\r?$/.test(out);
+      return out;
+    })
+    .join("\n");
+}
+
 /**
  * The header VB6 writes at the top of a class module in a Standard EXE. The
  * first four lines are the form file's, and VB6 never counts them or the
@@ -377,7 +415,7 @@ export function findBlocks(text) {
  * @returns {{name: string, kind: "cls"|"bas", text: string, lineDelta: number}[]}
  */
 export function translateTwinFile(src, { topName }) {
-  const lines = rewriteDebugPrint(src).text.replace(/\n+$/, "").split("\n");
+  const lines = declaresForVb6(rewriteDebugPrint(src).text).replace(/\n+$/, "").split("\n");
   const blocks = findBlocks(src);
   const owner = new Array(lines.length + 1).fill(-1); // by line, from 1
   blocks.forEach((b, i) => {
@@ -421,7 +459,7 @@ export function translateTwinFile(src, { topName }) {
  * rewritten.
  */
 export function declarationsModule(src, name) {
-  const body = rewriteDebugPrint(src).text.replace(/\n+$/, "");
+  const body = declaresForVb6(rewriteDebugPrint(src).text).replace(/\n+$/, "");
   return { name, kind: "bas", text: crlf(`Attribute VB_Name = "${name}"\n${body}\n`), lineDelta: 1 };
 }
 
@@ -455,6 +493,16 @@ export function harnessText(calls) {
     `    Close #${OUT_FILE}`,
     "End Sub",
     "",
+    // A form a sample left loaded keeps the exe running after Main returns, so
+    // each sample's forms are unloaded when it ends, as the twinBASIC dispatcher does.
+    "Private Sub tbxUnloadForms()",
+    "    Dim i As Long",
+    "    On Error Resume Next",
+    "    For i = Forms.Count - 1 To 0 Step -1",
+    "        Unload Forms(i)",
+    "    Next i",
+    "End Sub",
+    "",
     "Sub Main()",
     "    Dim tbxStart As Long, tbxNum As Long, tbxDesc As String",
     "    tbxStart = Val(Command$)",
@@ -476,6 +524,7 @@ export function harnessText(calls) {
       `    Resume tbxNext${i}`,
       `tbxNext${i}:`,
       "    On Error GoTo 0",
+      "    tbxUnloadForms",
       `    If tbxNum <> 0 Then tbxMark "${RUN_TAG} error " & tbxNum & " " & tbxDesc`,
       `    tbxMark "${RUN_TAG} end ${i}"`,
       `tbxSkip${i}:`,
@@ -485,15 +534,55 @@ export function harnessText(calls) {
   return crlf(out.join("\n"));
 }
 
-/** The project file. `Unattended=-1` is why a box VB6 would show is written to the event log instead. */
+/**
+ * A blank form: the VB6 side of twinBASIC's `form` template (test/example-projects/form),
+ * whose Form1 is an empty form of 300 by 300 pixels with a predeclared instance. A
+ * `project=form` fence is built into a project that has this component, as
+ * `{name: "Form1", kind: "frm", text: FORM1}`.
+ */
+export const FORM1_NAME = "Form1";
+export const FORM1 = crlf(
+  [
+    "VERSION 5.00",
+    "Begin VB.Form Form1",
+    '   Caption         =   "Form1"',
+    "   ClientHeight    =   4500",
+    "   ClientLeft      =   60",
+    "   ClientTop       =   345",
+    "   ClientWidth     =   4500",
+    '   LinkTopic       =   "Form1"',
+    "   ScaleHeight     =   4500",
+    "   ScaleWidth      =   4500",
+    "   StartUpPosition =   3  'Windows Default",
+    "   Visible         =   0   'False",
+    "End",
+    'Attribute VB_Name = "Form1"',
+    "Attribute VB_GlobalNameSpace = False",
+    "Attribute VB_Creatable = False",
+    "Attribute VB_PredeclaredId = True",
+    "Attribute VB_Exposed = False",
+    "Option Explicit",
+    "",
+  ].join("\n"),
+);
+
+/** The project's components that are forms, which VB6 will not build with Unattended Execution. */
+export const hasForm = (components) => components.some((c) => c.kind === "frm");
+
+/**
+ * The project file. `Unattended=-1` is why a box VB6 would show is written to the event log
+ * instead; a project with a form cannot have it (see 9 at the top), and is run on a private
+ * desktop for the same reason a reproducer is.
+ */
 export function projectText(components) {
   return crlf(
     [
       "Type=Exe",
+      ...components.filter((c) => c.kind === "frm").map((c) => `Form=${c.name}.frm`),
       `Module=${HARNESS}; ${HARNESS}.bas`,
-      ...components.map((c) =>
-        c.kind === "cls" ? `Class=${c.name}; ${c.name}.cls` : `Module=${c.name}; ${c.name}.bas`,
-      ),
+      ...components
+        .filter((c) => c.kind !== "frm")
+        .map((c) => (c.kind === "cls" ? `Class=${c.name}; ${c.name}.cls` : `Module=${c.name}; ${c.name}.bas`)),
       'Startup="Sub Main"',
       `ExeName32="${PROJECT}.exe"`,
       'Command32=""',
@@ -505,7 +594,7 @@ export function projectText(components) {
       "RevisionVer=0",
       "AutoIncrementVer=0",
       "StartMode=0",
-      "Unattended=-1",
+      ...(hasForm(components) ? [] : ["Unattended=-1"]),
       "Retained=0",
       "CompilationType=0",
       "OptimizationType=0",
@@ -570,6 +659,36 @@ export function runLimited(exe, args, { cwd, timeoutMs }) {
   });
 }
 
+/**
+ * Run `exe` with one argument on a private desktop, inside a kill-on-close job, for at most
+ * `timeoutMs`, for a project with a form: a window or a box the exe shows is then on a
+ * desktop nobody uses. It ends as runLimited's does, by its pid.
+ *
+ * @returns {Promise<{status: number|null, timedOut: boolean, error?: string}>}
+ */
+async function runOnDesktop(exe, arg, { timeoutMs }) {
+  let run;
+  try {
+    run = await launchOnDesktop({ exe, arg, desktop: `vb6run-${process.pid}`, env: { ...process.env } });
+  } catch (e) {
+    return { status: null, timedOut: false, error: `could not run the built exe on a private desktop: ${e.message}` };
+  }
+  let timer;
+  const timedOut = await Promise.race([
+    run.exited.then(() => false),
+    new Promise((r) => {
+      timer = setTimeout(() => r(true), timeoutMs);
+    }),
+  ]);
+  clearTimeout(timer);
+  if (timedOut) {
+    killTree(run.pid);
+    run.launcher.kill();
+  }
+  const status = await run.exited;
+  return { status: timedOut ? null : status, timedOut };
+}
+
 /**
  * Build the project in `dir` with `VB6.EXE /make`.
  *
@@ -592,11 +711,13 @@ export async function make(vb6, dir, { timeoutMs = 120000, project = PROJECT } =
  */
 export async function runExe(
   dir,
-  { start = 0, timeoutMs = 30000, project = PROJECT, outName = OUT_NAME, args = [String(start)] } = {},
+  { start = 0, timeoutMs = 30000, project = PROJECT, outName = OUT_NAME, args = [String(start)], desktop = false } = {},
 ) {
   const outPath = path.join(dir, outName);
   rmSync(outPath, { force: true });
-  const r = await runLimited(path.join(dir, `${project}.exe`), args, { cwd: dir, timeoutMs });
+  const r = desktop
+    ? await runOnDesktop(path.join(dir, `${project}.exe`), args.join(" "), { timeoutMs })
+    : await runLimited(path.join(dir, `${project}.exe`), args, { cwd: dir, timeoutMs });
   const lines = existsSync(outPath) ? splitLines(decodeAnsi(readFileSync(outPath))) : [];
   return { lines, status: r.status, timedOut: r.timedOut, error: r.error };
 }
@@ -610,14 +731,19 @@ export async function runExe(
 // sources only. It is built in a copy under the OS temp folder, so no exe or
 // output ever lands in the repository, and the copy's project gets Unattended
 // Execution, as the generated project of vb6run does: a message box, or an error
-// the program did not handle, goes to the event log in place of the desktop.
+// the program did not handle, goes to the event log in place of the desktop. A
+// project with a form cannot have it (see 9 at the top), and every reproducer's
+// exe runs on a private desktop.
 
 /** The project, exe and output of a reproducer's VB6 project. */
 export const REPRO_PROJECT = "Probe";
 export const REPRO_OUT = "out.txt";
 
-/** The files of a VB6 project that are sources: the project, its modules, classes and forms (`.frx` is a form's binary part). */
-export const REPRO_SOURCE_EXTENSIONS = [".vbp", ".bas", ".cls", ".frm", ".frx"];
+/**
+ * The files of a VB6 project that are sources: the project, its modules, classes,
+ * forms and user controls (`.frx` is a form's binary part, `.ctx` a user control's).
+ */
+export const REPRO_SOURCE_EXTENSIONS = [".vbp", ".bas", ".cls", ".frm", ".frx", ".ctl", ".ctx"];
 
 /**
  * The files in a reproducer's vb6/ folder, by name: the sources, and the others
@@ -643,7 +769,7 @@ export function reproProblem(dir) {
   const { sources } = reproFiles(dir);
   if (!sources.includes(`${REPRO_PROJECT}.vbp`)) return `has no ${REPRO_PROJECT}.vbp`;
   for (const name of sources) {
-    if (/\.(?:vbp|frx)$/i.test(name)) continue;
+    if (/\.(?:vbp|frx|ctx)$/i.test(name)) continue;
     for (const { text, line } of logicalLines(decodeAnsi(readFileSync(path.join(dir, name))))) {
       const prompt = PROMPTS.exec(text);
       if (prompt) {
@@ -659,19 +785,65 @@ export function reproZipFiles(dir) {
   return reproFiles(dir).sources.map((name) => fileEntry(name, path.join(dir, name)));
 }
 
+/**
+ * Whether a project file names a component VB6 can show: a form (an MDI form is a
+ * `Form=` line too), a user control, a property page, a user document or a
+ * designer. VB6 will not build such a project with `Unattended=-1`.
+ */
+export const hasVisibleComponent = (vbp) =>
+  /^[ \t]*(?:Form|UserControl|PropertyPage|UserDocument|Designer)[ \t]*=/im.test(String(vbp));
+
 /**
  * The text of a project file with `Unattended=-1`, in the general section, before
- * any `[Section]`. A line it already has is replaced.
+ * any `[Section]`. A line it already has is replaced. With `on` false, the line
+ * is only removed.
  */
-export function unattended(vbp) {
+export function unattended(vbp, on = true) {
   const lines = String(vbp).split(/\r?\n/);
   if (lines[lines.length - 1] === "") lines.pop();
   const kept = lines.filter((l) => !/^\s*Unattended\s*=/i.test(l));
   const section = kept.findIndex((l) => /^\s*\[/.test(l));
-  kept.splice(section < 0 ? kept.length : section, 0, "Unattended=-1");
+  if (on) kept.splice(section < 0 ? kept.length : section, 0, "Unattended=-1");
   return `${kept.join("\r\n")}\r\n`;
 }
 
+/**
+ * Run a reproducer's built exe on a private desktop, inside a kill-on-close job,
+ * for at most `timeoutMs`, and read the out.txt it wrote. `env` adds variables to the exe's
+ * environment, which is the caller's otherwise.
+ *
+ * @returns {Promise<{lines: string[], status: number|null, timedOut: boolean}>}
+ */
+async function runReproExe(work, timeoutMs, env = {}) {
+  const outPath = path.join(work, REPRO_OUT);
+  rmSync(outPath, { force: true });
+  let run;
+  try {
+    run = await launchOnDesktop({
+      exe: path.join(work, `${REPRO_PROJECT}.exe`),
+      desktop: `bugrepro-vb6-${process.pid}`,
+      env: { ...process.env, ...env },
+    });
+  } catch (e) {
+    throw new Error(`could not run the built exe on a private desktop: ${e.message}`);
+  }
+  let timer;
+  const timedOut = await Promise.race([
+    run.exited.then(() => false),
+    new Promise((r) => {
+      timer = setTimeout(() => r(true), timeoutMs);
+    }),
+  ]);
+  clearTimeout(timer);
+  if (timedOut) {
+    killTree(run.pid);
+    run.launcher.kill();
+  }
+  const status = await run.exited;
+  const lines = existsSync(outPath) ? splitLines(decodeAnsi(readFileSync(outPath))) : [];
+  return { lines, status: timedOut ? null : status, timedOut };
+}
+
 /**
  * Build and run the VB6 project in `dir` (a reproducer's vb6/ folder), in a copy
  * of its sources under the OS temp folder, which is removed unless `keep`.
@@ -679,25 +851,20 @@ export function unattended(vbp) {
  * @returns {Promise<{built: boolean, log: string, lines: string[], status: number|null, timedOut: boolean, work: string, kept: boolean}>}
  *   `lines` is what out.txt held; a VB6 that did not finish building throws
  */
-export async function runRepro(vb6, dir, { timeoutMs = 30000, keep = false } = {}) {
+export async function runRepro(vb6, dir, { timeoutMs = 30000, keep = false, env = {} } = {}) {
   const work = mkdtempSync(path.join(tmpdir(), "bugrepro-vb6-"));
   try {
     for (const name of reproFiles(dir).sources) copyFileSync(path.join(dir, name), path.join(work, name));
     const vbp = path.join(work, `${REPRO_PROJECT}.vbp`);
-    writeFileSync(vbp, encodeAnsi(unattended(decodeAnsi(readFileSync(vbp)))));
+    const text = decodeAnsi(readFileSync(vbp));
+    writeFileSync(vbp, encodeAnsi(unattended(text, !hasVisibleComponent(text))));
     const made = await make(vb6, work, { project: REPRO_PROJECT });
     if (made.timedOut || made.error) {
       throw new Error(`VB6 did not finish building${made.error ? `: ${made.error}` : " in time"}\n${made.log}`);
     }
     const result = { built: made.built, log: made.log, lines: [], status: null, timedOut: false, work, kept: keep };
     if (!made.built) return result;
-    const ran = await runExe(work, {
-      timeoutMs: Math.min(timeoutMs, 2147483647),
-      project: REPRO_PROJECT,
-      outName: REPRO_OUT,
-      args: [],
-    });
-    if (ran.error) throw new Error(`could not run the built exe: ${ran.error}`);
+    const ran = await runReproExe(work, Math.min(timeoutMs, 2147483647), env);
     return { ...result, lines: ran.lines, status: ran.status, timedOut: ran.timedOut };
   } finally {
     if (!keep) rmSync(work, { recursive: true, force: true });
@@ -720,7 +887,7 @@ export function parseMakeLog(log, names) {
   const m = /Error in File '([^']*)', Line (\d+) : ([^\n]*)/i.exec(text);
   if (!m) return { module: null, line: null, message: text.split("\n")[0] ?? "" };
   const file = m[1].slice(Math.max(m[1].lastIndexOf("\\"), m[1].lastIndexOf("/")) + 1);
-  const base = file.replace(/\.(?:bas|cls)$/i, "").toLowerCase();
+  const base = file.replace(/\.(?:bas|cls|frm)$/i, "").toLowerCase();
   return {
     module: names.find((n) => n.toLowerCase() === base) ?? null,
     line: Number(m[2]),
@@ -770,7 +937,8 @@ export async function buildBatch(vb6, dir, modules, { timeoutMs, support = [] }
     // A log that names no module of the project: with one module left it is that one's, and
     // otherwise nothing says which to drop, so the build cannot go on.
     const culprit =
-      active.find((m) => m.name === err.module) ?? (active.length === 1 && !support.length ? active[0] : null);
+      active.find((m) => m.name === err.module) ??
+      (active.length === 1 && support.every((c) => c.kind === "frm") ? active[0] : null);
     if (!culprit)
       throw new Error(`VB6 could not build the project, and its log names no sample:\n${r.log || "(empty log)"}`);
     refused.set(culprit.name, { line: err.line, message: err.message, log: r.log });
@@ -783,15 +951,17 @@ export async function buildBatch(vb6, dir, modules, { timeoutMs, support = [] }
  * Run a built batch, sample by sample, and go on after one that does not return.
  *
  * @param {number} count  samples in the built project
+ * @param {{timeoutMs?: number, desktop?: boolean}} o  `desktop` runs the exe on a private
+ *   desktop, for a project with a form
  * @returns {Promise<{items: ReturnType<typeof parseRun>["items"], hung: number[]}>}
  *   `hung` lists the samples that began and never ended
  */
-export async function runBatch(dir, count, { timeoutMs } = {}) {
+export async function runBatch(dir, count, { timeoutMs, desktop = false } = {}) {
   const items = Array.from({ length: count }, () => ({ began: false, ended: false, output: [], error: null }));
   const hung = [];
   let start = 0;
   while (start < count) {
-    const r = await runExe(dir, { start, timeoutMs });
+    const r = await runExe(dir, { start, timeoutMs, desktop });
     if (r.error) throw new Error(`could not run the built exe: ${r.error}`);
     const parsed = parseRun(r.lines, count);
     parsed.items.forEach((it, i) => {
@@ -1023,6 +1193,56 @@ export function vb6Probes() {
     "the project lists a class as Class= and a module as Module=",
     proj.includes("Class=Foo; Foo.cls\r\n") && proj.includes("Module=Util; Util.bas\r\n"),
   );
+  check("a project with no form is built with Unattended Execution", proj.includes("Unattended=-1\r\n"));
+  // `project=form`: a blank Form1.frm beside the samples, and no Unattended Execution, which VB6
+  // refuses for a project that has a form.
+  const formProj = projectText([
+    { name: FORM1_NAME, kind: "frm", text: FORM1 },
+    { name: "Util", kind: "bas" },
+  ]);
+  check(
+    "a form is listed as Form=, and the project is not unattended",
+    formProj.includes("Form=Form1.frm\r\n") &&
+      !formProj.includes("Unattended") &&
+      !formProj.includes("Module=Form1") &&
+      formProj.includes("Module=Util; Util.bas\r\n"),
+    JSON.stringify(formProj),
+  );
+  check(
+    "the blank form is a Form1 with a predeclared instance",
+    FORM1.startsWith("VERSION 5.00\r\nBegin VB.Form Form1\r\n") &&
+      /Attribute VB_PredeclaredId = True\r\n/.test(FORM1) &&
+      !/(?<!\r)\n/.test(FORM1),
+  );
+  // Each sample's forms are unloaded before its end marker, as the twinBASIC dispatcher does, because
+  // a form left loaded keeps the exe running after Main returns.
+  const harness = harnessText(["a.Body", "b.Body"]).split("\r\n");
+  check(
+    "the harness unloads a sample's forms before the sample's end marker",
+    [0, 1].every((i) => {
+      const call = harness.indexOf(`    ${i ? "b" : "a"}.Body`);
+      const unload = harness.indexOf("    tbxUnloadForms", call);
+      return unload > call && unload < harness.findIndex((l) => l.includes(`end ${i}"`));
+    }) && harness.includes("        Unload Forms(i)"),
+  );
+  const declared = declaresForVb6(
+    'Public Declare PtrSafe Function GetPixel Lib "gdi32" (ByVal hdc As LongPtr, ByVal x As Long) As Long\n' +
+      'Private Declare PtrSafe Function F Lib "k" (ByVal a As LongPtr, _\n    ByVal b As LongPtr) As LongPtr\n' +
+      'Declare Function G Lib "k" (ByVal a As LongPtr) As Long\n' +
+      "Dim p As LongPtr\n",
+  ).split("\n");
+  check(
+    "a PtrSafe Declare loses PtrSafe and reads LongPtr as Long, across a continuation",
+    declared[0] === 'Public Declare Function GetPixel Lib "gdi32" (ByVal hdc As Long, ByVal x As Long) As Long' &&
+      declared[1] === 'Private Declare Function F Lib "k" (ByVal a As Long, _' &&
+      declared[2] === "    ByVal b As Long) As Long",
+    JSON.stringify(declared),
+  );
+  check(
+    "a Declare with no PtrSafe, and any other line, is left as it is",
+    declared[3] === 'Declare Function G Lib "k" (ByVal a As LongPtr) As Long' && declared[4] === "Dim p As LongPtr",
+    JSON.stringify(declared),
+  );
   out.push(...reproProbes());
   return out;
 }
@@ -1048,10 +1268,13 @@ function reproProbes() {
     put("Widget.cls", "VERSION 1.0 CLASS\r\nBEGIN\r\nEND\r\n");
     put("Form1.frm", "VERSION 5.00\r\n");
     put("Form1.frx", "binary");
+    put("UC1.ctl", "VERSION 5.00\r\n");
+    // A binary part that happens to spell a prompt: never read as code.
+    put("UC1.ctx", "MsgBox binary");
     // What a build or a run leaves behind, and what an editor does, none of which is a source.
     for (const name of ["Probe.exe", "out.txt", "make.log", "Probe.vbw", "notes.md", "Module1.bas.bak"]) put(name, "x");
     mkdirSync(path.join(dir, "Sub.bas"));
-    const want = ["Form1.frm", "Form1.frx", "Module1.bas", "Probe.vbp", "Widget.cls"];
+    const want = ["Form1.frm", "Form1.frx", "Module1.bas", "Probe.vbp", "UC1.ctl", "UC1.ctx", "Widget.cls"];
     const files = reproFiles(dir);
     check("only sources are listed, by name", files.sources.join(" ") === want.join(" "), files.sources.join(" "));
     check(
@@ -1087,6 +1310,23 @@ function reproProbes() {
     );
     put("Widget.cls", "VERSION 1.0 CLASS\r\nBEGIN\r\nEND\r\n");
     check("a class with only its header is accepted", reproProblem(dir) === null, String(reproProblem(dir)));
+    // The picture module that bug_repro new --with-images copies into vb6/ is a source like any other, and
+    // must not call a prompt.
+    const pngDump = fileURLToPath(new URL("../../test/repro-templates/png/PngDump.bas", import.meta.url));
+    copyFileSync(pngDump, path.join(dir, "PngDump.bas"));
+    check(
+      "PngDump.bas, the picture module of --with-images, passes",
+      reproProblem(dir) === null,
+      String(reproProblem(dir)),
+    );
+    rmSync(path.join(dir, "PngDump.bas"));
+    put("UC1.ctl", "VERSION 5.00\r\nBegin VB.UserControl UC1\r\nEnd\r\nSub F()\r\n    MsgBox 1\r\nEnd Sub\r\n");
+    check(
+      "MsgBox in a user control refuses it too",
+      /^UC1\.ctl, line 5 calls MsgBox/.test(reproProblem(dir) ?? ""),
+      String(reproProblem(dir)),
+    );
+    put("UC1.ctl", "VERSION 5.00\r\n");
     rmSync(path.join(dir, "Probe.vbp"));
     check(
       "a folder with no Probe.vbp is refused",
@@ -1107,5 +1347,19 @@ function reproProbes() {
     unattended('Type=Exe\nUnattended=0\nName="P"\n') === 'Type=Exe\r\nName="P"\r\nUnattended=-1\r\n',
     JSON.stringify(unattended('Type=Exe\nUnattended=0\nName="P"\n')),
   );
+  check(
+    "with on false, Unattended is only removed",
+    unattended("Type=Exe\nUnattended=-1\nForm=Form1.frm\n", false) === "Type=Exe\r\nForm=Form1.frm\r\n",
+    JSON.stringify(unattended("Type=Exe\nUnattended=-1\nForm=Form1.frm\n", false)),
+  );
+  check(
+    "a form, a user control and a designer are visible components, a module and a class are not",
+    hasVisibleComponent("Type=Exe\r\nForm=Form1.frm\r\n") &&
+      hasVisibleComponent("UserControl=Ctl.ctl\r\n") &&
+      hasVisibleComponent("Designer=DataEnv.Dsr\r\n") &&
+      !hasVisibleComponent('Type=Exe\r\nModule=Module1; Module1.bas\r\nClass=C; C.cls\r\nStartup="Sub Main"\r\n') &&
+      !hasVisibleComponent("[MS Transaction Server]\r\nFormatted=1\r\n"),
+    "",
+  );
   return out;
 }
diff --git a/scripts/tbbuild.mjs b/scripts/tbbuild.mjs
index 884aff729..47ea11518 100644
--- a/scripts/tbbuild.mjs
+++ b/scripts/tbbuild.mjs
@@ -42,7 +42,8 @@
 // whole surface is six verbs -- export, import, settings, licence, changelog,
 // readme -- and none builds; the IDE executable does take `--buildAndExit32`
 // and `--buildAndExit64`, but those write nothing to stdout or stderr, exit 0
-// on a project the IDE flags, and do not exit at all when the build fails.
+// when the error is in code nothing calls, and do not exit at all for an error
+// the build reaches.
 //
 // The IDE's user interface, though, is a WebView2 page, and WebView2 honours
 // WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS. So the IDE can be started with a
diff --git a/scripts/vb6run.mjs b/scripts/vb6run.mjs
index b0c670ae0..7a5d8d584 100644
--- a/scripts/vb6run.mjs
+++ b/scripts/vb6run.mjs
@@ -35,6 +35,8 @@ import { expectedOutput, isRunFence, judgeOutput, runFenceProblem, runRefusal }
 import { joinConcatGroups } from "./lib/example-batches.mjs";
 import { HIDDEN_MARKER, classify, collectFences, partOf } from "./lib/tb-fences.mjs";
 import {
+  FORM1,
+  FORM1_NAME,
   NO_VB6,
   USER_MODULE,
   buildBatch,
@@ -74,7 +76,10 @@ generated Sub Main opens, because Debug.Print writes nothing in a compiled exe.
               fences of a projname= group are built in a project of its own with
               the group's other fences, each slot=file fence translated into
               VB6 classes (.cls) and modules (.bas); a construct VB6 has no form
-              for is left as it is, and VB6 refuses it. Each fence ends as one of:
+              for is left as it is, and VB6 refuses it. A fence that says
+              project=form is built with a blank Form1.frm (no Unattended
+              Execution, the exe run on a private desktop), and a Declare loses
+              PtrSafe and reads LongPtr as Long. Each fence ends as one of:
               same, differs (the lines that differ, page against VB6), not VB6
               (VB6 refuses to compile it, or the files of its group; most
               twinBASIC syntax ends here, and it is informational), error (a
@@ -254,14 +259,20 @@ async function docs() {
   }
 
   // The samples of a unit are built as modules of one project and run, and each is judged.
-  const judge = async (unit, dir, built) => {
+  // `project=form` is the twinBASIC `form` template: a real Form1, which VB6 gets as a blank
+  // Form1.frm. A project with a form is not built with Unattended Execution, and its exe is run
+  // on a private desktop (see vb6.mjs).
+  const wantsForm = (fence) => fence.keys.get("project") === "form";
+  const formSupport = { name: FORM1_NAME, kind: "frm", text: FORM1 };
+
+  const judge = async (unit, dir, built, { form = false } = {}) => {
     for (const r of unit) {
       const e = built.refused.get(r.module.name);
       if (e) notVb6(r, r.fence, e, r.module.lineDelta);
     }
     const ran = unit.filter((r) => !r.state);
     if (!ran.length) return;
-    const run = await runBatch(dir, ran.length, { timeoutMs });
+    const run = await runBatch(dir, ran.length, { timeoutMs, desktop: form });
     ran.forEach((r, i) => {
       const item = run.items[i];
       const f = r.fence;
@@ -293,18 +304,24 @@ async function docs() {
     });
   };
 
-  if (plain.length) {
-    plain.forEach((r, i) => {
+  // The plain samples are one project, and the ones that want a form another, the one with Form1.
+  for (const [label, form] of [
+    ["plain", false],
+    ["plain-form", true],
+  ]) {
+    const unit = plain.filter((r) => wantsForm(r.fence) === form);
+    if (!unit.length) continue;
+    unit.forEach((r, i) => {
       r.module = moduleFor(r.fence.content, { name: `tbxM${i}` });
     });
-    const dir = path.join(work, "plain");
+    const dir = path.join(work, label);
     const built = await buildBatch(
       vb6,
       dir,
-      plain.map((r) => r.module),
-      { timeoutMs: 120000 },
+      unit.map((r) => r.module),
+      { timeoutMs: 120000, support: form ? [formSupport] : [] },
     );
-    await judge(plain, dir, built);
+    await judge(unit, dir, built, { form });
   }
 
   // A projname group is one program: the fences of that name, on any page, that are not run fences
@@ -337,6 +354,9 @@ async function docs() {
     unit.forEach((r, i) => {
       r.module = moduleFor(r.fence.content, { name: `tbxM${i}` });
     });
+    // A group whose run fence says project=form, or any of whose files do, gets Form1.
+    const form = all.some((f) => f.keys.get("projname") === name && !f.isResource && wantsForm(f));
+    if (form) support.unshift(formSupport);
     const built = await buildBatch(
       vb6,
       dir,
@@ -349,7 +369,7 @@ async function docs() {
       for (const r of unit) notVb6(r, component.fence, { line, message }, component.lineDelta);
       continue;
     }
-    await judge(unit, dir, built);
+    await judge(unit, dir, built, { form });
   }
 
   const STATES = ["same", "differs", "not VB6", "error", "refused", "ran"];
diff --git a/test.bat b/test.bat
index 4538084f1..588470bb7 100644
--- a/test.bat
+++ b/test.bat
@@ -70,6 +70,13 @@ node --test test/render.test.mjs
 @rem No tree, no browser, well under a second.
 node --test test/strftime.test.mjs
 @if errorlevel 1 goto :fail
+@rem Unit tests for the pictures of a bug reproducer: scripts/lib/png.mjs
+@rem (PNG decoding, comparing and the side-by-side image), the files and
+@rem judgements behind repro.json's images and expect.imagesDiffer, and
+@rem bug_repro.mjs's own refusals, over fixtures. Starts no IDE and no VB6.
+@rem No tree, no browser, about 4 s.
+node --test test/png.test.mjs
+@if errorlevel 1 goto :fail
 @rem check_examples.mjs's probes: batching, crash isolation through a fake
 @rem lane, the canaries and the fence classifier. check_examples.mjs needs a
 @rem twinBASIC install, so it runs only by hand; its probes need none.
diff --git a/test/addin/env.test.mjs b/test/addin/env.test.mjs
new file mode 100644
index 000000000..a2db08634
--- /dev/null
+++ b/test/addin/env.test.mjs
@@ -0,0 +1,102 @@
+// P10 in WIP.HelpAddin.md, measured: whether the environment variable the
+// harness sets, TB_ADDIN_TEST (ADDIN_TEST_ENV in scripts/lib/tb-ide.mjs),
+// reaches an add-in. The EnvProbe add-in (probes/env) prints, as its project
+// loads, the variable as Environ$ and as GetEnvironmentVariableW read it, and
+// the id of the process it runs in.
+//
+// The rule that an add-in under test prints `open <url>` instead of opening a
+// browser (WIP.md, "Testing an IDE add-in") depends on this: an IDE starts the
+// compiler, the compiler loads the add-in into its own process, and the
+// variable has to survive both steps and a compiler restart. Nothing else in the
+// lanes guards it. The last test is the control: an IDE started with the
+// variable left out reports it unset, so the first two read what the harness set
+// and not something the machine had.
+//
+// Each test states what BETA 983 and 995 do. If one fails after an IDE update, the
+// IDE has changed: update P10 in WIP.HelpAddin.md, the paragraph under "An
+// add-in under test opens nothing" in WIP.Harness.md, and every add-in that
+// checks the variable (they would open a real browser), and then this file.
+//
+// Run it with addin-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { ADDIN_TEST_ENV, compilerPid } from "../../scripts/lib/tb-ide.mjs";
+import { consoleMark, linesSince } from "../../scripts/lib/tb-ide-console.mjs";
+import { waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "./scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const HOST = path.join(HERE, "host");
+const PROBE = path.join(HERE, "probes", "env");
+
+// What the probe printed since a mark, as { environ, win32, pid } for each line.
+async function probeSince(c, mark) {
+  return (await linesSince(c, mark, { prefix: "[EnvProbe] " })).map((l) => {
+    const m = /^Environ=(.*) GetEnvironmentVariableW=(.*) pid=(\d+)$/.exec(l);
+    assert.ok(m, `not a line of the probe's: ${JSON.stringify(l)}`);
+    return { environ: m[1], win32: m[2], pid: Number(m[3]) };
+  });
+}
+
+// The probe's lines since a mark, once it has printed one.
+async function waitForProbe(c, mark) {
+  const lines = await waitFor(
+    c,
+    async (c) => {
+      const l = await probeSince(c, mark);
+      return l.length > 0 && l;
+    },
+    { timeout: 30000 },
+  );
+  assert.ok(lines, "the add-in printed nothing");
+  return lines;
+}
+
+scenario("P10: the environment variable the harness sets reaches an add-in", (lane) => {
+  let c, firstPid;
+  before(async () => {
+    assert.equal(ADDIN_TEST_ENV, "TB_ADDIN_TEST", "the probe reads the name this file expects");
+    await lane.addAddin(PROBE);
+    c = await lane.open(HOST);
+  });
+
+  test("an IDE the harness starts passes it to the add-in, in the compiler's process", async (t) => {
+    const lines = await waitForProbe(c, null);
+    assert.equal(lines.length, 1, `loaded more than once: ${JSON.stringify(lines)}`);
+    // Environ$ and the Win32 call read the same variable.
+    assert.deepEqual(lines[0].environ, "1");
+    assert.deepEqual(lines[0].win32, "1");
+    // The add-in runs in the compiler, a child of the IDE, not in the IDE.
+    firstPid = await compilerPid(c);
+    assert.equal(lines[0].pid, firstPid);
+    t.diagnostic(`TB_ADDIN_TEST was 1 in compiler process ${firstPid}`);
+  });
+
+  test("a compiler restarted with the toolbar's button is a new process, and the add-in it loads reads it too", async (t) => {
+    const mark = await consoleMark(c);
+    const newPid = await lane.restartCompiler();
+    const lines = await waitForProbe(c, mark);
+    assert.equal(lines.length, 1, `loaded more than once: ${JSON.stringify(lines)}`);
+    assert.deepEqual(lines[0].environ, "1");
+    assert.deepEqual(lines[0].win32, "1");
+    assert.notEqual(lines[0].pid, firstPid, "the restart did not start a new process");
+    assert.equal(lines[0].pid, newPid);
+    assert.equal(await compilerPid(c), newPid);
+    t.diagnostic(`TB_ADDIN_TEST was 1 in compiler process ${lines[0].pid}, after ${firstPid}`);
+  });
+
+  // The control. The probe prints nothing that opens anything, so an IDE started
+  // without the variable is safe to run.
+  test("an IDE started with the variable left out reports it unset", async () => {
+    await lane.closeProject();
+    c = await lane.open(HOST, { env: { [ADDIN_TEST_ENV]: undefined } });
+    const lines = await waitForProbe(c, null);
+    assert.deepEqual(lines.length, 1, `loaded more than once: ${JSON.stringify(lines)}`);
+    assert.deepEqual(lines[0].environ, "");
+    assert.deepEqual(lines[0].win32, "(unset)");
+    assert.equal(lines[0].pid, await compilerPid(c));
+  });
+});
diff --git a/test/addin/lanes.mjs b/test/addin/lanes.mjs
index 28b68063a..982f11dbf 100644
--- a/test/addin/lanes.mjs
+++ b/test/addin/lanes.mjs
@@ -21,8 +21,9 @@ export default [
   // Sample 15 saves all four of its option boxes whenever one is clicked.
   { file: "sample15.test.mjs", settings: ["GlobalSearchAddIn"] },
   // Stage 2 probes. Each finds what it needs in probes/<name>: an add-in it
-  // builds (keys, panes, appdata, arch, reload, entry) or a project it opens
-  // (symbols); ideserver needs neither.
+  // builds (keys, panes, appdata, arch, reload, entry, env) or a project it opens
+  // (symbols); ideserver needs neither. env's add-in prints the harness's
+  // environment variable and saves nothing.
   { file: "keys.test.mjs" },
   { file: "panes.test.mjs" },
   { file: "symbols.test.mjs" },
@@ -31,4 +32,5 @@ export default [
   { file: "arch.test.mjs" },
   { file: "reload.test.mjs" },
   { file: "entry.test.mjs" },
+  { file: "env.test.mjs" },
 ];
diff --git a/test/addin/probes/env/Settings b/test/addin/probes/env/Settings
new file mode 100644
index 000000000..4a9858827
--- /dev/null
+++ b/test/addin/probes/env/Settings
@@ -0,0 +1,42 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "EnvProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard DLL",
+	"project.description": "P10 in WIP.HelpAddin.md: whether the environment variable the harness sets reaches an add-in. test/addin/env.test.mjs builds it into the copy of the install its lane makes; never put it in your own %APPDATA%\\twinBASIC\\addins or in a real install's addins folder.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247100-0000-4000-9000-7B2471000007}",
+	"project.name": "EnvProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{99DEC38C-75F6-4488-8EE7-2D52D83881D2}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC IDE Extensibility Package",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "tbIDE",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 1
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.warnings": {
+		"errors": [],
+		"ignored": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/addin/probes/env/Sources/MainModule.twin b/test/addin/probes/env/Sources/MainModule.twin
new file mode 100644
index 000000000..f985c4bd9
--- /dev/null
+++ b/test/addin/probes/env/Sources/MainModule.twin
@@ -0,0 +1,47 @@
+' P10 in WIP.HelpAddin.md: does the environment variable the harness sets reach
+' an add-in? env.test.mjs builds this add-in into the copy of the install its
+' lane makes. When it loads it prints one line to the DEBUG CONSOLE: the value of
+' TB_ADDIN_TEST as Environ$ reads it, as GetEnvironmentVariableW reads it
+' ("(unset)" when the variable is not there), and the id of the process the
+' add-in runs in, which is the compiler's. Every line it prints starts
+' "[EnvProbe]". It does nothing else, and opens nothing.
+Module MainModule
+    Private Declare PtrSafe Function GetCurrentProcessId Lib "kernel32" () As Long
+    Private Declare PtrSafe Function GetEnvironmentVariableW Lib "kernel32" (ByVal lpName As LongPtr, _
+        ByVal lpBuffer As LongPtr, ByVal nSize As Long) As Long
+
+    [DllExport]
+    Public Function tbCreateCompilerAddin(ByVal Host As Host) As AddIn
+        Return New EnvProbeAddin(Host)
+    End Function
+
+    ' The variable as the Win32 API reads it, or "(unset)".
+    Public Function Win32Value(ByVal name As String) As String
+        Dim buf As String = String$(256, vbNullChar)
+        Dim n As Long = GetEnvironmentVariableW(StrPtr(name), StrPtr(buf), 256)
+        If n = 0 Or n > 255 Then Return "(unset)"
+        Return Left$(buf, n)
+    End Function
+
+    Public Function ProcessId() As Long
+        Return GetCurrentProcessId()
+    End Function
+End Module
+
+Private Class EnvProbeAddin
+    Implements AddIn
+    Private WithEvents Host As Host
+
+    Public Sub New(ByVal Host As Host)
+        Set Me.Host = Host
+    End Sub
+
+    Private Property Get AddIn_Name() As String
+        Return "EnvProbe AddIn"
+    End Property
+
+    Private Sub Host_OnProjectLoaded()
+        Host.DebugConsole.PrintText "[EnvProbe] Environ=" & Environ$("TB_ADDIN_TEST") & _
+            " GetEnvironmentVariableW=" & Win32Value("TB_ADDIN_TEST") & " pid=" & ProcessId()
+    End Sub
+End Class
diff --git a/test/example-projects/form/Sources/Form1.tbform b/test/example-projects/form/Sources/Form1.tbform
new file mode 100644
index 000000000..6b697e4f9
--- /dev/null
+++ b/test/example-projects/form/Sources/Form1.tbform
@@ -0,0 +1,83 @@
+[
+	{
+		"AlwaysShowKeyboardCues": false,
+		"Appearance": "vbAppear3d",
+		"AutoRedraw": false,
+		"BackColor": -2147483633,
+		"BorderStyle": "vbSizable",
+		"Caption": "Form1",
+		"ClipControls": true,
+		"ControlBox": true,
+		"DrawMode": "vbCopyPen",
+		"DrawStyle": "vbSolid",
+		"DrawWidth": 1,
+		"Enabled": true,
+		"FillColor": 0,
+		"FillStyle": "vbFSTransparent",
+		"FontBold": false,
+		"FontItalic": false,
+		"FontName": "Segoe UI",
+		"FontSize": 8,
+		"FontStrikethru": false,
+		"FontTransparent": true,
+		"FontUnderline": false,
+		"ForeColor": -2147483630,
+		"FormDesignerId": "{EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01}",
+		"HasDC": true,
+		"Height": 300,
+		"HelpContextID": 0,
+		"Icon": [],
+		"KeyPreview": false,
+		"Left": 0,
+		"LinkMode": "vbLinkNone",
+		"LinkTopic": null,
+		"MDIChild": false,
+		"MaxButton": true,
+		"MaxHeight": 0,
+		"MaxWidth": 0,
+		"MinButton": true,
+		"MinHeight": 0,
+		"MinWidth": 0,
+		"MouseIcon": [],
+		"MousePointer": "vbDefault",
+		"Moveable": true,
+		"Name": "Form1",
+		"NegotiateMenus": false,
+		"OLEDropMode": "vbOLEDropNone",
+		"Opacity": 100,
+		"Palette": [],
+		"PaletteMode": "vbPaletteModeHalftone",
+		"Picture": [],
+		"PictureDpiScaling": false,
+		"RightToLeft": false,
+		"ScaleHeight": 4500,
+		"ScaleLeft": 0,
+		"ScaleMode": "vbTwips",
+		"ScaleTop": 0,
+		"ScaleWidth": 4500,
+		"ShowInTaskbar": true,
+		"StartUpPosition": "vbStartUpScreen",
+		"TabFocusAutoSelect": false,
+		"Tag": null,
+		"Top": 0,
+		"TopMost": false,
+		"TransparencyKey": -1,
+		"Visible": true,
+		"WhatsThisButton": false,
+		"WhatsThisHelp": false,
+		"Width": 300,
+		"WindowState": "vbNormal",
+		"__IDEOptions": {
+			"alignToGrid": false,
+			"gridHeight": 10,
+			"gridWidth": 10,
+			"lockedControls": [],
+			"multiColoredGrabbers": false,
+			"showGrid": true,
+			"showOutlines": false
+		},
+		"__lastUpdateMarker": 2061908507,
+		"_className": "Form",
+		"_clsid": "{33AD4F38-6699-11CF-B70C-00AA0060D393}"
+	}
+]
diff --git a/test/example-projects/form/Sources/Form1.twin b/test/example-projects/form/Sources/Form1.twin
new file mode 100644
index 000000000..2a9d1872b
--- /dev/null
+++ b/test/example-projects/form/Sources/Form1.twin
@@ -0,0 +1,16 @@
+' A real, empty form for the samples that draw on one, or read or set a form's
+' own properties, and are run (see the `form` template in WIP.ExamplesBuild.md).
+'
+' Form1.tbform is its designer file, and the two name the same designer id. A form
+' created in code has no designer file, and cannot be drawn on: `Load` raises 361
+' and `AutoRedraw` raises -2147467259 -- so the form has to be a file of the project.
+
+[Description("")]
+[FormDesignerId("EAEAEAEA-EAEA-EAEA-EAEA-EAEAEAEAEA01")]
+[PredeclaredId]
+Class Form1
+
+    Sub New()
+    End Sub
+
+End Class
diff --git a/test/example-projects/form/Sources/tbxStage.twin b/test/example-projects/form/Sources/tbxStage.twin
new file mode 100644
index 000000000..b1cf0658a
--- /dev/null
+++ b/test/example-projects/form/Sources/tbxStage.twin
@@ -0,0 +1,149 @@
+' The stage set: the control instances the documentation's samples assume.
+'
+' This is the `console` template's file, the same list, with ONE line fewer:
+' `Public Form1 As Form`. The `form` template has a real Form1 (Form1.twin and
+' Form1.tbform), and a stand-in beside it would be a second Form1 at project
+' scope for `Load Form1` to choose between. test/example-batches.test.mjs checks
+' that this file is console's file less that line, so the two cannot drift apart.
+'
+' A sample that says `Text1.Text = "hi"` is form code-behind. It is complete as
+' documentation -- the reader has a form with a TextBox on it -- and it cannot
+' compile on its own, because the designer, not the code, is what declares
+' Text1. Declaring those instances here lets the compiler check what the sample
+' is actually asserting: that the member exists, that it takes those arguments,
+' that the types line up.
+'
+' Every name here was measured, not guessed: it is an identifier that appears in
+' a `tb` fence under docs/ in the position of a control instance. The list is
+' the tool's one deliberate fiction, so it stays explicit and greppable -- an
+' inference rule over "a name ending in a digit" would also have declared Var1,
+' Arg1, Line2, SQLITE3, VBA7 and MySub1, none of which is a control.
+'
+' Public, not Private: the samples are generated into their own modules and have
+' to see these from there.
+
+Module tbxStage
+
+    Public Form2 As Form
+    Public Form3 As Form
+    Public MDIForm1 As MDIForm
+    Public UserForm1 As Form
+    Public UserForm2 As Form
+
+    Public Text1 As TextBox
+    Public Text2 As TextBox
+    Public TextBox1 As TextBox
+
+    Public Label1 As Label
+    Public Timer1 As Timer
+    Public Command1 As CommandButton
+    Public Frame1 As Frame
+    Public Picture1 As PictureBox
+    Public Picture2 As PictureBox
+    Public PictureBox1 As PictureBox
+
+    ' The VB control instances the reference pages put on their forms. Each is
+    ' named after the page that assumes it -- ListBox/index.md says List1, and
+    ' the three file-system controls share Drive1 / Dir1 / File1 because the
+    ' pages show them wired to each other.
+    Public List1 As ListBox
+    Public Combo1 As ComboBox
+    Public Check1 As CheckBox
+    Public Drive1 As DriveListBox
+    Public Dir1 As DirListBox
+    Public File1 As FileListBox
+    Public Data1 As Data
+    Public OLE1 As OLE
+
+    ' QRCode/index.md's control instance.
+    Public QRCode1 As QRCode
+
+    ' The DataObject pages' samples enumerate a drag-and-drop payload, which in
+    ' real code arrives as an OLEDrag handler's `Data` parameter. Declaring it
+    ' shadows nothing: `Data1 As Data` above still resolves the VB control class
+    ' of the same name, which the compiler was asked directly.
+    Public Data As DataObject
+
+    ' The same, where the page uses a descriptive name rather than a numbered one.
+    Public picCanvas As PictureBox
+    Public hsbVolume As HScrollBar
+    Public vsbLevel As VScrollBar
+    Public lblStatus As Label
+    Public lblCoords As Label
+    Public lblClock As Label
+    Public cmdOK As CommandButton
+    Public optHTML As OptionButton
+    Public mnuFileSave As Menu
+    Public imgLogo As Image
+    Public linUnderHeading As Line
+    Public shpPanel As Shape
+    Public mfPanels As MultiFrame
+
+    ' UserControl code-behind reaches two intrinsic objects the way form
+    ' code-behind reaches Me: the control itself, and its container's ambient
+    ' properties. Both are declared here for the same reason Text1 is -- the
+    ' designer, not the code, is what brings them into scope.
+    Public UserControl As UserControl
+    Public Ambient As AmbientProperties
+
+    ' The rest of the VB reference's forms, named as each page names them. Every
+    ' one is a control instance a page's sample assumes the reader has placed,
+    ' and the type is the one that page is about -- fraLeft is a Frame because
+    ' MultiFrame's sample docks Frames into a strip, dlgOptions is a Form because
+    ' Form/index.md shows `dlgOptions.Show vbModal, Me`.
+    Public cboFonts As ComboBox
+    Public chkInPrint As CheckBox
+    Public cmdCancel As CommandButton
+    Public cmdContinue As CommandButton
+    Public cmdSave As CommandButton
+    Public dlgOptions As Form
+    Public fraCenter As Frame
+    Public fraExtra As Frame
+    Public fraLeft As Frame
+    Public fraOutput As Frame
+    Public fraRight As Frame
+    Public hsbZoom As HScrollBar
+    Public vsbVolume As VScrollBar
+    Public lblBox As Label
+    Public lblCount As Label
+    Public lblHelp As Label
+    Public lblLevel As Label
+    Public lblName As Label
+    Public lblResult As Label
+    Public lblUnits As Label
+    Public lblVolume As Label
+    Public optCtoF As OptionButton
+    Public optMarkdown As OptionButton
+    Public optPlain As OptionButton
+    Public optTerms As OptionButton
+    Public picLogo As PictureBox
+    Public tmrAnimate As Timer
+    Public tmrStartup As Timer
+    Public txtCaption As TextBox
+    Public txtEditor As TextBox
+    Public txtInput As TextBox
+    Public txtName As TextBox
+    Public txtPassword As TextBox
+    Public txtTitle As TextBox
+
+    ' The Menu page's menu items, including the separator: a Menu is a control
+    ' like any other here, and a separator is one whose Caption is "-".
+    Public mnuContext As Menu
+    Public mnuFileNew As Menu
+    Public mnuFilePrint As Menu
+    Public mnuFileSaveAs As Menu
+    Public mnuFileSep1 As Menu
+    Public mnuRecent As Menu
+    Public mnuViewToolbar As Menu
+
+    ' MyObject is the VBA reference's generic placeholder for "some object
+    ' reference", and eight pages use it -- For-Each-Next, Is, IsNot, Set, With,
+    ' Err.Raise, IsObject and GetObject. It is declared once here rather than by
+    ' each page, because a module-level name declared by two pages is ambiguous
+    ' in any project that holds both of them, and nothing separates two batches
+    ' over a name that is not a type. MyLabel is With.md's label, on the same
+    ' terms as lblStatus above.
+    Public MyObject As Object
+    Public MyLabel As Label
+
+End Module
diff --git a/test/ide/break-into.test.mjs b/test/ide/break-into.test.mjs
new file mode 100644
index 000000000..cb6e8ba9f
--- /dev/null
+++ b/test/ide/break-into.test.mjs
@@ -0,0 +1,128 @@
+// Break Into Code while the program is in DoEvents. The project in
+// probes/break-into loops on DoEvents alone, so a break lands there every time,
+// and stops inside the VB package's IdleMessageLoopBreakpoint, above Main. F5
+// from there stops again at once, in Main, on the line after DoEvents, where a
+// line in the DEBUG CONSOLE works. At the first stop, though, anything evaluated,
+// a line in the DEBUG CONSOLE or a watch, ends the program with a native access
+// violation, and the IDE stays in break mode: the yellow arrow stays on the
+// package's line, and Stop and the step commands stay enabled.
+//
+// The lane fails at its close when the DEBUG CONSOLE holds a NATIVE EXCEPTION
+// line (tb-lane.mjs), so a test that has asserted the crash clears the console,
+// and then restarts the compiler, which is what puts the IDE right again.
+//
+// Each test states what BETA 995 does. If one fails after an IDE update, the IDE
+// has changed: update the entry "After Break Into Code stops in DoEvents,
+// evaluating anything ends the program with an access violation" in
+// BUGS-TO-REPORT.md, or its report in bugs/filed/, and then this file.
+//
+// Run it with ide-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { consoleMark, linesSince } from "../../scripts/lib/tb-ide-console.mjs";
+import { editorState, pressKey, restartCompiler, typeText, waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "../addin/scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT = path.join(HERE, "probes", "break-into");
+const SOURCE = readFileSync(path.join(PROJECT, "Sources", "Startup.twin"), "utf8").split(/\r?\n/);
+// The line after DoEvents, 1-based as the IDE counts it.
+const LOOP = SOURCE.findIndex((l) => l.trim() === "Loop") + 1;
+const STARTUP_FILE = "/BreakIntoProbe/Sources/Startup.twin";
+const PACKAGE_FILE = "/BreakIntoProbe/Packages/VB/Sources/SUPPORT/IdleMessageLoopBreak.twin";
+const CRASH = /NATIVE EXCEPTION: ACCESS_VIOLATION/;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// The debugger's state, the CALL STACK's procedures, the lines the editor marks
+// as the one stopped on, and whether the toolbar's Stop and Break are enabled.
+const STATE_JS = `(() => {
+  const frames = liveStackTraceInfo[activeDebuggingThreadId];
+  const enabled = (id) => !document.getElementById(id).classList.contains("disabledCommand");
+  return {
+    paused: !!context.atBreakpoint.value, running: !!context.codeExecuting.value, line: activeDebuggingLine,
+    stack: Array.isArray(frames) ? frames.map((f) => f.name) : null,
+    marked: editor.getModel().getAllDecorations()
+      .filter((d) => (d.options.className || "").includes("activeDebugLineClass"))
+      .map((d) => d.range.startLineNumber),
+    stop: enabled("stopIcon"), pause: enabled("pauseIcon"),
+  };
+})()`;
+
+scenario("Break Into Code in a DoEvents loop", (lane) => {
+  let c;
+  let mark;
+  const state = () => c.evaluate(STATE_JS);
+  const file = async () => (await editorState(c))?.file;
+  const printed = () => linesSince(c, mark);
+
+  // F5, a second of the loop, then Break Into Code, as Ctrl+Break gives it.
+  async function breakIn() {
+    mark = await consoleMark(c);
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    assert.ok(await waitFor(c, async () => (await state()).running), "the run did not start");
+    await sleep(1000);
+    await c.evaluate(`executeIdeCommand("tbDebug_BreakInto")`);
+    assert.ok(await waitFor(c, async () => (await state()).paused), "the break did not stop the run");
+    assert.ok(await waitFor(c, async () => (await file()) === PACKAGE_FILE), "the package's file did not open");
+  }
+  // A line typed into the DEBUG CONSOLE and entered, as a person does.
+  async function enter(text) {
+    await c.evaluate("debugConsoleEntry.focus()");
+    await typeText(c, text);
+    await pressKey(c, "Enter");
+  }
+  // The access violation, the end of the program, and break mode kept. The
+  // console says it twice: as the run's result, and as the native exception's
+  // report, which names the module and offset.
+  async function crashed() {
+    const crashLines = async () => (await printed()).filter((l) => CRASH.test(l)).length;
+    assert.ok(await waitFor(c, async () => (await crashLines()) === 2), "no access violation");
+    assert.ok(await waitFor(c, async () => !(await state()).running), "the program did not end");
+    const s = await state();
+    assert.equal(s.paused, true);
+    assert.equal(await file(), PACKAGE_FILE);
+    assert.deepEqual(s.marked, [s.line]);
+    assert.equal(s.stop, true);
+    assert.equal(s.pause, false);
+    await c.evaluate(`executeIdeCommand("tbDebugConsole_Clear")`);
+    await restartCompiler(c, { project: lane.project });
+  }
+
+  before(async () => {
+    c = await lane.open(PROJECT);
+  });
+
+  test("the break stops in IdleMessageLoopBreakpoint; F5 stops again in Main, where the console works", async () => {
+    await breakIn();
+    assert.deepEqual((await state()).stack, ["IdleMessageLoopBreakpoint", "Main"]);
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    assert.ok(
+      await waitFor(c, async () => (await file()) === STARTUP_FILE && (await state()).line === LOOP),
+      "F5 did not stop again in Main",
+    );
+    const s = await state();
+    assert.equal(s.paused, true);
+    assert.deepEqual(s.stack, ["Main"]);
+    await enter("? 1");
+    assert.ok(await waitFor(c, async () => (await printed()).includes("1")), "? 1 printed nothing");
+    assert.ok(!(await printed()).some((l) => CRASH.test(l)));
+    await c.evaluate(`executeIdeCommand("tbDebug_Stop")`);
+    assert.ok(await waitFor(c, async () => !(await state()).running), "the run did not stop");
+  });
+
+  test("? 1 in the DEBUG CONSOLE at the first stop ends the program with an access violation", async () => {
+    await breakIn();
+    await enter("? 1");
+    await crashed();
+  });
+
+  test("so does a watch, which the IDE evaluates at the stop", async () => {
+    await c.evaluate(`addNewWatchExpression("1 + 1")`);
+    await breakIn();
+    await crashed();
+    await c.evaluate(`executeIdeCommand("tbWatches_Clear")`);
+  });
+});
diff --git a/test/ide/breakpoints.test.mjs b/test/ide/breakpoints.test.mjs
new file mode 100644
index 000000000..fc75cc03a
--- /dev/null
+++ b/test/ide/breakpoints.test.mjs
@@ -0,0 +1,124 @@
+// Breakpoints across a compiler restart: the toolbar's Restart the compiler
+// undoes Debug > Clear All Breakpoints, unless the project was saved in between,
+// while a breakpoint removed with F9 stays removed. The project in
+// probes/breakpoints prints three lines from Main and stops on the second, marked
+// BREAK, only when a breakpoint is set there. Each test sets and clears
+// breakpoints as a person does (F9, Ctrl+Shift+F9, Ctrl+S), restarts the compiler
+// with the toolbar's button, reads the margin and runs Main.
+//
+// Each test states what BETA 995 does. If one fails after an IDE update, the IDE
+// has changed: update the entry "Clear All Breakpoints is undone by restarting the
+// compiler, unless the project was saved in between" in BUGS-TO-REPORT.md, or its
+// report in bugs/filed/, and then this file.
+//
+// Run it with ide-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { consoleMark, linesSince } from "../../scripts/lib/tb-ide-console.mjs";
+import { openFile, pressKey, restartCompiler, setCursor, waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "../addin/scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT = path.join(HERE, "probes", "breakpoints");
+const SOURCE = readFileSync(path.join(PROJECT, "Sources", "Startup.twin"), "utf8").split(/\r?\n/);
+// The breakpoint's line, 1-based as the IDE counts it.
+const BREAK = SOURCE.findIndex((l) => l.includes("' BREAK")) + 1;
+const FILE = "/BreakpointsProbe/Sources/Startup.twin";
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// The lines the margin shows a breakpoint on, in the open file.
+const GLYPHS_JS = `editor.getModel().getAllDecorations()
+  .filter((d) => (d.options.glyphMarginClassName || "").includes("breakpointActiveGlyph"))
+  .map((d) => d.range.startLineNumber)`;
+const STATE_JS = `({ paused: !!context.atBreakpoint.value, running: !!context.codeExecuting.value,
+  line: activeDebuggingLine })`;
+
+scenario("breakpoints across a compiler restart", (lane) => {
+  let c;
+  const glyphs = () => c.evaluate(GLYPHS_JS);
+  const state = () => c.evaluate(STATE_JS);
+
+  // F9 on the BREAK line; the margin changes at once.
+  async function toggle() {
+    const was = (await glyphs()).includes(BREAK);
+    await setCursor(c, BREAK, 9);
+    await pressKey(c, "F9");
+    assert.ok(await waitFor(c, async () => (await glyphs()).includes(BREAK) !== was), "F9 changed nothing");
+  }
+  async function clearAll() {
+    await pressKey(c, "F9", { ctrl: true, shift: true });
+    assert.ok(await waitFor(c, async () => !(await glyphs()).length), "Clear All Breakpoints left a breakpoint");
+  }
+  async function save() {
+    await pressKey(c, "s", { ctrl: true });
+    assert.ok(await waitFor(c, () => c.evaluate("!projectIsDirty")), "the project was not saved");
+  }
+  // The toolbar's Restart the compiler, then the margin once the IDE has asked
+  // the new compiler for the open file's breakpoints.
+  async function restart() {
+    await restartCompiler(c, { project: lane.project });
+    await sleep(1500);
+    return glyphs();
+  }
+  // Run Main, as F5 does: "stopped" at the breakpoint, or "ran" to its end.
+  async function run() {
+    const mark = await consoleMark(c);
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    const how = await waitFor(
+      c,
+      async () => {
+        if ((await state()).paused) return "stopped";
+        return (await linesSince(c, mark)).includes("main end") ? "ran" : null;
+      },
+      { timeout: 30 * 1000 },
+    );
+    assert.ok(how, "the run neither stopped nor ended");
+    if (how === "stopped") {
+      assert.equal((await state()).line, BREAK);
+      await c.evaluate(`executeIdeCommand("tbDebug_Stop")`);
+      assert.ok(await waitFor(c, async () => !(await state()).running), "the run did not stop");
+    }
+    return how;
+  }
+
+  before(async () => {
+    c = await lane.open(PROJECT);
+    await openFile(c, FILE, { line: BREAK, column: 9 });
+  });
+
+  test("Clear All Breakpoints is undone by a restart: the breakpoint is back, and the run stops at it", async () => {
+    await toggle();
+    await clearAll();
+    assert.deepEqual(await restart(), [BREAK]);
+    assert.equal(await run(), "stopped");
+    // Leave no breakpoint for the next test.
+    await toggle();
+    assert.deepEqual(await glyphs(), []);
+  });
+
+  test("a breakpoint removed with F9 stays removed across a restart", async () => {
+    await toggle();
+    await toggle();
+    assert.deepEqual(await restart(), []);
+    assert.equal(await run(), "ran");
+  });
+
+  test("saving after Clear All Breakpoints keeps them cleared across a restart", async () => {
+    await toggle();
+    await clearAll();
+    await save();
+    assert.deepEqual(await restart(), []);
+    assert.equal(await run(), "ran");
+  });
+
+  test("a breakpoint saved with the project survives a restart", async () => {
+    await toggle();
+    await save();
+    assert.deepEqual(await restart(), [BREAK]);
+    assert.equal(await run(), "stopped");
+  });
+});
diff --git a/test/ide/console-completion.test.mjs b/test/ide/console-completion.test.mjs
new file mode 100644
index 000000000..f4f72d93a
--- /dev/null
+++ b/test/ide/console-completion.test.mjs
@@ -0,0 +1,138 @@
+// Completions in the DEBUG CONSOLE. The project in probes/console-completion
+// stops at a breakpoint on the line marked BREAK, with total and items, locals of
+// Main, in scope. Ctrl+Space after tot opens the console's list with total in it
+// when tot starts the line, after leading spaces, as a Sub call's argument (Touch
+// tot) and after ? with no space (?tot); after ? and a space (? tot), the
+// console's usual form, after Debug.Print, after Call (Call Tou) and on the right
+// of an assignment (total = to), no list opens. A dot after ? and a space opens
+// the list: ? items. offers the Collection's members. With no program running,
+// Mai offers Main and ? Mai opens no list.
+//
+// Each line is put in the console's input with the caret at its end, and
+// Ctrl+Space pressed, as a person presses it; the list is read once the answer
+// for that Ctrl+Space has come. The IDE closes the console's list 100 ms after
+// the code editor loses the focus, so the focus moves to the console before the
+// first Ctrl+Space, and each test checks that the console has it before and
+// after: a list closed by a change of focus never reads as no list.
+//
+// Each test states what BETA 995 does. If one fails after an IDE update, the IDE
+// has changed: update the entry "The Debug Console offers no completion for a name
+// typed after `?` and a space" in BUGS-TO-REPORT.md, or its report in bugs/filed/,
+// and then this file.
+//
+// Run it with ide-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { afterReveal, openFile, pressKey, setCursor, waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "../addin/scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT = path.join(HERE, "probes", "console-completion");
+const SOURCE = readFileSync(path.join(PROJECT, "Sources", "Startup.twin"), "utf8").split(/\r?\n/);
+const BREAK = SOURCE.findIndex((l) => l.includes("' BREAK")) + 1;
+const FILE = "/ConsoleCompletionProbe/Sources/Startup.twin";
+
+const STATE_JS = `({ paused: !!context.atBreakpoint.value, line: activeDebuggingLine })`;
+const FOCUSED_JS = "document.activeElement === debugConsoleEntry";
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+scenario("completions in the Debug Console", (lane) => {
+  let c;
+
+  // Moves the focus to the console's input, waits for the code editor to let it
+  // go, and then for the close of the list that the editor's loss of the focus
+  // starts, 100 ms later.
+  async function focusConsole() {
+    await c.evaluate("debugConsoleEntry.focus()");
+    assert.ok(
+      await waitFor(c, () => c.evaluate("!context.focusedTextEditorInput.value")),
+      "the code editor kept the focus",
+    );
+    await sleep(300);
+  }
+
+  // The names the console's list offers for `text`, or null when no list opens.
+  async function complete(text) {
+    assert.ok(await c.evaluate(FOCUSED_JS), "the console's input does not have the focus");
+    await c.evaluate(`(() => {
+      debugConsoleEntry.value = ${JSON.stringify(text)};
+      debugConsoleEntry.selectionStart = debugConsoleEntry.selectionEnd = debugConsoleEntry.value.length;
+    })()`);
+    const asked = await c.evaluate("debugConsoleIntellisenseRequestId");
+    await pressKey(c, " ", { ctrl: true });
+    assert.ok(
+      await waitFor(c, () =>
+        c.evaluate(`debugConsoleIntellisenseRequestId > ${asked} && debugIntellisenseIsInvalidated === false`),
+      ),
+      `the console had no answer for ${JSON.stringify(text)}`,
+    );
+    const { focused, names } = await c.evaluate(`({ focused: ${FOCUSED_JS},
+      names: context.activeDebugConsoleIntellisense.value
+        ? debugConsoleEntryIntellisenseList.dataNodesDATA.map((x) => x.l) : null })`);
+    assert.ok(focused, `the console's input lost the focus after ${JSON.stringify(text)}`);
+    return names;
+  }
+
+  before(async () => {
+    c = await lane.open(PROJECT);
+    await openFile(c, FILE, { line: BREAK, column: 9 });
+    await setCursor(c, BREAK, 9);
+    await pressKey(c, "F9");
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    assert.ok(
+      await waitFor(c, async () => {
+        const s = await c.evaluate(STATE_JS);
+        return s.paused && s.line === BREAK;
+      }),
+      "the run did not stop at the breakpoint",
+    );
+    await afterReveal(c);
+    await focusConsole();
+  });
+
+  test("?tot, with no space, offers total", async () => {
+    assert.ok((await complete("?tot"))?.includes("total"));
+  });
+
+  test("tot at the start of the line offers total", async () => {
+    assert.ok((await complete("tot"))?.includes("total"));
+  });
+
+  test("tot after leading spaces offers total", async () => {
+    assert.ok((await complete("   tot"))?.includes("total"));
+  });
+
+  test("the argument of a Sub call offers total", async () => {
+    assert.ok((await complete("Touch tot"))?.includes("total"));
+  });
+
+  test("? tot, with a space, opens no list", async () => {
+    assert.equal(await complete("? tot"), null);
+  });
+
+  test("Debug.Print tot opens no list", async () => {
+    assert.equal(await complete("Debug.Print tot"), null);
+  });
+
+  test("Call Tou and total = to open no list", async () => {
+    assert.equal(await complete("Call Tou"), null);
+    assert.equal(await complete("total = to"), null);
+  });
+
+  test("? items. offers the members of the Collection", async () => {
+    const names = await complete("? items.");
+    assert.ok(names?.includes("Add") && names.includes("Count"));
+  });
+
+  test("with no program running, Mai offers Main and ? Mai opens no list", async () => {
+    await c.evaluate(`executeIdeCommand("tbDebug_Stop")`);
+    assert.ok(await waitFor(c, async () => !(await c.evaluate("context.codeExecuting.value"))), "the run did not stop");
+    await focusConsole();
+    assert.ok((await complete("Mai"))?.includes("Main"));
+    assert.equal(await complete("? Mai"), null);
+  });
+});
diff --git a/test/ide/console-space.test.mjs b/test/ide/console-space.test.mjs
new file mode 100644
index 000000000..4ae64dde9
--- /dev/null
+++ b/test/ide/console-space.test.mjs
@@ -0,0 +1,163 @@
+// A space typed in the DEBUG CONSOLE while its IntelliSense list is open. The
+// project in probes/console-space stops at a breakpoint on the line marked BREAK,
+// with total, items and obj, locals of Main, in scope. A space typed while the
+// list is open accepts the list's first entry and is lost, unless the word typed
+// is that entry in full and not a procedure. The console's list holds no
+// keywords, so a keyword that starts a longer name is replaced by that name.
+// Typed key by key, Print total becomes Printertotal, Call Touch(total) becomes
+// CallByDispId(Touch(total)) and Set obj = items becomes SetAttr(obj = items),
+// and the console refuses all three. total = 6, ? total and Debug.Print total
+// type as they are, and Escape before the space keeps it: Print total typed that
+// way prints 5. With no program running, Print 1 + 1 becomes Printer1 + 1.
+//
+// Each line is typed one key at a time, and after each key the lane waits for the
+// console's answer to it, as a person typing at an ordinary speed sees the list:
+// in the IDE's default IntelliSense mode, MODERN, the console asks for the list
+// after every key. The IDE closes the console's list 100 ms after the code editor
+// loses the focus, so the focus moves to the console before the first line, and
+// each test checks that the console has it before and after.
+//
+// Each test states what BETA 995 does. If one fails after an IDE update, the IDE
+// has changed: update the entry "A space typed in the Debug Console accepts the
+// IntelliSense list's selection, so `Print x` becomes `Printerx`" in
+// BUGS-TO-REPORT.md, or its report in bugs/filed/, and then this file.
+//
+// Run it with ide-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { consoleMark, linesSince } from "../../scripts/lib/tb-ide-console.mjs";
+import { afterReveal, openFile, pressKey, setCursor, typeText, waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "../addin/scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT = path.join(HERE, "probes", "console-space");
+const SOURCE = readFileSync(path.join(PROJECT, "Sources", "Startup.twin"), "utf8").split(/\r?\n/);
+const BREAK = SOURCE.findIndex((l) => l.includes("' BREAK")) + 1;
+const FILE = "/ConsoleSpaceProbe/Sources/Startup.twin";
+
+const STATE_JS = `({ paused: !!context.atBreakpoint.value, line: activeDebuggingLine })`;
+const FOCUSED_JS = "document.activeElement === debugConsoleEntry";
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+scenario("a space in the Debug Console", (lane) => {
+  let c;
+
+  // Moves the focus to the console's input, waits for the code editor to let it
+  // go, and then for the close of the list that the editor's loss of the focus
+  // starts, 100 ms later.
+  async function focusConsole() {
+    await c.evaluate("debugConsoleEntry.focus()");
+    assert.ok(
+      await waitFor(c, () => c.evaluate("!context.focusedTextEditorInput.value")),
+      "the code editor kept the focus",
+    );
+    await sleep(300);
+  }
+
+  // Empties the console's input, types `keys` into it one key at a time, and
+  // returns what it then holds. "Escape" stands for the Escape key; any other
+  // string is typed character by character, and after each character that asks
+  // for the list the lane waits for the console's answer to it. A key that asks
+  // raises the request count as it is released, and the answer clears the
+  // invalidated flag that the request set; a few keys, such as ? and +, never ask.
+  async function type(...keys) {
+    assert.ok(await c.evaluate(FOCUSED_JS), "the console's input does not have the focus");
+    await pressKey(c, "Escape");
+    await c.evaluate(`debugConsoleEntry.value = ""`);
+    for (const k of keys) {
+      if (k === "Escape") {
+        await pressKey(c, "Escape");
+        continue;
+      }
+      for (const ch of k) {
+        const asked = await c.evaluate("debugConsoleIntellisenseRequestId");
+        await typeText(c, ch);
+        if (await c.evaluate(`debugConsoleIntellisenseRequestId > ${asked}`)) {
+          assert.ok(
+            await waitFor(c, () => c.evaluate("debugIntellisenseIsInvalidated === false"), { interval: 20 }),
+            `the console had no answer for ${JSON.stringify(ch)} in ${JSON.stringify(keys.join(""))}`,
+          );
+        }
+        await sleep(50);
+      }
+    }
+    const { focused, value } = await c.evaluate(`({ focused: ${FOCUSED_JS}, value: debugConsoleEntry.value })`);
+    assert.ok(focused, `the console's input lost the focus in ${JSON.stringify(keys.join(""))}`);
+    return value;
+  }
+
+  // Enters what the console's input holds, and waits for a line the console
+  // prints that satisfies `found`. False when none comes.
+  async function enter(found) {
+    const mark = await consoleMark(c);
+    await pressKey(c, "Enter");
+    return !!(await waitFor(c, async () => (await linesSince(c, mark)).some(found)));
+  }
+  const refused = (l) => l.startsWith("(compile error:");
+
+  before(async () => {
+    c = await lane.open(PROJECT);
+    assert.equal(
+      await c.evaluate(`liveIDEOptions["intellisenseMode"]`),
+      "MODERN",
+      "the IDE's IntelliSense mode is not its default, MODERN, in which the console asks after every key",
+    );
+    await openFile(c, FILE, { line: BREAK, column: 9 });
+    await setCursor(c, BREAK, 9);
+    await pressKey(c, "F9");
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    assert.ok(
+      await waitFor(c, async () => {
+        const s = await c.evaluate(STATE_JS);
+        return s.paused && s.line === BREAK;
+      }),
+      "the run did not stop at the breakpoint",
+    );
+    await afterReveal(c);
+    await focusConsole();
+  });
+
+  test("Print total becomes Printertotal, which the console refuses", async () => {
+    assert.equal(await type("Print total"), "Printertotal");
+    assert.ok(
+      await enter((l) => l === "(compile error: Unrecognized symbol 'Printertotal')"),
+      "the console did not refuse it",
+    );
+  });
+
+  test("Escape before the space keeps it, and Print total prints 5", async () => {
+    assert.equal(await type("Print", "Escape", " total"), "Print total");
+    assert.ok(await enter((l) => l === "5"), "Print total did not print 5");
+  });
+
+  test("Call Touch(total) becomes CallByDispId(Touch(total)), which the console refuses", async () => {
+    assert.equal(await type("Call Touch(total)"), "CallByDispId(Touch(total))");
+    assert.ok(await enter(refused), "the console did not refuse it");
+  });
+
+  test("Set obj = items becomes SetAttr(obj = items), which the console refuses", async () => {
+    assert.equal(await type("Set obj = items"), "SetAttr(obj = items)");
+    assert.ok(await enter(refused), "the console did not refuse it");
+  });
+
+  test("a space after a whole variable name is kept: total = 6", async () => {
+    assert.equal(await type("total = 6"), "total = 6");
+  });
+
+  test("? total and Debug.Print total type as they are", async () => {
+    assert.equal(await type("? total"), "? total");
+    assert.equal(await type("Debug.Print total"), "Debug.Print total");
+  });
+
+  test("with no program running, Print 1 + 1 becomes Printer1 + 1", async () => {
+    await pressKey(c, "Escape");
+    await c.evaluate(`executeIdeCommand("tbDebug_Stop")`);
+    assert.ok(await waitFor(c, async () => !(await c.evaluate("context.codeExecuting.value"))), "the run did not stop");
+    await focusConsole();
+    assert.equal(await type("Print 1 + 1"), "Printer1 + 1");
+  });
+});
diff --git a/test/ide/lanes.mjs b/test/ide/lanes.mjs
index fc61b3229..7541aa4e8 100644
--- a/test/ide/lanes.mjs
+++ b/test/ide/lanes.mjs
@@ -20,4 +20,9 @@ export default [
   { file: "debugger.test.mjs" },
   { file: "assert.test.mjs" },
   { file: "packages.test.mjs" },
+  { file: "breakpoints.test.mjs" },
+  { file: "watches.test.mjs" },
+  { file: "break-into.test.mjs" },
+  { file: "console-completion.test.mjs" },
+  { file: "console-space.test.mjs" },
 ];
diff --git a/test/ide/probes/break-into/Settings b/test/ide/probes/break-into/Settings
new file mode 100644
index 000000000..1d4628b0d
--- /dev/null
+++ b/test/ide/probes/break-into/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "BreakIntoProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "test/ide/break-into.test.mjs opens it in a lane's copy of the install, breaks into its DoEvents loop and evaluates there.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247500-0000-4000-9000-7B2475000008}",
+	"project.name": "BreakIntoProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/ide/probes/break-into/Sources/Startup.twin b/test/ide/probes/break-into/Sources/Startup.twin
new file mode 100644
index 000000000..46896e31b
--- /dev/null
+++ b/test/ide/probes/break-into/Sources/Startup.twin
@@ -0,0 +1,12 @@
+' The project test/ide/break-into.test.mjs runs. Main's loop spends nearly all
+' its time in DoEvents, so a break into it stops inside the VB package; the test
+' evaluates there.
+Module Startup
+
+    Public Sub Main()
+        Do
+            DoEvents
+        Loop
+    End Sub
+
+End Module
diff --git a/test/ide/probes/breakpoints/Settings b/test/ide/probes/breakpoints/Settings
new file mode 100644
index 000000000..96a1f1cd0
--- /dev/null
+++ b/test/ide/probes/breakpoints/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "BreakpointsProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "test/ide/breakpoints.test.mjs opens it in a lane's copy of the install, sets and clears a breakpoint, restarts the compiler and runs it.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247500-0000-4000-9000-7B2475000006}",
+	"project.name": "BreakpointsProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/ide/probes/breakpoints/Sources/Startup.twin b/test/ide/probes/breakpoints/Sources/Startup.twin
new file mode 100644
index 000000000..9d5b2cf66
--- /dev/null
+++ b/test/ide/probes/breakpoints/Sources/Startup.twin
@@ -0,0 +1,12 @@
+' The project test/ide/breakpoints.test.mjs runs. It sets a breakpoint on the
+' line marked BREAK, clears it, restarts the compiler and runs Main, which stops
+' there if the breakpoint is set and otherwise prints all three lines.
+Module Startup
+
+    Public Sub Main()
+        Debug.Print "main start"
+        Debug.Print "the breakpoint's line" ' BREAK
+        Debug.Print "main end"
+    End Sub
+
+End Module
diff --git a/test/ide/probes/console-completion/Settings b/test/ide/probes/console-completion/Settings
new file mode 100644
index 000000000..45d957f23
--- /dev/null
+++ b/test/ide/probes/console-completion/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ConsoleCompletionProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "test/ide/console-completion.test.mjs opens it in a lane's copy of the install, stops it at a breakpoint and asks the Debug Console for completions.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247500-0000-4000-9000-7B2475000009}",
+	"project.name": "ConsoleCompletionProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/ide/probes/console-completion/Sources/Startup.twin b/test/ide/probes/console-completion/Sources/Startup.twin
new file mode 100644
index 000000000..4360f204f
--- /dev/null
+++ b/test/ide/probes/console-completion/Sources/Startup.twin
@@ -0,0 +1,18 @@
+' The project test/ide/console-completion.test.mjs runs. It stops at a breakpoint
+' on the line marked BREAK, with total and items, locals of Main, in scope, and
+' asks the Debug Console for completions of tot and of the members of items.
+Module Startup
+
+    Public Sub Main()
+        Dim total As Long
+        Dim items As New Collection
+        total = 5
+        items.Add total
+        Touch total ' BREAK
+    End Sub
+
+    Private Sub Touch(ByVal n As Long)
+        Debug.Print "total " & n
+    End Sub
+
+End Module
diff --git a/test/ide/probes/console-space/Settings b/test/ide/probes/console-space/Settings
new file mode 100644
index 000000000..ac49b1625
--- /dev/null
+++ b/test/ide/probes/console-space/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "ConsoleSpaceProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "test/ide/console-space.test.mjs opens it in a lane's copy of the install, stops it at a breakpoint and types lines into the Debug Console key by key.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247500-0000-4000-9000-7B247500000A}",
+	"project.name": "ConsoleSpaceProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/ide/probes/console-space/Sources/Startup.twin b/test/ide/probes/console-space/Sources/Startup.twin
new file mode 100644
index 000000000..1f301f5e5
--- /dev/null
+++ b/test/ide/probes/console-space/Sources/Startup.twin
@@ -0,0 +1,19 @@
+' The project test/ide/console-space.test.mjs runs. It stops at a breakpoint on
+' the line marked BREAK, with total, items and obj, locals of Main, in scope, and
+' types lines into the Debug Console key by key.
+Module Startup
+
+    Public Sub Main()
+        Dim total As Long
+        Dim items As New Collection
+        Dim obj As Object
+        total = 5
+        items.Add total
+        Touch total ' BREAK
+    End Sub
+
+    Private Sub Touch(ByVal n As Long)
+        Debug.Print "total " & n
+    End Sub
+
+End Module
diff --git a/test/ide/probes/watches/Settings b/test/ide/probes/watches/Settings
new file mode 100644
index 000000000..48b05016e
--- /dev/null
+++ b/test/ide/probes/watches/Settings
@@ -0,0 +1,61 @@
+{
+	"configuration.inherits": "Defaults",
+	"project.appTitle": "WatchesProbe",
+	"project.buildPath": "${SourcePath}\\Build\\${ProjectName}_${Architecture}.${FileExtension}",
+	"project.buildType": "Standard EXE",
+	"project.description": "test/ide/watches.test.mjs opens it in a lane's copy of the install, stops it at a breakpoint and adds watches.",
+	"project.exportPathIsV2": true,
+	"project.id": "{7B247500-0000-4000-9000-7B2475000007}",
+	"project.name": "WatchesProbe",
+	"project.optionExplicit": true,
+	"project.references": [
+		{
+			"id": "{00020430-0000-0000-C000-000000000046}",
+			"lcid": 0,
+			"name": "OLE Automation",
+			"path32": "C:\\Windows\\SysWOW64\\stdole2.tlb",
+			"path64": "C:\\Windows\\System32\\stdole2.tlb",
+			"symbolId": "stdole",
+			"versionMajor": 2,
+			"versionMinor": 0
+		},
+		{
+			"id": "{F50B82D0-DCAB-43FE-9631-11959D4A4728}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - VB Compatibility Package (Forms)",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "VB",
+			"versionBuild": 0,
+			"versionMajor": 0,
+			"versionMinor": 0,
+			"versionRevision": 31
+		},
+		{
+			"id": "{C192FB39-64CA-4D9B-B477-A5502F48EFCC}",
+			"isCompilerPackage": true,
+			"licence": "MIT",
+			"name": "[COMPILER PACKAGE] twinBASIC - App global class object",
+			"path32": "",
+			"path64": "",
+			"publisher": "TWINBASIC-COMPILER",
+			"symbolId": "AppGlobalClassProject",
+			"versionBuild": 0,
+			"versionMajor": 1,
+			"versionMinor": 0,
+			"versionRevision": 0
+		}
+	],
+	"project.settingsVersion": 1,
+	"project.startupObject": "Sub Main",
+	"project.warnings": {
+		"errors": [],
+		"hints": [],
+		"ignored": [],
+		"info": [],
+		"warnings": []
+	},
+	"runtime.useUnicodeStandardLibrary": true
+}
diff --git a/test/ide/probes/watches/Sources/Startup.twin b/test/ide/probes/watches/Sources/Startup.twin
new file mode 100644
index 000000000..7bf7bdb9a
--- /dev/null
+++ b/test/ide/probes/watches/Sources/Startup.twin
@@ -0,0 +1,20 @@
+' The project test/ide/watches.test.mjs runs. It stops at a breakpoint on the
+' line marked BREAK, on each of the loop's two passes, with watches on p, of a
+' user-defined type, and on p.X.
+Module Startup
+
+    Private Type Point
+        X As Long
+        Y As Long
+    End Type
+
+    Public Sub Main()
+        Dim p As Point
+        Dim i As Long
+        p.X = 7
+        For i = 1 To 2
+            Debug.Print "pass " & i ' BREAK
+        Next
+    End Sub
+
+End Module
diff --git a/test/ide/watches.test.mjs b/test/ide/watches.test.mjs
new file mode 100644
index 000000000..26b7f22e4
--- /dev/null
+++ b/test/ide/watches.test.mjs
@@ -0,0 +1,106 @@
+// Watches on a variable of a user-defined type. The project in probes/watches
+// stops at a breakpoint on the line marked BREAK on each of its loop's two passes,
+// with p, of a Private Type of the module, in scope. A watch on p fails with a
+// codegen error, and every stop while the watch is there writes a linker error to
+// the DEBUG CONSOLE; a watch on p.X works, and ? p in the console fails as the
+// watch does. The watches are added with the page's addNewWatchExpression, which
+// the WATCHES panel's own input calls.
+//
+// Each test states what BETA 995 does. If one fails after an IDE update, the IDE
+// has changed: update the entry "A watch on a variable of a user-defined type fails
+// with a codegen error, and the Debug Console reports a linker error at every
+// stop" in BUGS-TO-REPORT.md, or its report in bugs/filed/, and then this file.
+//
+// Run it with ide-test.bat, which gives it a lane; on its own it is skipped.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { before, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { consoleMark, linesSince } from "../../scripts/lib/tb-ide-console.mjs";
+import { openFile, pressKey, setCursor, typeText, waitFor } from "../../scripts/lib/tb-operate.mjs";
+import { scenario } from "../addin/scenario.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT = path.join(HERE, "probes", "watches");
+const SOURCE = readFileSync(path.join(PROJECT, "Sources", "Startup.twin"), "utf8").split(/\r?\n/);
+const BREAK = SOURCE.findIndex((l) => l.includes("' BREAK")) + 1;
+const FILE = "/WatchesProbe/Sources/Startup.twin";
+
+const LINKER = "[LINKER] compilation (codegen) error detected in 'Startup.{temp_procedure}' at line #1";
+const CODEGEN = "(compile error: codegen error; check for compilation errors)";
+const STATE_JS = `({ paused: !!context.atBreakpoint.value, running: !!context.codeExecuting.value,
+  line: activeDebuggingLine })`;
+// Each watch's row as the WATCHES panel renders it: its value and its type.
+const WATCHES_JS = `Object.fromEntries(Object.entries(watchPanel.tree.rootFolder.entries)
+  .map(([name, e]) => [name, e.customRenderData ? [e.customRenderData.result, e.customRenderData.type] : null]))`;
+
+scenario("watches on a user-defined type", (lane) => {
+  let c;
+  let mark;
+  const state = () => c.evaluate(STATE_JS);
+  const watches = () => c.evaluate(WATCHES_JS);
+  const printed = () => linesSince(c, mark);
+  const linkerErrors = async () => (await printed()).filter((l) => l.includes(LINKER)).length;
+
+  // F5 to the breakpoint, or on to its next hit.
+  async function toBreakpoint() {
+    const was = await c.evaluate("activeDebuggingFrameId || 0");
+    await c.evaluate(`executeIdeCommand("tbDebug_StartOrContinue")`);
+    assert.ok(
+      await waitFor(c, async () => {
+        const s = await state();
+        return s.paused && s.line === BREAK && (await c.evaluate("activeDebuggingFrameId || 0")) !== was;
+      }),
+      "the run did not stop at the breakpoint",
+    );
+  }
+  // A line typed into the DEBUG CONSOLE and entered, as a person does.
+  async function enter(text) {
+    await c.evaluate("debugConsoleEntry.focus()");
+    await typeText(c, text);
+    await pressKey(c, "Enter");
+  }
+
+  before(async () => {
+    c = await lane.open(PROJECT);
+    await openFile(c, FILE, { line: BREAK, column: 13 });
+    await setCursor(c, BREAK, 13);
+    await pressKey(c, "F9");
+    mark = await consoleMark(c);
+    await toBreakpoint();
+  });
+
+  test("a watch on p fails with a codegen error, and the console reports a linker error", async () => {
+    await c.evaluate(`addNewWatchExpression("p")`);
+    assert.ok(await waitFor(c, async () => (await watches()).p), "the watch on p was not evaluated");
+    assert.deepEqual((await watches()).p, [CODEGEN, "ERROR"]);
+    assert.ok(await waitFor(c, async () => (await linkerErrors()) === 1), "no linker error in the console");
+  });
+
+  test("a watch on p.X works", async () => {
+    await c.evaluate(`addNewWatchExpression("p.X")`);
+    assert.ok(await waitFor(c, async () => (await watches())["p.X"]), "the watch on p.X was not evaluated");
+    assert.deepEqual((await watches())["p.X"], ["7", "Variant [Long]"]);
+  });
+
+  test("the next stop reports the linker error again", async () => {
+    await toBreakpoint();
+    assert.ok(await waitFor(c, async () => (await linkerErrors()) === 2), "no second linker error");
+    assert.deepEqual((await watches()).p, [CODEGEN, "ERROR"]);
+  });
+
+  test("? p in the DEBUG CONSOLE fails the same way", async () => {
+    await c.evaluate(`executeIdeCommand("tbWatches_Clear")`);
+    const before = await linkerErrors();
+    await enter("? p");
+    assert.ok(await waitFor(c, async () => (await linkerErrors()) === before + 1), "no linker error for ? p");
+    assert.ok(
+      await waitFor(c, async () => (await printed()).some((l) => l.includes(CODEGEN))),
+      "the console did not print the error",
+    );
+    await c.evaluate(`executeIdeCommand("tbDebug_Stop")`);
+    assert.ok(await waitFor(c, async () => !(await state()).running), "the run did not stop");
+  });
+});
diff --git a/test/png.test.mjs b/test/png.test.mjs
new file mode 100644
index 000000000..aa2ed13d3
--- /dev/null
+++ b/test/png.test.mjs
@@ -0,0 +1,880 @@
+// Tests for the pictures of a bug reproducer: scripts/lib/png.mjs (decoding, encoding, comparing
+// and the side-by-side image), scripts/lib/repro-images.mjs (the files and judgements behind
+// repro.json's `images` and `expect.imagesDiffer`) and what scripts/bug_repro.mjs makes of them
+// (`new --with-images`, and the refusals of `verify`).
+//
+// Nothing here starts twinBASIC or VB6. bug_repro.mjs runs over fixtures in a temp folder, named
+// by BUG_REPRO_BUGS, and the commands used refuse or finish before they look for an IDE.
+//
+// Runs with a bare `node --test test/png.test.mjs`: no tree, no build.
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { after, describe, test } from "node:test";
+import zlib from "node:zlib";
+import { REPO_ROOT } from "../lib/repo-paths.mjs";
+import {
+  comparePngs,
+  composeComparison,
+  decodePng,
+  encodePng,
+  glyphRows,
+  GUTTER,
+  LABEL_CHARS,
+} from "../scripts/lib/png.mjs";
+import {
+  addPngModule,
+  collectImages,
+  compareWithKept,
+  comparisonLine,
+  copyImageTemplates,
+  embedProblems,
+  hasPngModule,
+  ImageError,
+  imageFile,
+  imageSourceCheck,
+  imagesDifferProblems,
+  imagesKeyProblem,
+  imageZipEntries,
+  normaliseEol,
+  PNG_TEMPLATES,
+  PNGDUMP_BAS,
+  PNGDUMP_TWIN,
+  recordedBeta,
+  tbLabel,
+  writeComparison,
+} from "../scripts/lib/repro-images.mjs";
+
+const scratch = mkdtempSync(path.join(tmpdir(), "png-test-"));
+after(() => rmSync(scratch, { recursive: true, force: true }));
+let counter = 0;
+const folder = () => {
+  const dir = path.join(scratch, String(++counter));
+  mkdirSync(dir, { recursive: true });
+  return dir;
+};
+
+// ----------------------------------------------------------- helpers: building PNGs by hand
+
+const SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+
+function chunk(type, data) {
+  const out = Buffer.alloc(12 + data.length);
+  out.writeUInt32BE(data.length, 0);
+  out.write(type, 4, "latin1");
+  Buffer.from(data).copy(out, 8);
+  out.writeUInt32BE(zlib.crc32(out.subarray(4, 8 + data.length)), 8 + data.length);
+  return out;
+}
+
+function ihdr(width, height, { depth = 8, colour = 6, interlace = 0 } = {}) {
+  const h = Buffer.alloc(13);
+  h.writeUInt32BE(width, 0);
+  h.writeUInt32BE(height, 4);
+  h[8] = depth;
+  h[9] = colour;
+  h[12] = interlace;
+  return chunk("IHDR", h);
+}
+
+/** A PNG file from filtered scanlines (each already with its filter byte), and extra chunks before IDAT. */
+function pngFile(width, height, rawScanlines, { extra = [], ...header } = {}) {
+  return Buffer.concat([
+    SIGNATURE,
+    ihdr(width, height, header),
+    ...extra,
+    chunk("IDAT", zlib.deflateSync(rawScanlines)),
+    chunk("IEND", Buffer.alloc(0)),
+  ]);
+}
+
+const paeth = (a, b, c) => {
+  const p = a + b - c;
+  const pa = Math.abs(p - a);
+  const pb = Math.abs(p - b);
+  const pc = Math.abs(p - c);
+  if (pa <= pb && pa <= pc) return a;
+  return pb <= pc ? b : c;
+};
+
+/** One scanline filtered with filter type `kind`, written here and not taken from the code under test. */
+function filtered(kind, row, prev, bpp) {
+  const out = Buffer.alloc(row.length + 1);
+  out[0] = kind;
+  for (let x = 0; x < row.length; x++) {
+    const a = x >= bpp ? row[x - bpp] : 0;
+    const b = prev[x];
+    const c = x >= bpp ? prev[x - bpp] : 0;
+    const predictor = [0, a, b, (a + b) >> 1, paeth(a, b, c)][kind];
+    out[x + 1] = (row[x] - predictor) & 255;
+  }
+  return out;
+}
+
+/** An image of pseudo-random pixels, the same each time. */
+function noise(width, height, seed = 1) {
+  const rgba = new Uint8Array(width * height * 4);
+  let s = seed;
+  for (let i = 0; i < rgba.length; i++) {
+    s = (s * 1103515245 + 12345) & 0x7fffffff;
+    rgba[i] = (s >> 16) & 255;
+  }
+  return { width, height, rgba };
+}
+
+/** An image of one colour. */
+function flat(width, height, [r, g, b, a = 255]) {
+  const rgba = new Uint8Array(width * height * 4);
+  for (let i = 0; i < width * height; i++) rgba.set([r, g, b, a], i * 4);
+  return { width, height, rgba };
+}
+
+const copyImage = (img) => ({ ...img, rgba: Uint8Array.from(img.rgba) });
+const pixel = (img, x, y) => Array.from(img.rgba.subarray((y * img.width + x) * 4, (y * img.width + x) * 4 + 4));
+const plant = (img, x, y, colour) => img.rgba.set(colour, (y * img.width + x) * 4);
+
+// ---------------------------------------------------------------------------- png.mjs
+
+describe("encodePng and decodePng", () => {
+  test("an image survives the round trip", () => {
+    const img = noise(7, 5);
+    const back = decodePng(encodePng(img));
+    assert.equal(back.width, 7);
+    assert.equal(back.height, 5);
+    assert.deepEqual(Array.from(back.rgba), Array.from(img.rgba));
+  });
+
+  test("the file starts with the PNG signature and holds colour type 6 at 8 bits", () => {
+    const file = encodePng(noise(3, 2));
+    assert.ok(file.subarray(0, 8).equals(SIGNATURE));
+    assert.equal(file[24], 8, "bit depth");
+    assert.equal(file[25], 6, "colour type");
+  });
+
+  test("each filter type is decoded as it was applied", () => {
+    const img = noise(9, 6, 7);
+    const stride = img.width * 4;
+    for (const kind of [0, 1, 2, 3, 4]) {
+      const lines = [];
+      for (let y = 0; y < img.height; y++) {
+        const row = Buffer.from(img.rgba.subarray(y * stride, (y + 1) * stride));
+        const prev = y ? Buffer.from(img.rgba.subarray((y - 1) * stride, y * stride)) : Buffer.alloc(stride);
+        lines.push(filtered(kind, row, prev, 4));
+      }
+      const decoded = decodePng(pngFile(img.width, img.height, Buffer.concat(lines)));
+      assert.deepEqual(Array.from(decoded.rgba), Array.from(img.rgba), `filter type ${kind}`);
+    }
+  });
+
+  test("a different filter on each row decodes too", () => {
+    const img = noise(5, 10, 3);
+    const stride = img.width * 4;
+    const lines = [];
+    for (let y = 0; y < img.height; y++) {
+      const row = Buffer.from(img.rgba.subarray(y * stride, (y + 1) * stride));
+      const prev = y ? Buffer.from(img.rgba.subarray((y - 1) * stride, y * stride)) : Buffer.alloc(stride);
+      lines.push(filtered(y % 5, row, prev, 4));
+    }
+    const decoded = decodePng(pngFile(img.width, img.height, Buffer.concat(lines)));
+    assert.deepEqual(Array.from(decoded.rgba), Array.from(img.rgba));
+  });
+
+  test("an RGB image gets an opaque alpha, under each filter", () => {
+    const width = 4;
+    const height = 3;
+    const rgb = Buffer.from(noise(width, height, 11).rgba.filter((_, i) => i % 4 !== 3));
+    const stride = width * 3;
+    for (const kind of [0, 1, 2, 3, 4]) {
+      const lines = [];
+      for (let y = 0; y < height; y++) {
+        const row = rgb.subarray(y * stride, (y + 1) * stride);
+        const prev = y ? rgb.subarray((y - 1) * stride, y * stride) : Buffer.alloc(stride);
+        lines.push(filtered(kind, row, prev, 3));
+      }
+      const decoded = decodePng(pngFile(width, height, Buffer.concat(lines), { colour: 2 }));
+      for (let i = 0; i < width * height; i++) {
+        assert.deepEqual(
+          Array.from(decoded.rgba.subarray(i * 4, i * 4 + 4)),
+          [rgb[i * 3], rgb[i * 3 + 1], rgb[i * 3 + 2], 255],
+          `filter ${kind}, pixel ${i}`,
+        );
+      }
+    }
+  });
+
+  test("a palette image takes its colours from PLTE and its alpha from tRNS", () => {
+    const plte = chunk("PLTE", [255, 0, 0, 0, 255, 0, 0, 0, 255]);
+    const trns = chunk("tRNS", [128, 0]);
+    // 3 by 2: indices 0 1 2 / 2 1 0, filter 0.
+    const raw = Buffer.from([0, 0, 1, 2, 0, 2, 1, 0]);
+    const img = decodePng(pngFile(3, 2, raw, { colour: 3, extra: [plte, trns] }));
+    assert.deepEqual(pixel(img, 0, 0), [255, 0, 0, 128]);
+    assert.deepEqual(pixel(img, 1, 0), [0, 255, 0, 0]);
+    assert.deepEqual(pixel(img, 2, 0), [0, 0, 255, 255], "an index past the end of tRNS is opaque");
+    assert.deepEqual(pixel(img, 0, 1), [0, 0, 255, 255]);
+    assert.deepEqual(pixel(img, 2, 1), [255, 0, 0, 128]);
+  });
+
+  test("a palette index the palette does not have is refused", () => {
+    const plte = chunk("PLTE", [255, 0, 0]);
+    assert.throws(
+      () => decodePng(pngFile(2, 1, Buffer.from([0, 0, 1]), { colour: 3, extra: [plte] })),
+      /palette entry 1/,
+    );
+  });
+
+  test("a wrong CRC is refused, in IHDR and in IDAT", () => {
+    const good = encodePng(noise(4, 4));
+    const inHeader = Buffer.from(good);
+    inHeader[16] ^= 1; // a byte of the width
+    assert.throws(() => decodePng(inHeader), /bad CRC in the IHDR chunk/);
+    const inData = Buffer.from(good);
+    inData[good.length - 12 - 6] ^= 0xff; // a byte inside IDAT's data
+    assert.throws(() => decodePng(inData), /bad CRC in the IDAT chunk/);
+  });
+
+  test("what is not a supported PNG is refused, and the message says why", () => {
+    const good = encodePng(noise(2, 2));
+    assert.throws(() => decodePng(Buffer.from("not a png at all")), /signature/);
+    assert.throws(() => decodePng(good.subarray(0, good.length - 5)), /truncated/);
+    assert.throws(() => decodePng(good.subarray(0, good.length - 12)), /no IEND/);
+    assert.throws(() => decodePng(pngFile(1, 1, Buffer.from([0, 0, 0]), { colour: 0 })), /colour type 0 \(greyscale\)/);
+    assert.throws(
+      () => decodePng(pngFile(1, 1, Buffer.from([0, 0, 0, 0, 0, 0, 0, 0]), { depth: 16, colour: 6 })),
+      /bit depth 16/,
+    );
+    assert.throws(() => decodePng(pngFile(1, 1, Buffer.from([0, 0, 0, 0, 0]), { interlace: 1 })), /interlaced/);
+    assert.throws(() => decodePng(pngFile(2, 2, Buffer.from([0, 1, 2]))), /pixel data is 3 bytes/);
+    assert.throws(() => decodePng(pngFile(1, 1, Buffer.from([9, 0, 0, 0, 0]))), /filter type 9/);
+  });
+});
+
+describe("comparePngs", () => {
+  test("equal pictures have no differing pixel", () => {
+    const a = noise(6, 4);
+    assert.deepEqual(comparePngs(a, copyImage(a)), { sameSize: true, differing: 0 });
+  });
+
+  test("it counts each pixel that differs once, whatever channel differs", () => {
+    const a = noise(6, 4);
+    const b = copyImage(a);
+    b.rgba[0] ^= 1; // red of (0,0)
+    b.rgba[(2 * 6 + 3) * 4 + 3] ^= 1; // alpha of (3,2)
+    b.rgba[(3 * 6 + 5) * 4 + 1] ^= 1;
+    b.rgba[(3 * 6 + 5) * 4 + 2] ^= 1; // two channels of (5,3): still one pixel
+    assert.deepEqual(comparePngs(a, b), { sameSize: true, differing: 3 });
+  });
+
+  test("it reads PNG files as well as images", () => {
+    const a = noise(5, 5);
+    const b = copyImage(a);
+    plant(b, 2, 2, [1, 2, 3, 255]);
+    assert.deepEqual(comparePngs(encodePng(a), encodePng(b)), { sameSize: true, differing: 1 });
+  });
+
+  test("pictures of different sizes are never equal: a pixel only one has differs", () => {
+    const a = flat(10, 10, [9, 9, 9]);
+    const b = flat(12, 10, [9, 9, 9]);
+    assert.deepEqual(comparePngs(a, b), { sameSize: false, differing: 20 });
+    assert.deepEqual(comparePngs(b, a), { sameSize: false, differing: 20 });
+  });
+});
+
+describe("composeComparison", () => {
+  // 300 by 20 is wide enough that no label is wider than its panel, and too wide for the doubled scale.
+  const tb = flat(300, 20, [10, 20, 30]);
+  const vb6 = flat(300, 20, [10, 20, 30]);
+  plant(tb, 5, 3, [200, 100, 50, 255]);
+
+  test("three panels, a gutter and a margin of 8, a label strip over them", () => {
+    const out = composeComparison(tb, vb6);
+    assert.equal(out.scale, 1);
+    assert.equal(GUTTER, 8);
+    assert.equal(out.width, 2 * 8 + 3 * 300 + 2 * 8);
+    assert.equal(out.height, 2 * 8 + (7 + 6) + 20);
+    assert.equal(out.rgba.length, out.width * out.height * 4);
+    assert.deepEqual(pixel(out, 0, 0), [255, 255, 255, 255], "the ground is white");
+    assert.deepEqual(pixel(out, 8 + 300 + 4, 30), [255, 255, 255, 255], "so is a gutter");
+  });
+
+  test("the planted difference is pure red in the difference panel, and the rest is a faint grey", () => {
+    const out = composeComparison(tb, vb6);
+    const left = 8 + 2 * (300 + 8);
+    const top = 8 + 13;
+    assert.deepEqual(pixel(out, left + 5, top + 3), [255, 0, 0, 255]);
+    const match = pixel(out, left + 6, top + 3);
+    assert.ok(match[0] === match[1] && match[1] === match[2] && match[0] > 150 && match[0] < 255, `grey, got ${match}`);
+    // The first two panels show the pictures themselves.
+    assert.deepEqual(pixel(out, 8 + 5, top + 3), [200, 100, 50, 255]);
+    assert.deepEqual(pixel(out, 8 + 300 + 8 + 5, top + 3), [10, 20, 30, 255]);
+  });
+
+  test("it says how many pixels differ, and that nothing does", () => {
+    assert.equal(composeComparison(tb, vb6).differing, 1);
+    assert.equal(composeComparison(vb6, copyImage(vb6)).differing, 0);
+    const same = composeComparison(vb6, copyImage(vb6));
+    assert.equal(same.differing, 0);
+    const where = pixel(same, 8 + 2 * (300 + 8) + 5, 8 + 13 + 3);
+    assert.notDeepEqual(where, [255, 0, 0, 255], "no red in an identical comparison");
+  });
+
+  test("a small picture is doubled, a large one is not, and the scale can be given", () => {
+    const small = flat(50, 10, [0, 0, 0]);
+    assert.equal(composeComparison(small, small).scale, 2);
+    assert.equal(composeComparison(flat(199, 199, [0, 0, 0]), flat(199, 199, [0, 0, 0])).scale, 2);
+    assert.equal(composeComparison(flat(200, 10, [0, 0, 0]), flat(200, 10, [0, 0, 0])).scale, 1);
+    assert.equal(composeComparison(small, small, {}, { scale: 3 }).scale, 3);
+    assert.throws(() => composeComparison(small, small, {}, { scale: 0 }), /whole number/);
+    const doubled = composeComparison(small, small);
+    const left = 8;
+    const top = 8 + (7 * 2 + 6);
+    assert.deepEqual(pixel(doubled, left + 1, top + 1), [0, 0, 0, 255]);
+    assert.deepEqual(
+      pixel(doubled, left + 2 * 49 + 1, top + 2 * 9 + 1),
+      [0, 0, 0, 255],
+      "the last pixel fills two by two",
+    );
+  });
+
+  test("a panel is never narrower than its label", () => {
+    const tiny = flat(4, 4, [0, 0, 0]);
+    const out = composeComparison(tiny, tiny, { tb: "TWINBASIC BETA 995" });
+    const labelWidth = (18 * 6 - 1) * out.scale;
+    assert.ok(out.width >= 3 * labelWidth + 4 * 8, `width ${out.width}`);
+  });
+
+  test("pictures of different sizes are laid on the larger canvas, grey and red where one is missing", () => {
+    const a = flat(300, 20, [0, 0, 0]);
+    const b = flat(310, 20, [0, 0, 0]);
+    const out = composeComparison(a, b);
+    assert.equal(out.sameSize, false);
+    assert.equal(out.differing, 20 * 10);
+    const top = 8 + 13;
+    const panel = 310;
+    assert.deepEqual(pixel(out, 8 + 305, top + 5), [224, 224, 224, 255], "the smaller picture's panel is padded grey");
+    assert.deepEqual(
+      pixel(out, 8 + 2 * (panel + 8) + 305, top + 5),
+      [255, 0, 0, 255],
+      "and the difference is red there",
+    );
+  });
+
+  test("it accepts PNG files, and its own result can be encoded and decoded", () => {
+    const out = composeComparison(encodePng(tb), encodePng(vb6));
+    const back = decodePng(encodePng(out));
+    assert.equal(back.width, out.width);
+    assert.deepEqual(Array.from(back.rgba), Array.from(out.rgba));
+  });
+
+  test("every character of the label font draws, and every glyph is five by seven", () => {
+    const blank = flat(300, 20, [255, 255, 255]);
+    for (const ch of LABEL_CHARS) {
+      const rows = glyphRows(ch);
+      assert.equal(rows.length, 7, `glyph ${ch}`);
+      for (const row of rows) assert.match(row, /^[.#]{5}$/, `glyph ${ch}`);
+      const out = composeComparison(blank, blank, { tb: ch, vb6: "", diff: "" });
+      // The strip over the first panel: rows 8 + 3 to 8 + 3 + 6, columns 8 to 8 + 4.
+      let ink = 0;
+      for (let y = 11; y <= 17; y++) for (let x = 8; x <= 12; x++) if (pixel(out, x, y)[0] < 128) ink++;
+      if (ch === " ") assert.equal(ink, 0, "a space draws nothing");
+      else assert.ok(ink > 0, `${JSON.stringify(ch)} draws nothing`);
+    }
+  });
+
+  test("lower case is drawn as upper case, and an unknown character as a question mark", () => {
+    assert.deepEqual(glyphRows("a"), glyphRows("A"));
+    assert.deepEqual(glyphRows("~"), glyphRows("?"));
+    assert.notDeepEqual(glyphRows("O"), glyphRows("0"));
+  });
+});
+
+// ---------------------------------------------------------------------- repro-images.mjs
+
+describe("imagesKeyProblem", () => {
+  test("accepts a list of names of letters, digits, - and _", () => {
+    assert.equal(imagesKeyProblem(["main"]), null);
+    assert.equal(imagesKeyProblem(["a", "B-2", "c_3"]), null);
+  });
+
+  test("refuses everything else, and names the key", () => {
+    assert.match(imagesKeyProblem([]).why, /non-empty list/);
+    assert.match(imagesKeyProblem("main").why, /non-empty list/);
+    assert.equal(imagesKeyProblem(["ok", "bad name"]).key, "images[1]");
+    assert.equal(imagesKeyProblem(["a.png"]).key, "images[0]");
+    assert.equal(imagesKeyProblem([""]).key, "images[0]");
+    assert.equal(imagesKeyProblem([3]).key, "images[0]");
+    assert.deepEqual(imagesKeyProblem(["a", "b", "a"]), { key: "images[2]", why: "names a twice" });
+  });
+});
+
+describe("the PngDump modules and the Probe.vbp line", () => {
+  test("a Probe.vbp gets the line after its last Module line, in its own line endings", () => {
+    const vbp = 'Type=Exe\r\nModule=Module1; Module1.bas\r\nModule=Other; Other.bas\r\nStartup="Sub Main"\r\n';
+    const out = addPngModule(vbp);
+    assert.equal(
+      out,
+      'Type=Exe\r\nModule=Module1; Module1.bas\r\nModule=Other; Other.bas\r\nModule=PngDump; PngDump.bas\r\nStartup="Sub Main"\r\n',
+    );
+    assert.ok(hasPngModule(out));
+    assert.equal(addPngModule(out), out, "a project that has it is left alone");
+    assert.ok(addPngModule("Type=Exe\nStartup=x\n").includes("\nModule=PngDump; PngDump.bas\n"));
+    assert.ok(!hasPngModule("Module=PngDumper; PngDump.bas\r\n"));
+    assert.ok(!hasPngModule("' Module=PngDump; PngDump.bas\r\n"));
+  });
+
+  test("the templates exist, are CRLF, and are what the reproducers are compared with", () => {
+    for (const name of [PNGDUMP_TWIN, PNGDUMP_BAS]) {
+      const text = readFileSync(path.join(PNG_TEMPLATES, name), "latin1");
+      assert.ok(text.includes("\r\n"), `${name} is CRLF`);
+      assert.ok(!/(?<!\r)\n/.test(text), `${name} has no bare LF`);
+      assert.ok(!/[^\t\r\n -~]/.test(text), `${name} is ASCII`);
+    }
+    assert.match(readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_BAS), "latin1"), /^Attribute VB_Name = "PngDump"/);
+    assert.match(readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_TWIN), "latin1"), /^Module PngDump/);
+  });
+
+  test("both templates ask for the same things of GDI+ and agree on the folder rule", () => {
+    const twin = readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_TWIN), "latin1");
+    const bas = readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_BAS), "latin1");
+    for (const text of [twin, bas]) {
+      for (const needle of [
+        "GdiplusStartup",
+        "GdipCreateBitmapFromHBITMAP",
+        "GdipSaveImageToFile",
+        "GdipDisposeImage",
+        "GdiplusShutdown",
+        "{557CF406-1A04-11D3-9A73-0000F81EF32E}",
+        'Environ$("BUGREPRO_IMAGES")',
+        "App.Path",
+      ]) {
+        assert.ok(text.includes(needle), `${needle} is missing`);
+      }
+      assert.ok(!/\b(MsgBox|InputBox)\b/i.test(text), "no prompt");
+      assert.match(text, /PngPrintWindow\(hWnd, memDC, 3\)/, "PW_CLIENTONLY Or PW_RENDERFULLCONTENT");
+      assert.match(text, /Err\.Raise 5, "PngDump", failure/, "the failure is error 5 with a description");
+    }
+    assert.ok(twin.includes("PtrSafe") && twin.includes("LongPtr"));
+    assert.ok(!bas.includes("PtrSafe") && !bas.includes("LongPtr"));
+  });
+});
+
+/** A reproducer folder with the layout `new --with-images --with-vb6` makes, built from the templates. */
+function reproducer({ vb6 = true } = {}) {
+  const dir = folder();
+  mkdirSync(path.join(dir, "src", "Sources"), { recursive: true });
+  writeFileSync(path.join(dir, "src", "Settings"), "{}");
+  if (vb6) {
+    mkdirSync(path.join(dir, "vb6"));
+    writeFileSync(
+      path.join(dir, "vb6", "Probe.vbp"),
+      'Type=Exe\r\nModule=Module1; Module1.bas\r\nStartup="Sub Main"\r\n',
+    );
+  }
+  copyImageTemplates(dir, { withVb6: vb6 });
+  return dir;
+}
+
+describe("imageSourceCheck", () => {
+  test("a reproducer made from the templates has neither error nor warning", () => {
+    assert.deepEqual(imageSourceCheck(reproducer()), { errors: [], warnings: [] });
+    assert.deepEqual(imageSourceCheck(reproducer({ vb6: false })), { errors: [], warnings: [] });
+  });
+
+  test("a copy with other line endings is the same copy", () => {
+    const dir = reproducer();
+    const file = path.join(dir, "src", "Sources", PNGDUMP_TWIN);
+    writeFileSync(file, normaliseEol(readFileSync(file, "latin1")), "latin1");
+    assert.deepEqual(imageSourceCheck(dir), { errors: [], warnings: [] });
+  });
+
+  test("a missing PngDump.twin is an error, found anywhere under Sources", () => {
+    const dir = reproducer({ vb6: false });
+    rmSync(path.join(dir, "src", "Sources", PNGDUMP_TWIN));
+    assert.match(imageSourceCheck(dir).errors[0], /needs a PngDump\.twin under src\/Sources/);
+    mkdirSync(path.join(dir, "src", "Sources", "Deep", "Er"), { recursive: true });
+    copyFileSync(path.join(PNG_TEMPLATES, PNGDUMP_TWIN), path.join(dir, "src", "Sources", "Deep", "Er", PNGDUMP_TWIN));
+    assert.deepEqual(imageSourceCheck(dir), { errors: [], warnings: [] });
+  });
+
+  test("with vb6/, PngDump.bas and the Probe.vbp line are errors when missing", () => {
+    const dir = reproducer();
+    rmSync(path.join(dir, "vb6", PNGDUMP_BAS));
+    assert.match(imageSourceCheck(dir).errors[0], /needs vb6\/PngDump\.bas/);
+    const other = reproducer();
+    writeFileSync(path.join(other, "vb6", "Probe.vbp"), "Type=Exe\r\nModule=Module1; Module1.bas\r\n");
+    assert.match(imageSourceCheck(other).errors[0], /Probe\.vbp needs the line Module=PngDump; PngDump\.bas/);
+  });
+
+  test("a copy that differs from its template is a warning, not an error", () => {
+    const dir = reproducer();
+    const twin = path.join(dir, "src", "Sources", PNGDUMP_TWIN);
+    writeFileSync(twin, `${readFileSync(twin, "latin1")}' changed\r\n`, "latin1");
+    const bas = path.join(dir, "vb6", PNGDUMP_BAS);
+    writeFileSync(bas, `${readFileSync(bas, "latin1")}' changed\r\n`, "latin1");
+    const { errors, warnings } = imageSourceCheck(dir);
+    assert.deepEqual(errors, []);
+    assert.equal(warnings.length, 2);
+    assert.match(warnings[0], /^src\/Sources\/PngDump\.twin differs from test\/repro-templates\/png\/PngDump\.twin$/);
+    assert.match(warnings[1], /^vb6\/PngDump\.bas differs/);
+  });
+});
+
+describe("keeping and comparing pictures", () => {
+  test("collectImages copies each picture to its name with the kind, and reports the missing", () => {
+    const from = folder();
+    const to = path.join(folder(), "images");
+    writeFileSync(path.join(from, "a.png"), encodePng(noise(2, 2)));
+    const { found, missing } = collectImages(from, to, ["a", "b"], "tb");
+    assert.deepEqual(found, ["a"]);
+    assert.deepEqual(missing, ["b"]);
+    assert.ok(existsSync(imageFile(to, "a", "tb")));
+    assert.ok(!existsSync(imageFile(to, "b", "tb")));
+  });
+
+  test("writeComparison waits for both pictures, then writes the third and says what it shows", () => {
+    const dir = folder();
+    const a = noise(40, 20);
+    const b = copyImage(a);
+    writeFileSync(imageFile(dir, "p", "tb"), encodePng(a));
+    assert.equal(writeComparison(dir, "p"), null);
+    plant(b, 1, 1, [1, 2, 3, 255]);
+    plant(b, 2, 2, [1, 2, 3, 255]);
+    writeFileSync(imageFile(dir, "p", "vb6"), encodePng(b));
+    writeFileSync(path.join(dir, "tb-beta.txt"), "995\n");
+    const made = writeComparison(dir, "p");
+    assert.equal(made.line, "image p: 2 pixels differ");
+    assert.equal(made.differing, 2);
+    assert.equal(made.file, imageFile(dir, "p", "compare"));
+    const picture = decodePng(readFileSync(made.file));
+    assert.equal(
+      picture.width,
+      2 * 8 + 3 * Math.max(40 * 2, ("DIFFERENCE: 2 PIXELS".length * 6 - 1) * 2) + 2 * 8,
+      "scaled twice, labels wider than the picture",
+    );
+    assert.equal(recordedBeta(dir), 995);
+    assert.equal(tbLabel(995), "TWINBASIC BETA 995");
+    assert.equal(tbLabel(null), "TWINBASIC");
+  });
+
+  test("identical pictures say identical; different sizes say so", () => {
+    const a = flat(10, 10, [1, 1, 1]);
+    assert.equal(comparisonLine("n", a, a, comparePngs(a, a)), "image n: identical");
+    const b = flat(12, 10, [1, 1, 1]);
+    assert.equal(
+      comparisonLine("n", a, b, comparePngs(a, b)),
+      "image n: sizes differ (twinBASIC 10x10, VB6 12x10), 20 pixels differ",
+    );
+  });
+
+  test("a picture that is not a PNG is an ImageError that names the file", () => {
+    const dir = folder();
+    writeFileSync(imageFile(dir, "p", "tb"), "junk");
+    writeFileSync(imageFile(dir, "p", "vb6"), encodePng(noise(2, 2)));
+    assert.throws(
+      () => writeComparison(dir, "p"),
+      (e) => e instanceof ImageError && /p-tb\.png cannot be read: not a PNG/.test(e.message),
+    );
+  });
+
+  test("compareWithKept judges fresh pictures against the kept VB6 ones, and names what is missing", () => {
+    const fresh = folder();
+    const kept = folder();
+    const a = noise(8, 8);
+    const b = copyImage(a);
+    plant(b, 0, 0, [9, 9, 9, 255]);
+    writeFileSync(path.join(fresh, "same.png"), encodePng(a));
+    writeFileSync(imageFile(kept, "same", "vb6"), encodePng(a));
+    writeFileSync(path.join(fresh, "diff.png"), encodePng(a));
+    writeFileSync(imageFile(kept, "diff", "vb6"), encodePng(b));
+    writeFileSync(path.join(fresh, "size.png"), encodePng(noise(9, 8)));
+    writeFileSync(imageFile(kept, "size", "vb6"), encodePng(a));
+    assert.deepEqual(compareWithKept(fresh, kept, ["same", "diff", "size"]), [
+      { name: "same", sameSize: true, differing: 0 },
+      { name: "diff", sameSize: true, differing: 1 },
+      { name: "size", sameSize: false, differing: comparePngs(noise(9, 8), a).differing },
+    ]);
+    assert.throws(
+      () => compareWithKept(fresh, kept, ["gone"]),
+      (e) => e instanceof ImageError && /wrote no picture gone\.png/.test(e.message),
+    );
+    writeFileSync(path.join(fresh, "nokept.png"), encodePng(a));
+    assert.throws(
+      () => compareWithKept(fresh, kept, ["nokept"]),
+      (e) => e instanceof ImageError && /no images\/nokept-vb6\.png/.test(e.message),
+    );
+  });
+
+  test("imagesDiffer true reproduces when one picture differs, a size counting; false when every one matches", () => {
+    const match = { name: "a", sameSize: true, differing: 0 };
+    const differ = { name: "b", sameSize: true, differing: 5 };
+    const resized = { name: "c", sameSize: false, differing: 9 };
+    assert.deepEqual(imagesDifferProblems(true, [match, differ]), []);
+    assert.deepEqual(imagesDifferProblems(true, [match, resized]), []);
+    assert.equal(imagesDifferProblems(true, [match]).length, 1);
+    assert.deepEqual(imagesDifferProblems(false, [match]), []);
+    assert.match(imagesDifferProblems(false, [match, differ])[0], /picture b differs .* 5 pixels/);
+    assert.match(imagesDifferProblems(false, [resized])[0], /picture c is not the size/);
+  });
+
+  test("the zip holds every file of images/, flat, in name order", () => {
+    const dir = folder();
+    assert.deepEqual(imageZipEntries(dir), []);
+    mkdirSync(path.join(dir, "images", "sub"), { recursive: true });
+    writeFileSync(path.join(dir, "images", "b-vb6.png"), "2");
+    writeFileSync(path.join(dir, "images", "a-tb.png"), "1");
+    writeFileSync(path.join(dir, "images", "tb-beta.txt"), "995\n");
+    assert.deepEqual(
+      imageZipEntries(dir).map((e) => e.name),
+      ["images/a-tb.png", "images/b-vb6.png", "images/tb-beta.txt"],
+    );
+  });
+});
+
+// --------------------------------------------------------------- bug_repro.mjs over fixtures
+
+const BUG_REPRO = path.join(REPO_ROOT, "scripts", "bug_repro.mjs");
+
+/** bug_repro.mjs over a fixture folder, with no IDE and no VB6 to find. */
+function bugRepro(bugs, ...args) {
+  const env = { ...process.env, BUG_REPRO_BUGS: bugs, TB_IDE: path.join(bugs, "no-ide", "twinBASIC.exe") };
+  delete env.TBBUILD_SHOW;
+  const r = spawnSync(process.execPath, [BUG_REPRO, ...args], { env, encoding: "utf8", cwd: scratch });
+  return { code: r.status, stdout: r.stdout, stderr: r.stderr };
+}
+
+const readJson = (file) => JSON.parse(readFileSync(file, "utf8"));
+
+describe("bug_repro.mjs", () => {
+  const bugs = folder();
+  const reproFile = (slug) => path.join(bugs, slug, "repro.json");
+  /** A reproducer made by `new --with-images --with-vb6`, its repro.json then rewritten. */
+  function made(slug, repro) {
+    const r = bugRepro(bugs, "new", slug, "A picture", "--with-vb6", "--with-images");
+    assert.equal(r.code, 0, r.stderr);
+    if (repro) writeFileSync(reproFile(slug), `${JSON.stringify(repro, null, 2)}\n`);
+    return slug;
+  }
+  const verifyMessage = (slug) => bugRepro(bugs, "verify", slug);
+
+  test("new --with-images --with-vb6 copies both modules, adds the line and lists main", () => {
+    const r = bugRepro(bugs, "new", "pic-new", "A picture", "--with-vb6", "--with-images");
+    assert.equal(r.code, 0, r.stderr);
+    const dir = path.join(bugs, "pic-new");
+    assert.deepEqual(readJson(reproFile("pic-new")).images, ["main"]);
+    assert.equal(readJson(reproFile("pic-new")).mode, "manual");
+    assert.ok(
+      readFileSync(path.join(dir, "src", "Sources", PNGDUMP_TWIN)).equals(
+        readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_TWIN)),
+      ),
+    );
+    assert.ok(
+      readFileSync(path.join(dir, "vb6", PNGDUMP_BAS)).equals(readFileSync(path.join(PNG_TEMPLATES, PNGDUMP_BAS))),
+    );
+    assert.ok(hasPngModule(readFileSync(path.join(dir, "vb6", "Probe.vbp"), "latin1")));
+    assert.ok(readFileSync(path.join(dir, "vb6", "Probe.vbp"), "latin1").includes("\r\n"), "Probe.vbp stays CRLF");
+    assert.deepEqual(imageSourceCheck(dir), { errors: [], warnings: [] });
+    assert.match(r.stdout, /pictures: src\/Sources\/PngDump\.twin and vb6\/PngDump\.bas/);
+    // A manual reproducer with images is valid, and says nothing on stderr.
+    const v = verifyMessage("pic-new");
+    assert.equal(v.code, 0, v.stderr);
+    assert.match(v.stdout, /pic-new: manual/);
+    assert.equal(v.stderr, "");
+  });
+
+  test("new --with-images without --with-vb6 copies the twinBASIC module only", () => {
+    const r = bugRepro(bugs, "new", "pic-tb-only", "A picture", "--with-images");
+    assert.equal(r.code, 0, r.stderr);
+    assert.ok(existsSync(path.join(bugs, "pic-tb-only", "src", "Sources", PNGDUMP_TWIN)));
+    assert.ok(!existsSync(path.join(bugs, "pic-tb-only", "vb6")));
+    assert.equal(verifyMessage("pic-tb-only").code, 0);
+  });
+
+  test("new without --with-images has no images key", () => {
+    assert.equal(bugRepro(bugs, "new", "pic-plain", "A picture").code, 0);
+    assert.ok(!("images" in readJson(reproFile("pic-plain"))));
+  });
+
+  test("--with-images belongs to new alone", () => {
+    const r = bugRepro(bugs, "pack", "pic-plain", "--with-images");
+    assert.equal(r.code, 2);
+    assert.match(r.stderr, /^--with-images does not apply to pack\n/);
+  });
+
+  test("images is refused when it is not a list of valid names", () => {
+    for (const [images, key] of [
+      [[], '"images"'],
+      ["main", '"images"'],
+      [["a b"], '"images[0]"'],
+      [["a", "a"], '"images[1]"'],
+    ]) {
+      const slug = made("pic-bad-list", { mode: "manual", steps: "x", images });
+      const r = verifyMessage(slug);
+      assert.equal(r.code, 2, JSON.stringify(images));
+      assert.ok(r.stderr.includes(key), r.stderr);
+      rmSync(path.join(bugs, slug), { recursive: true });
+    }
+  });
+
+  test("images applies to the run and manual modes only", () => {
+    const slug = made("pic-compile", { mode: "compile", expect: { noDiagnostics: true }, images: ["main"] });
+    const r = verifyMessage(slug);
+    assert.equal(r.code, 2);
+    assert.match(r.stderr, /"images" applies to the run and manual modes only/);
+  });
+
+  test("images needs the modules that draw it", () => {
+    const slug = made("pic-nomodule", { mode: "manual", steps: "x", images: ["main"] });
+    rmSync(path.join(bugs, slug, "src", "Sources", PNGDUMP_TWIN));
+    assert.match(verifyMessage(slug).stderr, /"images" images needs a PngDump\.twin under src\/Sources/);
+    const other = made("pic-novbp", { mode: "manual", steps: "x", images: ["main"] });
+    writeFileSync(path.join(bugs, other, "vb6", "Probe.vbp"), "Type=Exe\r\nModule=Module1; Module1.bas\r\n");
+    assert.match(verifyMessage(other).stderr, /Probe\.vbp needs the line Module=PngDump; PngDump\.bas/);
+  });
+
+  test("a module that has drifted from the template warns, once, and is accepted", () => {
+    const slug = made("pic-drift", { mode: "manual", steps: "x", images: ["main"] });
+    const twin = path.join(bugs, slug, "src", "Sources", PNGDUMP_TWIN);
+    writeFileSync(twin, `${readFileSync(twin, "latin1")}' filed this way\r\n`, "latin1");
+    const r = verifyMessage(slug);
+    assert.equal(r.code, 0, r.stderr);
+    assert.match(
+      r.stderr,
+      /^warning: .*pic-drift.*repro\.json: src\/Sources\/PngDump\.twin differs from test\/repro-templates\/png\/PngDump\.twin\n$/,
+    );
+  });
+
+  test("expect.imagesDiffer needs a boolean, the images list and the kept VB6 pictures", () => {
+    const run = (imagesDiffer, extra = {}) => ({
+      mode: "run",
+      images: ["main"],
+      expect: { output: ["x"], imagesDiffer },
+      ...extra,
+    });
+    const slug = made("pic-differ", run(true));
+    const noPicture = verifyMessage(slug);
+    assert.equal(noPicture.code, 2);
+    assert.match(noPicture.stderr, /"expect\.imagesDiffer" needs .*main-vb6\.png, the VB6 picture to compare with/);
+
+    writeFileSync(reproFile(slug), `${JSON.stringify(run("yes"), null, 2)}\n`);
+    assert.match(verifyMessage(slug).stderr, /"expect\.imagesDiffer" must be true or false/);
+
+    const without = made("pic-differ-noimages", { mode: "run", expect: { imagesDiffer: true } });
+    rmSync(path.join(bugs, without, "src", "Sources", PNGDUMP_TWIN));
+    writeFileSync(reproFile(without), `${JSON.stringify({ mode: "run", expect: { imagesDiffer: true } }, null, 2)}\n`);
+    assert.match(verifyMessage(without).stderr, /"expect\.imagesDiffer" needs an images list/);
+
+    // With the VB6 picture kept, the file is valid: the next thing refused is the missing IDE.
+    mkdirSync(path.join(bugs, slug, "images"));
+    writeFileSync(imageFile(path.join(bugs, slug, "images"), "main", "vb6"), encodePng(noise(4, 4)));
+    for (const flag of [true, false]) {
+      writeFileSync(reproFile(slug), `${JSON.stringify(run(flag), null, 2)}\n`);
+      const valid = verifyMessage(slug);
+      assert.equal(valid.code, 2);
+      assert.match(valid.stderr, /no twinBASIC IDE at /, `imagesDiffer ${flag}: ${valid.stderr}`);
+    }
+  });
+
+  test("expect.imagesDiffer is for the run mode alone", () => {
+    const slug = made("pic-differ-compile", { mode: "compile", expect: { imagesDiffer: true } });
+    assert.match(verifyMessage(slug).stderr, /"expect\.imagesDiffer" does not apply to the compile mode/);
+  });
+
+  test("an attachment may not be a file of images/", () => {
+    const slug = made("pic-attach", { mode: "manual", steps: "x", images: ["main"], attach: ["images/main-tb.png"] });
+    mkdirSync(path.join(bugs, slug, "images"));
+    writeFileSync(path.join(bugs, slug, "images", "main-tb.png"), encodePng(noise(2, 2)));
+    assert.match(
+      verifyMessage(slug).stderr,
+      /"attach\[0\]" names images\/main-tb\.png, which goes into pic-attach\.zip/,
+    );
+  });
+});
+
+describe("embedProblems", () => {
+  const withPicture = () => {
+    const dir = folder();
+    mkdirSync(path.join(dir, "bugs", "x", "images"), { recursive: true });
+    writeFileSync(path.join(dir, "bugs", "x", "images", "main-compare.png"), encodePng(noise(2, 2)));
+    return dir;
+  };
+
+  test("a picture embedded by a path from the report's folder shows", () => {
+    const dir = withPicture();
+    const images = path.join(dir, "bugs", "x", "images");
+    assert.deepEqual(embedProblems("![a](bugs/x/images/main-compare.png)", dir, images, ["main"]), []);
+    assert.deepEqual(embedProblems("![](images/main-compare.png)", path.join(dir, "bugs", "x"), images, ["main"]), []);
+  });
+
+  test("a link, a code span or another picture is not an embedded picture", () => {
+    const dir = withPicture();
+    const images = path.join(dir, "bugs", "x", "images");
+    for (const text of [
+      "[a](bugs/x/images/main-compare.png)",
+      "`bugs/x/images/main-compare.png`",
+      "![a](bugs/x/images/main-tb.png)",
+      "![a](images/main-compare.png)",
+    ]) {
+      assert.deepEqual(embedProblems(text, dir, images, ["main"]), [
+        "main: no ![...](bugs/x/images/main-compare.png) embeds the picture",
+      ]);
+    }
+  });
+
+  test("an embedded picture whose file is missing is named, and so is each name not embedded", () => {
+    const dir = withPicture();
+    const images = path.join(dir, "bugs", "x", "images");
+    assert.deepEqual(embedProblems("![a](bugs/x/images/side-compare.png)", dir, images, ["main", "side"]), [
+      "main: no ![...](bugs/x/images/main-compare.png) embeds the picture",
+      "side: it embeds bugs/x/images/side-compare.png, which does not exist",
+    ]);
+  });
+});
+
+// The reports themselves: every reproducer whose repro.json names pictures shows each of them in
+// its entry of BUGS-TO-REPORT.md, or in its REPORT.md once filed. The pictures are part of the
+// report, so a reproducer that makes them and an entry that does not show them is a fault here.
+describe("the bug reports show their pictures", () => {
+  const queueText = normaliseEol(readFileSync(path.join(REPO_ROOT, "BUGS-TO-REPORT.md"), "utf8"));
+  const entries = queueText.split(/^---$/m).slice(1);
+  const reproducers = (base) =>
+    existsSync(base)
+      ? readdirSync(base, { withFileTypes: true })
+          .filter((e) => e.isDirectory() && existsSync(path.join(base, e.name, "repro.json")))
+          .map((e) => ({ slug: e.name, dir: path.join(base, e.name) }))
+      : [];
+  const bugsDir = path.join(REPO_ROOT, "bugs");
+  const all = [...reproducers(bugsDir).filter((r) => r.slug !== "filed"), ...reproducers(path.join(bugsDir, "filed"))];
+  const withImages = all
+    .map((r) => ({ ...r, images: JSON.parse(readFileSync(path.join(r.dir, "repro.json"), "utf8")).images }))
+    .filter((r) => Array.isArray(r.images));
+
+  test("at least one reproducer has pictures, so this check reads something", () => {
+    assert.ok(withImages.length > 0);
+  });
+
+  for (const r of withImages) {
+    test(`${path.relative(REPO_ROOT, r.dir).split(path.sep).join("/")} shows each picture in its report`, () => {
+      const images = path.join(r.dir, "images");
+      const report = path.join(r.dir, "REPORT.md");
+      if (existsSync(report)) {
+        assert.deepEqual(embedProblems(readFileSync(report, "utf8"), r.dir, images, r.images), []);
+        return;
+      }
+      const mine = entries.filter((e) => e.includes(`bugs/${r.slug}/`));
+      assert.equal(mine.length, 1, `one entry of BUGS-TO-REPORT.md names bugs/${r.slug}/`);
+      assert.deepEqual(embedProblems(mine[0], REPO_ROOT, images, r.images), []);
+    });
+  }
+});
diff --git a/test/repro-templates/png/PngDump.bas b/test/repro-templates/png/PngDump.bas
new file mode 100644
index 000000000..181d5e68c
--- /dev/null
+++ b/test/repro-templates/png/PngDump.bas
@@ -0,0 +1,200 @@
+Attribute VB_Name = "PngDump"
+Option Explicit
+
+' Saves what a surface or a window shows as a PNG file, for a bug report that is
+' best shown by a picture. The same module, as PngDump.twin, runs in twinBASIC, so that
+' the two pictures can be put side by side (node scripts/bug_repro.mjs run, then vb6).
+'
+'     PngDump.Surface Form1, "main"       ' an object with an hDC: a Form, PictureBox, UserControl
+'     PngDump.Window Text1.hWnd, "text"   ' a control with no hDC; its client area
+'
+' The file is <folder>\<Name>.png. The folder is the BUGREPRO_IMAGES environment
+' variable, which bug_repro.mjs sets, or else App.Path. Name uses letters, digits,
+' - and _. Any failure raises error 5, whose Description says which call failed.
+'
+' The pixels are copied with BitBlt (or PrintWindow) into a bitmap of this module's own
+' and saved with GDI+, so the picture is what was drawn, not what the object's Image
+' property or SavePicture would make of it.
+'
+' The Declares are aliased to Png... names, so that a reproducer's own BitBlt or
+' SelectObject cannot collide with them.
+
+Private Type PngGuid
+    Data1 As Long
+    Data2 As Integer
+    Data3 As Integer
+    Data4(0 To 7) As Byte
+End Type
+
+Private Type PngGdipInput
+    GdiplusVersion As Long
+    DebugEventCallback As Long
+    SuppressBackgroundThread As Long
+    SuppressExternalCodecs As Long
+End Type
+
+Private Type PngRect
+    Left As Long
+    Top As Long
+    Right As Long
+    Bottom As Long
+End Type
+
+Private Type PngBmpHeader
+    biSize As Long
+    biWidth As Long
+    biHeight As Long
+    biPlanes As Integer
+    biBitCount As Integer
+    biCompression As Long
+    biSizeImage As Long
+    biXPelsPerMeter As Long
+    biYPelsPerMeter As Long
+    biClrUsed As Long
+    biClrImportant As Long
+End Type
+
+Private Declare Function PngGdiplusStartup Lib "gdiplus" Alias "GdiplusStartup" ( _
+    ByRef token As Long, ByRef startInput As PngGdipInput, ByVal startOutput As Long) As Long
+Private Declare Sub PngGdiplusShutdown Lib "gdiplus" Alias "GdiplusShutdown" ( _
+    ByVal token As Long)
+Private Declare Function PngGdipCreateBitmapFromHBITMAP Lib "gdiplus" Alias "GdipCreateBitmapFromHBITMAP" ( _
+    ByVal hbm As Long, ByVal hpal As Long, ByRef bitmap As Long) As Long
+Private Declare Function PngGdipSaveImageToFile Lib "gdiplus" Alias "GdipSaveImageToFile" ( _
+    ByVal image As Long, ByVal fileName As Long, ByRef clsidEncoder As PngGuid, ByVal encoderParams As Long) As Long
+Private Declare Function PngGdipDisposeImage Lib "gdiplus" Alias "GdipDisposeImage" ( _
+    ByVal image As Long) As Long
+Private Declare Function PngCLSIDFromString Lib "ole32" Alias "CLSIDFromString" ( _
+    ByVal lpsz As Long, ByRef pclsid As PngGuid) As Long
+Private Declare Function PngCreateCompatibleDC Lib "gdi32" Alias "CreateCompatibleDC" ( _
+    ByVal hdc As Long) As Long
+Private Declare Function PngCreateDIBSection Lib "gdi32" Alias "CreateDIBSection" ( _
+    ByVal hdc As Long, ByRef pbmi As PngBmpHeader, ByVal usage As Long, ByRef ppvBits As Long, _
+    ByVal hSection As Long, ByVal offset As Long) As Long
+Private Declare Function PngSelectObject Lib "gdi32" Alias "SelectObject" ( _
+    ByVal hdc As Long, ByVal hObject As Long) As Long
+Private Declare Function PngDeleteObject Lib "gdi32" Alias "DeleteObject" ( _
+    ByVal hObject As Long) As Long
+Private Declare Function PngDeleteDC Lib "gdi32" Alias "DeleteDC" ( _
+    ByVal hdc As Long) As Long
+Private Declare Function PngBitBlt Lib "gdi32" Alias "BitBlt" ( _
+    ByVal hdcDest As Long, ByVal xDest As Long, ByVal yDest As Long, ByVal cx As Long, ByVal cy As Long, _
+    ByVal hdcSrc As Long, ByVal xSrc As Long, ByVal ySrc As Long, ByVal rop As Long) As Long
+Private Declare Function PngGetClientRect Lib "user32" Alias "GetClientRect" ( _
+    ByVal hwnd As Long, ByRef rc As PngRect) As Long
+Private Declare Function PngPrintWindow Lib "user32" Alias "PrintWindow" ( _
+    ByVal hwnd As Long, ByVal hdcBlt As Long, ByVal flags As Long) As Long
+
+' Saves the pixels an object with an hDC has drawn, <Name>.png.
+Public Sub Surface(ByVal Obj As Object, ByVal Name As String)
+    Dim target As String
+    Dim w As Long
+    Dim h As Long
+    Dim src As Long
+    target = TargetFile(Name)
+    w = CLng(Obj.ScaleX(Obj.ScaleWidth, Obj.ScaleMode, vbPixels))
+    h = CLng(Obj.ScaleY(Obj.ScaleHeight, Obj.ScaleMode, vbPixels))
+    src = CLng(Obj.hDC)
+    Capture 0, src, w, h, target
+End Sub
+
+' Saves the client area of a window, <Name>.png: for a control with no hDC.
+Public Sub Window(ByVal hWnd As Long, ByVal Name As String)
+    Dim target As String
+    Dim rc As PngRect
+    target = TargetFile(Name)
+    If hWnd = 0 Then Err.Raise 5, "PngDump", "the window handle is 0"
+    If PngGetClientRect(hWnd, rc) = 0 Then
+        Err.Raise 5, "PngDump", "GetClientRect failed, error " & Err.LastDllError
+    End If
+    Capture hWnd, 0, rc.Right - rc.Left, rc.Bottom - rc.Top, target
+End Sub
+
+' The file's path, or error 5 for a name that is empty or uses a character outside
+' letters, digits, - and _.
+Private Function TargetFile(ByVal Name As String) As String
+    Dim i As Long
+    Dim c As Long
+    Dim folder As String
+    If Len(Name) = 0 Then Err.Raise 5, "PngDump", "the image name is empty"
+    For i = 1 To Len(Name)
+        c = AscW(Mid$(Name, i, 1))
+        If Not ((c >= 48 And c <= 57) Or (c >= 65 And c <= 90) Or (c >= 97 And c <= 122) Or c = 45 Or c = 95) Then
+            Err.Raise 5, "PngDump", "the image name """ & Name & """ must use only letters, digits, - and _"
+        End If
+    Next i
+    folder = Environ$("BUGREPRO_IMAGES")
+    If Len(folder) = 0 Then folder = App.Path
+    If Right$(folder, 1) = "\" Then folder = Left$(folder, Len(folder) - 1)
+    TargetFile = folder & "\" & Name & ".png"
+End Function
+
+' Copies w by h pixels, from the DC srcDC or, when hWnd is not 0, with PrintWindow, into a
+' 24-bit bitmap of our own and saves it as target. Every GDI object and the GDI+ token
+' are released on every path, and the error is raised after that.
+Private Sub Capture(ByVal hWnd As Long, ByVal srcDC As Long, ByVal w As Long, ByVal h As Long, ByVal target As String)
+    Dim token As Long
+    Dim memDC As Long
+    Dim dib As Long
+    Dim oldBmp As Long
+    Dim image As Long
+    Dim bits As Long
+    Dim hdr As PngBmpHeader
+    Dim gdipIn As PngGdipInput
+    Dim encoder As PngGuid
+    Dim status As Long
+    Dim failure As String
+
+    If w < 1 Or h < 1 Then failure = "the surface is " & w & " by " & h & " pixels: nothing to capture": GoTo Done
+
+    gdipIn.GdiplusVersion = 1
+    status = PngGdiplusStartup(token, gdipIn, 0)
+    If status <> 0 Then token = 0: failure = "GdiplusStartup failed, status " & status: GoTo Done
+
+    status = PngCLSIDFromString(StrPtr("{557CF406-1A04-11D3-9A73-0000F81EF32E}"), encoder)
+    If status <> 0 Then failure = "CLSIDFromString failed for the PNG encoder, HRESULT " & Hex$(status): GoTo Done
+
+    memDC = PngCreateCompatibleDC(0)
+    If memDC = 0 Then failure = "CreateCompatibleDC failed, error " & Err.LastDllError: GoTo Done
+
+    hdr.biSize = 40
+    hdr.biWidth = w
+    hdr.biHeight = h
+    hdr.biPlanes = 1
+    hdr.biBitCount = 24
+    dib = PngCreateDIBSection(memDC, hdr, 0, bits, 0, 0)
+    If dib = 0 Then failure = "CreateDIBSection failed, error " & Err.LastDllError: GoTo Done
+
+    oldBmp = PngSelectObject(memDC, dib)
+    If oldBmp = 0 Then failure = "SelectObject failed, error " & Err.LastDllError: GoTo Done
+
+    If hWnd = 0 Then
+        If PngBitBlt(memDC, 0, 0, w, h, srcDC, 0, 0, &HCC0020) = 0 Then
+            failure = "BitBlt failed, error " & Err.LastDllError: GoTo Done
+        End If
+    Else
+        If PngPrintWindow(hWnd, memDC, 3) = 0 Then
+            failure = "PrintWindow failed, error " & Err.LastDllError: GoTo Done
+        End If
+    End If
+
+    ' GDI+ must not be given a bitmap that is selected into a device context.
+    PngSelectObject memDC, oldBmp
+    oldBmp = 0
+
+    status = PngGdipCreateBitmapFromHBITMAP(dib, 0, image)
+    If status <> 0 Then image = 0: failure = "GdipCreateBitmapFromHBITMAP failed, status " & status: GoTo Done
+
+    status = PngGdipSaveImageToFile(image, StrPtr(target), encoder, 0)
+    If status <> 0 Then failure = "GdipSaveImageToFile failed for " & target & ", status " & status
+
+Done:
+    If image <> 0 Then PngGdipDisposeImage image
+    If memDC <> 0 Then
+        If oldBmp <> 0 Then PngSelectObject memDC, oldBmp
+        If dib <> 0 Then PngDeleteObject dib
+        PngDeleteDC memDC
+    End If
+    If token <> 0 Then PngGdiplusShutdown token
+    If Len(failure) > 0 Then Err.Raise 5, "PngDump", failure
+End Sub
diff --git a/test/repro-templates/png/PngDump.twin b/test/repro-templates/png/PngDump.twin
new file mode 100644
index 000000000..766d74baa
--- /dev/null
+++ b/test/repro-templates/png/PngDump.twin
@@ -0,0 +1,201 @@
+Module PngDump
+
+    ' Saves what a surface or a window shows as a PNG file, for a bug report that is
+    ' best shown by a picture. The same module, as PngDump.bas, runs in VB6, so that the
+    ' two pictures can be put side by side (node scripts/bug_repro.mjs run, then vb6).
+    '
+    '     PngDump.Surface Form1, "main"       ' an object with an hDC: a Form, PictureBox, UserControl
+    '     PngDump.Window Text1.hWnd, "text"   ' a control with no hDC; its client area
+    '
+    ' The file is <folder>\<Name>.png. The folder is the BUGREPRO_IMAGES environment
+    ' variable, which bug_repro.mjs sets, or else App.Path. Name uses letters, digits,
+    ' - and _. Any failure raises error 5, whose Description says which call failed.
+    '
+    ' The pixels are copied with BitBlt (or PrintWindow) into a bitmap of this module's own
+    ' and saved with GDI+, so the picture is what was drawn, not what the object's Image
+    ' property or SavePicture would make of it.
+    '
+    ' The Declares are aliased to Png... names, so that a reproducer's own BitBlt or
+    ' SelectObject cannot collide with them.
+
+    Private Type PngGuid
+        Data1 As Long
+        Data2 As Integer
+        Data3 As Integer
+        Data4(0 To 7) As Byte
+    End Type
+
+    Private Type PngGdipInput
+        GdiplusVersion As Long
+        DebugEventCallback As LongPtr
+        SuppressBackgroundThread As Long
+        SuppressExternalCodecs As Long
+    End Type
+
+    Private Type PngRect
+        Left As Long
+        Top As Long
+        Right As Long
+        Bottom As Long
+    End Type
+
+    Private Type PngBmpHeader
+        biSize As Long
+        biWidth As Long
+        biHeight As Long
+        biPlanes As Integer
+        biBitCount As Integer
+        biCompression As Long
+        biSizeImage As Long
+        biXPelsPerMeter As Long
+        biYPelsPerMeter As Long
+        biClrUsed As Long
+        biClrImportant As Long
+    End Type
+
+    Private Declare PtrSafe Function PngGdiplusStartup Lib "gdiplus" Alias "GdiplusStartup" ( _
+        ByRef token As LongPtr, ByRef startInput As PngGdipInput, ByVal startOutput As LongPtr) As Long
+    Private Declare PtrSafe Sub PngGdiplusShutdown Lib "gdiplus" Alias "GdiplusShutdown" ( _
+        ByVal token As LongPtr)
+    Private Declare PtrSafe Function PngGdipCreateBitmapFromHBITMAP Lib "gdiplus" Alias "GdipCreateBitmapFromHBITMAP" ( _
+        ByVal hbm As LongPtr, ByVal hpal As LongPtr, ByRef bitmap As LongPtr) As Long
+    Private Declare PtrSafe Function PngGdipSaveImageToFile Lib "gdiplus" Alias "GdipSaveImageToFile" ( _
+        ByVal image As LongPtr, ByVal fileName As LongPtr, ByRef clsidEncoder As PngGuid, ByVal encoderParams As LongPtr) As Long
+    Private Declare PtrSafe Function PngGdipDisposeImage Lib "gdiplus" Alias "GdipDisposeImage" ( _
+        ByVal image As LongPtr) As Long
+    Private Declare PtrSafe Function PngCLSIDFromString Lib "ole32" Alias "CLSIDFromString" ( _
+        ByVal lpsz As LongPtr, ByRef pclsid As PngGuid) As Long
+    Private Declare PtrSafe Function PngCreateCompatibleDC Lib "gdi32" Alias "CreateCompatibleDC" ( _
+        ByVal hdc As LongPtr) As LongPtr
+    Private Declare PtrSafe Function PngCreateDIBSection Lib "gdi32" Alias "CreateDIBSection" ( _
+        ByVal hdc As LongPtr, ByRef pbmi As PngBmpHeader, ByVal usage As Long, ByRef ppvBits As LongPtr, _
+        ByVal hSection As LongPtr, ByVal offset As Long) As LongPtr
+    Private Declare PtrSafe Function PngSelectObject Lib "gdi32" Alias "SelectObject" ( _
+        ByVal hdc As LongPtr, ByVal hObject As LongPtr) As LongPtr
+    Private Declare PtrSafe Function PngDeleteObject Lib "gdi32" Alias "DeleteObject" ( _
+        ByVal hObject As LongPtr) As Long
+    Private Declare PtrSafe Function PngDeleteDC Lib "gdi32" Alias "DeleteDC" ( _
+        ByVal hdc As LongPtr) As Long
+    Private Declare PtrSafe Function PngBitBlt Lib "gdi32" Alias "BitBlt" ( _
+        ByVal hdcDest As LongPtr, ByVal xDest As Long, ByVal yDest As Long, ByVal cx As Long, ByVal cy As Long, _
+        ByVal hdcSrc As LongPtr, ByVal xSrc As Long, ByVal ySrc As Long, ByVal rop As Long) As Long
+    Private Declare PtrSafe Function PngGetClientRect Lib "user32" Alias "GetClientRect" ( _
+        ByVal hwnd As LongPtr, ByRef rc As PngRect) As Long
+    Private Declare PtrSafe Function PngPrintWindow Lib "user32" Alias "PrintWindow" ( _
+        ByVal hwnd As LongPtr, ByVal hdcBlt As LongPtr, ByVal flags As Long) As Long
+
+    ' Saves the pixels an object with an hDC has drawn, <Name>.png.
+    Public Sub Surface(ByVal Obj As Object, ByVal Name As String)
+        Dim target As String
+        Dim w As Long
+        Dim h As Long
+        Dim src As LongPtr
+        target = TargetFile(Name)
+        w = CLng(Obj.ScaleX(Obj.ScaleWidth, Obj.ScaleMode, vbPixels))
+        h = CLng(Obj.ScaleY(Obj.ScaleHeight, Obj.ScaleMode, vbPixels))
+        src = CLngPtr(Obj.hDC)
+        Capture 0, src, w, h, target
+    End Sub
+
+    ' Saves the client area of a window, <Name>.png: for a control with no hDC.
+    Public Sub Window(ByVal hWnd As LongPtr, ByVal Name As String)
+        Dim target As String
+        Dim rc As PngRect
+        target = TargetFile(Name)
+        If hWnd = 0 Then Err.Raise 5, "PngDump", "the window handle is 0"
+        If PngGetClientRect(hWnd, rc) = 0 Then
+            Err.Raise 5, "PngDump", "GetClientRect failed, error " & Err.LastDllError
+        End If
+        Capture hWnd, 0, rc.Right - rc.Left, rc.Bottom - rc.Top, target
+    End Sub
+
+    ' The file's path, or error 5 for a name that is empty or uses a character outside
+    ' letters, digits, - and _.
+    Private Function TargetFile(ByVal Name As String) As String
+        Dim i As Long
+        Dim c As Long
+        Dim folder As String
+        If Len(Name) = 0 Then Err.Raise 5, "PngDump", "the image name is empty"
+        For i = 1 To Len(Name)
+            c = AscW(Mid$(Name, i, 1))
+            If Not ((c >= 48 And c <= 57) Or (c >= 65 And c <= 90) Or (c >= 97 And c <= 122) Or c = 45 Or c = 95) Then
+                Err.Raise 5, "PngDump", "the image name """ & Name & """ must use only letters, digits, - and _"
+            End If
+        Next i
+        folder = Environ$("BUGREPRO_IMAGES")
+        If Len(folder) = 0 Then folder = App.Path
+        If Right$(folder, 1) = "\" Then folder = Left$(folder, Len(folder) - 1)
+        TargetFile = folder & "\" & Name & ".png"
+    End Function
+
+    ' Copies w by h pixels, from the DC srcDC or, when hWnd is not 0, with PrintWindow, into a
+    ' 24-bit bitmap of our own and saves it as target. Every GDI object and the GDI+ token
+    ' are released on every path, and the error is raised after that.
+    Private Sub Capture(ByVal hWnd As LongPtr, ByVal srcDC As LongPtr, ByVal w As Long, ByVal h As Long, ByVal target As String)
+        Dim token As LongPtr
+        Dim memDC As LongPtr
+        Dim dib As LongPtr
+        Dim oldBmp As LongPtr
+        Dim image As LongPtr
+        Dim bits As LongPtr
+        Dim hdr As PngBmpHeader
+        Dim gdipIn As PngGdipInput
+        Dim encoder As PngGuid
+        Dim status As Long
+        Dim failure As String
+
+        If w < 1 Or h < 1 Then failure = "the surface is " & w & " by " & h & " pixels: nothing to capture": GoTo Done
+
+        gdipIn.GdiplusVersion = 1
+        status = PngGdiplusStartup(token, gdipIn, 0)
+        If status <> 0 Then token = 0: failure = "GdiplusStartup failed, status " & status: GoTo Done
+
+        status = PngCLSIDFromString(StrPtr("{557CF406-1A04-11D3-9A73-0000F81EF32E}"), encoder)
+        If status <> 0 Then failure = "CLSIDFromString failed for the PNG encoder, HRESULT " & Hex$(status): GoTo Done
+
+        memDC = PngCreateCompatibleDC(0)
+        If memDC = 0 Then failure = "CreateCompatibleDC failed, error " & Err.LastDllError: GoTo Done
+
+        hdr.biSize = 40
+        hdr.biWidth = w
+        hdr.biHeight = h
+        hdr.biPlanes = 1
+        hdr.biBitCount = 24
+        dib = PngCreateDIBSection(memDC, hdr, 0, bits, 0, 0)
+        If dib = 0 Then failure = "CreateDIBSection failed, error " & Err.LastDllError: GoTo Done
+
+        oldBmp = PngSelectObject(memDC, dib)
+        If oldBmp = 0 Then failure = "SelectObject failed, error " & Err.LastDllError: GoTo Done
+
+        If hWnd = 0 Then
+            If PngBitBlt(memDC, 0, 0, w, h, srcDC, 0, 0, &HCC0020&) = 0 Then
+                failure = "BitBlt failed, error " & Err.LastDllError: GoTo Done
+            End If
+        Else
+            If PngPrintWindow(hWnd, memDC, 3) = 0 Then
+                failure = "PrintWindow failed, error " & Err.LastDllError: GoTo Done
+            End If
+        End If
+
+        ' GDI+ must not be given a bitmap that is selected into a device context.
+        PngSelectObject memDC, oldBmp
+        oldBmp = 0
+
+        status = PngGdipCreateBitmapFromHBITMAP(dib, 0, image)
+        If status <> 0 Then image = 0: failure = "GdipCreateBitmapFromHBITMAP failed, status " & status: GoTo Done
+
+        status = PngGdipSaveImageToFile(image, StrPtr(target), encoder, 0)
+        If status <> 0 Then failure = "GdipSaveImageToFile failed for " & target & ", status " & status
+
+Done:
+        If image <> 0 Then PngGdipDisposeImage image
+        If memDC <> 0 Then
+            If oldBmp <> 0 Then PngSelectObject memDC, oldBmp
+            If dib <> 0 Then PngDeleteObject dib
+            PngDeleteDC memDC
+        End If
+        If token <> 0 Then PngGdiplusShutdown token
+        If Len(failure) > 0 Then Err.Raise 5, "PngDump", failure
+    End Sub
+
+End Module