diff --git a/.claude/skills/release/SKILL.md b/.claude/skills/release/SKILL.md
index 81a6d6e..419223e 100644
--- a/.claude/skills/release/SKILL.md
+++ b/.claude/skills/release/SKILL.md
@@ -31,8 +31,18 @@ The policy page states what was *measured* — no accounts, no analytics, no
 advertising or third-party SDK, no tracking, and no networking code anywhere
 in the app or in TortoiseGraphics2 — which is also why no
 `PrivacyInfo.xcprivacy` is needed: nothing here touches a required-reason
-API, not even `UserDefaults`. Re-check that if a dependency or an
-`@AppStorage` ever arrives. **Both pages read in one language**, chosen by
+API, not even `UserDefaults`. That last one is **held on purpose and has
+already had to be defended once**: #53's viewer read a debug launch flag with
+`UserDefaults.standard.bool(forKey:)`, which is where a `-flag value` pair
+normally arrives, and one debug read of it obliges the whole app to ship a
+manifest declaring `CA92.1`. It now reads `ProcessInfo.processInfo.arguments`
+instead — same launch command, no manifest. So the thing to re-check is not
+only "a dependency or an `@AppStorage`": *any* `UserDefaults` call counts,
+including a read, including one that only fires in development, because it is
+compiled into the shipping binary. `NSWorldSensingUsageDescription` (#53) is
+**not** on that list — a usage description is a permission, not a
+required-reason API, and it changes the policy page rather than the manifest.
+**Both pages read in one language**, chosen by
 `?lang=` first, then `navigator.languages` in the reader's own order, falling
 back to English; adding a language is a code in `LANGS`, an `<option>`, and a
 translated `<section>`. Two rules hold it together: the site stores nothing (a
@@ -126,8 +136,29 @@ One more vocabulary mismatch to remember: deliver says `osx`, the Connect API
 says `MAC_OS`, and passing the former to spaceship reports a missing version
 that plainly exists.
 
+**visionOS is a third listing, spelled three different ways** (#11). It is a
+native app on the xrOS SDK, not "Designed for iPad", so App Store Connect gives
+it its own platform version — which the app record must carry *before* either
+lane will run (`get_edit_app_store_version` returns nil otherwise, and
+`metadata_diff` stops with "No editable xros version"). The text is shared with
+the other two, as it already was between iOS and macOS; only the screenshots
+are per-platform. Then the vocabulary: **`visionos` names the screenshots
+directory, `xros` goes to deliver, `VISION_OS` goes to spaceship**, and the
+first of those is not a style choice. A Vision Pro capture is 3840×2160, the
+same size as an Apple TV one, so deliver cannot resolve the display type from
+the size and falls back to asking whether the *path* contains `vision`
+(downcased) — name the directory after deliver's own platform value and every
+screenshot is filed as `APP_APPLE_TV` on an app with no tvOS listing.
+The captures need no staging: `xcrun simctl io <device> screenshot` on the
+visionOS simulator writes exactly 3840×2160, the simulated room and all, which
+is what visionOS screenshots look like anyway. They do carry an alpha channel,
+so `-alpha off` applies here like everywhere else. And no new identifier is
+needed — spaceship maps `xros` onto the **iOS** `BundleIdPlatform`, so the App
+IDs the iPhone/iPad build already registered are the ones visionOS signs
+against.
+
 **A release is a `v*` tag** (#4). Xcode Cloud runs one `Release` workflow off
-it — two Archive actions, iOS and macOS, each with a TestFlight internal
+it — an Archive action per platform, each with a TestFlight internal
 post-action bound to its own archive artifact. It carries no Build or Test
 action: GitHub Actions has already run the lint, the Kit tests and both
 platform builds on the way to main, and Xcode Cloud's 25 free compute
diff --git a/.github/workflows/appstore-metadata.yml b/.github/workflows/appstore-metadata.yml
index 1ec937c..74167a2 100644
--- a/.github/workflows/appstore-metadata.yml
+++ b/.github/workflows/appstore-metadata.yml
@@ -13,8 +13,8 @@ on:
       platform:
         description: Which listing
         type: choice
-        options: [both, ios, macos]
-        default: both
+        options: [all, ios, macos, visionos]
+        default: all
       apply:
         description: Upload (unticked, only the diff is shown)
         type: boolean
@@ -48,9 +48,10 @@ jobs:
         run: |
           lane='${{ inputs.apply && 'metadata_push' || 'metadata_diff' }}'
           case '${{ inputs.platform }}' in
-            ios)   platforms="ios" ;;
-            macos) platforms="mac" ;;
-            *)     platforms="ios mac" ;;
+            ios)      platforms="ios" ;;
+            macos)    platforms="mac" ;;
+            visionos) platforms="visionos" ;;
+            *)        platforms="ios mac visionos" ;;
           esac
           for p in $platforms; do
             echo "::group::$p $lane"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47ba4a9..b168396 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,6 +99,13 @@ jobs:
             destination: generic/platform=iOS Simulator
           - name: macOS
             destination: platform=macOS
+          # visionOS (#11). It shares every source file with iPadOS, so what
+          # this catches is the `#if` that quietly stops applying: SwiftUI
+          # marks a handful of iOS API unavailable there (`ToolbarSpacer`),
+          # and an `#if os(iOS)` compiles clean on all three platforms while
+          # doing nothing on this one.
+          - name: visionOS
+            destination: generic/platform=visionOS Simulator
     steps:
       - uses: actions/checkout@v7
 
diff --git a/App/Document/BlocksDocument.swift b/App/Document/BlocksDocument.swift
index 0952ade..0a30319 100644
--- a/App/Document/BlocksDocument.swift
+++ b/App/Document/BlocksDocument.swift
@@ -25,6 +25,15 @@ struct BlocksDocument: FileDocument {
         guard let data = configuration.file.regularFileContents else {
             throw CocoaError(.fileReadCorruptFile)
         }
+        self.project = try Self.project(from: data)
+    }
+
+    /// Decoding, apart from `FileDocument`, because the visionOS viewer (#53)
+    /// reads `.tortoise` files through a `fileImporter` and has no
+    /// `DocumentGroup` to hand it a `ReadConfiguration`. The version gate has
+    /// to be the same one, or the two ways in would disagree about which files
+    /// are from the future.
+    static func project(from data: Data) throws -> BlocksProject {
         // Probe just the version before the full decode: a newer file's
         // unknown block shapes would fail the full decode with a generic
         // "corrupt" error before the version gate could explain it.
@@ -32,7 +41,7 @@ struct BlocksDocument: FileDocument {
         guard probe.schemaVersion <= BlocksProject.currentSchemaVersion else {
             throw DocumentError.newerSchema
         }
-        self.project = try JSONDecoder().decode(BlocksProject.self, from: data)
+        return try JSONDecoder().decode(BlocksProject.self, from: data)
     }
 
     func fileWrapper(configuration: WriteConfiguration) throws -> FileWrapper {
diff --git a/App/InfoPlist.xcstrings b/App/InfoPlist.xcstrings
index ae021cf..cd0eeb7 100644
--- a/App/InfoPlist.xcstrings
+++ b/App/InfoPlist.xcstrings
@@ -30,6 +30,18 @@
         }
       }
     },
+    "NSWorldSensingUsageDescription" : {
+      "comment" : "Privacy - World Sensing Usage Description",
+      "extractionState" : "extracted_with_value",
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Used to place your drawing on a real table."
+          }
+        }
+      }
+    },
     "Tortoise Blocks Block" : {
 
     },
diff --git a/App/Localizable.xcstrings b/App/Localizable.xcstrings
index 2ad62fa..ddaa5eb 100644
--- a/App/Localizable.xcstrings
+++ b/App/Localizable.xcstrings
@@ -14,6 +14,56 @@
         }
       }
     },
+    "Away" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ださない"
+          }
+        }
+      }
+    },
+    "Blocks" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ブロック"
+          }
+        }
+      }
+    },
+    "In Front of You" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "めのまえ"
+          }
+        }
+      }
+    },
+    "On a Table" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "つくえ"
+          }
+        }
+      }
+    },
+    "Where should the drawing go?" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "えを どこに だす？"
+          }
+        }
+      }
+    },
     "🎲" : {
       "localizations" : {
         "ja" : {
@@ -184,6 +234,16 @@
         }
       }
     },
+    "Can't Open This" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "これは ひらけません"
+          }
+        }
+      }
+    },
     "Cancel" : {
       "localizations" : {
         "ja" : {
@@ -494,6 +554,16 @@
         }
       }
     },
+    "Looking for a table…" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "つくえを さがしています…"
+          }
+        }
+      }
+    },
     "item %lld" : {
       "localizations" : {
         "ja" : {
@@ -634,6 +704,26 @@
         }
       }
     },
+    "No Drawing" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "えが ありません"
+          }
+        }
+      }
+    },
+    "No table found, so it is floating in front of you." : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "つくえが みつからないので、めのまえに だしているよ。"
+          }
+        }
+      }
+    },
     "Nothing to play" : {
       "localizations" : {
         "ja" : {
@@ -674,6 +764,26 @@
         }
       }
     },
+    "Open" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ひらく"
+          }
+        }
+      }
+    },
+    "Open a drawing, or start from a sample." : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "えを ひらくか、サンプルから はじめてね。"
+          }
+        }
+      }
+    },
     "or less" : {
       "localizations" : {
         "ja" : {
@@ -784,6 +894,16 @@
         }
       }
     },
+    "Pinch to resize, twist to turn, drag to move." : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "つまむと おおきさ、ひねると むき、うごかすと ばしょが かわるよ。"
+          }
+        }
+      }
+    },
     "Play" : {
       "localizations" : {
         "ja" : {
@@ -884,6 +1004,16 @@
         }
       }
     },
+    "Reset Position" : {
+      "localizations" : {
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "もとの ばしょに もどす"
+          }
+        }
+      }
+    },
     "Resume" : {
       "localizations" : {
         "ja" : {
diff --git a/App/Models/RunnerModel.swift b/App/Models/RunnerModel.swift
index 5807da0..5051360 100644
--- a/App/Models/RunnerModel.swift
+++ b/App/Models/RunnerModel.swift
@@ -22,6 +22,16 @@ final class RunnerModel {
     /// exports render exactly what is on screen.
     private(set) var lastRunCommands: [TortoiseCommand] = []
 
+    /// Bounding box of the last run's visible output, or nil when it drew
+    /// nothing. `nil` on an empty stream, exactly as `DrawingBounds` reports it.
+    ///
+    /// Computed once per run rather than per use, because both users want it
+    /// repeatedly and neither can afford the replay: the export sizes its
+    /// frame from it (once per export, previously replaying the stream again),
+    /// and the visionOS table maps the 3-D tortoise's position through the
+    /// same `autoFit` transform the canvas uses — *every display frame*.
+    private(set) var drawingBounds: DrawingBounds?
+
     /// Set when expansion fails; drives a kid-friendly alert.
     var showsExpansionError = false
 
@@ -114,6 +124,8 @@ final class RunnerModel {
             let expanded = try BlockExpander.expand(blocks)
             expandedBlockIDs = expanded.map(\.blockID)
             lastRunCommands = expanded.map(\.command)
+            drawingBounds = DrawingBounds.compute(
+                from: CommandPlayer.play(commands: lastRunCommands))
             lastRunTreeHash = blocks.hashValue
             player.isPaused = startPaused
             tortoise.reset()
@@ -182,7 +194,8 @@ final class RunnerModel {
     func pngData(scale: CGFloat = 2) -> Data? {
         if let cached = pngDataCache[scale] { return cached }
         guard canExport else { return nil }
-        let data = Self.renderPNG(lastRunCommands, longSide: 512, scale: scale)
+        let data = Self.renderPNG(
+            lastRunCommands, bounds: drawingBounds, longSide: 512, scale: scale)
         pngDataCache[scale] = data
         return data
     }
@@ -209,7 +222,8 @@ final class RunnerModel {
     /// putting the picture on the file in the first place.
     func thumbnailData() -> Data? {
         guard canExport else { return nil }
-        return Self.renderPNG(lastRunCommands, longSide: 256, scale: 1, onWhite: true)
+        return Self.renderPNG(
+            lastRunCommands, bounds: drawingBounds, longSide: 256, scale: 1, onWhite: true)
     }
 
     /// Renders a command stream to PNG, cropped tight to the drawing and
@@ -228,14 +242,15 @@ final class RunnerModel {
     /// exports transparent, because an export is a picture you place somewhere
     /// yourself, and the thumbnail white, because Finder places that one.
     private static func renderPNG(
-        _ commands: [TortoiseCommand], longSide: Double, scale: CGFloat, onWhite: Bool = false
+        _ commands: [TortoiseCommand], bounds: DrawingBounds?, longSide: Double, scale: CGFloat,
+        onWhite: Bool = false
     ) -> Data? {
         let export = Tortoise()
         export.speed = 0
         export.backgroundColor = onWhite ? .white : .clear
         export.apply(commands)
         export.hideTortoise()
-        let size = exportFrameSize(for: commands, longSide: longSide)
+        let size = exportFrameSize(for: bounds, longSide: longSide)
         let renderer = ImageRenderer(
             content: TortoiseCanvas(export)
                 .frame(width: size.width, height: size.height)
@@ -255,11 +270,10 @@ final class RunnerModel {
     /// an unusable sliver; an empty drawing (no bounds) falls back to a square,
     /// mirroring SVG's own "no visible output" fallback.
     private static func exportFrameSize(
-        for commands: [TortoiseCommand], longSide long: Double
+        for bounds: DrawingBounds?, longSide long: Double
     ) -> CGSize {
         let square = CGSize(width: long, height: long)
-        guard let bounds = DrawingBounds.compute(from: CommandPlayer.play(commands: commands))
-        else { return square }
+        guard let bounds else { return square }
         // Mirrors TortoiseUI's autoFit inset — the tortoise sprite's
         // half-extent × tortoiseScaleMax — so the drawing fills the frame with
         // a uniform margin instead of a lopsided one. 20 is the *triangle's*
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/AppIcon_Back.png b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/AppIcon_Back.png
new file mode 100644
index 0000000..ad0bfec
Binary files /dev/null and b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/AppIcon_Back.png differ
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/Contents.json
new file mode 100644
index 0000000..fc68ee6
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Content.imageset/Contents.json
@@ -0,0 +1,13 @@
+{
+  "images" : [
+    {
+      "filename" : "AppIcon_Back.png",
+      "idiom" : "vision",
+      "scale" : "2x"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Contents.json
new file mode 100644
index 0000000..73c0059
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Back.solidimagestacklayer/Contents.json
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Contents.json
new file mode 100644
index 0000000..950af4d
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Contents.json
@@ -0,0 +1,17 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  },
+  "layers" : [
+    {
+      "filename" : "Front.solidimagestacklayer"
+    },
+    {
+      "filename" : "Middle.solidimagestacklayer"
+    },
+    {
+      "filename" : "Back.solidimagestacklayer"
+    }
+  ]
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/AppIcon_Front.png b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/AppIcon_Front.png
new file mode 100644
index 0000000..c70b7dc
Binary files /dev/null and b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/AppIcon_Front.png differ
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/Contents.json
new file mode 100644
index 0000000..49293b9
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Content.imageset/Contents.json
@@ -0,0 +1,13 @@
+{
+  "images" : [
+    {
+      "filename" : "AppIcon_Front.png",
+      "idiom" : "vision",
+      "scale" : "2x"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Contents.json
new file mode 100644
index 0000000..73c0059
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Front.solidimagestacklayer/Contents.json
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/AppIcon_Middle.png b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/AppIcon_Middle.png
new file mode 100644
index 0000000..b58a0fb
Binary files /dev/null and b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/AppIcon_Middle.png differ
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/Contents.json
new file mode 100644
index 0000000..a1e19d3
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Content.imageset/Contents.json
@@ -0,0 +1,13 @@
+{
+  "images" : [
+    {
+      "filename" : "AppIcon_Middle.png",
+      "idiom" : "vision",
+      "scale" : "2x"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Contents.json b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Contents.json
new file mode 100644
index 0000000..73c0059
--- /dev/null
+++ b/App/Resources/Assets.xcassets/AppIcon.solidimagestack/Middle.solidimagestacklayer/Contents.json
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/App/Resources/Tortoise.usdz b/App/Resources/Tortoise.usdz
new file mode 100644
index 0000000..e0f739b
Binary files /dev/null and b/App/Resources/Tortoise.usdz differ
diff --git a/App/TortoiseBlocksApp.swift b/App/TortoiseBlocksApp.swift
index 012d593..8872ab9 100644
--- a/App/TortoiseBlocksApp.swift
+++ b/App/TortoiseBlocksApp.swift
@@ -2,28 +2,84 @@ import SwiftUI
 
 @main
 struct TortoiseBlocksApp: App {
+    // The viewer's whole state, shared by its two scenes (#53). One `Scene`
+    // cannot see another's, and the window and the table are exactly that
+    // split: controls here, drawing there.
+    #if os(visionOS)
+        @State private var viewer = ViewerModel()
+    #endif
+
     var body: some Scene {
-        DocumentGroup(newDocument: BlocksDocument()) { file in
-            ContentView(document: file.$document)
-        }
-        .commands {
-            TortoiseBlocksCommands()
-        }
-        // A default worth having anyway — three panes need room, and macOS
-        // otherwise opens something narrower than the palette, workspace and
-        // canvas want. It is also exactly the App Store's macOS screenshot
-        // size: a Retina backing scale of 2 makes 1280×800pt capture as
-        // 2560×1600px, so a window at its default size needs no cropping or
-        // resampling. Only a default — macOS restores a window's saved frame
-        // in preference to it, so a capture wants that state cleared first.
-        .defaultWindowSize()
+        // **visionOS is a viewer, not the editor** (#53), so its scene tree is
+        // a different tree rather than the same one with adjustments.
+        //
+        // No `DocumentGroup`: a `.fileImporter` in a plain window opens a
+        // drawing in one press, which is exactly what #52 could never make a
+        // DocumentGroup do there — `dismiss()` only reveals the system's own
+        // 「書類」 button, and `openDocument` / `newDocument` are unavailable on
+        // the platform. Dropping the apparatus drops the editing UI with it,
+        // and that is what makes a visionOS build worth having at all instead
+        // of an iPad app in a window.
+        #if os(visionOS)
+            WindowGroup {
+                ViewerWindow(model: viewer)
+            }
+            // The window is its contents, not a canvas they sit in — so no
+            // `defaultSize`, which left a band of empty glass under the
+            // controls on device. It shrinks to the "no drawing" state and
+            // grows when a drawing brings the transport with it.
+            .windowResizability(.contentSize)
+
+            // The program, on a surface of its own (#53). A separate window
+            // rather than a pane, because that is the version of this idea the
+            // iPad cannot give: the blocks and the drawing at full size at the
+            // same time, with nothing to switch between.
+            WindowGroup(id: ViewerModel.programWindowID) {
+                ProgramWindow(model: viewer)
+            }
+            .defaultSize(width: 480, height: 700)
+
+            // And the code on a third (#53 Phase 3). Same reasoning one step
+            // further: iPad and Mac make the canvas and the code two states of
+            // one toggle because a window holds one of them, and a headset
+            // never has to choose.
+            WindowGroup(id: ViewerModel.codeWindowID) {
+                CodeWindow(model: viewer)
+            }
+            // Wider than the program's 480: source lines are longer than block
+            // rows, and the pane scrolls horizontally rather than wrapping.
+            .defaultSize(width: 620, height: 700)
+
+            ImmersiveSpace(id: ViewerModel.spaceID) {
+                TableCanvasSpace(model: viewer)
+            }
+            .immersionStyle(selection: .constant(.mixed), in: .mixed)
+        #else
+            DocumentGroup(newDocument: BlocksDocument()) { file in
+                ContentView(document: file.$document)
+            }
+            .commands {
+                TortoiseBlocksCommands()
+            }
+            // A default worth having anyway — three panes need room, and macOS
+            // otherwise opens something narrower than the palette, workspace
+            // and canvas want. It is also exactly the App Store's macOS
+            // screenshot size: a Retina backing scale of 2 makes 1280×800pt
+            // capture as 2560×1600px, so a window at its default size needs no
+            // cropping or resampling. Only a default — macOS restores a
+            // window's saved frame in preference to it, so a capture wants that
+            // state cleared first.
+            .defaultWindowSize()
 
-        // The custom launch screen (#32). `DocumentGroupLaunchScene` is
-        // unavailable on macOS and SwiftUI has no empty `Scene` to return in
-        // its place, so this `#if` can't hide inside a modifier the way the
-        // ones in `PlatformModifiers` do.
-        #if os(iOS)
-            LaunchScene()
+            // The custom launch screen (#32) — iPadOS only. It is
+            // `DocumentGroupLaunchScene`, so it has nothing to attach to on the
+            // platform with no DocumentGroup, and nothing to do on macOS, which
+            // keeps the standard open panel. (It never appeared on visionOS
+            // even while that platform had a DocumentGroup: the system document
+            // browser is shown straight away there.)
+            #if os(iOS)
+                LaunchScene()
+            #endif
         #endif
     }
 }
diff --git a/App/Views/CLAUDE.md b/App/Views/CLAUDE.md
index a24ea7c..ce0e14f 100644
--- a/App/Views/CLAUDE.md
+++ b/App/Views/CLAUDE.md
@@ -66,6 +66,60 @@ with `.toolbar(removing: .title)` (#31). The back chevron beside it is not
 ours to remove — neither dropping that column's toolbar nor
 `navigationBarBackButtonHidden` touches it.
 
+**visionOS needs three things the other two get for free** (#11), and all three
+are `#if os(visionOS)` rather than shared, because on iPadOS and macOS each
+would be a second copy of something that already exists.
+
+*A way back to the browser.* iPadOS puts a chevron beside the document title
+and macOS has File ▸ Open with a window per document; visionOS has neither, so
+the window carries the drawing it was opened with and the only route to another
+was to close it and launch again. `documentBrowserToolbar()` puts a folder
+button in the sidebar's bar, and `dismiss` — what a `DocumentGroup` document
+closes itself with — is what it calls. **Where `dismiss` is read from decides
+whether it does anything.** Read inside the toolbar item's own view, which is
+the obvious place, it resolves against the toolbar's context and the button is
+inert: it highlights on press and nothing happens. It has to come from the
+environment of the *content* the toolbar is attached to, which is why this is a
+`ViewModifier` and not a view inside the `toolbar` block. Nothing warns you —
+the code compiles and the button draws.
+
+*The name is deliberately in one place.* The sidebar carries the
+DocumentGroup's own title with its rename chevron, and `CanvasPane` still drops
+its copy with `.toolbar(removing: .title)` (#31). A second, self-drawn label in
+the canvas pane was tried — `\.documentConfiguration`'s `fileURL`, which unlike
+the system chrome is right from the first frame — and taken back out: on a
+window this wide the two read as one name printed twice rather than as a title
+and a reminder.
+
+*A hover effect, but never on a drag source.* visionOS does not give a button
+with a custom `ButtonStyle` the system hover treatment, so without
+`pointerHover()` a palette block is the one thing on screen that never lights
+up when looked at — and gaze feedback is the whole targeting affordance there.
+The catch is that a hover effect and `draggable` **on the same view** segfault
+(a `swift_release` inside SwiftUI's update of that view's body, before a window
+appears). The palette entry is a drag source, so its hover lives inside
+`PaletteBlockButtonStyle` — one level below the `Button` that carries
+`draggable` — while every other call site applies it directly. The crash blames
+the body, not the modifier, which is why this first read as "`hoverEffect`
+crashes on visionOS": it does not, the pairing does.
+
+**The code pane is paper, not a semantic surface** (#11). It sat on
+`.background.secondary`, which resolves to near-white or near-black on iPad and
+Mac but to light translucent glass on visionOS — and the syntax colors had
+nowhere to stand: system `.purple` and `.blue` are tuned for an opaque backdrop
+and `.plain` was `Color.primary`, which is *white* there, so the plain text and
+its ground were both light. It is now white, opaque, the same in both
+appearances, rounded the same 8 as the canvas — the two swap places inside one
+`ZStack`, so pressing the toggle should change the content and nothing else.
+The token colors are fixed values measured against white (8.6:1, 8.4:1, 5.1:1,
+16.9:1) for the reason the block fills are fixed (#41). Two traps came with it.
+The copy button stays *outside* the paper: on it, it needed the ink as a tint
+to be legible, and on visionOS the tint went to the button's capsule instead of
+its label, leaving a black lozenge with invisible text. And a program narrower
+than the pane sat in the middle of it — in a scroll view that scrolls both ways
+the content is offered no width to fill, so a `.leading` frame does nothing and
+`defaultScrollAnchor(.topLeading)` is what places it.
+
 **A block row is one VoiceOver element, a container header is not** (#1).
 Swiping a program should say "まえへ、かず 100、じっこうちゅう" once per block,
 not stop three times, so a simple row is `.accessibilityElement(children:
@@ -123,10 +177,24 @@ damage rather than fixing it: with the label served first, `0.6` in the next row
 broke as "0." over "6", which is worse — a chip holds a number, a name or a
 colour, all atomic. So `WorkspaceChipButtonStyle` pins its label with
 `.fixedSize(horizontal: true, vertical: false)`. Priority rather than
-`fixedSize` on the *label*, deliberately: a row two levels deep with a long name
-(「はこにかける」) genuinely runs out of room, and there the label should still
-wrap instead of overflowing its block. Each level of nesting costs 18pt, so no
-column width wins that race — the wrap is accepted there.
+`fixedSize` on the *label*, deliberately: a row deep enough with a long name
+genuinely runs out of room, and there the label should still wrap instead of
+overflowing its block. Each level of nesting costs 18pt, so no column width wins
+that race for ever — the wrap is the correct last resort, not the working state.
+
+**And `ideal` is not a starting point on every platform.** macOS and iPadOS 26
+both let the split view's divider be dragged, so there the ideal is only where
+the workspace column *opens*. **visionOS has no draggable divider**, so there
+the ideal is the width, for good, and the *detail* column absorbs every extra
+point the window has. On a 1280pt visionOS window that used to read 360 here
+and ~690 on the canvas (#11) — with 「くりかえす 10 かい」 wrapping か/い at the
+**top** level, no nesting involved, and 「はこにかける」 splitting in the middle
+three levels down. The ideal is now 440, measured against exactly that program:
+every row fits on one line at three levels, and the canvas still clears its own
+420 ideal. `max` (560) has to stay above `ideal`, or the two platforms that can
+drag could only ever drag narrower. Judge a change to it on a *nested Japanese*
+program — English fits where 「はこにかける」 does not, and the top-level wrap is
+invisible in a flat one.
 
 **Drop model**: a `DropGap` between rows carries `(BodyAddress, index)`, so
 insertion semantics need no y-coordinate math and every mouth — an if's else
diff --git a/App/Views/CodePane.swift b/App/Views/CodePane.swift
index 71c642d..931627c 100644
--- a/App/Views/CodePane.swift
+++ b/App/Views/CodePane.swift
@@ -24,6 +24,27 @@ struct CodePane: View {
                 .labelStyle(.titleAndIcon)
             }
             .padding(8)
+            // The code is on paper, the same paper the canvas is on (#11). It
+            // used to sit on `.background.secondary`, which is a *semantic*
+            // surface: near-white or near-black on iPad and Mac, and on
+            // visionOS light translucent glass over a room. The syntax colors
+            // then had nowhere to stand — system `.purple` and `.blue` are
+            // tuned for an opaque backdrop, and `.plain` was `Color.primary`,
+            // which is *white* there, so the plain text and the ground behind
+            // it were both light. Opaque, named, and the same in both
+            // appearances, for the reason the block fills are (#41): this is
+            // the app's surface, not a response to its surroundings.
+            //
+            // White rather than an editor's dark theme because the code pane
+            // and the canvas swap places inside one `ZStack` — the same sheet,
+            // rounded the same 8, means pressing the toggle changes only the
+            // *content*.
+            //
+            // The paper wraps the code and nothing else. The copy button stays
+            // outside it, on the pane's own ground with the window's other
+            // controls: inside, it needed the ink as a tint to be legible, and
+            // on visionOS the tint went to the *capsule* instead of the label,
+            // leaving a black lozenge with invisible text on it.
             ScrollView([.vertical, .horizontal]) {
                 Text(highlightedCode)
                     .font(.system(.callout, design: .monospaced))
@@ -31,12 +52,40 @@ struct CodePane: View {
                     .padding()
                     .frame(maxWidth: .infinity, alignment: .leading)
             }
+            // A program narrower than the pane sat in the *middle* of it, which
+            // is not where source starts. The `.leading` frame above cannot fix
+            // that on its own: in a scroll view that scrolls both ways the
+            // content is offered no width to fill, so it takes its own and the
+            // scroll view centres what is left over. The anchor is what places
+            // undersized content, on both axes at once.
+            .defaultScrollAnchor(.topLeading)
+            .background(Color.white, in: Self.sheet)
+            .clipShape(Self.sheet)
         }
-        .background(.background.secondary)
     }
 
-    /// Colors each `CodeTokenizer` span with a semantic color, so both
-    /// light and dark mode stay legible.
+    /// The canvas's shape, so the two panes are the same sheet — see
+    /// `CanvasPane.sheet`, which this deliberately matches.
+    private static let sheet = RoundedRectangle(cornerRadius: 8)
+
+    /// Colors each `CodeTokenizer` span with a fixed color.
+    ///
+    /// Fixed, not semantic: the pane is white in both appearances, so a color
+    /// that inverts with the appearance would be picking its contrast against
+    /// a background it no longer has. These are measured against white —
+    /// 8.6:1, 8.4:1, 5.1:1 and 16.9:1 — so every kind clears AA at the callout
+    /// size, and the three accents stay far enough apart in hue to be told
+    /// apart at a glance.
+    private func color(for kind: CodeTokenKind) -> Color {
+        switch kind {
+        case .keyword: Color(.sRGB, red: 0.604, green: 0.129, blue: 0.588)  // #9A2196
+        case .number: Color(.sRGB, red: 0.106, green: 0.220, blue: 0.784)  // #1B38C8
+        case .methodOrProperty: Color(.sRGB, red: 0.031, green: 0.396, blue: 0.435)  // #08656F
+        case .plain: BlockCategory.ink
+        }
+    }
+
+    /// Colors each `CodeTokenizer` span, so the pane reads as source.
     private var highlightedCode: AttributedString {
         var result = AttributedString()
         for token in CodeTokenizer.tokenize(code) {
@@ -46,15 +95,6 @@ struct CodePane: View {
         }
         return result
     }
-
-    private func color(for kind: CodeTokenKind) -> Color {
-        switch kind {
-        case .keyword: .purple
-        case .number: .blue
-        case .methodOrProperty: .teal
-        case .plain: .primary
-        }
-    }
 }
 
 /// Shared with the Run menu's "Copy Code" command (#23), so both paths to
diff --git a/App/Views/CodeWindow.swift b/App/Views/CodeWindow.swift
new file mode 100644
index 0000000..fb008ee
--- /dev/null
+++ b/App/Views/CodeWindow.swift
@@ -0,0 +1,51 @@
+#if os(visionOS)
+
+    import SwiftUI
+
+    /// The generated Swift, on a surface of its own (#53 Phase 3).
+    ///
+    /// The third surface, and the one that makes the platform's whole argument
+    /// concrete: the drawing on the table, the blocks that make it, and the
+    /// code they stand for, **all three at once**. On iPad and Mac the canvas
+    /// and the code are the two states of one toggle, because a window has
+    /// room for one of them; a headset has as many surfaces as you like, so the
+    /// choice never has to be made. That is the same reason the program got a
+    /// window rather than a pane.
+    ///
+    /// It is `CodePane`, unchanged — the app's own paper, the same
+    /// `CodeTokenizer` colouring, the same copy button. The pane was already
+    /// made to work here: #11 took it off `.background.secondary`, which
+    /// resolves to translucent glass on this platform and left the syntax
+    /// colours with nothing to stand on.
+    struct CodeWindow: View {
+        let model: ViewerModel
+
+        var body: some View {
+            // A `Group`, so the lifecycle below reports the *window* rather
+            // than its content: the `if` swaps what is inside when a drawing
+            // loads, and the same modifiers on either branch would fire then
+            // too. SwiftUI offers nothing to read window state from, so the
+            // window telling the model is what lets the viewer's toggle show
+            // it as open and close it again.
+            Group {
+                // An `if`, where `ProgramWindow` puts the empty state in an
+                // `.overlay`. Deliberate, and the difference is what is behind
+                // it: an empty block list is nothing, while an empty code pane
+                // is a sheet of white paper carrying a "Copy Code" button that
+                // would copy an empty string.
+                if model.hasProgram {
+                    CodePane(code: model.code)
+                        .padding()
+                }
+                else {
+                    ContentUnavailableView(
+                        "No Drawing", systemImage: "curlybraces",
+                        description: Text("Open a drawing, or start from a sample."))
+                }
+            }
+            .onAppear { model.isCodeWindowOpen = true }
+            .onDisappear { model.isCodeWindowOpen = false }
+        }
+    }
+
+#endif
diff --git a/App/Views/ContentView.swift b/App/Views/ContentView.swift
index 1fcfc8b..f9645ce 100644
--- a/App/Views/ContentView.swift
+++ b/App/Views/ContentView.swift
@@ -27,12 +27,13 @@ struct ContentView: View {
     }
 }
 
-/// The one layout, on both platforms (#29). The app is iPad and Mac only, and
-/// compact width — an iPhone, or an iPad window squeezed into Slide Over — is
-/// no longer a design target: three panes' worth of information (palette,
-/// program, canvas) folded into one 390pt column never came out usable. A
-/// window narrow enough to go compact gets `NavigationSplitView`'s own
-/// collapse, not a layout of ours.
+/// The one layout, on every platform (#29) — iPad, Mac, and the visionOS
+/// window, which is a regular-width scene and needs nothing of its own (#11).
+/// Compact width — an iPhone, or an iPad window squeezed into Slide Over — is
+/// not a design target: three panes' worth of information (palette, program,
+/// canvas) folded into one 390pt column never came out usable. A window narrow
+/// enough to go compact gets `NavigationSplitView`'s own collapse, not a layout
+/// of ours.
 struct RootView: View {
     let workspace: WorkspaceEditor
     let runner: RunnerModel
@@ -56,8 +57,21 @@ struct RootView: View {
             PaletteView(workspace: workspace)
                 .navigationSplitViewColumnWidth(paletteWidth)
         } content: {
+            // 440pt is measured, not chosen, and `ideal` carries more weight
+            // than it looks. macOS and iPadOS both let the divider be dragged,
+            // so there the ideal is only where the column *opens*; on visionOS
+            // it can't be, so the ideal is the width, permanently, while the
+            // detail column absorbs every extra point — a 1280pt visionOS
+            // window put 360 here and ~690 on the canvas (#11).
+            // At 360 a three-deep program broke its labels onto two lines, and
+            // not only at depth: 「くりかえす 10 かい」 wrapped か/い at the top
+            // level, and 「はこにかける」 split in the middle. 440 fits every one
+            // of them on one line at three levels of nesting (each level costs
+            // 18pt), and still leaves the canvas ~600pt — well over its own 420
+            // ideal. `max` has to stay above `ideal`, or the two platforms that
+            // can drag could only ever drag narrower.
             WorkspaceView(workspace: workspace, runner: runner)
-                .navigationSplitViewColumnWidth(min: 300, ideal: 360, max: 440)
+                .navigationSplitViewColumnWidth(min: 300, ideal: 440, max: 560)
         } detail: {
             // 280pt keeps the canvas usable (#23) — narrower and its own
             // playback row starts contesting space with the drawing.
@@ -135,7 +149,7 @@ struct CanvasPane: View {
             }
             Divider()
             PlaybackControls(
-                workspace: workspace, runner: runner,
+                blocks: workspace.blocks, runner: runner,
                 isStale: runner.isStale(comparedTo: workspace.blocks)
             )
             .padding()
@@ -150,18 +164,8 @@ struct CanvasPane: View {
         // toolbar nor `navigationBarBackButtonHidden` touches it.
         .toolbar(removing: .title)
         .toolbar {
-            ToolbarSpacer(.flexible, placement: .primaryAction)
-
-            ToolbarItemGroup(placement: .primaryAction) {
-                CanvasViewToggle(showsCode: $showsCode)
-            }
-
-            ToolbarSpacer(.fixed, placement: .primaryAction)
-
-            ToolbarItemGroup(placement: .primaryAction) {
-                CanvasRollAgainButton(workspace: workspace, runner: runner)
-                CanvasExportMenu(runner: runner, onExport: export)
-            }
+            CanvasToolbar(
+                workspace: workspace, runner: runner, showsCode: $showsCode, onExport: export)
         }
         // One alert, switching on why the run failed (`expansionAlert`):
         // attaching a second one for the recursion case would silently drop
@@ -197,6 +201,39 @@ struct CanvasPane: View {
     }
 }
 
+/// `CanvasPane`'s toolbar: the canvas/code toggle, then ⟳ and the export menu.
+///
+/// It is a `ToolbarContent` type of its own only so the `#if` below has
+/// somewhere to live that isn't the call site — `ToolbarSpacer` is the Liquid
+/// Glass grouping separator and is unavailable on visionOS, which lays its
+/// toolbar out as an ornament and spaces the groups itself. The items and
+/// their order are the same everywhere; only the separators come and go.
+struct CanvasToolbar: ToolbarContent {
+    let workspace: WorkspaceEditor
+    let runner: RunnerModel
+    @Binding var showsCode: Bool
+    let onExport: (Data?, UTType) -> Void
+
+    var body: some ToolbarContent {
+        #if !os(visionOS)
+            ToolbarSpacer(.flexible, placement: .primaryAction)
+        #endif
+
+        ToolbarItemGroup(placement: .primaryAction) {
+            CanvasViewToggle(showsCode: $showsCode)
+        }
+
+        #if !os(visionOS)
+            ToolbarSpacer(.fixed, placement: .primaryAction)
+        #endif
+
+        ToolbarItemGroup(placement: .primaryAction) {
+            CanvasRollAgainButton(workspace: workspace, runner: runner)
+            CanvasExportMenu(runner: runner, onExport: onExport)
+        }
+    }
+}
+
 /// The canvas/code segmented toggle, in `CanvasPane`'s toolbar (#23).
 struct CanvasViewToggle: View {
     @Binding var showsCode: Bool
diff --git a/App/Views/LaunchScene.swift b/App/Views/LaunchScene.swift
index 6031154..8ab33ad 100644
--- a/App/Views/LaunchScene.swift
+++ b/App/Views/LaunchScene.swift
@@ -2,10 +2,13 @@
 
     import SwiftUI
 
-    /// The screen in front of the system document browser (#32).
+    /// The screen in front of the system document browser (#32) — iPadOS only.
     ///
     /// `DocumentGroupLaunchScene` is `@available(macOS, unavailable)`, so this
-    /// whole file is iOS-only and the Mac keeps the standard open panel.
+    /// once covered visionOS too. It never actually appeared there — visionOS
+    /// shows the system document browser straight away — and #53 took the
+    /// DocumentGroup off that platform entirely, leaving this nothing to sit in
+    /// front of. The Mac keeps the standard open panel.
     struct LaunchScene: Scene {
         var body: some Scene {
             DocumentGroupLaunchScene(
diff --git a/App/Views/PaletteView.swift b/App/Views/PaletteView.swift
index 1ac7cca..446b359 100644
--- a/App/Views/PaletteView.swift
+++ b/App/Views/PaletteView.swift
@@ -227,6 +227,11 @@ private struct PaletteBlockButtonStyle: ButtonStyle {
             .frame(maxWidth: .infinity, alignment: .leading)
             .background(color, in: RoundedRectangle(cornerRadius: 8))
             .opacity(configuration.isPressed ? 0.7 : 1)
+            // Here rather than on the `Button`, because the button is a drag
+            // source and the pair crashes visionOS — see `pointerHover`. It
+            // also reads better: the highlight follows the shape the style
+            // draws instead of the label's own bounds.
+            .pointerHover()
     }
 }
 
@@ -252,7 +257,9 @@ struct PaletteEntryButton: View {
         // color — white — which is the one thing a pastel fill can't carry. A
         // palette entry and the row it becomes should look alike anyway.
         .buttonStyle(PaletteBlockButtonStyle(color: category.color))
-        .pointerHover()
+        // The hover is inside that style, not here. On visionOS a hover effect
+        // and `draggable` on the same view segfault — see `pointerHover`.
+        //
         // Evaluated per drag, so every drag stamps a fresh Block (new ID).
         .draggable(Block(kind: entry.kind))
         .accessibilityHint("Tap to add to the end of the program. Drag to place anywhere.")
diff --git a/App/Views/PlatformModifiers.swift b/App/Views/PlatformModifiers.swift
index 7bd8fe1..f7a553b 100644
--- a/App/Views/PlatformModifiers.swift
+++ b/App/Views/PlatformModifiers.swift
@@ -2,30 +2,57 @@ import SwiftUI
 
 // Small cross-cutting modifiers that hide their `#if os(...)` inside a
 // modifier (the SwiftUI-way rule), so call sites stay platform-agnostic.
+//
+// They are written `#if !os(macOS)` rather than naming iOS wherever the
+// behaviour is simply "the touch platforms": these are UIKit-backed and exist
+// on visionOS as well as iPadOS (#11), and spelling the condition as "not the
+// Mac" is what keeps a new platform from silently taking the no-op branch the
+// way visionOS did — an `#if os(iOS)` compiles clean everywhere and just stops
+// applying. `pointerHover` is the exception, and says why.
 extension View {
-    /// The number pad for numeric entry on iOS (#24); a no-op elsewhere.
-    /// `.decimalPad` gives the digits and decimal point kids need; the
-    /// number blocks don't take negative literals, so its lack of a minus
-    /// key is intentional.
+    /// The number pad for numeric entry (#24); a no-op on macOS, which has a
+    /// hardware keyboard. `.decimalPad` gives the digits and decimal point kids
+    /// need; the number blocks don't take negative literals, so its lack of a
+    /// minus key is intentional.
     func numericKeyboard() -> some View {
-        #if os(iOS)
+        #if !os(macOS)
             keyboardType(.decimalPad)
         #else
             self
         #endif
     }
 
-    /// The iPad (pointer) hover highlight (#24); a no-op on macOS, which has
-    /// its own cursor affordances.
+    /// The hover highlight (#24): the iPad's pointer, and on visionOS the gaze,
+    /// which is the only thing there that says what you are about to press.
+    /// A no-op on macOS, which has its own cursor affordances.
+    ///
+    /// **Never put this on a view that is also `draggable`.** That combination
+    /// segfaults on visionOS — a `swift_release` inside SwiftUI's own update of
+    /// the view's body, before a window is ever shown, with `.automatic` as
+    /// well as `.highlight`. It cost a while to place, because the crash blames
+    /// the body rather than the modifier and the effect looked like the
+    /// culprit; the effect is fine and the *pairing* is not. So a palette
+    /// entry, which is a drag source, wears its hover inside
+    /// `PaletteBlockButtonStyle` — on the shaped body the style draws, one
+    /// level below the `Button` that `draggable` is attached to — and that is
+    /// why the palette applies this in its style while everything else applies
+    /// it at the call site.
+    ///
+    /// visionOS needs it stated at all because it does *not* give a button with
+    /// a custom `ButtonStyle` the system hover treatment; without this, a
+    /// palette block is the one thing on screen that never lights up when
+    /// looked at.
     func pointerHover() -> some View {
-        #if os(iOS)
+        #if !os(macOS)
             hoverEffect(.highlight)
         #else
             self
         #endif
     }
 
-    /// Holds an icon-only control to the 44pt finger minimum on iPadOS.
+    /// Holds an icon-only control to the 44pt finger minimum on iPadOS (and to
+    /// the same floor on visionOS, where the target is a gaze rather than a
+    /// finger — 44 is the iPad number, not a measured visionOS one).
     /// A borderless SF Symbol button is only as tappable as the glyph is big —
     /// around 24pt at body size — so the ⋯ on a block row is a small target on
     /// a touch screen even though the row around it is not.
@@ -44,7 +71,7 @@ extension View {
     /// this is used sits after a `Spacer`, so the extra width takes slack
     /// instead of pushing the label.
     func touchTarget() -> some View {
-        #if os(iOS)
+        #if !os(macOS)
             frame(minWidth: 44, minHeight: 44).contentShape(.rect)
         #else
             self
diff --git a/App/Views/PlaybackControls.swift b/App/Views/PlaybackControls.swift
index 3f6af80..d06791c 100644
--- a/App/Views/PlaybackControls.swift
+++ b/App/Views/PlaybackControls.swift
@@ -11,7 +11,10 @@ import TortoiseUI
 /// "roll the dice again" lives on the canvas itself (`CanvasRollAgainButton`)
 /// because it re-runs the program rather than moving the playhead.
 struct PlaybackControls: View {
-    let workspace: WorkspaceEditor
+    /// The program the run button runs. Deliberately the blocks and not the
+    /// `WorkspaceEditor` they came from: the transport never edited anything,
+    /// and the visionOS viewer (#53) has a program with no editor behind it.
+    let blocks: [Block]
     @Bindable var runner: RunnerModel
     /// Whether the workspace has been edited since the run on screen.
     /// Hoisted to the pane rather than computed here: deciding it hashes the
@@ -85,7 +88,7 @@ struct PlaybackControls: View {
 
     private func perform() {
         switch action {
-        case .run: runner.run(workspace.blocks)
+        case .run: runner.run(blocks)
         case .pause: runner.player.isPaused = true
         case .play, .resume: runner.player.isPaused = false
         case .replay: runner.replay()
diff --git a/App/Views/ProgramWindow.swift b/App/Views/ProgramWindow.swift
new file mode 100644
index 0000000..9c63d0d
--- /dev/null
+++ b/App/Views/ProgramWindow.swift
@@ -0,0 +1,109 @@
+#if os(visionOS)
+
+    import SwiftUI
+    import TortoiseBlocksKit
+
+    /// The program, read-only, following the playback on the table (#53).
+    ///
+    /// This is the window that makes the visionOS build *this app* rather than
+    /// a way to watch a drawing appear. Seeing which block is running while the
+    /// tortoise moves is the whole pedagogy, and on a headset it gets the
+    /// version the iPad cannot give it: the program on one surface and the
+    /// drawing on your actual table, both full size, with nothing to switch
+    /// between.
+    ///
+    /// **The rows are the editor's own rows.** Not a read-only lookalike — the
+    /// same `BlockListView`, and so the same category colours, the same C-shaped
+    /// containers, the same row heights and label alignment. A second renderer
+    /// would have to be kept in step by hand, and the failure mode is silent:
+    /// `SimpleBlockLabel` is on the "when adding a block kind" checklist
+    /// precisely because a kind that is missed there renders as nothing.
+    struct ProgramWindow: View {
+        let model: ViewerModel
+
+        var body: some View {
+            ScrollView {
+                // The list has to follow the playhead, or the feature only
+                // works for programs short enough to fit: on device the
+                // highlight was correct and *off screen* for everything past
+                // the first few rows.
+                //
+                // `scrollTo` with **no anchor** is the whole trick. Centring
+                // the running block would drag the list on nearly every
+                // command — a loop body cycling three rows would never sit
+                // still — while the default anchor scrolls the least amount
+                // that brings the row into view, and does nothing at all while
+                // it is already there. Unanimated for the same reason: at ten
+                // commands a second an animation only ever restarts itself.
+                ScrollViewReader { proxy in
+                    programList
+                        .onChange(of: model.runner.currentBlockID) { _, id in
+                            guard let id else { return }
+                            proxy.scrollTo(id)
+                        }
+                }
+            }
+            // The editing controls are not drawn at all. Inert-but-visible was
+            // tried first and reads worse than either alternative: the ⋯ menu
+            // and the mouths' "add here" toggle look pressable, do nothing, and
+            // are the two things #53 says a read-only program must not offer.
+            .environment(\.showsBlockEditing, false)
+            // Reported so the viewer's toggle can show this window as open and
+            // close it again — SwiftUI offers nothing to read window state
+            // from, so the window is the only thing that knows.
+            .onAppear { model.isProgramWindowOpen = true }
+            .onDisappear { model.isProgramWindowOpen = false }
+            .overlay {
+                if !model.hasProgram {
+                    ContentUnavailableView(
+                        "No Drawing", systemImage: "square.stack.3d.up",
+                        description: Text("Open a drawing, or start from a sample."))
+                }
+            }
+        }
+
+        private var programList: some View {
+            BlockListView(
+                blocks: model.blocks,
+                address: .topLevel,
+                workspace: Self.readOnly(model.blocks),
+                // The highlight this window exists for. It costs nothing
+                // extra: `RunnerModel.currentBlockID` is
+                // `expandedBlockIDs[player.currentCommandIndex]`, and the
+                // table draws through the very same `CommandPlayer`, so the
+                // index alignment the whole app rests on is untouched by
+                // the drawing having moved into an immersive space.
+                highlightedID: model.runner.currentBlockID,
+                usedVariableNames: BlockTree.usedVariableNames(in: model.blocks),
+                usedFunctionNames: BlockTree.usedFunctionNames(in: model.blocks)
+            )
+            .padding()
+            // Read-only twice over, and the belt matters more than the braces.
+            //
+            // The *binding* is what enforces it: `WorkspaceEditor` writes
+            // through `document`, and a constant binding throws those writes
+            // away — so even a path that tried to edit could not, and no list
+            // of hidden affordances has to stay complete for that to hold.
+            // Hit-testing off then removes the drag sources, the drop gaps and
+            // the value chips from a window where none of them mean anything.
+            //
+            // On the **content**, not on the `ScrollView`. Around the scroll
+            // view it takes the scrolling with it, and the window becomes one
+            // that can only ever show the rows it happens to open on — which is
+            // most of the program for anything but a short one.
+            .allowsHitTesting(false)
+        }
+
+        /// An editor that cannot edit: no undo manager to register with, fresh
+        /// UI state nothing reads, and a constant document binding that
+        /// discards every write.
+        private static func readOnly(_ blocks: [Block]) -> WorkspaceEditor {
+            WorkspaceEditor(
+                document: .constant(
+                    BlocksDocument(project: BlocksProject(title: "", blocks: blocks))),
+                undoManager: nil,
+                uiState: WorkspaceUIState())
+        }
+    }
+
+#endif
diff --git a/App/Views/TableCanvas.swift b/App/Views/TableCanvas.swift
new file mode 100644
index 0000000..0165243
--- /dev/null
+++ b/App/Views/TableCanvas.swift
@@ -0,0 +1,846 @@
+#if os(visionOS)
+
+    import ARKit
+    import QuartzCore
+    import RealityKit
+    import Spatial
+    import SwiftUI
+    import TortoiseBlocksKit
+    import TortoiseUI
+
+    // The visionOS viewer's drawing surface (#53): a sheet of paper lying on a
+    // real table, with the tortoise walking across it.
+    //
+    // **No texture pipeline, and no stroke geometry.** #53 framed the renderer
+    // as a choice between the two; `ViewAttachmentComponent` (visionOS 26) is a
+    // third answer that costs neither. It puts a live SwiftUI view into the
+    // RealityKit scene, so what lies on the table is the *same*
+    // `TortoiseCanvas` the iPad and Mac panes draw, driven by the same
+    // `CommandPlayer`. Nothing about the command stream changes, which is what
+    // keeps the executing-block alignment (`RunnerModel.currentBlockID`)
+    // available for free when the read-only program window arrives.
+
+    /// Everything the viewer holds: the program on screen, the runner playing
+    /// it, and where the sheet sits in the room.
+    ///
+    /// One object across two scenes — the window owns the controls, the
+    /// immersive space owns the drawing, and a `Scene` cannot see another
+    /// scene's state.
+    @Observable
+    @MainActor
+    final class ViewerModel {
+        static let spaceID = "table"
+        static let programWindowID = "program"
+        static let codeWindowID = "code"
+
+        // MARK: What is loaded
+
+        /// The name shown in the window. A document's file name, a sample's
+        /// title, or empty when nothing has been opened yet.
+        private(set) var title = ""
+        private(set) var blocks: [Block] = []
+        let runner = RunnerModel()
+
+        /// The generated Swift, for the code window (#53 Phase 3).
+        ///
+        /// Built here, once per load, rather than in the window's `body` the
+        /// way `CanvasPane` does it. The iPad's code pane is only in the
+        /// hierarchy while the toggle says so, so generating there costs
+        /// nothing when it is hidden; a window is its own scene and redraws on
+        /// its own schedule, and the program behind it cannot change while it
+        /// is open — nothing here can edit.
+        private(set) var code = ""
+
+        /// Set when opening a file fails, and shown as an alert. Kept as the
+        /// message rather than the error so the version gate's wording
+        /// (`DocumentError.newerSchema`) survives to the alert unchanged.
+        var openFailure: String?
+
+        var hasProgram: Bool { !blocks.isEmpty }
+
+        /// Bumped by every load, so the window can put the new drawing down
+        /// without each of the five call sites — the file importer and the
+        /// four samples — having to remember to.
+        ///
+        /// A counter rather than a flag, for the same reason
+        /// `RunnerModel.runGeneration` is one: `blocks` alone cannot say
+        /// "loaded again" when the same drawing is chosen twice, and it is the
+        /// *choosing* that means "show me this".
+        private(set) var loadGeneration = 0
+
+        func load(_ blocks: [Block], title: String) {
+            self.blocks = blocks
+            self.title = title
+            code = SwiftCodeGenerator.code(for: blocks)
+            runner.run(blocks, startPaused: true)
+            loadGeneration += 1
+        }
+
+        /// Opens a `.tortoise` from the file importer. The URL comes from
+        /// outside the sandbox, so it has to be asked for before it can be
+        /// read — and given back whether or not the read worked.
+        func open(_ url: URL) {
+            let scoped = url.startAccessingSecurityScopedResource()
+            defer { if scoped { url.stopAccessingSecurityScopedResource() } }
+            do {
+                let project = try BlocksDocument.project(from: Data(contentsOf: url))
+                load(project.blocks, title: url.deletingPathExtension().lastPathComponent)
+            }
+            catch {
+                openFailure = error.localizedDescription
+            }
+        }
+
+        // MARK: Where the sheet sits
+
+        /// Committed size of the sheet's side, in metres. Bounded because an
+        /// unbounded pinch reaches a 50m canvas in about a second; 2m at the
+        /// top because a drawing that fills a whole table is a thing people
+        /// want, and it stays legible there.
+        var side: Double = 0.6
+        static let sideRange: ClosedRange<Double> = 0.2...2.0
+
+        /// The size the one render is built at — **the resolution knob**.
+        ///
+        /// A pinch scales the *entity* rather than rebuilding the attachment,
+        /// because rebuilding mid-drag re-runs the anchor search and makes the
+        /// drawing jump. So the sheet carries one render of a fixed point size
+        /// and stretches it, and this is that size.
+        ///
+        /// visionOS lays out at **1m = 1360pt**, so 1.0 here is a 1360pt²
+        /// render. What that buys depends on how big the sheet is shown: about
+        /// 2270pt per displayed metre at the 60cm default, 680 at the 2m top of
+        /// the range — a 3.3× spread, which is where the slight softness at the
+        /// large end comes from. Raising this is the fix and it costs the
+        /// square: 2.0 would be 2720pt², four times the pixels, heading toward
+        /// texture-size limits at 2× backing.
+        ///
+        /// Do **not** conclude from the one measurement so far that this has no
+        /// effect. It was tried at 1.2 against 1.0 and looked identical on
+        /// device — but that is a 20% change in linear resolution, which is
+        /// about what "identical" should look like. A real test is a 2× swing,
+        /// judged at *one* displayed size.
+        static let builtSide: Double = 1.0
+
+        /// Committed rotation about the vertical axis, in radians.
+        ///
+        /// A 2-D `RotateGesture` is the wrong tool even though the geometry
+        /// invites it: on visionOS it wants **two hands**, so a one-handed
+        /// wrist turn does nothing and two-handed attempts fight the magnify.
+        /// `RotateGesture3D(constrainedToAxis: .y)` is the one that means "turn
+        /// your wrist, and only the vertical axis counts".
+        var spin: Double = 0
+
+        /// Committed translation, in world space — which is also the sheet's
+        /// parent space, now that it hangs off the scene root rather than a
+        /// plane anchor.
+        var offset: SIMD3<Float> = .zero
+
+        /// In-flight gesture values, applying on top of the committed ones
+        /// until the gesture ends. Kept apart so a cancelled gesture leaves
+        /// nothing behind.
+        var liveScale: Double = 1
+        var liveSpin: Double = 0
+        var liveOffset: SIMD3<Float> = .zero
+
+        /// Sit on a detected horizontal surface, or hang in front of the
+        /// wearer. The second is the fallback #53 asks for — a room with no
+        /// table, a refused world-sensing prompt, and the simulator, where
+        /// ARKit finds no planes at all.
+        ///
+        /// It is also the *remembered* choice: opening a drawing places it
+        /// (see `ViewerWindow`), and this is what says where. Someone who has
+        /// once said "in the air" is not asked again on the next file.
+        var sitsOnTable = true
+
+        var isPlaced = false
+
+        /// Where the drawing is, as one value (#53).
+        ///
+        /// The window used to ask this as two controls — a button that put the
+        /// drawing down or took it away, and a switch for whether to look for a
+        /// table — sitting in different rows with unrelated buttons between
+        /// them. But there are only ever **three** answers, and naming them is
+        /// what the window should be asking: nowhere, on a table, in the air.
+        /// One picker says that, and it retires two verbs that were almost the
+        /// same word for different things (「つくえに おく」 put the drawing
+        /// down, 「つくえに のせる」 look for a table at all).
+        ///
+        /// Read-only, and deliberately: `isPlaced` is only true once the system
+        /// has actually opened the immersive space, so this cannot be *set*
+        /// without waiting to find out. `ViewerWindow` drives it through an
+        /// async action instead, and a space that fails to open leaves the
+        /// picker showing `.away` — which is where the drawing is.
+        var placing: Placing {
+            guard isPlaced else { return .away }
+            return sitsOnTable ? .table : .inFront
+        }
+
+        enum Placing: Hashable, CaseIterable {
+            case away
+            case table
+            case inFront
+        }
+
+        // MARK: The other two surfaces
+
+        /// Whether each window is on screen, so the buttons that open them can
+        /// also close them.
+        ///
+        /// SwiftUI has no "is this window open" to read, so the windows report
+        /// it themselves as they come and go. Worth the two flags: without
+        /// them the control is a switch with one position — pressing it again
+        /// when the window is already up only brings it forward, and the way
+        /// back is the window's own close button, which is somewhere else
+        /// entirely.
+        var isProgramWindowOpen = false
+        var isCodeWindowOpen = false
+
+        // MARK: Finding somewhere to put it
+
+        /// How the sheet came to be where it is.
+        enum Placement {
+            /// Looking for a table. **The sheet is not drawn yet**, and this
+            /// can take ten seconds or more, so it is a state the window has
+            /// to say out loud rather than a gap it leaves unexplained.
+            case searching
+            /// Standing on a surface ARKit found.
+            case onTable
+            /// In mid-air in front of the wearer, because no surface turned up
+            /// (or none was asked for).
+            case floating
+        }
+
+        var placement: Placement = .searching
+
+        /// Where the sheet was put, in world space, before the wearer moved it.
+        private(set) var home: SIMD3<Float> = [0, 1.0, -1.2]
+
+        /// The turn that puts the sheet's top edge away from the wearer.
+        private(set) var homeYaw: Float = 0
+
+        /// How far ahead of the eyes the sheet lands. Desk reach: near enough
+        /// to be *the thing you are looking at*, far enough not to sit in your
+        /// lap. Everything past this is the wearer's to drag.
+        static let reach: Float = 0.6
+
+        /// Drop below eye level for the floating fallback — roughly where a
+        /// desk would be if there were one.
+        private static let floatingDrop: Float = 0.35
+
+        func placeOnTable(atHeight y: Float, device: simd_float4x4) {
+            aim(from: device, height: y)
+            placement = .onTable
+        }
+
+        /// The fallback. `device` is nil only when world tracking has not
+        /// produced a pose yet, and then there is nothing to aim by — the sheet
+        /// takes a fixed spot ahead of the origin instead.
+        func floatInFront(device: simd_float4x4?) {
+            if let device {
+                aim(from: device, height: device.columns.3.y - Self.floatingDrop)
+            }
+            else {
+                home = [0, 1.0, -1.2]
+                homeYaw = 0
+            }
+            placement = .floating
+        }
+
+        /// Puts the sheet in front of the wearer, facing the way they face.
+        ///
+        /// Lying down, the sheet's top edge points along **−Z** (that is what
+        /// the −90° turn about X does to the page's up direction). So the yaw
+        /// that carries −Z onto the gaze direction is exactly the one that puts
+        /// the drawing's *north* away from the wearer — read from where you
+        /// stand, the far edge is the top, which is the way a sheet of paper on
+        /// a desk is oriented without anyone thinking about it.
+        private func aim(from device: simd_float4x4, height y: Float) {
+            let target = Self.gazeTarget(from: device)
+            home = [target.x, y, target.z]
+            homeYaw = Self.yaw(from: device)
+        }
+
+        /// The spot the sheet aims for: `reach` metres ahead of the eyes, at
+        /// eye height. Shared with surface picking, so "the table I am looking
+        /// at" and "where on it the drawing goes" are the same point.
+        static func gazeTarget(from device: simd_float4x4) -> SIMD3<Float> {
+            let eye = SIMD3(device.columns.3.x, device.columns.3.y, device.columns.3.z)
+            let ahead = forward(of: device)
+            return eye + ahead * reach
+        }
+
+        static func yaw(from device: simd_float4x4) -> Float {
+            let ahead = forward(of: device)
+            return atan2(-ahead.x, -ahead.z)
+        }
+
+        /// The gaze, flattened onto the horizontal plane. A head transform
+        /// looks along its own −Z; dropping the Y component is what keeps the
+        /// sheet level however far up or down the wearer happens to be looking
+        /// when it lands.
+        static func forward(of device: simd_float4x4) -> SIMD3<Float> {
+            let flat = SIMD3(-device.columns.2.x, 0, -device.columns.2.z)
+            let length = simd_length(flat)
+            return length > 1e-4 ? flat / length : SIMD3(0, 0, -1)
+        }
+
+        var visibleSide: Double { (side * liveScale).clamped(to: Self.sideRange) }
+        var visibleSpin: Double { spin + liveSpin }
+        var visibleOffset: SIMD3<Float> { offset + liveOffset }
+
+        /// The entity scale that turns the one built render into that size.
+        var entityScale: Float { Float(visibleSide / Self.builtSide) }
+
+        func commitScale(_ magnification: Double) {
+            side = (side * magnification).clamped(to: Self.sideRange)
+            liveScale = 1
+        }
+
+        func commitSpin(_ radians: Double) {
+            spin += radians
+            liveSpin = 0
+        }
+
+        func commitOffset(_ translation: SIMD3<Float>) {
+            offset += translation
+            liveOffset = .zero
+        }
+
+        func resetPlacement() {
+            side = 0.6
+            spin = 0
+            offset = .zero
+            liveScale = 1
+            liveSpin = 0
+            liveOffset = .zero
+        }
+
+        /// The signed turn a constrained `RotateGesture3D` describes. Held to
+        /// the vertical axis, the rotation's own axis comes back as ±Y and its
+        /// sign is the direction — the angle alone is unsigned.
+        static func verticalAngle(of rotation: Rotation3D) -> Double {
+            rotation.angle.radians * (rotation.axis.y < 0 ? -1 : 1)
+        }
+    }
+
+    extension Double {
+        fileprivate func clamped(to range: ClosedRange<Double>) -> Double {
+            min(max(self, range.lowerBound), range.upperBound)
+        }
+    }
+
+    /// Keeps every horizontal surface ARKit has told us about, so the choice of
+    /// where to put the drawing is made over the whole set rather than over
+    /// whichever one happened to arrive first.
+    @MainActor
+    final class SurfaceCollector {
+        private var surfaces: [UUID: PlaneAnchor] = [:]
+
+        var all: [PlaneAnchor] { Array(surfaces.values) }
+
+        func consume(_ provider: PlaneDetectionProvider) async {
+            for await update in provider.anchorUpdates {
+                if update.event == .removed {
+                    surfaces[update.anchor.id] = nil
+                }
+                else {
+                    surfaces[update.anchor.id] = update.anchor
+                }
+            }
+        }
+    }
+
+    /// Everything the entity's transform depends on, gathered in `body` so
+    /// Observation actually sees it change.
+    private struct SheetTransform {
+        let isVisible: Bool
+        let position: SIMD3<Float>
+        let scale: Float
+        let yaw: Float
+    }
+
+    /// The immersive space: one sheet, lying flat, placed by hand.
+    struct TableCanvasSpace: View {
+        let model: ViewerModel
+
+        /// visionOS lays SwiftUI out in points and the world in metres. This is
+        /// the conversion, read from the scene rather than guessed at — it is
+        /// what makes "60cm" mean 60cm instead of an arbitrary scale factor.
+        @PhysicalMetric(from: .meters) private var pointsPerMeter: CGFloat = 1
+
+        /// Holds the per-frame subscription alive. A `RealityView`'s `make`
+        /// closure runs once, and an `EventSubscription` that nothing retains
+        /// is cancelled the moment it goes out of scope — which reads exactly
+        /// like the handler never being called.
+        @State private var frameTicker = FrameTicker()
+
+        private static let sheetName = "table-canvas"
+
+        /// White paper around the drawing, in points at ``ViewerModel/builtSide``.
+        ///
+        /// It replaces the inset `autoFit` used to add for the sprite, which a
+        /// `.hidden` sprite no longer earns. Sized for the *tortoise* rather
+        /// than for looks: at `tortoiseLength` it is about half the animal, so
+        /// a tortoise standing at the far corner of its drawing still has all
+        /// four feet on the paper.
+        static let sheetMargin: CGFloat = 64
+
+        var body: some View {
+            // Read here, in `body`, and captured by the closure below.
+            //
+            // Observation only registers what a *view update* touches, and a
+            // `RealityView`'s `update:` closure runs outside that — properties
+            // read only in there never mark this view as needing an update, so
+            // the closure is called once and never again. The symptom is total:
+            // the sheet stays disabled at wherever the first frame put it, and
+            // ARKit deciding where the table is changes nothing on screen.
+            let sheet = SheetTransform(
+                isVisible: model.placement != .searching,
+                position: model.home + model.visibleOffset,
+                scale: model.entityScale,
+                yaw: model.homeYaw + Float(model.visibleSpin))
+
+            return RealityView { content in
+                let sheet = Entity()
+                sheet.name = Self.sheetName
+                sheet.components.set(
+                    ViewAttachmentComponent(
+                        rootView: TableCanvasSheet(
+                            runner: model.runner,
+                            side: ViewerModel.builtSide * pointsPerMeter)))
+                // The gestures target the *entity*, so it needs a shape to be
+                // hit and a component saying it accepts input. The box lies in
+                // the view's own plane and scales with the entity, so it keeps
+                // matching the sheet.
+                sheet.components.set(InputTargetComponent())
+                sheet.components.set(
+                    CollisionComponent(shapes: [
+                        .generateBox(
+                            size: [
+                                Float(ViewerModel.builtSide), Float(ViewerModel.builtSide), 0.005,
+                            ]
+                        )
+                    ]))
+
+                // A plain entity in world space, **not** an `AnchorEntity`.
+                // Anchoring to a plane is one line and answers none of the
+                // three questions that matter: the system picks which surface,
+                // picks where on it, and never says when it succeeded. Running
+                // the providers directly is what buys "in front of your eyes",
+                // "turned to face you", and a wait the window can explain.
+                content.add(sheet)
+
+                // The tortoise, as a child of the sheet — so it inherits the
+                // pinch, the twist and the drag for free, and its own
+                // transform only ever has to say where on the *paper* it is.
+                //
+                // A failure here costs the tortoise and nothing else: the
+                // drawing still appears and still plays. An immersive space
+                // that shows no picture because a model would not load would
+                // be a much worse trade than a picture that draws itself.
+                if let tortoise = await Self.loadTortoise() {
+                    sheet.addChild(tortoise)
+                    // Per *display frame*, not per view update. The two differ
+                    // by two orders of magnitude here and the difference is the
+                    // feature: `currentCommandIndex` changes about ten times a
+                    // second, and a tortoise moved on that schedule jumps from
+                    // command to command while the line it is drawing grows
+                    // smoothly underneath it.
+                    frameTicker.subscription = content.subscribe(
+                        to: SceneEvents.Update.self, on: nil
+                    ) { _ in
+                        Self.walk(tortoise, with: model.runner, pointsPerMeter: pointsPerMeter)
+                    }
+                }
+            } update: { content in
+                guard let entity = Self.sheet(in: content) else { return }
+                // Nothing to look at until there is somewhere to put it —
+                // better a considered wait than a sheet parked wherever the
+                // origin happens to be.
+                entity.isEnabled = sheet.isVisible
+                entity.position = sheet.position
+                entity.scale = .init(repeating: sheet.scale)
+                // Lie flat, then turn: the yaw the placement chose, plus
+                // whatever the wearer has twisted since.
+                entity.orientation =
+                    simd_quatf(angle: sheet.yaw, axis: [0, 1, 0])
+                    * simd_quatf(angle: -.pi / 2, axis: [1, 0, 0])
+            }
+            .task { await findSomewhereToPutIt() }
+            // Only the placement mode rebuilds; size, spin and position are
+            // transforms on the entity that is already there.
+            .id(model.sitsOnTable)
+            // All three run together, the way a hand does them: a pinch that
+            // drifts and turns should move and spin rather than pick one. The
+            // rotation's 5° threshold keeps an ordinary drag from spinning the
+            // sheet on the way past.
+            .gesture(
+                DragGesture()
+                    .targetedToAnyEntity()
+                    .onChanged {
+                        model.liveOffset = Self.translation(
+                            of: $0, keepingOnPlane: model.placement == .onTable)
+                    }
+                    .onEnded {
+                        model.commitOffset(
+                            Self.translation(of: $0, keepingOnPlane: model.placement == .onTable))
+                    }
+            )
+            .simultaneousGesture(
+                RotateGesture3D(constrainedToAxis: .y, minimumAngleDelta: .degrees(5))
+                    .targetedToAnyEntity()
+                    .onChanged {
+                        model.liveSpin = ViewerModel.verticalAngle(of: $0.gestureValue.rotation)
+                    }
+                    .onEnded {
+                        model.commitSpin(ViewerModel.verticalAngle(of: $0.gestureValue.rotation))
+                    }
+            )
+            .simultaneousGesture(
+                MagnifyGesture()
+                    .targetedToAnyEntity()
+                    .onChanged { model.liveScale = $0.gestureValue.magnification }
+                    .onEnded { model.commitScale($0.gestureValue.magnification) }
+            )
+        }
+
+        /// Long enough for a table to turn up, short enough that nobody is left
+        /// staring at nothing wondering whether it is broken. Measured against
+        /// the ten-plus seconds plane detection actually took on device.
+        private static let searchTimeout: Duration = .seconds(15)
+
+        /// Finds a table, or gives up and floats — and either way ends with the
+        /// sheet in front of the wearer, turned to face them.
+        private func findSomewhereToPutIt() async {
+            let session = ARKitSession()
+            let world = WorldTrackingProvider()
+            let planes = PlaneDetectionProvider(alignments: [.horizontal])
+            model.placement = .searching
+
+            do {
+                try await session.run(model.sitsOnTable ? [world, planes] : [world])
+            }
+            catch {
+                // A refused world-sensing prompt lands here, and it is not an
+                // error worth showing a child: floating is a perfectly good way
+                // to look at a drawing.
+                model.floatInFront(device: nil)
+                return
+            }
+
+            guard model.sitsOnTable else {
+                model.floatInFront(device: await Self.pose(from: world))
+                return
+            }
+            guard let device = await Self.pose(from: world) else {
+                model.floatInFront(device: nil)
+                return
+            }
+
+            // Collected rather than consumed. Taking the **first** surface that
+            // passed was the whole of the "it keeps choosing the floor" bug:
+            // updates arrive in no useful order, and a floor is large, flat and
+            // found early, so it won nearly every race it was allowed to enter.
+            let surfaces = SurfaceCollector()
+            let collecting = Task { await surfaces.consume(planes) }
+            defer { collecting.cancel() }
+
+            let clock = ContinuousClock()
+            let started = clock.now
+            var firstSeen: ContinuousClock.Instant?
+
+            while clock.now - started < Self.searchTimeout {
+                if let best = Self.bestSurface(among: surfaces.all, device: device) {
+                    firstSeen = firstSeen ?? clock.now
+                    // A table by name is the answer outright. Anything else is
+                    // a guess worth holding a moment, in case the real table is
+                    // still being mapped.
+                    if best.surfaceClassification == .table
+                        || clock.now - firstSeen! >= Self.settleDelay
+                    {
+                        model.placeOnTable(
+                            atHeight: best.originFromAnchorTransform.columns.3.y, device: device)
+                        return
+                    }
+                }
+                try? await Task.sleep(for: .milliseconds(250))
+            }
+            model.floatInFront(device: device)
+        }
+
+        /// The surface to put the drawing on: the one nearest to where the
+        /// wearer is looking, out of those that could be a table at all.
+        ///
+        /// **Height is tested two ways, and each covers the other's blind
+        /// spot.** An immersive space's origin sits on the floor, so an
+        /// absolute height excludes the floor outright — but only while the
+        /// origin really is down there. Eye-relative height does not depend on
+        /// that, but on its own it lets the floor through for anyone *sitting*:
+        /// a seated wearer's eyes are about 1.2m up, which puts the floor 1.2m
+        /// below them, in exactly the band a standing wearer's desk occupies.
+        /// That is what made this pick the floor. Together they leave a desk
+        /// and take a floor whether you sit or stand.
+        ///
+        /// Classification is a *preference*, never a filter: it reports
+        /// `.undetermined` often enough that filtering on it would find nothing
+        /// in an ordinary room.
+        private static func bestSurface(
+            among surfaces: [PlaneAnchor], device: simd_float4x4
+        ) -> PlaneAnchor? {
+            let eye = SIMD3(device.columns.3.x, device.columns.3.y, device.columns.3.z)
+            let ahead = ViewerModel.gazeTarget(from: device)
+            return
+                surfaces
+                .filter { surface in
+                    let y = surface.originFromAnchorTransform.columns.3.y
+                    let belowEyes = eye.y - y
+                    return y > minimumSurfaceHeight && belowEyes > 0.2
+                        && belowEyes < maximumDropBelowEyes
+                }
+                .min { a, b in
+                    // A named table beats an unnamed surface; after that, the
+                    // one closest to what the wearer is looking at wins, which
+                    // is what makes "the desk in front of me" beat "the counter
+                    // behind me".
+                    let named = (
+                        a.surfaceClassification == .table, b.surfaceClassification == .table
+                    )
+                    if named.0 != named.1 { return named.0 }
+                    return distance(from: ahead, to: a) < distance(from: ahead, to: b)
+                }
+        }
+
+        private static func distance(from point: SIMD3<Float>, to surface: PlaneAnchor) -> Float {
+            let centre = surface.originFromAnchorTransform.columns.3
+            return simd_length(SIMD2(centre.x - point.x, centre.z - point.z))
+        }
+
+        /// The floor is at zero, so anything at knee height or below is not a
+        /// table. Deliberately low: a child's desk is lower than an adult's.
+        private static let minimumSurfaceHeight: Float = 0.35
+
+        /// Far enough below the eyes to be a surface you look *down* at, near
+        /// enough that a seated wearer's floor (about 1.2m down) is excluded.
+        private static let maximumDropBelowEyes: Float = 1.1
+
+        /// How long a non-table surface is held before being accepted, in case
+        /// a real table is still being mapped. Cheap against the ten seconds
+        /// detection takes anyway.
+        private static let settleDelay: Duration = .seconds(2)
+
+        /// The head pose — **once world tracking is actually tracking**.
+        ///
+        /// `queryDeviceAnchor` answers straight away after `run`, and what it
+        /// answers with at first is an *untracked* anchor whose transform is the
+        /// identity. Aiming from that puts the sheet 35cm below the origin,
+        /// which is under the floor, which looks exactly like nothing rendering
+        /// at all — the same symptom, from a different cause, as the very first
+        /// placement bug in this file. `isTracked` is what separates a pose from
+        /// a placeholder.
+        private static func pose(from world: WorldTrackingProvider) async -> simd_float4x4? {
+            for _ in 0..<poseAttempts {
+                if let anchor = world.queryDeviceAnchor(atTimestamp: CACurrentMediaTime()),
+                    anchor.isTracked,
+                    anchor.originFromAnchorTransform.columns.3.y > minimumEyeHeight
+                {
+                    return anchor.originFromAnchorTransform
+                }
+                try? await Task.sleep(for: .milliseconds(100))
+            }
+            return nil
+        }
+
+        /// The height below which a "pose" is not one.
+        ///
+        /// An immersive space's origin is on the floor under the wearer, so a
+        /// head is about a metre and a half up. **The simulator reports the
+        /// identity transform and calls it tracked**, which reads as a head on
+        /// the floor and aims the sheet into the ground — so `isTracked` alone
+        /// is not enough to trust a pose by. 0.8m is under a seated child's
+        /// eyes and over anything that is really a placeholder; below it the
+        /// placement stops guessing and takes its fixed spot instead.
+
+        /// Three seconds' worth of 100ms tries. Long enough for tracking to
+        /// start, short enough that a headset which never tracks still gets a
+        /// drawing rather than a blank room.
+        private static let minimumEyeHeight: Float = 0.8
+
+        private static let poseAttempts = 30
+
+        /// A drag's translation in the entity's parent space, which is where
+        /// `position` is read. Converting to `.scene` instead would be wrong
+        /// the moment the sheet hangs off a plane anchor.
+        ///
+        /// `keepingOnPlane` is what stops a drag lifting the sheet off the
+        /// table: the sheet is level, so dropping the Y component slides the
+        /// drawing along the surface instead of into the air. It is off in the
+        /// floating placement, where there is no surface to stay on and height
+        /// is the only way to put the sheet somewhere sensible.
+        private static func translation(
+            of value: EntityTargetValue<DragGesture.Value>, keepingOnPlane: Bool
+        ) -> SIMD3<Float> {
+            guard let parent = value.entity.parent else { return .zero }
+            var delta = value.convert(value.gestureValue.translation3D, from: .local, to: parent)
+            if keepingOnPlane { delta.y = 0 }
+            return delta
+        }
+
+        private static func sheet(in content: RealityViewContent) -> Entity? {
+            for root in content.entities {
+                if let found = root.findEntity(named: sheetName) { return found }
+            }
+            return nil
+        }
+
+        // MARK: - The tortoise on the paper
+
+        /// How long the tortoise is, as a fraction of the sheet's side — so it
+        /// keeps its size relative to the drawing however big the sheet is
+        /// pinched, and needs no rescaling of its own.
+        ///
+        /// A twelfth is deliberately larger than the 2-D sprite ever was
+        /// (23×32pt of a 1360pt sheet is nearer a thirtieth). On a screen the
+        /// tortoise is a *cursor* — the thing you track to see where the line
+        /// is going. On the table it is the animal, and the animal is the whole
+        /// argument for this platform existing (#53): a tortoise that walks
+        /// across your desk drawing a line is what tortoise graphics was before
+        /// there were screens. At 60cm — the default sheet — this is 5cm.
+        private static let tortoiseLength: Float = 1.0 / 12.0
+
+        /// Clear of the paper by a hair, so nothing the model owns is ever
+        /// exactly coplanar with the attachment's white ground — which
+        /// z-fights along the whole underside of a tortoise that lands on
+        /// zero. A tenth of a millimetre at the default sheet size, which is
+        /// far below anything the eye resolves and far above the depth
+        /// buffer's tie.
+        private static let hover: Float = 0.0002
+
+        /// Loads the generated tortoise (`Tools/tortoise-model/`), scaled to
+        /// `tortoiseLength` and stood upright on the paper.
+        ///
+        /// The model is authored to a contract this depends on: Y-up with
+        /// **forward at −Z**, total length exactly 1.0 so a scale is a length,
+        /// and its origin at the ground point under the shell's centre — the
+        /// point it turns about. Wrapped in a plain container entity so the
+        /// standing-up rotation lives here, once, and `walk` only ever has to
+        /// say where on the paper and which way round.
+        private static func loadTortoise() async -> Entity? {
+            guard let model = try? await Entity(named: "Tortoise", in: .main) else { return nil }
+            // +90° about X: the model's own up (+Y) becomes the sheet's +Z,
+            // which is up off the table, and its forward (−Z) becomes the
+            // sheet's +Y — the drawing's north, which is heading 0.
+            model.orientation = simd_quatf(angle: .pi / 2, axis: [1, 0, 0])
+            model.scale = .init(repeating: tortoiseLength)
+            let carrier = Entity()
+            carrier.addChild(model)
+            // Stand it *on* the paper rather than at its own origin. The origin
+            // is the ground point under the shell's centre — the point the
+            // animal turns about — and the feet reach a little below it (6‰ of
+            // the body length, measured off the loaded model rather than
+            // assumed, so a re-generated tortoise cannot quietly start sinking
+            // into the page).
+            model.position.z = -model.visualBounds(relativeTo: carrier).min.z + hover
+            return carrier
+        }
+
+        /// Puts the tortoise where the canvas would have drawn its sprite.
+        ///
+        /// Called once per display frame, which is what
+        /// `currentTortoiseState` is for: it interpolates *between* commands,
+        /// so the tortoise walks the line as it is drawn. Driving this from
+        /// `currentCommandIndex` instead — the value everything else in the app
+        /// watches — would teleport it once per command while the line grew
+        /// smoothly underneath.
+        @MainActor
+        private static func walk(
+            _ tortoise: Entity, with runner: RunnerModel, pointsPerMeter: CGFloat
+        ) {
+            guard let state = runner.player.currentTortoiseState, state.isVisible else {
+                tortoise.isEnabled = false
+                return
+            }
+            tortoise.isEnabled = true
+
+            // The same transform the canvas laid the drawing out with, asked
+            // for rather than reimplemented — `autoFit` centres on the drawing
+            // and scales to fill, and getting that subtly wrong would put the
+            // tortoise beside its own line rather than on it.
+            let side = ViewerModel.builtSide * pointsPerMeter
+            let inner = side - 2 * sheetMargin
+            let transform = ViewportMode.autoFit.transform(
+                canvasSize: runner.tortoise.canvasSize,
+                viewSize: CGSize(width: inner, height: inner),
+                drawingBounds: runner.drawingBounds,
+                spriteHalfExtent: TortoiseSprite.hidden.halfExtent)
+            let point = CGPoint(x: state.position.x, y: state.position.y).applying(transform)
+
+            // View points (top-left origin, Y down) to the sheet entity's own
+            // space (centre origin, Y up, 1 unit = 1 metre). The canvas is
+            // centred in the attachment, so the margin cancels and only the
+            // inner size matters.
+            // Z is the loader's business, not this function's: the model was
+            // lifted onto the paper once, and every frame after that is a slide
+            // across it.
+            tortoise.position = [
+                Float((point.x - inner / 2) / pointsPerMeter),
+                Float((inner / 2 - point.y) / pointsPerMeter),
+                0,
+            ]
+            // Heading is clockwise from north; a turn about the sheet's +Z,
+            // which points up out of the paper, is counter-clockwise seen from
+            // above. Hence the sign.
+            tortoise.orientation = simd_quatf(
+                angle: -Float(state.heading * .pi / 180), axis: [0, 0, 1])
+        }
+    }
+
+    /// Owns the scene-update subscription for as long as the view is on
+    /// screen. A `final class` in `@State` rather than the subscription in
+    /// `@State` directly, because `make` runs before the first update and
+    /// assigning state from there would be a write during view construction.
+    @MainActor
+    private final class FrameTicker {
+        var subscription: EventSubscription?
+    }
+
+    /// What actually lies on the table: the app's own canvas, drawing
+    /// everything **except** the tortoise.
+    ///
+    /// `.hidden` (TortoiseGraphics2 2.1.0) is the whole difference from the
+    /// iPad's pane. The tortoise here is not a picture on the paper, it is a
+    /// model standing on it, so the canvas has to stop drawing its own — and
+    /// this is the way to say that, rather than `hideTortoise()`, which
+    /// records a *command* and would travel into the SVG export, the PNG, the
+    /// thumbnail and the saved stream.
+    private struct TableCanvasSheet: View {
+        let runner: RunnerModel
+        let side: CGFloat
+
+        var body: some View {
+            TortoiseCanvas(runner.tortoise, player: runner.player)
+                .tortoiseSprite(.hidden)
+                // The margin the sprite used to buy. `autoFit` insets by the
+                // sprite's half-diagonal so it can't clip at the edge, and a
+                // hidden sprite has no extent — so without this the drawing
+                // runs edge to edge, and the tortoise standing at its far
+                // corner hangs off the paper. Inner frame first, then the
+                // paper around it: that keeps the drawing centred on the
+                // sheet, which is what lets the mapping below be a single
+                // scale about the middle.
+                .frame(
+                    width: side - 2 * TableCanvasSpace.sheetMargin,
+                    height: side - 2 * TableCanvasSpace.sheetMargin
+                )
+                // Paper, for the same reason the pane paints it: the default
+                // pen is black and a table is not white.
+                .frame(width: side, height: side)
+                .background(.white)
+                // The pinch, twist and drag belong to the entity. Left
+                // hit-testable, this view swallows them first and the sheet can
+                // never be moved at all.
+                .allowsHitTesting(false)
+        }
+    }
+
+#endif
diff --git a/App/Views/ViewerWindow.swift b/App/Views/ViewerWindow.swift
new file mode 100644
index 0000000..7f14186
--- /dev/null
+++ b/App/Views/ViewerWindow.swift
@@ -0,0 +1,399 @@
+#if os(visionOS)
+
+    import SwiftUI
+    import TortoiseBlocksKit
+
+    /// The visionOS viewer's one window (#53) — **controls only**.
+    ///
+    /// The drawing is never here. It lives on the table, in the immersive
+    /// space, and that is the whole reason this platform gets an app of its
+    /// own: a second flat copy in the window would put the same picture in two
+    /// places and take the reason away with it. So this window is what a
+    /// remote control is: pick a drawing, put it down, play it.
+    ///
+    /// There is no editing anywhere in it. That is not a feature that was cut
+    /// — text entry and precise dragging are worse in a headset than on an
+    /// iPad in every respect, and being read-only is what lets the whole
+    /// `DocumentGroup` apparatus go, taking with it the two visionOS problems
+    /// that #52 could not solve (no way back to the browser, and the
+    /// view-switching residue).
+    struct ViewerWindow: View {
+        let model: ViewerModel
+
+        @Environment(\.openImmersiveSpace) private var openSpace
+        @Environment(\.dismissImmersiveSpace) private var dismissSpace
+        @Environment(\.openWindow) private var openWindow
+
+        @State private var showsImporter = false
+
+        var body: some View {
+            @Bindable var model = model
+            VStack(spacing: 24) {
+                DrawingChooser(model: model, showsImporter: $showsImporter)
+
+                if model.hasProgram {
+                    PlaybackControls(
+                        blocks: model.blocks, runner: model.runner,
+                        isStale: model.runner.isStale(comparedTo: model.blocks)
+                    )
+                    TablePlacementControls(model: model, place: place)
+                }
+                else {
+                    ContentUnavailableView(
+                        "No Drawing", systemImage: "photo.on.rectangle.angled",
+                        description: Text("Open a drawing, or start from a sample."))
+                }
+            }
+            .padding(28)
+            // A fixed width and *no* height at all. The window sizes itself to
+            // this content (`windowResizability(.contentSize)`), so leaving the
+            // height to the content is what stops the empty band under the
+            // controls — a remote control should be exactly as tall as its
+            // buttons, and it grows by itself when a drawing brings the
+            // transport with it. The width is held because the scrubber has no
+            // opinion of its own and would otherwise collapse toward the
+            // widest label.
+            .frame(width: 520)
+            .fileImporter(
+                isPresented: $showsImporter, allowedContentTypes: [.tortoiseBlocksProject]
+            ) { result in
+                if case .success(let url) = result { model.open(url) }
+            }
+            .alert(
+                "Can't Open This",
+                isPresented: Binding(
+                    get: { model.openFailure != nil },
+                    set: { if !$0 { model.openFailure = nil } })
+            ) {
+                Button("OK", role: .cancel) {}
+            } message: {
+                Text(model.openFailure ?? "")
+            }
+            // **Opening a drawing puts it down.** The viewer has exactly one
+            // job, so choosing a drawing and then being asked where to put it
+            // is a question with one sensible answer — and until it is
+            // answered the room stays empty and nothing on screen says why,
+            // which reads as an app that did not open the file. An alert
+            // ("shall I put it on the table?") was the other candidate and
+            // fails for the same reason twice over: a modal whose answer is
+            // always yes, stacked in front of the world-sensing prompt that
+            // the first placement already brings with it.
+            //
+            // It stays an ordinary *placement*, not a special case. The picker
+            // below moves to wherever this put it and 「ださない」 takes it
+            // away again, so nothing here is a state the wearer cannot get
+            // out of. Opening a second drawing while one is already out
+            // changes what is on the sheet and leaves the sheet where it was
+            // dragged to — `place` sees the drawing is already there and
+            // returns.
+            .onChange(of: model.loadGeneration) {
+                Task { await place(model.sitsOnTable ? .table : .inFront) }
+            }
+            .task {
+                // Development only: the simulator cannot press any of these
+                // buttons (simctl sends no input), so `-TBPlace YES` loads a
+                // sample, opens the program window and puts the drawing down at
+                // launch. Without it a simulator run is a window of buttons
+                // nobody can reach, and the immersive space never opens at all.
+                //
+                // **It does not let you see the drawing.** The simulator hosts
+                // no `ViewAttachmentComponent` view, so the sheet's own SwiftUI
+                // body never runs, `TortoisePlayer` never attaches to a canvas,
+                // and `currentTortoiseState` stays nil — which looks exactly
+                // like a broken tortoise and has cost an afternoon once
+                // already (the root CLAUDE.md has the longer note). What the
+                // flag is actually good for is everything that is not the
+                // picture: that the USDZ loads in the real visionOS runtime
+                // with the bounds its contract promises, that the per-frame
+                // subscription fires, that load → run → place survives, and
+                // that the program and code windows draw with content in them.
+                // The picture itself is the headset's to judge.
+                //
+                // Read off the launch arguments rather than through
+                // `UserDefaults`, which is where a `-flag value` pair normally
+                // arrives. **`UserDefaults` is one of Apple's required-reason
+                // APIs**, so touching it — even for a debug flag, even for a
+                // read — obliges the app to ship a `PrivacyInfo.xcprivacy`
+                // declaring `CA92.1`. This app has no privacy manifest and
+                // needs none, which is a property worth keeping for one line:
+                // nothing else here touches a required-reason API, and the
+                // launch command is unchanged either way.
+                guard ProcessInfo.processInfo.arguments.contains("-TBPlace"),
+                    !model.hasProgram
+                else {
+                    return
+                }
+                // Loading is what places it now, so the destination is
+                // chosen by setting the preference first. In front rather
+                // than on a table because the simulator finds no planes at
+                // all, and a table search there only spends its fifteen
+                // seconds before falling back to exactly this.
+                model.sitsOnTable = false
+                model.load(SampleBlocks.spiral(), title: String(localized: "Spiral"))
+                openWindow(id: ViewerModel.programWindowID)
+            }
+        }
+
+        /// Moves the drawing to `destination`, opening or closing the
+        /// immersive space as that requires.
+        ///
+        /// The table/in-front choice is set *before* the space opens, because
+        /// the space reads it as it starts looking for somewhere to put the
+        /// sheet. Changing it while already placed rebuilds the sheet and
+        /// starts that search again, which is the intent — it is the wearer
+        /// saying "not there, here".
+        private func place(_ destination: ViewerModel.Placing) async {
+            guard destination != model.placing else { return }
+            guard destination != .away else {
+                await dismissSpace()
+                model.isPlaced = false
+                return
+            }
+            model.sitsOnTable = destination == .table
+            guard !model.isPlaced else { return }
+            if case .opened = await openSpace(id: ViewerModel.spaceID) {
+                model.isPlaced = true
+            }
+        }
+    }
+
+    /// Which drawing is on the table: a file, or one of the four samples the
+    /// iPad and Mac workspace already offers.
+    ///
+    /// The samples are not a convenience — they are what stops a viewer with
+    /// no files from being an empty app. Documents live in the app's own
+    /// folder on whichever device made them, so a Vision Pro starts with none
+    /// until something is AirDropped to it. `SampleBlocks` is already public
+    /// and already what 「みほん」 uses, so this needs no bundled resources and
+    /// no second set of names.
+    ///
+    /// **There is no export here, and that is the same decision as everything
+    /// else this window leaves out** (#53). The viewer cannot change a drawing,
+    /// so the file it was given is already the artifact; a second one written
+    /// from it belongs where the drawing is *made*, which is the iPad and the
+    /// Mac. It also kept a remote control down to the controls that place and
+    /// play — the row had reached four buttons before this came out.
+    private struct DrawingChooser: View {
+        let model: ViewerModel
+        @Binding var showsImporter: Bool
+
+        var body: some View {
+            VStack(spacing: 12) {
+                // Verbatim on both sides: a file's name is the user's own text,
+                // and the app name mirrors CFBundleDisplayName, which is
+                // "Tortoise Blocks" in every language — localizing either would
+                // put something in the string catalog that must never be
+                // translated (the same reason `LaunchScene` says it verbatim).
+                Text(verbatim: model.title.isEmpty ? "Tortoise Blocks" : model.title)
+                    .font(.title)
+                    .lineLimit(1)
+
+                HStack(spacing: 12) {
+                    Button("Open", systemImage: "folder") {
+                        showsImporter = true
+                    }
+                    Menu {
+                        // "Sample" is said once, over the list, rather than at
+                        // the head of all four names — the same reasoning as
+                        // the workspace's own menu.
+                        SampleItem("🟦", "Filled Square", SampleBlocks.filledSquare, model)
+                        SampleItem("⭐️", "Star", SampleBlocks.star, model)
+                        SampleItem("🌀", "Spiral", SampleBlocks.spiral, model)
+                        SampleItem("🌳", "Tree", SampleBlocks.fractalTree, model)
+                    } label: {
+                        Label("Samples", systemImage: "sparkles")
+                    }
+                }
+                .buttonStyle(.bordered)
+            }
+        }
+    }
+
+    /// One sample entry. Takes the block-builder rather than the blocks so the
+    /// program is only built when it is chosen — four sample trees built on
+    /// every redraw of the menu's label would be four for nothing.
+    private struct SampleItem: View {
+        let icon: String
+        /// A `LocalizedStringResource` rather than a `LocalizedStringKey`
+        /// because this name is needed twice — as the menu entry, and as the
+        /// title the window then shows — and only a resource can be both drawn
+        /// and resolved to a `String`. Same reason the palette's titles are
+        /// resources: a plain `String` there would skip localization outright.
+        let title: LocalizedStringResource
+        let build: () -> [Block]
+        let model: ViewerModel
+
+        init(
+            _ icon: String, _ title: LocalizedStringResource, _ build: @escaping () -> [Block],
+            _ model: ViewerModel
+        ) {
+            self.icon = icon
+            self.title = title
+            self.build = build
+            self.model = model
+        }
+
+        var body: some View {
+            Button {
+                model.load(build(), title: String(localized: title))
+            } label: {
+                // The emoji is `verbatim` and separate from the title, so the
+                // string catalog stays free of it.
+                Label {
+                    Text(title)
+                } icon: {
+                    Text(verbatim: icon)
+                }
+            }
+        }
+    }
+
+    /// Where the drawing goes, and the two other surfaces it can be seen on.
+    ///
+    /// **Grouped by what a control does, not by what it looks like** (#53).
+    /// The row used to hold "put it on the table", "show blocks" and "show
+    /// code" side by side, whose only shared property was being buttons: one
+    /// was about placement and the other two opened windows, while placement's
+    /// own mode switch and reset sat in a *different* row underneath, with
+    /// those two wedged in between. Now placement is one group and the other
+    /// surfaces are another, with a divider saying so.
+    private struct TablePlacementControls: View {
+        let model: ViewerModel
+        let place: (ViewerModel.Placing) async -> Void
+
+        var body: some View {
+            VStack(spacing: 14) {
+                VStack(spacing: 6) {
+                    Text("Where should the drawing go?")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                    HStack(spacing: 10) {
+                        PlacementPicker(placing: model.placing, place: place)
+                        // Inline, icon-only, and last. Size, spin and position
+                        // are gestures on the sheet itself, so all that is left
+                        // for a control is the way back from having dragged the
+                        // drawing out of reach — which is rare, and must not
+                        // read as louder than the question above it. On its own
+                        // row with a title it did exactly that.
+                        Button("Reset Position", systemImage: "arrow.counterclockwise") {
+                            model.resetPlacement()
+                        }
+                        .labelStyle(.iconOnly)
+                        .buttonStyle(.bordered)
+                        .disabled(!model.isPlaced)
+                    }
+                }
+
+                PlacementStatus(model: model)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+
+                Divider()
+
+                SurfaceToggles(model: model)
+            }
+        }
+    }
+
+    /// The one question the placement controls ask: where is the drawing?
+    ///
+    /// A picker rather than a button and a switch, because the answers are a
+    /// closed set of three and naming them is clearer than composing them —
+    /// see `ViewerModel.placing`. Selecting is asynchronous (opening an
+    /// immersive space can fail, and does in a room that refuses world
+    /// sensing), so the binding's setter starts the work and the picker
+    /// follows whatever actually happened rather than what was asked for.
+    private struct PlacementPicker: View {
+        let placing: ViewerModel.Placing
+        let place: (ViewerModel.Placing) async -> Void
+
+        var body: some View {
+            Picker(
+                "Where should the drawing go?",
+                selection: Binding(get: { placing }, set: { new in Task { await place(new) } })
+            ) {
+                Text("Away").tag(ViewerModel.Placing.away)
+                Text("On a Table").tag(ViewerModel.Placing.table)
+                Text("In Front of You").tag(ViewerModel.Placing.inFront)
+            }
+            .pickerStyle(.segmented)
+            .labelsHidden()
+        }
+    }
+
+    /// The other two surfaces this drawing can be shown on.
+    ///
+    /// **Toggles, not buttons**, so the control that opens a window can also
+    /// close it. `openWindow` on a window that is already up only brings it
+    /// forward, which made these a switch with one position — the way back was
+    /// the window's own close button, somewhere else entirely. The windows
+    /// report whether they are on screen (`ViewerModel.isProgramWindowOpen` /
+    /// `isCodeWindowOpen`), since SwiftUI offers nothing to read that from.
+    ///
+    /// Short labels on purpose. Under a heading that has just said where the
+    /// drawing goes, 「ブロック」 and 「コード」 are the two other things it can
+    /// be, and "show" was a word every button in the row was already saying.
+    private struct SurfaceToggles: View {
+        let model: ViewerModel
+
+        @Environment(\.openWindow) private var openWindow
+        @Environment(\.dismissWindow) private var dismissWindow
+
+        var body: some View {
+            HStack(spacing: 12) {
+                Toggle(
+                    "Blocks", systemImage: "square.stack.3d.up",
+                    isOn: binding(model.isProgramWindowOpen, ViewerModel.programWindowID))
+                Toggle(
+                    "Code", systemImage: "curlybraces",
+                    isOn: binding(model.isCodeWindowOpen, ViewerModel.codeWindowID))
+            }
+            .toggleStyle(.button)
+            .buttonStyle(.bordered)
+        }
+
+        private func binding(_ isOpen: Bool, _ id: String) -> Binding<Bool> {
+            Binding(
+                get: { isOpen },
+                set: { $0 ? openWindow(id: id) : dismissWindow(id: id) })
+        }
+    }
+
+    /// What the sheet is doing, under the placement controls.
+    ///
+    /// Finding a table takes **ten seconds or more** on device, and the sheet
+    /// is deliberately not drawn until there is somewhere to put it — so
+    /// without this the app spends that time looking broken. Saying what it is
+    /// waiting for is the whole of the fix: a wait you understand is a wait,
+    /// and a wait you don't is a bug.
+    private struct PlacementStatus: View {
+        let model: ViewerModel
+
+        var body: some View {
+            switch (model.isPlaced, model.placement) {
+            // Nothing is out, so there is nothing to report and nothing to
+            // pinch. The picker above has already said where the drawing is.
+            case (false, _):
+                EmptyView()
+            case (_, .searching):
+                HStack(spacing: 8) {
+                    ProgressView()
+                        .controlSize(.small)
+                    Text("Looking for a table…")
+                }
+            // Floating is two different things now that it can be *chosen*
+            // (#53). Asking for a table and not getting one is news; asking for
+            // the air and getting it is not, and telling someone their choice
+            // failed when it did not is worse than saying nothing.
+            case (_, .floating):
+                Text(
+                    model.sitsOnTable
+                        ? "No table found, so it is floating in front of you."
+                        : "Pinch to resize, twist to turn, drag to move.")
+            case (_, .onTable):
+                Text("Pinch to resize, twist to turn, drag to move.")
+            }
+        }
+    }
+
+#endif
diff --git a/App/Views/WorkspaceView.swift b/App/Views/WorkspaceView.swift
index 217625f..a5ad2cc 100644
--- a/App/Views/WorkspaceView.swift
+++ b/App/Views/WorkspaceView.swift
@@ -632,7 +632,10 @@ struct ElseDividerRow: View {
             // either by the ⋯ or by long-press. The mouth is removed from
             // inside it, so "けす" means the same thing wherever it is found.
             Menu {
+                // See `RowControls.editingMenu`: the tint below belongs to the
+                // glyph, and a menu hands its tint to the popup as well.
                 removeButton
+                    .tint(nil)
             } label: {
                 // Inside the label, for the reason `RowControls` gives.
                 Label("More", systemImage: "ellipsis")
@@ -642,7 +645,7 @@ struct ElseDividerRow: View {
             .menuIndicator(.hidden)
             .buttonStyle(.borderless)
             .controlSize(.large)
-            .tint(BlockCategory.ink)
+            .blockMenuInk()
         }
         .blockChrome(
             BlockCategory.control.color, corners: .containerDivider,
@@ -787,9 +790,19 @@ struct InsertionTargetButton: View {
     let address: BodyAddress
     let workspace: WorkspaceEditor
 
+    @Environment(\.showsBlockEditing) private var showsBlockEditing
+
     private var isTarget: Bool { workspace.insertionTarget == address }
 
     var body: some View {
+        // Gone entirely when the program is only being read (#53). This is the
+        // palette's aim, and a viewer has no palette to aim.
+        if showsBlockEditing {
+            targetToggle
+        }
+    }
+
+    private var targetToggle: some View {
         Toggle(
             "Add Here",
             systemImage: isTarget ? "arrow.down.to.line.circle.fill" : "arrow.down.to.line.circle",
@@ -830,26 +843,49 @@ struct RowControls: View {
     /// The if block's "add an otherwise mouth", when this row has one.
     var addElseAction: (() -> Void)? = nil
 
+    @Environment(\.showsBlockEditing) private var showsBlockEditing
+
     var body: some View {
+        // Absent, not disabled, where the program is only being read (#53):
+        // the visionOS viewer's constant document binding already makes this
+        // menu incapable of changing anything, and a control that looks
+        // pressable and does nothing is worse than no control.
+        if showsBlockEditing {
+            editingMenu
+        }
+    }
+
+    private var editingMenu: some View {
         Menu {
-            Button("Move Up", systemImage: "chevron.up") {
-                workspace.move(blockID, by: -1)
-            }
-            Button("Move Down", systemImage: "chevron.down") {
-                workspace.move(blockID, by: 1)
-            }
-            if let addElseAction {
-                Button("Add Otherwise", systemImage: "arrow.triangle.branch", action: addElseAction)
+            // The popup keeps the system's own colours. `blockMenuInk()` below
+            // is a *tint*, and a tint reaches a menu's items as well as its
+            // glyph — which put a fixed near-black (#41) on macOS's dark menu
+            // background. Resetting it here is what lets the glyph keep the
+            // ink it needs against a pastel block.
+            Group {
+                Button("Move Up", systemImage: "chevron.up") {
+                    workspace.move(blockID, by: -1)
+                }
+                Button("Move Down", systemImage: "chevron.down") {
+                    workspace.move(blockID, by: 1)
+                }
+                if let addElseAction {
+                    Button(
+                        "Add Otherwise", systemImage: "arrow.triangle.branch",
+                        action: addElseAction
+                    )
                     // The hint the button on the header used to carry: what an
                     // else mouth *is* still needs saying, and a menu entry is
                     // where it is now read.
                     .accessibilityHint(
                         Text("Adds an otherwise mouth that runs when the condition fails"))
+                }
+                Divider()
+                Button("Delete", systemImage: "xmark.circle", role: .destructive) {
+                    workspace.delete(blockID)
+                }
             }
-            Divider()
-            Button("Delete", systemImage: "xmark.circle", role: .destructive) {
-                workspace.delete(blockID)
-            }
+            .tint(nil)
         } label: {
             // The finger target belongs *inside* the label: a `Menu` hit-tests
             // what it was handed to draw, so a `frame` wrapped around the menu
@@ -863,7 +899,7 @@ struct RowControls: View {
         .menuIndicator(.hidden)
         .buttonStyle(.borderless)
         .controlSize(.large)
-        .tint(BlockCategory.ink)
+        .blockMenuInk()
     }
 }
 
@@ -1057,3 +1093,39 @@ extension View {
                 isDropTargeted: isDropTargeted))
     }
 }
+
+extension EnvironmentValues {
+    /// Whether block rows draw the controls that *change* the program — the
+    /// row menu (⋯) and the container mouths' "add here" target toggle.
+    ///
+    /// True everywhere the workspace is an editor, and false in the visionOS
+    /// viewer's program window (#53), which shows the same rows for reading
+    /// only. It is an environment value rather than a parameter because the
+    /// two views that read it sit several layers below the one that knows —
+    /// threading a flag through `BlockListView`, `BlockRowView` and
+    /// `ContainerBlockRow` would put an argument on every one of them for the
+    /// benefit of two leaves.
+    ///
+    /// Hiding is not what enforces read-only — a constant document binding is
+    /// (see `ProgramWindow`). This is about not *offering* what cannot happen.
+    @Entry var showsBlockEditing = true
+}
+
+extension View {
+    /// The ⋯ glyph's colour, on the two menus a block row can carry.
+    ///
+    /// Every row this appears on is a filled pastel block, so the glyph takes
+    /// the same fixed near-black the label does (#41) rather than the system
+    /// accent — white on a pastel is the control nobody can see.
+    ///
+    /// It is a `tint` because that is what a `borderless` menu reads for its
+    /// label; `foregroundStyle` on the label is ignored there, which is how the
+    /// first attempt at this ended up with a white ⋯ in dark mode. The cost is
+    /// that the tint reaches the *popup* too, so each menu's content resets it
+    /// with `.tint(nil)` — a fixed dark ink is right against a pastel block and
+    /// wrong against macOS's dark menu background, which is the whole of the
+    /// bug this pair exists to hold apart.
+    fileprivate func blockMenuInk() -> some View {
+        tint(BlockCategory.ink)
+    }
+}
diff --git a/CLAUDE.md b/CLAUDE.md
index f395117..78c39d5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -22,6 +22,13 @@ xcodebuild -project TortoiseBlocks.xcodeproj -scheme TortoiseBlocks \
 # Manual verification loop (macOS):
 pkill -x TortoiseBlocks; open ~/Library/Developer/Xcode/DerivedData/TortoiseBlocks-*/Build/Products/Debug/TortoiseBlocks.app
 
+# visionOS. `-TBPlace` is the only way in: simctl sends no input, so without it
+# the run is a window of buttons nobody can press. It does NOT show the drawing
+# (see the tortoise note below) — it is for the load path, the USDZ, and the
+# program/code windows.
+xcrun simctl install <device> ~/Library/Developer/Xcode/DerivedData/TortoiseBlocks-*/Build/Products/Debug-xrsimulator/TortoiseBlocks.app
+xcrun simctl launch <device> space.hiraku.tortoiseblocks -TBPlace YES
+
 # The App Store listing (appstore/). The check needs no key and no bundle;
 # the other two need ASC_ISSUER_ID / ASC_KEY_ID / ASC_PRIVATE_KEY_PATH.
 ruby fastlane/metadata_check.rb            # what CI runs on every pull request
@@ -303,7 +310,8 @@ And a macOS QuickLook extension has to be sandboxed to be loaded, so it carries
 even though the app itself has none. `pluginkit -mAvvv | grep -i tortoise`
 confirms registration — the `-p com.apple.quicklook.thumbnail` filter does not
 match it and will make a working extension look missing.
-`TARGETED_DEVICE_FAMILY` is `"2"` — iPad and Mac, no iPhone (#29).
+`TARGETED_DEVICE_FAMILY` is `"2,7"` — iPad, Mac and Vision Pro, no iPhone
+(#29, #11).
 Documents are `.tortoise` files, but the exported UTI keeps the
 `tortoiseblocks` spelling (`space.hiraku.tortoiseblocks.project`, and
 `.block` for the drag payload), which is also the bundle ID's — the
@@ -356,8 +364,18 @@ greps `project.pbxproj` for the setting, because a build setting cannot
 enforce its own absence and Xcode writes one there the moment a team is
 picked in Signing & Capabilities.
 The everyday loop needs no team because **Debug ad-hoc-signs**
-(`CODE_SIGN_IDENTITY = "-"` on macOS for both targets). Release does not, and
-must not: those pins used to sit in Release too, which quietly made the
+(`CODE_SIGN_IDENTITY = "-"` on macOS for both targets). Note *on macOS* — the
+identity is `[sdk=macosx*]`-conditional, and it has to be written that way
+round. The extension had it as a bare `CODE_SIGN_IDENTITY = "-"` with an
+`[sdk=iphoneos*]` exception naming a real certificate, which reads the same
+until a platform arrives that the exception doesn't name: a visionOS *device*
+build then fell into the ad-hoc default and stopped with "has entitlements
+that require signing with a development certificate" (both targets are
+sandboxed, so ad-hoc is never enough on a device). Simulators hid it, because
+they ad-hoc sign whatever they are given. Name the platform that wants ad-hoc,
+never the ones that don't — the same rule as `#if !os(macOS)` in
+`PlatformModifiers`, and the same silent failure when it is inverted.
+Release does not ad-hoc sign, and must not: those pins used to sit in Release too, which quietly made the
 distribution configuration unable to archive at all — an ad-hoc macOS app
 cannot go to App Store Connect. Release is left to automatic signing, which
 is what Xcode Cloud's cloud signing then takes over; that is the whole reason
@@ -370,6 +388,173 @@ rules apply. The app takes `files.user-selected.read-write` for the
 `read-only` and is sandboxed for a different reason (a macOS QuickLook
 extension is not loaded otherwise).
 
+**visionOS runs the iPad app, not a port** (#11). `SUPPORTED_PLATFORMS` gains
+`xros xrsimulator`, `XROS_DEPLOYMENT_TARGET` is 26.0, and the same three-pane
+`NavigationSplitView` fills the window — the scene is regular width, so nothing
+in the layout is platform-conditional and no ornament or volumetric anything is
+declared. Both packages already shipped `.visionOS(.v26)`. What the platform
+actually costs is the `#if`s, in both directions. **A guard written
+`#if os(iOS)` stops applying** — it still compiles everywhere, so `LaunchScene`
+(`DocumentGroupLaunchScene` is unavailable on *macOS* only) and the numeric
+keyboard and touch targets in `PlatformModifiers` were silently dropped until
+they were rewritten as `#if !os(macOS)`. And some UIKit-era API is genuinely
+gone: `ToolbarSpacer` — the Liquid Glass grouping separator — is unavailable,
+which is the only reason `CanvasToolbar` exists as a `ToolbarContent` type of
+its own. That is also why CI builds visionOS: nothing else catches an `#if`
+that quietly does nothing.
+One layout constant *is* load-bearing here, though the layout itself isn't
+conditional: visionOS has **no draggable split-view divider** — macOS and
+iPadOS 26 both do — so the workspace column is stuck at its `ideal` for good
+while the canvas takes the rest of a wide window. That is what set the ideal at
+440; the measurement is in `App/Views/CLAUDE.md`.
+One thing is known-missing rather than done: **`hoverEffect` crashes** there —
+`.automatic` as well as `.highlight`, a `swift_release` segfault inside
+SwiftUI's update of `PaletteEntryButton.body`, before a window appears — so
+`pointerHover()` stays iOS-only and says so.
+
+**The app icon comes from a second, differently-shaped source.** visionOS wants
+a circular layered icon and Icon Composer writes only squares (plus watchOS
+circles), so `AppIcon.icon` produces nothing for it —
+`Assets.xcassets/AppIcon.solidimagestack` does, three
+`.solidimagestacklayer`s (Front / Middle / Back) of 1024×1024 at the `vision`
+idiom. The two carry the same name on purpose and do **not** collide:
+`ASSETCATALOG_COMPILER_APPICON_NAME` is `AppIcon` for every platform and actool
+routes by idiom, so the visionOS `Assets.car` gets a `SolidImageStack` and no
+`IconImageStack`, iOS gets the reverse, and macOS still gets `AppIcon.icns`.
+Check a change here in the *built* product rather than in Xcode — `assetutil
+--info` on each platform's `Assets.car` — because a stack that never made it in
+fails the same silent way a missing one does: the system's placeholder, which
+looks like a plain app that hasn't been styled yet.
+
+**The 3D tortoise is generated, not modelled** (#53).
+`App/Resources/Tortoise.usdz` — the sprite the immersive space will draw with —
+comes out of `Tools/tortoise-model/build_tortoise.py`, a Blender script whose
+constants *are* the three-view drawing's measurements. It is checked in
+alongside the script so no build step needs Blender. Four things about it are a
+contract app code will assume, and the reasoning for each is in
+`Tools/tortoise-model/README.md`: `upAxis = "Y"` with **forward at `-Z`** (the
+model is authored Z-up and the exporter puts `rotateXYZ = (-90, 0, 0)` on the
+root — wrong settings here are invisible until the tortoise drives sideways);
+**total length exactly 1.0** with `metersPerUnit = 1`, normalised rather than
+real-world because the canvas is a 0.2–2m gesture and the size is always
+computed anyway; the **origin is the ground point under the shell's centre**,
+the point it turns about, *not* the brush tip, so the drawn line trails behind
+the animal; and the whole thing rides in `App/` as a synchronized-folder
+resource, landing flat at `Contents/Resources/Tortoise.usdz` (verified in the
+built bundle, the only way that works — see the nested-CLAUDE.md note above).
+Blender rendering it proves nothing about RealityKit; `qlcheck.swift` in the
+same directory runs it through Apple's own USD stack instead.
+A fifth thing is a contract with the *room* rather than with app code: **every
+material emits a third of its own colour**, because a `.mixed` immersive space
+lights the model with the real room and a lamp-lit evening one drained the
+pastels to mud (measured: luminance 39 of 255, gold reading brown — 111 with
+emission, and the facets still step). Do not "fix" it as a PBR error, and do
+not lighten the colours instead: those are sampled from the drawing, which is
+the specification. The reasoning and the shell's second texture are in the
+tool README.
+
+**The tortoise on the table is drawn by us, and that took a library release**
+(#53 Phase 3, TortoiseGraphics2 2.1.0). The sheet is still the app's own
+`TortoiseCanvas` in a `ViewAttachmentComponent`; what changed is that it now
+draws everything *except* the tortoise (`.tortoiseSprite(.hidden)`), and the
+USDZ stands on the paper as a child of the sheet entity — so the pinch, twist
+and drag it inherits for free, and its own transform only ever says where on
+the page it is. Three upstream additions were needed and none of them had an
+honest app-side substitute. `.hidden` is a property of the *view*, unlike
+`hideTortoise()`, which records a command and would have followed the drawing
+into the SVG, the PNG, the thumbnail and the saved file.
+`TortoisePlayer.currentTortoiseState` is the pose **interpolated between
+commands**: `currentCommandIndex` — what every other surface in the app watches
+— changes about ten times a second, and a tortoise moved on that schedule
+teleports from command to command while the line it is drawing grows smoothly
+underneath it, which is the one thing this feature exists to show. And
+`ViewportMode.transform` is public so the placement asks for `autoFit`'s
+mapping rather than reimplementing it; a reimplementation agrees on the day it
+is written and drifts silently after. It is read once per *display frame*, from
+a `SceneEvents.Update` subscription — not from `body`, which would re-evaluate
+the view at the refresh rate — and the subscription has to be retained
+(`FrameTicker`), because one that nothing holds is cancelled at the end of
+`make` and looks exactly like a handler that is never called.
+Two numbers are judged on device and are the first things to change if it looks
+wrong: the tortoise is `1/12` of the sheet's side (deliberately larger than the
+2-D sprite's ~1/30 — on a screen it is a cursor, on a table it is the animal),
+and the paper keeps a 64pt margin, since a hidden sprite earns no `autoFit`
+inset and the drawing would otherwise run to the paper's edge with the tortoise
+hanging off it. The lift onto the paper is *measured* from the loaded model,
+not assumed: the feet reach ~6‰ of the body length below the origin, which is
+the ground point under the shell's centre.
+**The visionOS simulator cannot check any of this.** It does not host
+`ViewAttachmentComponent` views at all — the sheet's own `.task` never runs, so
+`TortoisePlayer` never attaches to a canvas and `currentTortoiseState` stays
+nil, which reads exactly like a broken tortoise. What the simulator *is* good
+for is the two things that would otherwise be guesses: that the USDZ loads in
+the real visionOS runtime with the bounds the contract promises, and that the
+per-frame subscription fires. Everything else is the headset.
+
+**The viewer has three surfaces, and the third is the code** (#53 Phase 3).
+Table, program, code — a `WindowGroup` each, all open at once. That is the
+whole argument for the platform restated one step further: iPad and Mac make
+the canvas and the code two states of *one toggle* because a window holds one
+of them, and a headset never has to choose. The code window is `CodePane`
+unchanged, which #11 had already made work here by taking it off
+`.background.secondary` (translucent glass on this platform, with the syntax
+colours left standing on nothing). The source is generated in
+`ViewerModel.load` rather than in the window's `body`: the iPad's pane is only
+in the hierarchy while its toggle says so, but a window redraws on its own
+schedule and nothing here can edit the program behind it.
+**The remote's controls are grouped by what they do, not by what they are.**
+The row used to read 「つくえに おく」「ブロックを みる」「コードを みる」, whose
+only shared property was being buttons — one placed the drawing, two opened
+windows — while placement's own mode switch and reset sat in a *different* row
+underneath with those two wedged between. Placement is now one group with its
+own question over it, the other surfaces are another below a divider, and three
+things fell out of doing it. The two verbs went: 「つくえに おく」 (put the
+drawing down) and 「つくえに のせる」 (look for a table at all) were nearly the
+same words for different things, invisible while they sat apart and unbearable
+once grouped — so `ViewerModel.placing` names the **three** states the window
+actually has (away / table / in front) and one picker asks them. It stays
+read-only and the window drives it through an async action, because `isPlaced`
+is only true once the space has really opened and a refused world-sensing prompt
+must leave the picker showing where the drawing *is*. A visionOS **ornament** was the other candidate for those
+two — the platform's own place for "belongs to this window but is not its
+content" — and was turned down: it is always visible, so it hangs under the
+window even in the small "えが ありません" state and adds its height to every
+glance, and a divider already says the difference for nothing. The window
+buttons became toggles, since `openWindow` on an open window only brings it
+forward — a switch with one position — so the windows report themselves through
+`isProgramWindowOpen` / `isCodeWindowOpen`, there being nothing in SwiftUI to
+read that from. And floating stopped being an error: it can now be *chosen*, so
+`PlacementStatus` says "no table found" only when a table was actually asked
+for.
+
+**Opening a drawing puts it down**, and that is the placement group's last
+open question answered. Choosing a file used to change nothing but the window:
+the room stayed empty until the picker was touched, so the app read as one
+that had not opened the file — the state with the least to look at was the one
+reached by doing the thing the app is for. An alert asking "shall I put it on
+the table?" was the obvious fix and is the wrong one twice over: the answer is
+always yes, and the first placement already raises the world-sensing prompt, so
+it would be two modals in a row before anything appeared. So a load *is* a
+placement, through `ViewerModel.loadGeneration` — a counter rather than a flag,
+because `blocks` cannot say "chosen again" when the same drawing is picked
+twice, and because the five call sites (the importer and the four samples)
+should not each have to remember. Where it goes is `sitsOnTable`, which is
+therefore now a *remembered* preference rather than only the space's own
+question: someone who has once said 「めのまえ」 is not asked again on the next
+file. Nothing about it is a special case — the picker moves to wherever the
+load put it, 「ださない」 takes it away, and a second file opened while one is
+already out leaves the sheet exactly where it was dragged to, because `place`
+sees the drawing is already there and returns.
+
+**SVG/PNG export was built here and then taken back out**, and the reason is
+worth keeping so it is not re-added as an oversight: it worked, and cost one
+view — `CanvasExportMenu` unchanged, rendering `lastRunCommands`, so moving the
+drawing into an immersive space changed nothing about what came out. It came
+out because a viewer cannot change a drawing, so the file it was handed is
+already the artifact, and writing a second one from it belongs where drawings
+are *made*. The window is a remote control, and its row had reached four
+buttons.
+
 **Releasing, the store listing and the website are in the `release` skill.** Tags, Xcode Cloud, TestFlight, `appstore/`, fastlane, and `site/`.
 
 **Localization**: `en` is the source language; Japanese (kid-friendly
diff --git a/README.md b/README.md
index da35bb0..1c4f0a0 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 [![Swift](https://img.shields.io/badge/Swift-6.2-orange.svg)](https://swift.org)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![Platform](https://img.shields.io/badge/platform-iPadOS%2026%2B%20%7C%20macOS%2026%2B-lightgrey.svg)]()
+[![Platform](https://img.shields.io/badge/platform-iPadOS%2026%2B%20%7C%20macOS%2026%2B%20%7C%20visionOS%2026%2B-lightgrey.svg)]()
 
 A visual programming app for kids — snap blocks together, press play, and
 watch the tortoise draw. Powered by
@@ -56,7 +56,8 @@ graphics engine written in Swift.
 ## Requirements
 
 - **Xcode** 26+ (Swift 6.2)
-- **Platforms** iPadOS 26+ · macOS 26+ (visionOS planned)
+- **Platforms** iPadOS 26+ · macOS 26+ · visionOS 26+ (the same three-pane app,
+  in a window on Vision Pro)
 
 ## Getting Started
 
@@ -171,11 +172,11 @@ arithmetic saturates the same way, so a value can never run off to infinity.
 ## Releasing
 
 A `v*` tag is the release. Pushing one starts an Xcode Cloud workflow that
-archives both platforms and sends them to TestFlight, while GitHub Actions
-checks that the tag matches `MARKETING_VERSION` in every configuration — the
-two are otherwise unconnected, and a mismatch would ship the wrong version
-silently. The same tag drafts a GitHub release, with notes split by whether a
-commit reached the app or only the site, the listing, CI or the docs.
+archives the app for each platform and sends the builds to TestFlight, while
+GitHub Actions checks that the tag matches `MARKETING_VERSION` in every configuration
+— the two are otherwise unconnected, and a mismatch would ship the wrong
+version silently. The same tag drafts a GitHub release, with notes split by
+whether a commit reached the app or only the site, the listing, CI or the docs.
 
 The store listing is not part of that. It lives in [appstore/](appstore/) and
 goes up on demand, by hand:
diff --git a/Support/Info.plist b/Support/Info.plist
index cf8baa0..ba875af 100644
--- a/Support/Info.plist
+++ b/Support/Info.plist
@@ -19,6 +19,8 @@
 	</array>
 	<key>ITSAppUsesNonExemptEncryption</key>
 	<false/>
+	<key>NSWorldSensingUsageDescription</key>
+	<string>Used to place your drawing on a real table.</string>
 	<key>UIFileSharingEnabled</key>
 	<true/>
 	<key>UTExportedTypeDeclarations</key>
diff --git a/Tools/tortoise-model/README.md b/Tools/tortoise-model/README.md
new file mode 100644
index 0000000..d29be08
--- /dev/null
+++ b/Tools/tortoise-model/README.md
@@ -0,0 +1,129 @@
+# The 3D tortoise
+
+`App/Resources/Tortoise.usdz` is generated, not modelled. This directory is
+what generates it.
+
+The design came in as a three-view drawing (top / side / front / rear, #53),
+and every shape in it is a primitive — a domed shell, an ellipsoid head,
+four flipper blobs, a beret, a tail ending in a brush. That is what makes a
+script the right tool rather than the lazy one: the numbers in
+`build_tortoise.py` *are* the drawing's measurements, so a proportion can be
+argued about and changed in one place instead of being pushed around by hand
+and then lost.
+
+## Running it
+
+```bash
+cd Tools/tortoise-model
+
+# Build the model.  Writes Tortoise.usdz, tortoise.blend and the shell's
+# gradient texture into --out.
+blender --background --python build_tortoise.py -- --out /tmp/tortoise
+
+# Render the same views as the drawing, to compare against it.  --only takes
+# a comma-separated subset (top side front rear hero tail head); a full sheet
+# is seven renders and several minutes.
+blender --background /tmp/tortoise/tortoise.blend --python render_views.py -- \
+    --out /tmp/tortoise --only tail,side
+python3 sheet.py /tmp/tortoise      # composites them, needs Pillow
+
+# Then copy the result over the committed asset.
+cp /tmp/tortoise/Tortoise.usdz ../../App/Resources/Tortoise.usdz
+```
+
+Built with Blender 5.2 LTS. `build_tortoise.py` needs nothing but Blender's
+own bundled Python — the shell's gradient PNG is written out of `zlib` and
+`struct` rather than Pillow for exactly that reason. Only `sheet.py`, which
+is a convenience for looking at renders, wants Pillow, and it runs under the
+system `python3`.
+
+## Verifying it
+
+Blender rendering the model proves nothing about whether *RealityKit* can
+read it. Ask Apple's own USD stack instead:
+
+```bash
+xcrun swiftc -O qlcheck.swift -o /tmp/qlcheck
+/tmp/qlcheck ../../App/Resources/Tortoise.usdz /tmp/tortoise-ql.png
+```
+
+That runs the file through QuickLook, which parses and renders it with the
+same USD implementation the app will. `qlmanage -t` is the obvious
+alternative and tends to hang — the same trap as the thumbnail extension
+(see the root `CLAUDE.md`).
+
+Worth checking the stage metadata too, since it is what decides which way up
+the animal arrives:
+
+```bash
+usdcat --flatten ../../App/Resources/Tortoise.usdz -o /tmp/flat.usda
+grep -m3 -E 'upAxis|metersPerUnit|defaultPrim' /tmp/flat.usda
+```
+
+## The contract the app depends on
+
+These are the things app code will assume, so changing one is a change to
+the app and not just to the asset.
+
+- **`upAxis = "Y"`, forward is `-Z`** — RealityKit's convention, not
+  Blender's. The model is authored Z-up with the head at `+Y` and the
+  exporter puts a `rotateXYZ = (-90, 0, 0)` on the root prim to convert.
+  Confirm with `usdcat` after any change to the export settings; getting it
+  wrong is invisible until the tortoise drives sideways.
+- **Total length is 1.0**, nose tip to brush tip, with `metersPerUnit = 1`.
+  Deliberately normalised rather than given a real-world size: the canvas is
+  a gesture between 0.2m and 2m (#53), so the tortoise's size is always
+  computed anyway, and a unit-length model makes that `scale = the length you
+  want`.
+- **The origin is the point on the ground under the shell's centre** — the
+  tortoise's position, and the point it turns about. Not the brush tip. The
+  brush is the pen, so the drawn line trails *behind* the animal; putting the
+  origin at the brush instead would make the line exact and the turning
+  strange, and that trade was decided in favour of ordinary turning.
+- Bounds, for framing: `x ±0.309`, `y 0 .. 0.386` (height), `z -0.543` (nose)
+  `.. +0.457` (brush). The brush tip is at `(0, 0.066, 0.457)`.
+- Fifteen named meshes under one `Tortoise` xform, five materials, two small
+  textures (the shell's ramp, and the same ramp dimmed for emission); about
+  2,200 triangles.
+- **Every material emits a third of its own colour** (`EMISSION`). Not
+  decoration — see below.
+
+## Three things that look like mistakes and are not
+
+**The shell's ramp is squared** (`SHELL_RAMP_BIAS`). It runs blue at the rim
+to pink at the apex, by height — but the view that matters is from above,
+and a dome seen from above shows only `v²` of its projected area below height
+`v`. Mapped straight, three quarters of the top view comes out pink.
+
+**Every material has an `emissiveColor`, and the shell has a second texture
+for it.** A tortoise is not a lamp, so this looks like a mistake in the PBR
+setup, and removing it is a one-line change that will look correct and undo
+the reason it is here.
+
+In a `.mixed` immersive space RealityKit lights the model with the **real
+room**. Measured against the shipped no-emission build under a lamp-lit
+evening room, the pastels came out at 39 of 255 in luminance — the gold read
+brown, the blue-to-pink dome read muddy teal — which is the state the
+maintainer reported from the headset. At `EMISSION = 0.35` the same render is
+111, a factor of 2.8, and the facets still step (all of it, and the tortoise
+flattens into a sticker). Under QuickLook's bright studio lighting the same
+change is only +12%, which is the point: emission is a floor that a dark room
+cannot take away, not a brightness knob.
+
+Lightening the colours instead was the alternative and is wrong: they are
+sampled from the three-view drawing, which is the specification. Emission
+leaves the design alone and lets it read at its own value in any room.
+
+The shell needs a *second* PNG because `UsdPreviewSurface` has no emissive
+strength — only `emissiveColor` — so feeding it the diffuse texture makes the
+dome emit at full value while every other part emits at a third, and the shell
+washes out. A multiply node in Blender does not survive the export either: the
+preview-surface writer follows a fixed set of node patterns and drops the rest,
+silently. The dimming is baked in **linear** light, and the ratio is checked at
+three points along the ramp (0.347–0.354 against the flat materials' 0.35).
+
+**The brush tip is uneven.** Alternate hairs stop a third of the bundle
+short. Three level-tipped versions were built after this one — radial fluting,
+a bellied profile, and fourteen separately modelled strands — and the
+maintainer chose this shape to come back to. There is a longer note at
+`BRISTLE_NOTCH`.
diff --git a/Tools/tortoise-model/build_tortoise.py b/Tools/tortoise-model/build_tortoise.py
new file mode 100644
index 0000000..3bcf859
--- /dev/null
+++ b/Tools/tortoise-model/build_tortoise.py
@@ -0,0 +1,733 @@
+"""Build the 3D tortoise from the three-view drawing, and write a USDZ.
+
+Run with:  blender --background --python build_tortoise.py -- [--out DIR]
+
+Everything is parametric: the numbers below were read off the drawing (in
+pixels) and normalised so the whole animal is **1.0 unit long**, nose tip to
+brush tip.  The app scales that to whatever the canvas is.
+
+Axes while building (Blender's own): +X right, +Y forward (the head), +Z up.
+The origin is the point on the ground directly under the shell's centre — the
+tortoise's "position", i.e. what turns when it turns.  Export converts to
+USD/RealityKit convention (+Y up, -Z forward).
+"""
+
+import math
+import os
+import sys
+
+import bmesh
+import bpy
+from mathutils import Matrix, Vector
+
+# --------------------------------------------------------------------------
+# Proportions, read off the three-view drawing.
+#
+# Top view was measured over 565px nose-to-brush; the side view over 540px.
+# Both are the same animal, so every measurement below is divided by its own
+# view's total and expressed as a fraction of the overall length L = 1.0.
+# --------------------------------------------------------------------------
+
+L = 1.0  # total length, nose tip to brush tip
+
+# Shell — a low-poly dome.  325px across, 150px tall (side view).
+#
+# The rim height is the one number that has to be got right against the body,
+# and getting it wrong is not subtle: with the rim *below* the body's top the
+# golden ellipsoid rises through the dome and the animal reads as a sausage
+# with a hat.  The rim must sit just inside the body's surface — see BODY_Z.
+SHELL_R = 0.288  # radius in the ground plane
+SHELL_BASE_Z = 0.115  # the dome's rim height
+SHELL_TOP_Z = 0.380  # the animal's full height, from the side view
+SHELL_H = SHELL_TOP_Z - SHELL_BASE_Z
+
+# Body / plastron — the golden rim that shows under the shell in the front
+# and rear views.  Barely wider than the dome (0.014 of rim, which is what the
+# drawing shows) and *flat*: it is a rim, not a torso.
+BODY_R_X = 0.302
+BODY_R_Y = 0.312
+BODY_R_Z = 0.082
+BODY_Z = 0.098
+# Where the body's surface crosses the dome's rim radius:
+#   0.098 +- 0.082 * sqrt(1 - (0.288/0.302)^2) = 0.073 .. 0.123
+# so a rim at 0.115 is buried 0.008 deep and the seam cannot open.
+
+# Head — a teardrop: rounded point at the nose, widest about two thirds back.
+HEAD_NOSE_Y = 0.543  # the nose, measured forward of the shell's centre
+HEAD_LEN = 0.250
+HEAD_R_X = 0.089
+HEAD_R_Z = 0.093
+HEAD_Z = 0.209
+# How much narrower the nose is than the back of the head.  Applied through a
+# smoothstep, not a power curve: an ellipsoid is already closing toward its
+# own end, so a taper that keeps biting there compounds into a spike.  The
+# drawing's head stays broad most of the way and only rounds off near the tip,
+# which is a shallow taper, not a steep one.
+HEAD_TAPER = 0.26
+
+# Beret — a purple one, worn on the head with a backward tilt.
+#
+# The drawing reads as a collar round the neck and it is not one; this is a
+# hat.  Taken literally the drawing puts the purple almost upright, facing
+# forward, which is exactly why it reads as a collar: at that angle the crown
+# points at the shell, the head hides it, and all that is left to see is the
+# rolled edge — a ring.  Built that way once and it still looked like a
+# collar, so the tilt is set by what makes it legible as a hat instead, and
+# the drawing loses this one.  It is the element the drawing was wrong about.
+#
+# What makes it a beret rather than a purple disc: a domed crown wider than
+# the skull, so it overhangs; the rolled band round the bottom edge; and the
+# little nub on top.
+# Every dimension goes through one factor, so resizing the hat stays a single
+# number instead of four that can drift apart.  0.70 is against the first pass,
+# which sat too big on the head.
+BERET_SCALE = 0.70
+BERET_R = 0.115 * BERET_SCALE  # the crown, and the ring the rolled edge follows
+BERET_DOME = 0.065 * BERET_SCALE  # how far the crown rises above the band
+BERET_RIM = 0.020 * BERET_SCALE  # the rolled edge; outer radius is R + this
+BERET_NUB = 0.019 * BERET_SCALE
+# Sitting a little lower and straighter than the big one did: a small cap at a
+# steep angle perches rather than is worn, because its front edge lifts off the
+# skull by more of the head's own height the smaller it gets.
+BERET_POS = (0.0, 0.332, 0.274)
+BERET_TILT = math.radians(28.0)
+
+# Legs — four flippers, splayed out at roughly 40 degrees.
+#
+# Their centres sit almost exactly on the shell's edge circle (measured: 0.280
+# from the centre against a shell radius of 0.288), so what shows outside the
+# rim is roughly one half-length of flipper.  That is the drawing's silhouette.
+LEG_R = (0.082, 0.068, 0.054)  # outward, along, up
+LEG_Z = 0.048  # centre height; the underside just kisses the ground
+FRONT_LEG = (0.220, 0.202)  # |x|, y
+REAR_LEG = (0.236, -0.194)
+LEG_SPLAY = math.radians(40.0)
+
+# Tail — a tapering shaft ending in a paintbrush.  This is the pen.
+#
+# Both halves are generated from *one* segment, base to tip, and that is the
+# point rather than tidiness: built separately, the shaft took a pitch to match
+# its two end heights while the brush stayed level, and the join came out with
+# a visible kink in it.  A brush is one straight object; there is nowhere for a
+# second axis to come from.
+TAIL_BASE = Vector((0.0, -0.270, 0.092))
+TAIL_TIP = Vector((0.0, -0.457, 0.070))
+FERRULE_T = 0.66  # where the golden shaft stops and the bristles start
+TAIL_R_BASE = 0.050
+TAIL_R_TIP = 0.034
+BRUSH_R = 0.056
+BRISTLES = 10
+BRISTLE_NOTCH = 0.34  # how far back the gaps between hairs are cut
+
+# This tip is **deliberately uneven**: alternate hairs stop a third of the
+# bundle short, so the end is a zigzag rather than a cut.
+#
+# Which is worth a note, because it looks like an oversight and is not.  Three
+# other tips were built after this one — the notch swapped for radial fluting
+# so the end came out flat, then a bellied profile, then fourteen separately
+# modelled strands splaying to a level cut.  The maintainer looked at all of
+# them and chose this one to come back to.  So a future pass that "fixes" the
+# ragged end is redoing work that was already done and already rejected.
+
+
+# Eyes — big, forward, sitting proud of the snout.
+#
+# They have to read from *above* as well as from the front: the drawing shows
+# both eyes whole in the top view, and the top view is the one the app will
+# mostly show, since the tortoise is being watched drawing on a table.  So the
+# pupils face up-and-forward rather than out to the sides.
+EYE_X = 0.052
+EYE_Y = 0.444
+EYE_Z = 0.250
+EYE_R = 0.043
+PUPIL_R = 0.031
+PUPIL_OUT = 0.017  # how far the pupil pokes out of the white
+PUPIL_AIM = (0.42, 0.70, 0.58)  # outward, forward, up — normalised on use
+
+# --------------------------------------------------------------------------
+# Colours, sampled from the drawing.
+# --------------------------------------------------------------------------
+
+GOLD = (0.867, 0.706, 0.310)
+PURPLE = (0.557, 0.184, 0.753)
+SHELL_LOW = (0.341, 0.776, 0.910)  # blue, at the rim
+SHELL_HIGH = (0.933, 0.447, 0.835)  # pink, at the apex
+# The ramp runs up the dome's *height*, but the view that matters most is from
+# above — the animal is being watched drawing on a table — and a dome seen from
+# above shows only v^2 of its projected area below height v.  Mapped straight,
+# three quarters of the top view comes out pink.  Squaring the coordinate puts
+# the halfway colour at v = 0.71, which is where the drawing has it.
+SHELL_RAMP_BIAS = 2.0
+WHITE = (0.980, 0.980, 0.980)
+BLACK = (0.055, 0.055, 0.060)
+
+# How much of its own colour each material gives off, on top of what the room
+# lends it.
+#
+# **This is not decoration, it is what makes the colours survive the room.** In
+# a `.mixed` immersive space RealityKit lights the model with the *real* room,
+# so a lamp-lit living room in the evening dims every one of these and tints
+# what is left — and the colours above are sampled from the three-view drawing,
+# which is the whole specification. Lightening them instead would move the
+# design to suit one room; emission leaves the design alone and lets it read at
+# its own value in any room.
+#
+# 0.35 rather than more: the shading is what makes a low-poly dome look faceted,
+# and emission is flat by definition, so all of it and the tortoise turns into a
+# sticker. At this level the facets still step and the pastels stop going grey.
+# Judged on the headset, in a room — a render cannot tell you this, because the
+# renderer's lights are not the room's.
+EMISSION = 0.35
+
+GRADIENT_PNG = "shell_gradient.png"
+EMISSION_PNG = "shell_gradient_emission.png"
+
+
+# --------------------------------------------------------------------------
+# Scene plumbing
+# --------------------------------------------------------------------------
+
+
+def clear_scene():
+    bpy.ops.wm.read_factory_settings(use_empty=True)
+
+
+def srgb_to_linear_one(u):
+    return u / 12.92 if u <= 0.04045 else ((u + 0.055) / 1.055) ** 2.4
+
+
+def linear_to_srgb(u):
+    u = min(max(u, 0.0), 1.0)
+    return 12.92 * u if u <= 0.0031308 else 1.055 * u ** (1 / 2.4) - 0.055
+
+
+def srgb_to_linear(c):
+    return tuple(srgb_to_linear_one(x) for x in c)
+
+
+def plain_material(name, colour, roughness=0.45):
+    """A Principled BSDF in one flat colour, which is all UsdPreviewSurface
+    needs for everything except the shell."""
+    mat = bpy.data.materials.new(name)
+    mat.use_nodes = True
+    bsdf = mat.node_tree.nodes["Principled BSDF"]
+    lin = srgb_to_linear(colour)
+    bsdf.inputs["Base Color"].default_value = (*lin, 1.0)
+    bsdf.inputs["Roughness"].default_value = roughness
+    bsdf.inputs["Metallic"].default_value = 0.0
+    # Its own colour, not white: emission at white would wash every part toward
+    # grey and take the pastels with it, which is the problem, not the fix.
+    bsdf.inputs["Emission Color"].default_value = (*lin, 1.0)
+    bsdf.inputs["Emission Strength"].default_value = EMISSION
+    mat.diffuse_color = (*lin, 1.0)
+    return mat
+
+
+def gradient_material(name, png_path, emission_png_path, roughness=0.35):
+    """The shell's blue-to-pink ramp, as an image texture.
+
+    A texture rather than vertex colours on purpose: `primvars:displayColor`
+    is not reliably honoured once a material is bound, while an image feeding
+    UsdPreviewSurface's diffuse is exactly what RealityKit reads.
+    """
+    mat = bpy.data.materials.new(name)
+    mat.use_nodes = True
+    tree = mat.node_tree
+    bsdf = tree.nodes["Principled BSDF"]
+    bsdf.inputs["Roughness"].default_value = roughness
+    bsdf.inputs["Metallic"].default_value = 0.0
+
+    tex = tree.nodes.new("ShaderNodeTexImage")
+    tex.image = bpy.data.images.load(png_path)
+    tex.image.colorspace_settings.name = "sRGB"
+    tex.interpolation = "Closest"
+    tex.location = (-320, 260)
+    tree.links.new(tex.outputs["Color"], bsdf.inputs["Base Color"])
+
+    # The same ramp again, pre-dimmed — see `write_gradient_png`. A *ramp* and
+    # not one flat emissive tint, because a single colour here would drag the
+    # blue rim and the pink apex toward each other and flatten the gradient the
+    # dome exists to show.
+    emis = tree.nodes.new("ShaderNodeTexImage")
+    emis.image = bpy.data.images.load(emission_png_path)
+    emis.image.colorspace_settings.name = "sRGB"
+    emis.interpolation = "Closest"
+    emis.location = (-320, -80)
+    tree.links.new(emis.outputs["Color"], bsdf.inputs["Emission Color"])
+    # 1.0: the dimming is in the image, so a strength here would apply it twice.
+    bsdf.inputs["Emission Strength"].default_value = 1.0
+    return mat
+
+
+def write_gradient_png(path, scale=1.0):
+    """A 8x256 strip: blue at the bottom (v=0, the rim), pink at the top.
+
+    Written by hand out of `zlib` and `struct` because Blender ships its own
+    Python and it has no Pillow.  A PNG is a signature plus three chunks, and
+    the whole image is 2KB — pulling a dependency into the build for that
+    would cost more than the twenty lines.
+
+    `scale` dims the whole ramp, and exists because the shell needs a *second*
+    copy of it for emission.  Everything else can say "my own colour times
+    EMISSION" in one shader input, but UsdPreviewSurface has no emissive
+    strength — only `emissiveColor` — so feeding the diffuse texture straight
+    into it makes the shell emit at full value while every other part emits at
+    a third, and the dome washes out.  A Blender multiply node in between does
+    not survive the export either: the preview-surface writer follows a fixed
+    set of node patterns and drops the rest, silently.  So the scaling is baked
+    into a second image.
+
+    It is done in **linear** light, not on the stored bytes.  These ramp
+    endpoints are sRGB, the texture is tagged sRGB, and the shader decodes it
+    before shading — so scaling the bytes would darken the shell well past the
+    third the other materials give off (0.35 of an sRGB byte is nearer 0.1 of
+    the light it stands for).
+    """
+    import struct
+    import zlib
+
+    w, h = 8, 256
+    raw = bytearray()
+    for row in range(h):
+        # Row 0 is the top of the image, which is v = 1.
+        t = 1.0 - row / (h - 1)
+        rgb = bytes(
+            int(
+                round(
+                    255
+                    * linear_to_srgb(
+                        srgb_to_linear_one(
+                            SHELL_LOW[i] + (SHELL_HIGH[i] - SHELL_LOW[i]) * t
+                        )
+                        * scale
+                    )
+                )
+            )
+            for i in range(3)
+        )
+        raw.append(0)  # filter type 0 (None) for this scanline
+        raw += rgb * w
+
+    def chunk(kind, payload):
+        return (
+            struct.pack(">I", len(payload))
+            + kind
+            + payload
+            + struct.pack(">I", zlib.crc32(kind + payload) & 0xFFFFFFFF)
+        )
+
+    png = (
+        b"\x89PNG\r\n\x1a\n"
+        + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0))
+        + chunk(b"IDAT", zlib.compress(bytes(raw), 9))
+        + chunk(b"IEND", b"")
+    )
+    with open(path, "wb") as f:
+        f.write(png)
+    return path
+
+
+def new_object(name, bm, material, smooth=True):
+    mesh = bpy.data.meshes.new(name)
+    bm.to_mesh(mesh)
+    bm.free()
+    for poly in mesh.polygons:
+        poly.use_smooth = smooth
+    mesh.materials.append(material)
+    obj = bpy.data.objects.new(name, mesh)
+    bpy.context.collection.objects.link(obj)
+    return obj
+
+
+def icosphere(bm, subdivisions, radius=1.0):
+    try:
+        bmesh.ops.create_icosphere(bm, subdivisions=subdivisions, radius=radius)
+    except TypeError:  # older bmesh spelled it "diameter"
+        bmesh.ops.create_icosphere(bm, subdivisions=subdivisions, diameter=radius)
+
+
+def cone(bm, segments, r1, r2, depth, matrix=None):
+    kwargs = dict(
+        cap_ends=True,
+        cap_tris=False,
+        segments=segments,
+        depth=depth,
+        matrix=matrix or Matrix.Identity(4),
+    )
+    try:
+        bmesh.ops.create_cone(bm, radius1=r1, radius2=r2, **kwargs)
+    except TypeError:
+        bmesh.ops.create_cone(bm, diameter1=r1, diameter2=r2, **kwargs)
+
+
+def align_to(p0, p1):
+    """The matrix that puts a part built along local +Z onto the segment
+    p0 -> p1, centred on it."""
+    axis = Vector(p1) - Vector(p0)
+    rot = axis.to_track_quat("Z", "Y").to_matrix().to_4x4()
+    return Matrix.Translation((Vector(p0) + Vector(p1)) / 2.0) @ rot
+
+
+def apply_matrix(bm, m):
+    for v in bm.verts:
+        v.co = m @ v.co
+
+
+def cone_between(bm, p0, p1, r0, r1, segments):
+    """A frustum from p0 (radius r0) to p1 (radius r1)."""
+    length = (Vector(p1) - Vector(p0)).length
+    cone(bm, segments, r0, r1, length, matrix=align_to(p0, p1))
+
+
+def torus(bm, major, minor, ring_n=24, tube_n=12):
+    """A torus in the local XY plane, its axis along +Z."""
+    rows = []
+    for i in range(ring_n):
+        a = 2 * math.pi * i / ring_n
+        nx, ny = math.cos(a), math.sin(a)
+        row = []
+        for j in range(tube_n):
+            b = 2 * math.pi * j / tube_n
+            r = major + minor * math.cos(b)
+            row.append(bm.verts.new((nx * r, ny * r, minor * math.sin(b))))
+        rows.append(row)
+    bm.verts.ensure_lookup_table()
+    for i in range(ring_n):
+        for j in range(tube_n):
+            bm.faces.new(
+                (
+                    rows[i][j],
+                    rows[i][(j + 1) % tube_n],
+                    rows[(i + 1) % ring_n][(j + 1) % tube_n],
+                    rows[(i + 1) % ring_n][j],
+                )
+            )
+
+
+def scale_verts(bm, sx, sy, sz, offset=(0.0, 0.0, 0.0)):
+    for v in bm.verts:
+        v.co.x = v.co.x * sx + offset[0]
+        v.co.y = v.co.y * sy + offset[1]
+        v.co.z = v.co.z * sz + offset[2]
+
+
+# --------------------------------------------------------------------------
+# The parts
+# --------------------------------------------------------------------------
+
+
+def build_shell(material):
+    """The dome: an icosphere squashed to the shell's proportions, with the
+    bottom half thrown away.
+
+    Subdivision 2 is what the drawing shows — about 160 triangles over the
+    dome.  A subdivided icosahedron has a closed loop of vertices exactly at
+    the equator (the cross-band edge midpoints land at z=0 and stay there
+    through normalisation), so cutting it in half leaves a clean rim.
+
+    Flat-shaded, and the only part of the animal that is: the faceting is the
+    whole look, and everything golden is smooth in the drawing.
+    """
+    bm = bmesh.new()
+    icosphere(bm, subdivisions=2, radius=1.0)
+
+    # Keep the top half.  A small epsilon so the equatorial ring survives.
+    doomed = [v for v in bm.verts if v.co.z < -1e-5]
+    bmesh.ops.delete(bm, geom=doomed, context="VERTS")
+
+    scale_verts(bm, SHELL_R, SHELL_R, SHELL_H, offset=(0, 0, SHELL_BASE_Z))
+
+    # Cap the open rim.  It sits inside the golden body, so it is never seen —
+    # but an open mesh shows its own inside through the silhouette at grazing
+    # angles, and a cap costs a dozen triangles.
+    rim = [e for e in bm.edges if len(e.link_faces) == 1]
+    bmesh.ops.holes_fill(bm, edges=rim)
+
+    # Per-face UVs: all three corners of a triangle take the v of the face's
+    # centre, so each facet is one flat colour and the ramp still runs up the
+    # dome.  That is the low-poly look in the drawing — flat steps, not a
+    # smooth wash.
+    uv = bm.loops.layers.uv.new("UVMap")
+    lo, hi = SHELL_BASE_Z, SHELL_TOP_Z
+    for face in bm.faces:
+        v = (face.calc_center_median().z - lo) / (hi - lo)
+        v = min(max(v, 0.0), 1.0) ** SHELL_RAMP_BIAS
+        for loop in face.loops:
+            loop[uv].uv = (0.5, v)
+
+    return new_object("Shell", bm, material, smooth=False)
+
+
+def build_body(material):
+    bm = bmesh.new()
+    icosphere(bm, subdivisions=3, radius=1.0)
+    scale_verts(bm, BODY_R_X, BODY_R_Y, BODY_R_Z, offset=(0, 0, BODY_Z))
+    return new_object("Body", bm, material)
+
+
+def build_head(material):
+    """An ellipsoid tapered toward the nose — the teardrop in the top view."""
+    bm = bmesh.new()
+    icosphere(bm, subdivisions=3, radius=1.0)
+    half = HEAD_LEN / 2.0
+    centre_y = HEAD_NOSE_Y - half
+    scale_verts(bm, HEAD_R_X, half, HEAD_R_Z, offset=(0, centre_y, HEAD_Z))
+
+    for v in bm.verts:
+        # f = 0 at the back of the head, 1 at the nose.
+        f = (v.co.y - (centre_y - half)) / HEAD_LEN
+        f = min(max(f, 0.0), 1.0)
+        k = 1.0 - HEAD_TAPER * (f * f * (3.0 - 2.0 * f))  # smoothstep
+        v.co.x *= k
+        v.co.z = HEAD_Z + (v.co.z - HEAD_Z) * k
+
+    return new_object("Head", bm, material)
+
+
+def build_beret(material):
+    """A domed crown, the rolled band round its base, and the nub on top.
+
+    All three are built flat in the local XY plane and tilted together, so the
+    band stays in the crown's plane and the nub stays on the crown's axis
+    whatever the tilt is set to.  The head pushes up into the open underside,
+    which is what holds the hat on.
+    """
+    bm = bmesh.new()
+
+    # The crown: the top half of a squashed sphere, capped underneath.
+    icosphere(bm, subdivisions=3, radius=1.0)
+    doomed = [v for v in bm.verts if v.co.z < -1e-5]
+    bmesh.ops.delete(bm, geom=doomed, context="VERTS")
+    scale_verts(bm, BERET_R, BERET_R, BERET_DOME)
+    bmesh.ops.holes_fill(bm, edges=[e for e in bm.edges if len(e.link_faces) == 1])
+
+    torus(bm, BERET_R, BERET_RIM, ring_n=24, tube_n=10)
+
+    nub = bmesh.new()
+    icosphere(nub, subdivisions=2, radius=BERET_NUB)
+    for v in nub.verts:
+        v.co.z += BERET_DOME
+    mesh = bpy.data.meshes.new("_nub")
+    nub.to_mesh(mesh)
+    nub.free()
+    bm.from_mesh(mesh)
+    bpy.data.meshes.remove(mesh)
+
+    m = Matrix.Translation(Vector(BERET_POS)) @ Matrix.Rotation(BERET_TILT, 4, "X")
+    apply_matrix(bm, m)
+    return new_object("Beret", bm, material)
+
+
+def build_neck(material):
+    """Joins the head to the body.
+
+    It has real work to do now that the purple is a hat rather than a collar:
+    the head's centre sits above the body's top, so with the collar gone this
+    is the only thing bridging them, and a gap here would be visible from
+    every angle rather than hidden under a ruff.
+    """
+    bm = bmesh.new()
+    cone_between(bm, (0.0, 0.200, 0.130), (0.0, 0.345, 0.207), 0.080, 0.070, 16)
+    return new_object("Neck", bm, material)
+
+
+def build_leg(name, x, y, splay, material):
+    bm = bmesh.new()
+    icosphere(bm, subdivisions=2, radius=1.0)
+    scale_verts(bm, LEG_R[0], LEG_R[1], LEG_R[2])
+    rot = Matrix.Rotation(splay, 4, "Z")
+    for v in bm.verts:
+        v.co = rot @ v.co + Vector((x, y, LEG_Z))
+    return new_object(name, bm, material)
+
+
+def build_legs(material):
+    fx, fy = FRONT_LEG
+    rx, ry = REAR_LEG
+    return [
+        build_leg("LegFrontLeft", -fx, fy, LEG_SPLAY, material),
+        build_leg("LegFrontRight", fx, fy, -LEG_SPLAY, material),
+        build_leg("LegRearLeft", -rx, ry, -LEG_SPLAY, material),
+        build_leg("LegRearRight", rx, ry, LEG_SPLAY, material),
+    ]
+
+
+def ferrule_point():
+    """Where the shaft ends and the bristles begin, on the one tail segment."""
+    return TAIL_BASE.lerp(TAIL_TIP, FERRULE_T)
+
+
+def build_tail(material):
+    """The golden shaft, sloping gently down and back."""
+    bm = bmesh.new()
+    cone_between(bm, TAIL_BASE, ferrule_point(), TAIL_R_BASE, TAIL_R_TIP, 16)
+    return new_object("Tail", bm, material)
+
+
+def build_brush(material):
+    """The bristles: a flared cone with a notched end.
+
+    Built along +Z and swung onto the tail's own segment afterwards, so the
+    ferrule cannot develop a kink: there is only one axis in the file.
+
+    The notch takes alternate rim vertices *back* along the axis as well as
+    inward, so half the hairs finish a third of the bundle short of the other
+    half.  The end is therefore a zigzag, not a cut — see the note by
+    BRISTLE_NOTCH, which is the whole reason it is like this.
+    """
+    bm = bmesh.new()
+    ferrule = ferrule_point()
+    length = (TAIL_TIP - ferrule).length
+    cone(bm, BRISTLES, TAIL_R_TIP * 1.04, BRUSH_R, length)
+
+    tip_z = length / 2.0
+    rim = sorted(
+        (v for v in bm.verts if abs(v.co.z - tip_z) < 1e-4),
+        key=lambda v: math.atan2(v.co.y, v.co.x),
+    )
+    for i, v in enumerate(rim):
+        if i % 2:
+            v.co.z -= length * BRISTLE_NOTCH
+            v.co.x *= 0.86
+            v.co.y *= 0.86
+
+    apply_matrix(bm, align_to(ferrule, TAIL_TIP))
+    return new_object("Brush", bm, material)
+
+
+def build_eyes(white, black):
+    objs = []
+    for side, sx in (("Left", -1.0), ("Right", 1.0)):
+        bm = bmesh.new()
+        icosphere(bm, subdivisions=2, radius=EYE_R)
+        for v in bm.verts:
+            v.co += Vector((sx * EYE_X, EYE_Y, EYE_Z))
+        objs.append(new_object(f"Eye{side}", bm, white))
+
+        # The pupil sits on the outward-forward-upper face of the white, poking
+        # through it — the same trick the drawing uses to read from any angle.
+        n = Vector((sx * PUPIL_AIM[0], PUPIL_AIM[1], PUPIL_AIM[2])).normalized()
+        bm = bmesh.new()
+        icosphere(bm, subdivisions=2, radius=PUPIL_R)
+        for v in bm.verts:
+            v.co += Vector((sx * EYE_X, EYE_Y, EYE_Z)) + n * PUPIL_OUT
+        objs.append(new_object(f"Pupil{side}", bm, black))
+    return objs
+
+
+# --------------------------------------------------------------------------
+# Assembly and export
+# --------------------------------------------------------------------------
+
+
+def build(out_dir):
+    clear_scene()
+    png = write_gradient_png(os.path.join(out_dir, GRADIENT_PNG))
+    emission_png = write_gradient_png(
+        os.path.join(out_dir, EMISSION_PNG), scale=EMISSION)
+
+    gold = plain_material("Gold", GOLD, roughness=0.42)
+    purple = plain_material("Purple", PURPLE, roughness=0.38)
+    white = plain_material("EyeWhite", WHITE, roughness=0.22)
+    black = plain_material("EyeBlack", BLACK, roughness=0.14)
+    # Matte rather than glossy: a tight highlight on a faceted dome blows one
+    # or two facets to white and breaks the ramp exactly where it is meant to
+    # be read.
+    shell_mat = gradient_material("Shell", png, emission_png, roughness=0.52)
+
+    parts = [
+        build_shell(shell_mat),
+        build_body(gold),
+        build_head(gold),
+        build_neck(gold),
+        build_beret(purple),
+        build_tail(gold),
+        build_brush(purple),
+    ]
+    parts += build_legs(gold)
+    parts += build_eyes(white, black)
+
+    root = bpy.data.objects.new("Tortoise", None)
+    bpy.context.collection.objects.link(root)
+    for p in parts:
+        p.parent = root
+    return root, parts
+
+
+def report(parts):
+    tris = 0
+    for p in parts:
+        for poly in p.data.polygons:
+            tris += max(0, len(poly.vertices) - 2)
+    lo = Vector((1e9, 1e9, 1e9))
+    hi = Vector((-1e9, -1e9, -1e9))
+    for p in parts:
+        for v in p.data.vertices:
+            lo = Vector((min(lo[i], v.co[i]) for i in range(3)))
+            hi = Vector((max(hi[i], v.co[i]) for i in range(3)))
+    print(f"[tortoise] parts={len(parts)} triangles={tris}")
+    print(f"[tortoise] bounds x {lo.x:+.3f}..{hi.x:+.3f}  (width {hi.x - lo.x:.3f})")
+    print(f"[tortoise] bounds y {lo.y:+.3f}..{hi.y:+.3f}  (length {hi.y - lo.y:.3f})")
+    print(f"[tortoise] bounds z {lo.z:+.3f}..{hi.z:+.3f}  (height {hi.z - lo.z:.3f})")
+
+
+def export_usdz(path):
+    for obj in bpy.context.scene.objects:
+        obj.select_set(True)
+    kwargs = dict(
+        filepath=path,
+        selected_objects_only=False,
+        export_animation=False,
+        export_materials=True,
+        export_uvmaps=True,
+        export_normals=True,
+        export_lights=False,
+        export_cameras=False,
+        generate_preview_surface=True,
+        export_textures_mode="NEW",
+        # RealityKit triangulates on load anyway; doing it here means the
+        # collar's quads are triangulated by Blender, where the result can be
+        # looked at, rather than at runtime where it cannot.
+        triangulate_meshes=True,
+        # Blender is Z-up, USD/RealityKit is Y-up with -Z forward.  The
+        # selections here are the operator's own defaults, written out so the
+        # convention this asset is authored in is stated rather than assumed.
+        convert_orientation=True,
+        export_global_forward_selection="NEGATIVE_Z",
+        export_global_up_selection="Y",
+        root_prim_path="/Tortoise",
+    )
+    while True:
+        try:
+            bpy.ops.wm.usd_export(**kwargs)
+            return
+        except TypeError as exc:
+            # Drop whichever keyword this Blender does not know and retry, so
+            # the script survives an API rename rather than failing outright.
+            message = str(exc).replace('"', "'")
+            bad = message.split("'")
+            dropped = next((k for k in list(kwargs) if k in bad), None)
+            if dropped is None or dropped == "filepath":
+                raise
+            print(f"[tortoise] usd_export: dropping unsupported '{dropped}'")
+            kwargs.pop(dropped)
+
+
+def main():
+    argv = sys.argv[sys.argv.index("--") + 1 :] if "--" in sys.argv else []
+    out_dir = os.path.abspath(argv[argv.index("--out") + 1] if "--out" in argv else ".")
+    os.makedirs(out_dir, exist_ok=True)
+
+    _, parts = build(out_dir)
+    report(parts)
+
+    blend = os.path.join(out_dir, "tortoise.blend")
+    bpy.ops.wm.save_as_mainfile(filepath=blend)
+    usdz = os.path.join(out_dir, "Tortoise.usdz")
+    export_usdz(usdz)
+    print(f"[tortoise] wrote {blend}")
+    print(f"[tortoise] wrote {usdz} ({os.path.getsize(usdz)} bytes)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/Tools/tortoise-model/qlcheck.swift b/Tools/tortoise-model/qlcheck.swift
new file mode 100644
index 0000000..da2aac0
--- /dev/null
+++ b/Tools/tortoise-model/qlcheck.swift
@@ -0,0 +1,44 @@
+// Ask the system to thumbnail the USDZ, which is the cheapest way to make
+// Apple's own USD stack parse and render it end to end. `qlmanage -t` is the
+// obvious alternative and tends to hang; QLThumbnailGenerator does not.
+import Foundation
+import ImageIO
+import QuickLookThumbnailing
+import UniformTypeIdentifiers
+
+let args = CommandLine.arguments
+guard args.count > 2 else {
+    FileHandle.standardError.write(Data("usage: qlcheck <in.usdz> <out.png>\n".utf8))
+    exit(2)
+}
+let input = URL(fileURLWithPath: args[1])
+let output = URL(fileURLWithPath: args[2])
+
+let request = QLThumbnailGenerator.Request(
+    fileAt: input, size: CGSize(width: 512, height: 512), scale: 1,
+    representationTypes: .all)
+
+let done = DispatchSemaphore(value: 0)
+var failure: Error?
+
+QLThumbnailGenerator.shared.generateBestRepresentation(for: request) { rep, error in
+    defer { done.signal() }
+    if let error { failure = error; return }
+    guard let cg = rep?.cgImage else { return }
+    guard
+        let dest = CGImageDestinationCreateWithURL(
+            output as CFURL, UTType.png.identifier as CFString, 1, nil as CFDictionary?)
+    else { return }
+    CGImageDestinationAddImage(dest, cg, nil as CFDictionary?)
+    CGImageDestinationFinalize(dest)
+    print("ok \(cg.width)x\(cg.height) -> \(output.path)")
+}
+
+if done.wait(timeout: .now() + 60) == .timedOut {
+    print("TIMED OUT")
+    exit(1)
+}
+if let failure {
+    print("FAILED: \(failure)")
+    exit(1)
+}
diff --git a/Tools/tortoise-model/render_views.py b/Tools/tortoise-model/render_views.py
new file mode 100644
index 0000000..6622dcd
--- /dev/null
+++ b/Tools/tortoise-model/render_views.py
@@ -0,0 +1,142 @@
+"""Render the same four orthographic views as the drawing, plus a hero shot.
+
+Run with:  blender --background tortoise.blend --python render_views.py -- --out DIR
+
+Kept apart from the builder on purpose: judging the shape means rendering it
+many times, and there is no reason to re-export a USDZ for each look.
+"""
+
+import math
+import os
+import sys
+
+import bpy
+from mathutils import Vector
+
+SIZE = 640
+CENTRE = Vector((0.0, 0.0, 0.19))  # mid-height of the animal
+ORTHO = 1.16  # the animal is 1.0 long; a little air around it
+
+# The head is at +Y, so the camera that *sees* the face stands at +Y looking
+# back along -Y.  Naming these the other way round is an easy mistake and a
+# confusing one, because the renders still look fine — they are just labelled
+# with each other's name.
+VIEWS = [
+    # name, camera location, euler XYZ in degrees, orthographic
+    ("top", (0.0, 0.0, 4.0), (0.0, 0.0, 0.0), True),
+    ("side", (-4.0, 0.0, CENTRE.z), (90.0, 0.0, -90.0), True),
+    ("front", (0.0, 4.0, CENTRE.z), (90.0, 0.0, 180.0), True),
+    ("rear", (0.0, -4.0, CENTRE.z), (90.0, 0.0, 0.0), True),
+    ("hero", (-1.05, 1.25, 0.78), None, False),
+]
+
+# Close-ups.  The brush is a tenth of the animal long, so at the scale of the
+# view sheet it is a dozen pixels and any judgement about it is guesswork.
+DETAILS = [
+    # name, camera location, target, orthographic scale
+    ("tail", (-0.55, -0.34, 0.22), (0.0, -0.37, 0.085), 0.26),
+    ("head", (-0.45, 0.62, 0.42), (0.0, 0.40, 0.245), 0.40),
+]
+
+
+def aim(obj, target):
+    direction = Vector(target) - obj.location
+    obj.rotation_euler = direction.to_track_quat("-Z", "Y").to_euler()
+
+
+def add_light(name, location, energy, size):
+    data = bpy.data.lights.new(name, type="AREA")
+    data.energy = energy
+    data.size = size
+    obj = bpy.data.objects.new(name, data)
+    obj.location = location
+    bpy.context.collection.objects.link(obj)
+    aim(obj, CENTRE)
+    return obj
+
+
+def setup_world():
+    world = bpy.data.worlds.new("World")
+    world.use_nodes = True
+    bg = world.node_tree.nodes["Background"]
+    bg.inputs["Color"].default_value = (0.55, 0.60, 0.66, 1.0)
+    bg.inputs["Strength"].default_value = 0.28
+    bpy.context.scene.world = world
+
+
+def setup_render(out_dir):
+    scene = bpy.context.scene
+    for engine in ("BLENDER_EEVEE_NEXT", "BLENDER_EEVEE", "CYCLES"):
+        try:
+            scene.render.engine = engine
+            break
+        except TypeError:
+            continue
+    print(f"[render] engine={scene.render.engine}")
+    scene.render.resolution_x = SIZE
+    scene.render.resolution_y = SIZE
+    scene.render.resolution_percentage = 100
+    scene.render.image_settings.file_format = "PNG"
+    scene.render.image_settings.color_mode = "RGBA"
+    scene.render.film_transparent = True
+    scene.view_settings.view_transform = "Standard"
+    if hasattr(scene, "eevee"):
+        for attr, value in (("taa_render_samples", 64), ("use_gtao", True)):
+            if hasattr(scene.eevee, attr):
+                setattr(scene.eevee, attr, value)
+
+
+def render_view(name, location, euler, ortho, out_dir, scale=ORTHO, target=None):
+    data = bpy.data.cameras.new(f"cam_{name}")
+    data.type = "ORTHO" if ortho else "PERSP"
+    if ortho:
+        data.ortho_scale = scale
+    else:
+        data.lens = 55
+    cam = bpy.data.objects.new(f"cam_{name}", data)
+    cam.location = location
+    bpy.context.collection.objects.link(cam)
+    if euler is None:
+        aim(cam, target or CENTRE)
+    else:
+        cam.rotation_euler = [math.radians(a) for a in euler]
+
+    bpy.context.scene.camera = cam
+    path = os.path.join(out_dir, f"view_{name}.png")
+    bpy.context.scene.render.filepath = path
+    bpy.ops.render.render(write_still=True)
+    bpy.data.objects.remove(cam, do_unlink=True)
+    print(f"[render] {path}")
+
+
+def main():
+    argv = sys.argv[sys.argv.index("--") + 1 :] if "--" in sys.argv else []
+    out_dir = os.path.abspath(argv[argv.index("--out") + 1] if "--out" in argv else ".")
+    os.makedirs(out_dir, exist_ok=True)
+
+    setup_world()
+    setup_render(out_dir)
+    # Key from the upper front-left, a soft fill opposite, and a rim behind —
+    # enough separation to read the facets without hiding the gradient.
+    #
+    # An area light's power spreads as 1/(4*pi*d^2), so at d ~ 3.5 the visible
+    # radiance is roughly P/490 for these albedos: past ~500W everything clips
+    # to white and the shell's ramp disappears along with it.
+    add_light("Key", (-2.0, 2.4, 2.8), 300.0, 3.0)
+    add_light("Fill", (2.6, 1.4, 1.0), 90.0, 4.0)
+    add_light("Rim", (0.8, -3.0, 2.2), 100.0, 2.5)
+
+    # --only tail,head renders a subset.  A full sheet is seven renders and
+    # about seven minutes; iterating on one part should not cost that.
+    wanted = set(argv[argv.index("--only") + 1].split(",")) if "--only" in argv else None
+
+    for name, loc, euler, ortho in VIEWS:
+        if wanted is None or name in wanted:
+            render_view(name, loc, euler, ortho, out_dir)
+    for name, loc, target, scale in DETAILS:
+        if wanted is None or name in wanted:
+            render_view(name, loc, None, True, out_dir, scale=scale, target=target)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/Tools/tortoise-model/sheet.py b/Tools/tortoise-model/sheet.py
new file mode 100644
index 0000000..ce23f42
--- /dev/null
+++ b/Tools/tortoise-model/sheet.py
@@ -0,0 +1,64 @@
+"""Composite the rendered views into one sheet laid out like the drawing."""
+
+import os
+import sys
+
+from PIL import Image, ImageDraw, ImageFont
+
+OUT = sys.argv[1] if len(sys.argv) > 1 else "."
+CELL = 460
+PAD = 18
+LABEL = 26
+BG = (246, 246, 248)
+
+
+def load(name):
+    img = Image.open(os.path.join(OUT, f"view_{name}.png")).convert("RGBA")
+    return img.resize((CELL, CELL), Image.LANCZOS)
+
+
+def font(size):
+    for path in (
+        "/System/Library/Fonts/Supplemental/Arial Bold.ttf",
+        "/System/Library/Fonts/SFNS.ttf",
+    ):
+        if os.path.exists(path):
+            try:
+                return ImageFont.truetype(path, size)
+            except OSError:
+                pass
+    return ImageFont.load_default()
+
+
+names = ["top", "side", "front", "rear", "hero", "tail", "head"]
+titles = {
+    "top": "TOP",
+    "side": "SIDE (Left)",
+    "front": "FRONT",
+    "rear": "REAR",
+    "hero": "3/4",
+    "tail": "TAIL (close)",
+    "head": "HEAD (close)",
+}
+
+cols = 4
+rows = (len(names) + cols - 1) // cols
+W = PAD + cols * (CELL + PAD)
+H = PAD + rows * (CELL + LABEL + PAD)
+sheet = Image.new("RGB", (W, H), BG)
+draw = ImageDraw.Draw(sheet)
+f = font(20)
+
+for i, name in enumerate(names):
+    cx = PAD + (i % cols) * (CELL + PAD)
+    cy = PAD + (i // cols) * (CELL + LABEL + PAD)
+    cell = Image.new("RGB", (CELL, CELL), (236, 238, 242))
+    img = load(name)
+    cell.paste(img, (0, 0), img)
+    sheet.paste(cell, (cx, cy))
+    draw.rectangle([cx, cy, cx + CELL - 1, cy + CELL - 1], outline=(200, 202, 208))
+    draw.text((cx + 4, cy + CELL + 4), titles[name], fill=(40, 40, 46), font=f)
+
+path = os.path.join(OUT, "sheet.png")
+sheet.save(path)
+print(path)
diff --git a/TortoiseBlocks.xcodeproj/project.pbxproj b/TortoiseBlocks.xcodeproj/project.pbxproj
index ae216f2..c8e4339 100644
--- a/TortoiseBlocks.xcodeproj/project.pbxproj
+++ b/TortoiseBlocks.xcodeproj/project.pbxproj
@@ -394,6 +394,8 @@
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=iphoneos*]" = YES;
 				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=iphonesimulator*]" = YES;
+				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=xros*]" = YES;
+				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=xrsimulator*]" = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.0;
 				LD_RUNPATH_SEARCH_PATHS = "@executable_path/Frameworks";
 				"LD_RUNPATH_SEARCH_PATHS[sdk=macosx*]" = "@executable_path/../Frameworks";
@@ -402,9 +404,10 @@
 				PRODUCT_BUNDLE_IDENTIFIER = space.hiraku.tortoiseblocks;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = auto;
-				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx xros xrsimulator";
 				SWIFT_EMIT_LOC_STRINGS = YES;
-				TARGETED_DEVICE_FAMILY = 2;
+				TARGETED_DEVICE_FAMILY = "2,7";
+				XROS_DEPLOYMENT_TARGET = 26.0;
 			};
 			name = Debug;
 		};
@@ -429,6 +432,8 @@
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=iphoneos*]" = YES;
 				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=iphonesimulator*]" = YES;
+				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=xros*]" = YES;
+				"INFOPLIST_KEY_UISupportsDocumentBrowser[sdk=xrsimulator*]" = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.0;
 				LD_RUNPATH_SEARCH_PATHS = "@executable_path/Frameworks";
 				"LD_RUNPATH_SEARCH_PATHS[sdk=macosx*]" = "@executable_path/../Frameworks";
@@ -437,9 +442,10 @@
 				PRODUCT_BUNDLE_IDENTIFIER = space.hiraku.tortoiseblocks;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = auto;
-				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx xros xrsimulator";
 				SWIFT_EMIT_LOC_STRINGS = YES;
-				TARGETED_DEVICE_FAMILY = 2;
+				TARGETED_DEVICE_FAMILY = "2,7";
+				XROS_DEPLOYMENT_TARGET = 26.0;
 			};
 			name = Release;
 		};
@@ -447,8 +453,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_ENTITLEMENTS = Support/ThumbnailExtension.entitlements;
-				CODE_SIGN_IDENTITY = "-";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEAD_CODE_STRIPPING = YES;
@@ -470,9 +475,10 @@
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = auto;
 				SKIP_INSTALL = YES;
-				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx xros xrsimulator";
 				SWIFT_EMIT_LOC_STRINGS = YES;
-				TARGETED_DEVICE_FAMILY = 2;
+				TARGETED_DEVICE_FAMILY = "2,7";
+				XROS_DEPLOYMENT_TARGET = 26.0;
 			};
 			name = Debug;
 		};
@@ -501,9 +507,10 @@
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = auto;
 				SKIP_INSTALL = YES;
-				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator macosx xros xrsimulator";
 				SWIFT_EMIT_LOC_STRINGS = YES;
-				TARGETED_DEVICE_FAMILY = 2;
+				TARGETED_DEVICE_FAMILY = "2,7";
+				XROS_DEPLOYMENT_TARGET = 26.0;
 			};
 			name = Release;
 		};
@@ -552,7 +559,7 @@
 			repositoryURL = "https://github.com/temoki/TortoiseGraphics2";
 			requirement = {
 				kind = exactVersion;
-				version = 2.0.0;
+				version = 2.1.0;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
diff --git a/TortoiseBlocks.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/TortoiseBlocks.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
index a8e5129..ef7ad8d 100644
--- a/TortoiseBlocks.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+++ b/TortoiseBlocks.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -6,8 +6,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/temoki/TortoiseGraphics2",
       "state" : {
-        "revision" : "8304101e5cdc8d717963ec1ac8ba143b2b6553d9",
-        "version" : "2.0.0"
+        "revision" : "83941fe71e20d39941f72d7f38d16d82308e3635",
+        "version" : "2.1.0"
       }
     }
   ],
diff --git a/TortoiseBlocksKit/Package.resolved b/TortoiseBlocksKit/Package.resolved
index 0897ec6..6e89044 100644
--- a/TortoiseBlocksKit/Package.resolved
+++ b/TortoiseBlocksKit/Package.resolved
@@ -1,13 +1,13 @@
 {
-  "originHash" : "c2d79e7964c910d5a59486e3f4d8fe4f42f923aabb5cfdeb8dffdf326080a937",
+  "originHash" : "6f793ae5ce9d59bfe288dda5c0a74b4c288b2bae63418b026cf2f644effa56e9",
   "pins" : [
     {
       "identity" : "tortoisegraphics2",
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/temoki/TortoiseGraphics2",
       "state" : {
-        "revision" : "8304101e5cdc8d717963ec1ac8ba143b2b6553d9",
-        "version" : "2.0.0"
+        "revision" : "83941fe71e20d39941f72d7f38d16d82308e3635",
+        "version" : "2.1.0"
       }
     }
   ],
diff --git a/TortoiseBlocksKit/Package.swift b/TortoiseBlocksKit/Package.swift
index 275c648..a5d4ca9 100644
--- a/TortoiseBlocksKit/Package.swift
+++ b/TortoiseBlocksKit/Package.swift
@@ -12,7 +12,7 @@ let package = Package(
         .library(name: "TortoiseBlocksKit", targets: ["TortoiseBlocksKit"])
     ],
     dependencies: [
-        .package(url: "https://github.com/temoki/TortoiseGraphics2", exact: "2.0.0")
+        .package(url: "https://github.com/temoki/TortoiseGraphics2", exact: "2.1.0")
     ],
     targets: [
         .target(
diff --git a/appstore/README.md b/appstore/README.md
index 3a90d02..9ef063d 100644
--- a/appstore/README.md
+++ b/appstore/README.md
@@ -5,14 +5,24 @@ App Store Connect (#42).
 
 ```
 metadata/<locale>/*.txt            the text, one file per field
-screenshots/<platform>/<locale>/   ios/ and macos/, one directory per locale
+screenshots/<platform>/<locale>/   ios/, macos/ and visionos/, one directory per locale
 screenshot-sources/                the documents the captures were shot from
 ```
 
 `<locale>` is an App Store Connect locale code (`en-US`, `ja`), not the app's
-`en` / `ja` string-catalog code. `ios` and `macos` name the two listings: there
-is no ipadOS — iPad is a display type under iOS, and deliver files a screenshot
-by its pixel size.
+`en` / `ja` string-catalog code. `ios`, `macos` and `visionos` name the three
+listings: there is no ipadOS — iPad is a display type under iOS, and deliver
+files a screenshot by its pixel size.
+
+**`visionos` is the one directory name that is load-bearing.** A Vision Pro
+screenshot is 3840×2160 — the same size as an Apple TV one — so deliver cannot
+tell the two display types apart by size and breaks the tie on whether the
+*path* contains `vision`, downcased, anywhere in it. Naming the directory
+`xros` to match deliver's platform value would file every capture under
+`APP_APPLE_TV`, on an app with no tvOS listing at all. visionOS is spelled
+three different ways across this pipeline and all three are required:
+`visionos` here (the ASC `Platform` enum, lowercased, like `ios` and `macos`),
+`xros` to deliver, `VISION_OS` to spaceship.
 
 ## Running it
 
@@ -24,11 +34,19 @@ export ASC_KEY_ID=…
 export ASC_PRIVATE_KEY_PATH=~/…/AuthKey_XXXXXXXXXX.p8
 
 bundle install
-bundle exec fastlane metadata_check      # the files alone, no network, no key
-bundle exec fastlane ios metadata_diff   # what is live, against what is written
-bundle exec fastlane ios metadata_push   # upload (mac for the other listing)
+bundle exec fastlane metadata_check           # the files alone, no network, no key
+bundle exec fastlane ios metadata_diff        # what is live, against what is written
+bundle exec fastlane ios metadata_push        # upload
+bundle exec fastlane mac metadata_push        # …and the same two for the other
+bundle exec fastlane visionos metadata_push   #    two listings
 ```
 
+A listing only exists once its platform does: `metadata_diff` and
+`metadata_push` both need an **editable version** for that platform in App
+Store Connect, and for visionOS that means the app record has to carry the
+Apple Vision Pro platform first. Until then the lane stops with "No editable
+xros version — create one first", which is the guard working, not a bug.
+
 In CI it is the **App Store Metadata** workflow, run by hand from the Actions
 tab: pick a platform, and tick *apply* to upload rather than diff. It reads the
 same three values from secrets, with the .p8 base64-encoded into
@@ -86,8 +104,11 @@ hand-run upload cannot skip it. It is plain Ruby with no gems, so CI runs it as
 ## Screenshots
 
 - The sizes are the ones Apple accepts as-is: **iPad 13-inch landscape
-  2752×2064** and **Mac 2880×1800**. A reshoot has to keep the window sizes
-  that produced them
+  2752×2064**, **Mac 2880×1800** and **Apple Vision Pro 3840×2160**. A reshoot
+  has to keep the window sizes that produced them. The Vision Pro size needs no
+  arranging at all — `xcrun simctl io <device> screenshot` on the visionOS
+  simulator writes exactly 3840×2160 — but the file it writes **has an alpha
+  channel**, so it still needs `-alpha off` like every other capture
 - Order comes from the leading number in the filename. Ten per locale, at most
 - **Carry no alpha channel** (`magick <f> -alpha off -define png:color-type=2
   <f>`). Fully opaque is not enough — the channel alone can get a screenshot
@@ -95,7 +116,10 @@ hand-run upload cannot skip it. It is plain Ruby with no gems, so CI runs it as
 - Capture the whole screen on Mac, not the window: a window-only capture has
   transparent rounded corners and shadow. Set the *system* language to the
   locale being shot, too — switching only the app's language leaves the menu
-  bar in the other language
+  bar in the other language. On Vision Pro the whole "screen" is the simulated
+  room, so the app window sits in the middle of a living room — that is what
+  the platform's screenshots look like, and cropping to the window would give
+  a size Apple does not accept
 - **deliver uploads every screenshot twice on a first upload**, reproducibly.
   It matches local against live by MD5, and Apple has not computed that
   checksum seven seconds after the PUT, so each image looks missing and the
diff --git a/appstore/metadata/en-US/description.txt b/appstore/metadata/en-US/description.txt
index 3fe3884..7c1f124 100644
--- a/appstore/metadata/en-US/description.txt
+++ b/appstore/metadata/en-US/description.txt
@@ -24,4 +24,4 @@ Drawings are ordinary documents in Files and Finder, and each one shows its own
 FOR PARENTS AND TEACHERS
 There is no sign-in and no account. There is nothing to type but numbers. There is no advertising, no analytics, no third-party SDK, and no network connection of any kind — the app contains no networking code at all. Drawings stay on the device and in whatever location you choose to save them.
 
-Tortoise Blocks runs on iPad and Mac, speaks English and Japanese, and is free and open source under the MIT license.
+Tortoise Blocks runs on iPad, Mac and Apple Vision Pro, speaks English and Japanese, and is free and open source under the MIT license.
diff --git a/appstore/metadata/en-US/release_notes.txt b/appstore/metadata/en-US/release_notes.txt
index 734b923..6db97b0 100644
--- a/appstore/metadata/en-US/release_notes.txt
+++ b/appstore/metadata/en-US/release_notes.txt
@@ -6,3 +6,7 @@ Give a block a name, put whatever you like inside it, and call it from anywhere
 • Every block now carries one ⋯ menu: delete it, move it up or down, or give an "if" its "otherwise".
 • Tap the trash can to clear the whole program at once. You can undo it.
 • Block labels stay on one line in narrower windows.
+
+ON APPLE VISION PRO
+
+Tortoise Blocks now runs on Apple Vision Pro, with the same three panes in a window: the blocks to pick from, the program you are building, and the tortoise drawing it. Your drawings are the same documents on every device.
diff --git a/appstore/metadata/ja/description.txt b/appstore/metadata/ja/description.txt
index b523621..cac08a2 100644
--- a/appstore/metadata/ja/description.txt
+++ b/appstore/metadata/ja/description.txt
@@ -24,4 +24,4 @@ Tortoise Blocks は、子どものためのビジュアルプログラミング
 ■ 保護者・先生の方へ
 ログインもアカウントもありません。入力するのは数字だけです。広告も、利用状況の計測も、第三者製の SDK もありません。ネットワーク通信は一切行わず、そもそもアプリの中に通信を行うコードが含まれていません。作った作品は、端末と、選んだ保存先にだけ残ります。
 
-Tortoise Blocks は iPad と Mac で動き、日本語と英語に対応しています。MIT ライセンスのオープンソースで、無料です。
+Tortoise Blocks は iPad と Mac と Apple Vision Pro で動き、日本語と英語に対応しています。MIT ライセンスのオープンソースで、無料です。
diff --git a/appstore/metadata/ja/release_notes.txt b/appstore/metadata/ja/release_notes.txt
index 7eedd13..b71b56c 100644
--- a/appstore/metadata/ja/release_notes.txt
+++ b/appstore/metadata/ja/release_notes.txt
@@ -6,3 +6,7 @@
 ・ブロックの操作を「⋯」メニューにまとめました（けす／うえへ／したへ／そうでなければ）。
 ・ゴミ箱をタップすると、プログラムを一度に消せます。元に戻せます。
 ・せまい画面でも、ブロックの文字が折り返さなくなりました。
+
+■ Apple Vision Pro に対応しました
+
+Apple Vision Pro でも Tortoise Blocks が動くようになりました。ウィンドウの中は同じ3つのペインです。選ぶブロック、組み立てたプログラム、そして絵を描いていくカメ。作品はどの端末でも同じ書類です。
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 9bbd1d5..3325481 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -4,12 +4,18 @@
 # Builds reach TestFlight from Xcode Cloud on a v* tag, and these lanes never
 # upload a binary — skip_binary_upload is on.
 #
-# iOS and macOS are separate versions in App Store Connect, so each takes its
-# own run against its own screenshots directory. The text is shared: one
-# directory of files per locale, which is deliver's own layout.
+# iOS, macOS and visionOS are separate versions in App Store Connect, so each
+# takes its own run against its own screenshots directory. The text is shared:
+# one directory of files per locale, which is deliver's own layout.
 
 require_relative "metadata_check"
 
+# fastlane knows :ios, :mac and :android as Fastfile platforms and warns on
+# every run about anything else. deliver understands visionOS perfectly well
+# (its platform value is "xros"); it is only the namespace around the lanes
+# that has to be declared.
+Fastlane::SupportedPlatforms.extra = [:visionos]
+
 APP_IDENTIFIER = "space.hiraku.tortoiseblocks"
 
 # Absolute, and deliberately so. deliver resolves a relative path against the
@@ -43,6 +49,24 @@ platform :mac do
   end
 end
 
+# The screenshots directory is "visionos" and it is not free to rename (#11).
+# A Vision Pro screenshot is 3840x2160 — the same size as an Apple TV one — so
+# deliver cannot tell the two display types apart by size, and breaks the tie
+# on whether the *path* contains "vision" (downcased, anywhere in it). Call the
+# directory "xros" to match deliver's platform value and every screenshot is
+# filed under APP_APPLE_TV instead, on an app that has no tvOS listing at all.
+platform :visionos do
+  desc "Diff the live visionOS listing against appstore/metadata"
+  lane :metadata_diff do
+    diff_metadata(platform: "xros")
+  end
+
+  desc "Push appstore/ to the visionOS listing"
+  lane :metadata_push do
+    push_metadata(platform: "xros", screenshots: "visionos")
+  end
+end
+
 desc "Check appstore/ without touching the network"
 lane :metadata_check do
   check_metadata
@@ -185,11 +209,14 @@ APP_FIELDS = {
 }.freeze
 
 # deliver and spaceship do not share a vocabulary for the platforms: deliver
-# takes "osx", the Connect API calls the same thing MAC_OS. The lanes speak
-# deliver's, so the translation happens here.
+# takes "osx" and "xros", the Connect API calls the same things MAC_OS and
+# VISION_OS. The lanes speak deliver's, so the translation happens here. Note
+# visionOS is spelled a third way again in appstore/screenshots — see the
+# visionos platform above.
 CONNECT_PLATFORM = {
   "ios" => Spaceship::ConnectAPI::Platform::IOS,
-  "osx" => Spaceship::ConnectAPI::Platform::MAC_OS
+  "osx" => Spaceship::ConnectAPI::Platform::MAC_OS,
+  "xros" => Spaceship::ConnectAPI::Platform::VISION_OS
 }.freeze
 
 private_lane :diff_metadata do |options|
diff --git a/fastlane/metadata_check.rb b/fastlane/metadata_check.rb
index 31dfe59..8978069 100755
--- a/fastlane/metadata_check.rb
+++ b/fastlane/metadata_check.rb
@@ -28,10 +28,13 @@ module MetadataCheck
   REQUIRED = (LIMITS.keys + URLS).sort.freeze
 
   # Sizes Apple accepts for the display types this app ships. An unexpected
-  # size is a mistake worth stopping on, not a shape to guess at.
+  # size is a mistake worth stopping on, not a shape to guess at. A platform
+  # missing from this table is not checked at all, so a new screenshots
+  # directory has to be added here to be seen.
   SIZES = {
     "ios" => [[2064, 2752], [2752, 2064]],                       # iPad 13-inch
-    "macos" => [[1280, 800], [1440, 900], [2560, 1600], [2880, 1800]]
+    "macos" => [[1280, 800], [1440, 900], [2560, 1600], [2880, 1800]],
+    "visionos" => [[3840, 2160]]                                 # Apple Vision Pro
   }.freeze
 
   DEFAULT_ROOT = Pathname.new(__dir__).parent / "appstore"
diff --git a/site/index.html b/site/index.html
index a8b9b2f..2103d83 100644
--- a/site/index.html
+++ b/site/index.html
@@ -4,14 +4,14 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Tortoise Blocks — Snap blocks together, watch the tortoise draw</title>
-<meta name="description" content="Tortoise Blocks is a visual programming app for kids on iPad and Mac: snap blocks together, press play, and watch the tortoise draw. Tortoise Blocks は、ブロックをならべてカメに絵をかいてもらう、iPad と Mac のための子ども向けプログラミングアプリです。">
+<meta name="description" content="Tortoise Blocks is a visual programming app for kids on iPad, Mac and Apple Vision Pro: snap blocks together, press play, and watch the tortoise draw. Tortoise Blocks は、ブロックをならべてカメに絵をかいてもらう、iPad と Mac と Apple Vision Pro のための子ども向けプログラミングアプリです。">
 <link rel="icon" href="icon-176.png">
 
 <!-- One card serves both languages, because both are served from one URL. -->
 <meta property="og:type" content="website">
 <meta property="og:site_name" content="Tortoise Blocks">
 <meta property="og:title" content="Tortoise Blocks">
-<meta property="og:description" content="Snap blocks together, press play, and watch the tortoise draw. A visual programming app for kids on iPad and Mac.">
+<meta property="og:description" content="Snap blocks together, press play, and watch the tortoise draw. A visual programming app for kids on iPad, Mac and Apple Vision Pro.">
 <meta property="og:url" content="https://temoki.github.io/TortoiseBlocks/">
 <meta property="og:image" content="https://temoki.github.io/TortoiseBlocks/og.png">
 <meta property="og:image:width" content="1200">
@@ -245,7 +245,8 @@
     <img class="icon" src="icon-256.png" alt="" width="112" height="112">
     <h1>Snap blocks together, and watch the tortoise draw.</h1>
     <p class="lede">
-      A visual programming app for kids on iPad and Mac. Drag blocks into a
+      A visual programming app for kids on iPad, Mac and Apple Vision Pro. Drag
+      blocks into a
       program, press ▶️, and a tortoise draws your picture line by line.
     </p>
 
@@ -254,7 +255,7 @@ <h1>Snap blocks together, and watch the tortoise draw.</h1>
       <a href="https://apps.apple.com/app/id6798677334">
         <img src="appstore-badge-en.svg" alt="Download on the App Store" height="48">
       </a>
-      <p>iPadOS&nbsp;26 or later · macOS&nbsp;26 or later</p>
+      <p>iPadOS&nbsp;26 or later · macOS&nbsp;26 or later · visionOS&nbsp;26 or later</p>
     </div>
 
     <figure>
@@ -390,9 +391,9 @@ <h2>From blocks to text</h2>
 
   <div class="showcase flip">
     <div class="text">
-      <h2>iPad and Mac, one app</h2>
+      <h2>iPad, Mac and Vision Pro, one app</h2>
       <p>
-        The same three panes on both, at home with each. It is an ordinary
+        The same three panes on all three, at home with each. It is an ordinary
         document app: iCloud&nbsp;Drive and Files, autosave, system undo, and
         its own folder full of drawings you can tell apart at a glance.
       </p>
@@ -422,7 +423,7 @@ <h2>Quiet about the child using it</h2>
   <dl class="specs">
     <div>
       <dt>Requires</dt>
-      <dd>iPadOS 26 or later · macOS 26 or later</dd>
+      <dd>iPadOS 26 or later · macOS 26 or later · visionOS 26 or later</dd>
     </div>
     <div>
       <dt>Languages</dt>
@@ -449,14 +450,14 @@ <h2>Quiet about the child using it</h2>
   <div class="hero">
     <img class="icon" src="icon-256.png" alt="" width="112" height="112">
     <h1>ブロックをならべて、カメに絵をかいてもらおう！</h1>
-    <p class="lede">iPad と Mac のための、子ども向けビジュアルプログラミングアプリ。ブロックを並べて ▶️ を押すと、カメが1本ずつ線を描いていきます。</p>
+    <p class="lede">iPad と Mac と Apple Vision Pro のための、子ども向けビジュアルプログラミングアプリ。ブロックを並べて ▶️ を押すと、カメが1本ずつ線を描いていきます。</p>
 
     <div class="get">
       <!-- 国コードなし。Apple が閲覧者のストアへ振り分ける。 -->
       <a href="https://apps.apple.com/app/id6798677334">
         <img src="appstore-badge-ja.svg" alt="App Store でダウンロード" height="48">
       </a>
-      <p>iPadOS&nbsp;26 以降 · macOS&nbsp;26 以降</p>
+      <p>iPadOS&nbsp;26 以降 · macOS&nbsp;26 以降 · visionOS&nbsp;26 以降</p>
     </div>
 
     <figure>
@@ -553,8 +554,8 @@ <h2>ブロックから、文字のプログラムへ</h2>
 
   <div class="showcase flip">
     <div class="text">
-      <h2>iPad でも Mac でも、同じアプリ</h2>
-      <p>3つのペインの構成はどちらでも同じで、それぞれの操作にちゃんとなじみます。中身はふつうの書類アプリです。iCloud&nbsp;Drive と「ファイル」、自動保存、システムの取り消し、そして一目で見分けられる作品の並んだフォルダ。</p>
+      <h2>iPad でも Mac でも Apple Vision Pro でも、同じアプリ</h2>
+      <p>3つのペインの構成はどれでも同じで、それぞれの操作にちゃんとなじみます。中身はふつうの書類アプリです。iCloud&nbsp;Drive と「ファイル」、自動保存、システムの取り消し、そして一目で見分けられる作品の並んだフォルダ。</p>
     </div>
     <figure>
       <img src="shots/mac-ja-1.png" loading="lazy"
@@ -577,7 +578,7 @@ <h2>使う子どものことを、何も集めません</h2>
   <dl class="specs">
     <div>
       <dt>動作環境</dt>
-      <dd>iPadOS 26 以降 · macOS 26 以降</dd>
+      <dd>iPadOS 26 以降 · macOS 26 以降 · visionOS 26 以降</dd>
     </div>
     <div>
       <dt>対応言語</dt>
diff --git a/site/privacy.html b/site/privacy.html
index 72a6dc8..c87675f 100644
--- a/site/privacy.html
+++ b/site/privacy.html
@@ -160,7 +160,7 @@ <h2 style="border-top:0;padding-top:0;margin-top:2.5rem">Privacy Policy</h2>
     device and in whatever location you choose to save them.
   </p>
 
-  <p class="meta">Last updated: 7 August 2026</p>
+  <p class="meta">Last updated: 18 August 2026</p>
 
   <h2>1. Information we collect</h2>
   <p>None. The app has none of the following:</p>
@@ -173,6 +173,11 @@ <h2>1. Information we collect</h2>
         (anything that would require App Tracking Transparency)</li>
     <li>Access to location, contacts, photos, camera, or microphone</li>
   </ul>
+  <p>
+    On Apple Vision Pro the app asks permission to detect your surroundings, so
+    it can put your drawing on a real table. That is not camera access, and
+    nothing it detects is collected — see section 6.
+  </p>
 
   <h2>2. Network connections</h2>
   <p>The app makes none. Its source code contains no networking code at all.</p>
@@ -203,10 +208,39 @@ <h2>4. Children</h2>
   <h2>5. Sharing with third parties</h2>
   <p>There is nothing to share, because nothing is collected.</p>
 
-  <h2>6. Changes to this policy</h2>
+  <h2>6. Detecting your surroundings on Apple Vision Pro</h2>
+  <p>
+    On Apple Vision Pro — and only there — the app asks for permission to detect
+    your surroundings. It uses this to place your drawing on a real table in
+    front of you, instead of leaving it floating wherever the app happened to
+    start.
+  </p>
+  <ul>
+    <li>
+      What the app receives is the <strong>position, size and height of flat
+      horizontal surfaces</strong> around you, and <strong>the position of the
+      device itself</strong> — enough to know that there is a table in front of
+      you and how far away it is.
+    </li>
+    <li>
+      <strong>No camera image is ever given to the app.</strong> The app cannot
+      see your room, the people in it, or anything written on your desk.
+    </li>
+    <li>
+      It is used only to decide where to put the drawing. It is never saved and
+      never sent anywhere — it exists in memory while the drawing is on the
+      table, and is gone once you put it away or close the app.
+    </li>
+    <li>
+      You do not have to allow it. If you decline, or if no table is found, the
+      drawing simply floats in front of you instead.
+    </li>
+  </ul>
+
+  <h2>7. Changes to this policy</h2>
   <p>If this policy changes, this page will be updated and the date above revised.</p>
 
-  <h2>7. Contact</h2>
+  <h2>8. Contact</h2>
   <p>
     Questions about this policy or the app are welcome at
     <a href="https://github.com/temoki/TortoiseBlocks/issues">GitHub Issues</a>.
@@ -224,7 +258,7 @@ <h2 style="border-top:0;padding-top:0;margin-top:2.5rem">プライバシーポ
     利用者自身が選んだ保存先にのみ保存されます。
   </p>
 
-  <p class="meta">最終更新日: 2026年8月7日</p>
+  <p class="meta">最終更新日: 2026年8月18日</p>
 
   <h2>1. 収集する情報</h2>
   <p>ありません。本アプリには次のいずれもありません。</p>
@@ -236,6 +270,7 @@ <h2>1. 収集する情報</h2>
     <li>端末を横断して利用者を追跡する仕組み（App Tracking Transparency の対象となる行為）</li>
     <li>位置情報、連絡先、写真、カメラ、マイクへのアクセス</li>
   </ul>
+  <p>Apple Vision Pro では、作品を現実の机の上に置くために、周囲の検出の許可を求めます。これはカメラへのアクセスではなく、検出した内容を収集することもありません。詳しくは 6 をご覧ください。</p>
 
   <h2>2. ネットワーク通信</h2>
   <p>
@@ -269,10 +304,19 @@ <h2>4. 子どもの利用について</h2>
   <h2>5. 第三者への提供</h2>
   <p>収集している情報がないため、第三者に提供する情報もありません。</p>
 
-  <h2>6. 本ポリシーの変更</h2>
+  <h2>6. Apple Vision Pro での周囲の検出</h2>
+  <p>Apple Vision Pro 版でのみ、アプリは周囲の検出の許可を求めます。作品を目の前の現実の机の上に置くために使います。許可がないと、作品はアプリが起動した場所に浮いたままになります。</p>
+  <ul>
+    <li>アプリが受け取るのは、周囲にある<strong>水平な面の位置・大きさ・高さ</strong>と、<strong>端末自身の位置</strong>だけです。目の前に机があること、それがどのくらい離れているかが分かる、という程度の情報です。</li>
+    <li><strong>カメラの映像がアプリに渡ることはありません。</strong>アプリが部屋の様子や、そこにいる人、机の上に置かれた書類などを見ることはできません。</li>
+    <li>これらは作品を置く場所を決めるためだけに使われます。保存も送信も一切行いません。作品が机の上にある間だけメモリ上に存在し、片付けるかアプリを終了した時点で失われます。</li>
+    <li>許可しなくても構いません。許可しなかった場合や、机が見つからなかった場合は、作品は目の前の空中に表示されます。</li>
+  </ul>
+
+  <h2>7. 本ポリシーの変更</h2>
   <p>内容を変更した場合は、このページを更新し、上記の最終更新日を改めます。</p>
 
-  <h2>7. お問い合わせ</h2>
+  <h2>8. お問い合わせ</h2>
   <p>
     本ポリシーや本アプリについてのご質問は、
     <a href="https://github.com/temoki/TortoiseBlocks/issues">GitHub の Issues</a>