patches: fix if(candidate) block indentation in 0008 (I1)

The if(candidate) block in postAccessibilityNotificationsForFrame: had its opening brace at col 8 (tab) while the if itself is at col 10 (tab+2), violating GNU coding style. Two consecutive closing braces at col 8 made nesting ambiguous on inspection. Correct indentation (all +4 columns throughout the block): - if(candidate) brace: tab+4 = col 12 - Body (/* Deduplicate */, if(![...]): tab+6 = col 14 - Inner if(![...]) brace: 2 tabs = col 16 - Inner if body: tab+tab+2 = col 18 - Inner closing brace: 2 tabs = col 16 - if(candidate) closing brace: tab+4 = col 12 New indentation exactly matches the original deleted code (same method, before our refactor), confirming it follows the pre-existing style in this file.
patches: fix if(candidate) block indentation in 0008
2026-03-04 13:53:05 +01:00 · 2026-03-04 13:50:45 +01:00 · 2026-03-04 13:38:54 +01:00 · 2026-03-04 13:37:39 +01:00 · 2026-03-04 13:35:54 +01:00 · 2026-03-04 13:32:24 +01:00
12 changed files with 2141 additions and 1749 deletions
--- a/config.el
+++ b/config.el
@@ -888,8 +888,10 @@ Skip for beamer exports — beamer uses adjustbox on plain tabular."
 (setq vc-ignore-dir-regexp
      (format "%s\\|%s" vc-ignore-dir-regexp tramp-file-name-regexp))

-(defadvice projectile-project-root (around ignore-remote first activate)
-  (unless (file-remote-p default-directory) ad-do-it))
+(advice-add 'projectile-project-root :around
+            (lambda (orig-fn &rest args)
+              (unless (file-remote-p default-directory)
+                (apply orig-fn args))))

 (setq remote-file-name-inhibit-cache nil
      tramp-verbose 1)
@@ -1584,13 +1586,14 @@ Skip for beamer exports — beamer uses adjustbox on plain tabular."

  ;; Error handler: catch errors during cal->org event update
  ;; so sync state is saved even if individual events fail
-  (defadvice org-caldav-update-events-in-org (around skip-failed-events activate)
+  (advice-add 'org-caldav-update-events-in-org :around
+              (lambda (orig-fn &rest args)
                "Catch errors during cal->org sync; log and return so sync state is saved."
                (condition-case err
-        ad-do-it
+                    (apply orig-fn args)
                  (error
                   (message "org-caldav: update-events-in-org error (sync continues): %S" err)
-       (org-caldav-debug-print 1 (format "update-events-in-org error: %S" err)))))
+                   (org-caldav-debug-print 1 (format "update-events-in-org error: %S" err))))))

  (defun my/org-caldav-sync ()
    "Sync 4 CalDAV calendars: Suky (twoway), Placeholders, Family, Klara (read-only)."
@@ -2139,3 +2142,9 @@ Formats matching what org-caldav/ox-icalendar export correctly:
 ;; gls
 (setq insert-directory-program "gls")

+
+;; Always enable macOS accessibility (VoiceOver + Zoom cursor tracking).
+;; Override auto-detection so the AX tree is available from startup
+;; regardless of whether an AT is currently active.
+(when (eq system-type 'darwin)
+  (setq ns-accessibility-enabled t))
--- a/patches/0000-ns-integrate-with-macOS-Zoom-for-cursor-tracking.patch
+++ b/patches/0000-ns-integrate-with-macOS-Zoom-for-cursor-tracking.patch
@@ -0,0 +1,461 @@
+From fcc1826baee5b424d5fdc176239c5675aee6159b Mon Sep 17 00:00:00 2001
+From: Martin Sukany <martin@sukany.cz>
+Date: Sat, 28 Feb 2026 22:39:35 +0100
+Subject: [PATCH 1/9] ns: integrate with macOS Zoom for cursor tracking
+
+Inform macOS Zoom of the text cursor position so the zoomed viewport
+follows keyboard focus in Emacs.  Also track completion candidates so
+Zoom follows the selected item (Vertico, Corfu, etc.) during completion.
+
+* etc/NEWS: Document Zoom integration.
+* src/nsterm.h (EmacsView): Add lastCursorRect, zoomCursorUpdated.
+* src/nsterm.m: Include ApplicationServices for UAZoomEnabled and
+UAZoomChangeFocus (UniversalAccess sub-framework).
+[NS_IMPL_COCOA]: Define NS_AX_MAX_COMPLETION_BUFFER_CHARS.
+(ns_zoom_enabled_p): New static function; caches UAZoomEnabled with
+1-second TTL to avoid per-frame Mach IPC overhead.
+(ns_zoom_face_is_selected): New static predicate; matches 'current',
+'selected', 'selection' in face symbol names.
+(ns_zoom_find_overlay_candidate_line): New static function; scans
+minibuffer overlays for the selected completion candidate line.
+(ns_zoom_find_child_frame_candidate): New static function; scans
+child frame buffers for a selected candidate; guards against partially
+initialized frames with WINDOWP and BUFFERP checks.
+(ns_zoom_track_completion): New static function; overrides Zoom focus
+to the selected completion candidate after normal cursor tracking.
+(ns_update_end): Call ns_zoom_track_completion.
+(ns_draw_window_cursor): Store cursor rect; call UAZoomChangeFocus.
+---
+ etc/NEWS     |  11 ++
+ src/nsterm.h |   6 +
+ src/nsterm.m | 354 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 371 insertions(+)
+
+diff --git a/etc/NEWS b/etc/NEWS
+index 7367e3ccbd..4c149e41d6 100644
+--- a/etc/NEWS
+++ b/etc/NEWS
+@@ -82,6 +82,17 @@ other directory on your system.  You can also invoke the
+ 
+ * Changes in Emacs 31.1
+ 
++++
+** The macOS NS port now integrates with macOS Zoom.
+When macOS Zoom is enabled (System Settings, Accessibility, Zoom,
+Follow keyboard focus), Emacs informs Zoom of the text cursor position
+after every cursor redraw via 'UAZoomChangeFocus'.  The zoomed viewport
+automatically tracks the insertion point across window splits and
+switches.  Completion frameworks (Vertico, Icomplete, Ivy for overlay
+candidates; Corfu, Company-box for child frame popups) are also
+tracked: Zoom follows the selected candidate rather than the text
+cursor during completion.
+
+ +++
+ ** 'line-spacing' now supports specifying spacing above the line.
+ Previously, only spacing below the line could be specified.  The user
+diff --git a/src/nsterm.h b/src/nsterm.h
+index 7c1ee4cf53..ea6e7ba4f5 100644
+--- a/src/nsterm.h
+++ b/src/nsterm.h
+@@ -484,6 +484,12 @@ enum ns_return_frame_mode
+ @public
+   struct frame *emacsframe;
+   int scrollbarsNeedingUpdate;
+#ifdef NS_IMPL_COCOA
+  /* Cached cursor rect for macOS Zoom integration.  Set by
+     ns_draw_window_cursor, used by ns_update_end fallback.  */
+  NSRect lastCursorRect;
+  BOOL zoomCursorUpdated;
+#endif
+   NSRect ns_userRect;
+ }
+ 
+diff --git a/src/nsterm.m b/src/nsterm.m
+index 932d209f56..88c9251c18 100644
+--- a/src/nsterm.m
+++ b/src/nsterm.m
+@@ -71,6 +71,11 @@ Updated by Christian Limpach (chris@nice.ch)
+ #include "macfont.h"
+ #include <Carbon/Carbon.h>
+ #include <IOSurface/IOSurface.h>
+/* ApplicationServices provides UAZoomEnabled and UAZoomChangeFocus
+   (UniversalAccess sub-framework).  Carbon.h already pulls in
+   ApplicationServices on most SDK versions, but the explicit import
+   makes the dependency visible and guards against SDK changes.  */
+#import <ApplicationServices/ApplicationServices.h>
+ #endif
+ 
+ static EmacsMenu *dockMenu;
+@@ -1081,6 +1086,281 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
+ }
+ 
+ 
+
+#ifdef NS_IMPL_COCOA
+#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
+    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
+
+/* Maximum buffer size (in characters) for a window that we consider
+   a candidate for a completion popup.  Completion popups are small;
+   if the buffer is larger than this, it is not a popup and we skip it
+   to avoid O(buffer-size) work per redisplay cycle.  */
+#define NS_AX_MAX_COMPLETION_BUFFER_CHARS 10000
+
+/* Cached wrapper around ns_zoom_enabled_p ().
+   ns_zoom_enabled_p () performs a synchronous Mach IPC roundtrip to the
+   macOS Accessibility server (~50-200 µs per call).  With call sites
+   in ns_draw_window_cursor, ns_update_end, and ns_zoom_track_completion,
+   the overhead accumulates to ~150-600 µs per redisplay cycle.  Zoom
+   state changes only on explicit user action in System Settings, so a
+   1-second TTL is safe and indistinguishable from querying every frame.
+   Uses CFAbsoluteTimeGetCurrent() (~5 ns, a VDSO read) for timing.  */
+static BOOL ns_zoom_cached_enabled;
+static CFAbsoluteTime ns_zoom_cache_time;
+
+static BOOL
+ns_zoom_enabled_p (void)
+{
+  CFAbsoluteTime now = CFAbsoluteTimeGetCurrent ();
+  if (now - ns_zoom_cache_time > 1.0)
+    {
+      ns_zoom_cached_enabled = UAZoomEnabled ();
+      ns_zoom_cache_time = now;
+    }
+  return ns_zoom_cached_enabled;
+}
+
+/* Identify faces that mark a selected completion candidate.
+   Matches vertico-current, corfu-current, icomplete-selected-match,
+   ivy-current-match, etc. by checking the face symbol name.
+   Defined here so the Zoom patch compiles independently of the
+   VoiceOver patches.  */
+static bool
+ns_zoom_face_is_selected (Lisp_Object face)
+{
+  if (SYMBOLP (face))
+    {
+      const char *name = SSDATA (SYMBOL_NAME (face));
+      return (strstr (name, "current") != NULL
+	      || strstr (name, "selected") != NULL
+	      || strstr (name, "selection") != NULL);
+    }
+  if (CONSP (face))
+    {
+      Lisp_Object tail;
+      for (tail = face; CONSP (tail); tail = XCDR (tail))
+	if (ns_zoom_face_is_selected (XCAR (tail)))
+	  return true;
+    }
+  return false;
+}
+
+/* Scan overlay before-string / after-string properties in the
+   selected window for a completion candidate with a "selected"
+   face.  Return the 0-based visual line index of the selected
+   candidate, or -1 if none found.  */
+static int
+ns_zoom_find_overlay_candidate_line (struct window *w)
+{
+  /* Overlay completion frameworks (Vertico, Icomplete, Ivy) place
+     candidates as overlay strings in the minibuffer only.  Scanning
+     overlays in large normal buffers causes O(overlays) work per
+     redisplay --- return immediately for non-minibuffer windows.  */
+  if (!MINI_WINDOW_P (w))
+    return -1;
+
+  struct buffer *b = XBUFFER (w->contents);
+  ptrdiff_t beg = marker_position (w->start);
+  ptrdiff_t end = BUF_ZV (b);
+  Lisp_Object overlays = Foverlays_in (make_fixnum (beg),
+					make_fixnum (end));
+  Lisp_Object tail;
+
+  for (tail = overlays; CONSP (tail); tail = XCDR (tail))
+    {
+      Lisp_Object ov = XCAR (tail);
+      Lisp_Object str = Foverlay_get (ov, Qbefore_string);
+
+      if (NILP (str))
+	str = Foverlay_get (ov, Qafter_string);
+      if (!STRINGP (str) || SCHARS (str) < 2)
+	continue;
+
+      /* Walk the string line by line, checking faces.  */
+      ptrdiff_t len = SCHARS (str);
+      int line = 0;
+      ptrdiff_t line_start = 0;
+
+      for (ptrdiff_t i = 0; i <= len; i++)
+	{
+	  bool at_newline = (i == len
+			     || SREF (str, i) == '\n');
+	  if (at_newline && i > line_start)
+	    {
+	      /* Check the face at line_start.  */
+	      Lisp_Object face
+		= Fget_text_property (make_fixnum (line_start),
+				      Qface, str);
+	      if (ns_zoom_face_is_selected (face))
+		return line;
+	      line++;
+	      line_start = i + 1;
+	    }
+	  else if (at_newline)
+	    {
+	      line++;
+	      line_start = i + 1;
+	    }
+	}
+    }
+  return -1;
+}
+
+/* Scan child frames for a completion popup with a selected
+   candidate.  Return the 0-based line index, or -1 if none.
+   Set *CHILD_FRAME to the child frame if found.  */
+static int
+ns_zoom_find_child_frame_candidate (struct frame *f,
+				    struct frame **child_frame)
+{
+  Lisp_Object frame, tail;
+
+  FOR_EACH_FRAME (tail, frame)
+    {
+      struct frame *cf = XFRAME (frame);
+      if (!FRAME_NS_P (cf) || !FRAME_LIVE_P (cf))
+	continue;
+      if (FRAME_PARENT_FRAME (cf) != f)
+	continue;
+      /* Small buffer = likely completion popup.  Guard against
+	 partially initialized frames where selected_window or its
+	 buffer may not yet be live.  */
+      if (!WINDOWP (cf->selected_window))
+	continue;
+      struct window *cw = XWINDOW (cf->selected_window);
+      if (!BUFFERP (cw->contents))
+	continue;
+      struct buffer *b = XBUFFER (cw->contents);
+      if (BUF_ZV (b) - BUF_BEGV (b) > NS_AX_MAX_COMPLETION_BUFFER_CHARS)
+	continue;
+
+      ptrdiff_t beg = BUF_BEGV (b);
+      ptrdiff_t zv = BUF_ZV (b);
+      int line = 0;
+
+      specpdl_ref count = SPECPDL_INDEX ();
+      record_unwind_current_buffer ();
+      set_buffer_internal_1 (b);
+
+      ptrdiff_t pos = beg;
+      while (pos < zv)
+	{
+	  Lisp_Object face
+	    = Fget_char_property (make_fixnum (pos), Qface,
+				 cw->contents);
+	  if (ns_zoom_face_is_selected (face))
+	    {
+	      unbind_to (count, Qnil);
+	      *child_frame = cf;
+	      return line;
+	    }
+	  /* Advance to next line.  */
+	  ptrdiff_t next = find_newline (pos, -1, zv, -1,
+					 1, NULL, NULL, false);
+	  if (next <= pos)
+	    break;
+	  pos = next;
+	  line++;
+	}
+      unbind_to (count, Qnil);
+    }
+  return -1;
+}
+
+/* Update Zoom focus based on completion candidates.
+   Called from ns_update_end after normal cursor tracking.
+   If a completion candidate is selected (overlay or child frame),
+   move Zoom to that candidate instead of the text cursor.  */
+static void
+ns_zoom_track_completion (struct frame *f, EmacsView *view)
+{
+  if (!ns_zoom_enabled_p ())
+    return;
+  if (!WINDOWP (f->selected_window))
+    return;
+  /* Child frames (e.g. the Corfu popup itself) have no children to
+     scan for completion candidates; their parent frame's ns_update_end
+     will scan them via FOR_EACH_FRAME.  Return early to avoid a
+     redundant O(frames) scan on every child-frame redisplay cycle.
+     Note: the rate limit that was here caused corfu tracking to fail:
+     the child frame's ns_update_end reset the timer, so the parent
+     frame's subsequent ns_update_end returned early without scanning.  */
+  if (FRAME_PARENT_FRAME (f))
+    return;
+
+  specpdl_ref count = SPECPDL_INDEX ();
+  record_unwind_current_buffer ();
+
+  struct window *w = XWINDOW (f->selected_window);
+  int line_h = FRAME_LINE_HEIGHT (f);
+
+  /* 1. Check overlay completions (Vertico, Icomplete, Ivy).  */
+  int ov_line = ns_zoom_find_overlay_candidate_line (w);
+  if (ov_line >= 0)
+    {
+      /* Overlay candidates typically start after the input line,
+	 so the visual offset is (ov_line + 1) * line_h from
+	 the window top.  */
+      int y_off = (ov_line + 1) * line_h;
+      if (y_off < w->pixel_height)
+	{
+	  NSRect r = NSMakeRect (
+	    WINDOW_TEXT_TO_FRAME_PIXEL_X (w, 0),
+	    WINDOW_TO_FRAME_PIXEL_Y (w, y_off),
+	    FRAME_COLUMN_WIDTH (f),
+	    line_h);
+
+	  NSRect windowRect = [view convertRect:r toView:nil];
+	  NSRect screenRect
+	    = [[view window] convertRectToScreen:windowRect];
+	  CGRect cgRect = NSRectToCGRect (screenRect);
+	  CGFloat primaryH
+	    = [[[NSScreen screens] firstObject] frame].size.height;
+	  cgRect.origin.y
+	    = primaryH - cgRect.origin.y - cgRect.size.height;
+
+	  UAZoomChangeFocus (&cgRect, &cgRect,
+			     kUAZoomFocusTypeInsertionPoint);
+	  unbind_to (count, Qnil);
+	  return;
+	}
+    }
+
+  /* 2. Check child frame completions (Corfu, Company-box).  */
+  struct frame *cf = NULL;
+  int cf_line = ns_zoom_find_child_frame_candidate (f, &cf);
+  if (cf_line >= 0 && cf)
+    {
+      EmacsView *cv = FRAME_NS_VIEW (cf);
+      struct window *cw
+	= XWINDOW (cf->selected_window);
+      int cf_line_h = FRAME_LINE_HEIGHT (cf);
+      int y_off = cf_line * cf_line_h;
+
+      NSRect r = NSMakeRect (
+	WINDOW_TEXT_TO_FRAME_PIXEL_X (cw, 0),
+	WINDOW_TO_FRAME_PIXEL_Y (cw, y_off),
+	FRAME_COLUMN_WIDTH (cf),
+	cf_line_h);
+
+      NSRect windowRect = [cv convertRect:r toView:nil];
+      NSRect screenRect
+	= [[cv window] convertRectToScreen:windowRect];
+      CGRect cgRect = NSRectToCGRect (screenRect);
+      CGFloat primaryH
+	= [[[NSScreen screens] firstObject] frame].size.height;
+      cgRect.origin.y
+	= primaryH - cgRect.origin.y - cgRect.size.height;
+
+      UAZoomChangeFocus (&cgRect, &cgRect,
+			 kUAZoomFocusTypeInsertionPoint);
+    }
+  unbind_to (count, Qnil);
+}
+
+#endif /* MAC_OS_X_VERSION_MIN_REQUIRED >= 101000 */
+#endif /* NS_IMPL_COCOA */
+
+ static void
+ ns_update_end (struct frame *f)
+ /* --------------------------------------------------------------------------
+@@ -1104,6 +1384,41 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
+ 
+   unblock_input ();
+   ns_updating_frame = NULL;
+
+#ifdef NS_IMPL_COCOA
+  /* Zoom fallback: ensure Zoom tracks the cursor after window
+     switches (C-x o) where the physical cursor may not be redrawn.
+     Only fires when ns_draw_window_cursor did NOT run in this cycle
+     (zoomCursorUpdated is NO).  */
+#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
+    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
+  if (view && !view->zoomCursorUpdated && ns_zoom_enabled_p ()
+      && !NSIsEmptyRect (view->lastCursorRect))
+    {
+      NSRect r = view->lastCursorRect;
+      NSRect windowRect = [view convertRect:r toView:nil];
+      NSRect screenRect
+	= [[view window] convertRectToScreen:windowRect];
+      CGRect cgRect = NSRectToCGRect (screenRect);
+
+      CGFloat primaryH
+	= [[[NSScreen screens] firstObject] frame].size.height;
+      cgRect.origin.y
+	= primaryH - cgRect.origin.y - cgRect.size.height;
+
+      UAZoomChangeFocus (&cgRect, &cgRect,
+			 kUAZoomFocusTypeInsertionPoint);
+    }
+  if (view)
+    view->zoomCursorUpdated = NO;
+#endif
+
+  /* Track completion candidates for Zoom (overlay and child frame).
+     Runs after cursor tracking so the selected candidate overrides
+     the default cursor position.  */
+  if (view)
+    ns_zoom_track_completion (f, view);
+#endif /* NS_IMPL_COCOA */
+ }
+ 
+ static void
+@@ -3232,6 +3547,45 @@ Note that CURSOR_WIDTH is meaningful only for (h)bar cursors.
+   /* Prevent the cursor from being drawn outside the text area.  */
+   r = NSIntersectionRect (r, ns_row_rect (w, glyph_row, TEXT_AREA));
+ 
+#ifdef NS_IMPL_COCOA
+  /* Zoom integration: inform macOS Zoom of the cursor position.
+     Zoom (System Settings -> Accessibility -> Zoom) tracks a focus
+     element to keep the zoomed viewport centered on the cursor.
+
+     Coordinate conversion:
+       EmacsView pixels (AppKit, flipped, top-left origin)
+         -> NSWindow (convertRect:toView:nil)
+         -> NSScreen (convertRectToScreen:)
+         -> CGRect with y-flip for CoreGraphics top-left origin.  */
+  {
+    EmacsView *view = FRAME_NS_VIEW (f);
+    if (view && on_p && active_p)
+      {
+	view->lastCursorRect = r;
+	view->zoomCursorUpdated = YES;
+
+#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
+    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
+	if (ns_zoom_enabled_p ())
+	  {
+	    NSRect windowRect = [view convertRect:r toView:nil];
+	    NSRect screenRect
+	      = [[view window] convertRectToScreen:windowRect];
+	    CGRect cgRect = NSRectToCGRect (screenRect);
+
+	    CGFloat primaryH
+	      = [[[NSScreen screens] firstObject] frame].size.height;
+	    cgRect.origin.y
+	      = primaryH - cgRect.origin.y - cgRect.size.height;
+
+	    UAZoomChangeFocus (&cgRect, &cgRect,
+			       kUAZoomFocusTypeInsertionPoint);
+	  }
+#endif
+      }
+  }
+#endif /* NS_IMPL_COCOA */
+
+   ns_focus (f, NULL, 0);
+ 
+   NSGraphicsContext *ctx = [NSGraphicsContext currentContext];
+-- 
+2.43.0
+
--- a/patches/0001-ns-add-accessibility-base-classes-and-text-extractio.patch
+++ b/patches/0001-ns-add-accessibility-base-classes-and-text-extractio.patch
@@ -1,43 +1,42 @@
-From d176c3c9d97574f0cd493d6491eda0a82ad28387 Mon Sep 17 00:00:00 2001
+From 29546d323559dbbefd846f7b2720285ff90368c8 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 1/8] ns: add accessibility base classes and text extraction
+Subject: [PATCH 2/9] ns: add accessibility base classes and text extraction

-Add the foundation for macOS VoiceOver accessibility in the NS
-(Cocoa) port.  No existing code paths are modified.
+Add the foundation for macOS VoiceOver accessibility in the NS (Cocoa)
+port.  No existing code paths are modified.

 * src/nsterm.h (ns_ax_visible_run): New struct.
-(EmacsAccessibilityElement): New base class.
+(EmacsAccessibilityElement): New base Objective-C class.
 (EmacsAccessibilityBuffer, EmacsAccessibilityModeLine)
-(EmacsAccessibilityInteractiveSpan): Forward declarations.
-(EmacsAccessibilityBuffer(Notifications)): New category interface.
-(EmacsAccessibilityBuffer(InteractiveSpans)): New category interface.
-(EmacsAXSpanType): New enum.
-(EmacsView): New ivars for accessibility state.
+(EmacsAccessibilityInteractiveSpan): Forward-declare new classes.
+(EmacsAXSpanType): New enum for interactive span types.
+(EmacsView): New ivars for accessibility element tree.
 * src/nsterm.m: Include intervals.h for TEXT_PROP_MEANS_INVISIBLE.
-
-(ns_ax_buffer_text, ns_ax_mode_line_text, ns_ax_frame_for_range)
-(ns_ax_completion_string_from_prop, ns_ax_window_buffer_object)
-(ns_ax_window_end_charpos, ns_ax_text_prop_at)
-(ns_ax_next_prop_change, ns_ax_get_span_label)
-(ns_ax_post_notification, ns_ax_post_notification_with_info): New
-functions.
+(ns_ax_buffer_text): New function; build visible-text string and
+run array for a window, skipping invisible character regions.
+(ns_ax_mode_line_text): New function; extract mode-line text.
+(ns_ax_frame_for_range): New function; map charpos range to screen
+rect via glyph matrix.
+(ns_ax_completion_string_from_prop)
+(ns_ax_window_buffer_object, ns_ax_window_end_charpos)
+(ns_ax_text_prop_at, ns_ax_next_prop_change)
+(ns_ax_get_span_label, ns_ax_post_notification)
+(ns_ax_post_notification_with_info): New helper functions.
 (EmacsAccessibilityElement): Implement base class.
-(syms_of_nsterm): Register accessibility DEFSYM and DEFVAR
-ns-accessibility-enabled.
-
-Tested on macOS 14 Sonoma with VoiceOver 10.  Builds cleanly;
-no functional change (dead code until patch 5/6 wires it in).
+(syms_of_nsterm): Register accessibility DEFSYMs.  Add DEFVAR_BOOL
+ns-accessibility-enabled with corrected doc: initial value is nil,
+set non-nil automatically when an AT is detected at startup.
 ---
- src/nsterm.h | 131 +++++++++++++++
- src/nsterm.m | 456 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 587 insertions(+)
+ src/nsterm.h | 131 ++++++++++++++
+ src/nsterm.m | 482 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 613 insertions(+)

 diff --git a/src/nsterm.h b/src/nsterm.h
-index 7c1ee4c..5298386 100644
+index ea6e7ba4f5..f245675513 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -453,6 +453,122 @@ enum ns_return_frame_mode
+@@ -453,6 +453,124 @@ enum ns_return_frame_mode
 @end
 
 
@@ -53,11 +52,11 @@ index 7c1ee4c..5298386 100644
 +/* Base class for virtual accessibility elements attached to EmacsView.  */
 +@interface EmacsAccessibilityElement : NSAccessibilityElement
 +@property (nonatomic, unsafe_unretained) EmacsView *emacsView;
-+/* Lisp window object — safe across GC cycles.
+/* Lisp window object --- safe across GC cycles.
 +   GC safety: these Lisp_Objects are NOT visible to GC via staticpro
 +   or the specpdl stack.  This is safe because:
 +   (1) Emacs GC runs only on the main thread, at well-defined safe
-+       points during Lisp evaluation — never during redisplay.
+       points during Lisp evaluation --- never during redisplay.
 +   (2) Accessibility elements are owned by EmacsView which belongs to
 +       an active frame; windows referenced here are always reachable
 +       from the frame's window tree until rebuildAccessibilityTree
@@ -82,13 +81,14 @@ index 7c1ee4c..5298386 100644
 +  NSUInteger ax_length; /* Length in accessibility string (UTF-16 units).  */
 +} ns_ax_visible_run;
 +
-+/* Virtual AXTextArea element — one per visible Emacs window (buffer).  */
-+@interface EmacsAccessibilityBuffer : EmacsAccessibilityElement <NSAccessibility>
+/* Virtual AXTextArea element --- one per visible Emacs window (buffer).  */
+@interface EmacsAccessibilityBuffer
+  : EmacsAccessibilityElement <NSAccessibility>
 +{
 +  ns_ax_visible_run *visibleRuns;
 +  NSUInteger         visibleRunCount;
-+  NSUInteger        *lineStartOffsets;   /* AX string index of each line start.  */
-+  NSUInteger         lineCount;          /* Number of entries in lineStartOffsets.  */
+  NSUInteger        *lineStartOffsets;   /* AX index for each line.  */
+  NSUInteger         lineCount;          /* Entries in lineStartOffsets.  */
 +  NSMutableArray    *cachedInteractiveSpans;
 +  BOOL               interactiveSpansDirty;
 +}
@@ -119,12 +119,12 @@ index 7c1ee4c..5298386 100644
 +- (void)invalidateInteractiveSpans;
 +@end
 +
-+/* Virtual AXStaticText element — one per mode line.  */
+/* Virtual AXStaticText element --- one per mode line.  */
 +@interface EmacsAccessibilityModeLine : EmacsAccessibilityElement
 +@end
 +
 +/* Span types for interactive AX child elements.  */
-+typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+typedef NS_ENUM(NSInteger, EmacsAXSpanType)
 +{
 +  EmacsAXSpanTypeNone           = -1,
 +  EmacsAXSpanTypeButton         = 0,
@@ -144,7 +144,8 @@ index 7c1ee4c..5298386 100644
 +@property (nonatomic, assign) EmacsAXSpanType spanType;
 +@property (nonatomic, copy)   NSString *spanLabel;
 +@property (nonatomic, copy)   NSString *spanValue;
-+@property (nonatomic, unsafe_unretained) EmacsAccessibilityBuffer *parentBuffer;
+@property (nonatomic, unsafe_unretained)
+  EmacsAccessibilityBuffer *parentBuffer;
 +
 +- (NSAccessibilityRole) accessibilityRole;
 +- (NSString *)          accessibilityLabel;
@@ -160,7 +161,7 @@ index 7c1ee4c..5298386 100644
 /* ==========================================================================
 
    The main Emacs view
-@@ -471,6 +587,14 @@ enum ns_return_frame_mode
+@@ -471,6 +589,12 @@ enum ns_return_frame_mode
 #ifdef NS_IMPL_COCOA
   char *old_title;
   BOOL maximizing_resize;
@@ -170,12 +171,10 @@ index 7c1ee4c..5298386 100644
 +  Lisp_Object lastRootWindow;
 +  BOOL accessibilityTreeValid;
 +  BOOL accessibilityUpdating;
-+  @public  /* Accessed by ns_draw_phys_cursor (C function).  */
-+  NSRect lastAccessibilityCursorRect;
 #endif
   BOOL font_panel_active;
   NSFont *font_panel_result;
-@@ -528,6 +652,13 @@ enum ns_return_frame_mode
+@@ -534,6 +658,13 @@ enum ns_return_frame_mode
 - (void)windowWillExitFullScreen;
 - (void)windowDidExitFullScreen;
 - (void)windowDidBecomeKey;
@@ -190,10 +189,10 @@ index 7c1ee4c..5298386 100644
 
 
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 74e4ad5..2ac1d9d 100644
+index 88c9251c18..3b923ee5fa 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -46,6 +46,7 @@ GNUstep port and post-20 update by Adrian Robert (arobert@cogsci.ucsd.edu)
+@@ -46,6 +46,7 @@ Updated by Christian Limpach (chris@nice.ch)
 #include "blockinput.h"
 #include "sysselect.h"
 #include "nsterm.h"
@@ -201,7 +200,7 @@ index 74e4ad5..2ac1d9d 100644
 #include "systime.h"
 #include "character.h"
 #include "xwidget.h"
-@@ -6856,6 +6857,430 @@ ns_create_font_panel_buttons (id target, SEL select, SEL cancel_action)
+@@ -7201,6 +7202,460 @@ - (BOOL)fulfillService: (NSString *)name withArg: (NSString *)arg
 }
 #endif
 
@@ -250,6 +249,11 @@ index 74e4ad5..2ac1d9d 100644
 +
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_current_buffer ();
+  /* block_input must come before record_unwind_protect_void (unblock_input):
+     if specpdl_push were to fail after registration, the unwind handler
+     would call unblock_input without a matching block_input.  */
+  block_input ();
+  record_unwind_protect_void (unblock_input);
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
 +
@@ -290,7 +294,7 @@ index 74e4ad5..2ac1d9d 100644
 +
 +      /* Extract this visible run's text.  Use
 +	 Fbuffer_substring_no_properties which correctly handles the
-+	 buffer gap — raw BUF_BYTE_ADDRESS reads across the gap would
+	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 +	 include garbage bytes when the run spans the gap position.  */
 +      Lisp_Object lstr = Fbuffer_substring_no_properties (
 +	make_fixnum (pos), make_fixnum (run_end));
@@ -327,7 +331,7 @@ index 74e4ad5..2ac1d9d 100644
 +
 +/* TODO: Only CHAR_GLYPH characters (>= 32) are extracted.  Image
 +   glyphs, stretch glyphs, and composed glyphs are silently skipped.
-+   Mode lines using icon fonts (e.g. doom-modeline with nerd-font)
+   Mode lines using icon fonts (e.g. nerd-font icons)
 +   will produce incomplete accessibility text.  */
 +static NSString *
 +ns_ax_mode_line_text (struct window *w)
@@ -371,7 +375,7 @@ index 74e4ad5..2ac1d9d 100644
 +    return NSZeroRect;
 +
 +  /* charpos_start and charpos_len are already in buffer charpos
-+     space — the caller maps AX string indices through
+     space --- the caller maps AX string indices through
 +     charposForAccessibilityIndex which handles invisible text.  */
 +  ptrdiff_t cp_start = charpos_start;
 +  ptrdiff_t cp_end = cp_start + charpos_len;
@@ -552,6 +556,31 @@ index 74e4ad5..2ac1d9d 100644
 +   Deferring via dispatch_async lets the current method return first,
 +   freeing the main queue for VoiceOver's dispatch_sync calls.  */
 +
+/* Return true if FACE (a symbol or list of symbols) looks like a
+   "selected item" face.  Substring match is intentionally broad ---
+   it catches vertico-current, icomplete-selected-match,
+   ivy-current-match, company-tooltip-selection, and similar.
+   False positives are harmless: this runs only on overlay/child-frame
+   strings during completion, never in a hot redisplay path.  */
+static bool
+ns_ax_face_is_selected (Lisp_Object face)
+{
+  if (SYMBOLP (face) && !NILP (face))
+    {
+      const char *name = SSDATA (SYMBOL_NAME (face));
+      if (strstr (name, "current") || strstr (name, "selected")
+	  || strstr (name, "selection"))
+	return true;
+    }
+  if (CONSP (face))
+    {
+      for (Lisp_Object tail = face; CONSP (tail); tail = XCDR (tail))
+	if (ns_ax_face_is_selected (XCAR (tail)))
+	  return true;
+    }
+  return false;
+}
+
 +static inline void
 +ns_ax_post_notification (id element,
 +			  NSAccessibilityNotificationName name)
@@ -632,7 +661,7 @@ index 74e4ad5..2ac1d9d 100644
 /* ==========================================================================
 
     EmacsView implementation
-@@ -11312,6 +11737,28 @@ syms_of_nsterm (void)
+@@ -11657,6 +12112,24 @@ Convert an X font name (XLFD) to an NS font name.
   DEFSYM (Qns_drag_operation_generic, "ns-drag-operation-generic");
   DEFSYM (Qns_handle_drag_motion, "ns-handle-drag-motion");
 
@@ -642,10 +671,6 @@ index 74e4ad5..2ac1d9d 100644
 +  DEFSYM (Qns_ax_previous_line, "previous-line");
 +  DEFSYM (Qns_ax_dired_next_line, "dired-next-line");
 +  DEFSYM (Qns_ax_dired_previous_line, "dired-previous-line");
-+  DEFSYM (Qns_ax_evil_next_line, "evil-next-line");
-+  DEFSYM (Qns_ax_evil_previous_line, "evil-previous-line");
-+  DEFSYM (Qns_ax_evil_next_visual_line, "evil-next-visual-line");
-+  DEFSYM (Qns_ax_evil_previous_visual_line, "evil-previous-visual-line");
 +
 +  /* Accessibility span scanning symbols.  */
 +  DEFSYM (Qns_ax_widget, "widget");
@@ -661,7 +686,7 @@ index 74e4ad5..2ac1d9d 100644
   Fput (Qalt, Qmodifier_value, make_fixnum (alt_modifier));
   Fput (Qhyper, Qmodifier_value, make_fixnum (hyper_modifier));
   Fput (Qmeta, Qmodifier_value, make_fixnum (meta_modifier));
-@@ -11460,6 +11907,15 @@ Note that this does not apply to images.
+@@ -11805,6 +12278,15 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
 This variable is ignored on Mac OS X < 10.7 and GNUstep.  */);
   ns_use_srgb_colorspace = YES;
 
@@ -671,8 +696,8 @@ index 74e4ad5..2ac1d9d 100644
 +When nil, the accessibility virtual element tree is not built and no
 +notifications are posted, eliminating the associated overhead.
 +Requires the Cocoa (NS) build on macOS; ignored on GNUstep.
-+Default is t.  */);
-+  ns_accessibility_enabled = YES;
+Default is nil.  Set to t to enable VoiceOver support.  */);
+  ns_accessibility_enabled = NO;
 +
   DEFVAR_BOOL ("ns-use-mwheel-acceleration",
                ns_use_mwheel_acceleration,
--- a/patches/0002-ns-implement-buffer-accessibility-element-core-proto.patch
+++ b/patches/0002-ns-implement-buffer-accessibility-element-core-proto.patch
@@ -1,288 +1,42 @@
-From 6f2e1b097c2ed1d2f45e99cf85792a1b28556202 Mon Sep 17 00:00:00 2001
+From f587654717e7a3d3121e4871f04ffbf4e0d5e9be Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 2/8] ns: implement buffer accessibility element (core
+Subject: [PATCH 3/9] ns: implement buffer accessibility element (core
 protocol)

 Implement the NSAccessibility text protocol for Emacs buffer windows.

 * src/nsterm.m (ns_ax_find_completion_overlay_range): New function.
-(ns_ax_event_is_line_nav_key): New function.
-(ns_ax_completion_text_for_span): New function.
-(EmacsAccessibilityBuffer): Implement core NSAccessibility protocol:
-text cache with @synchronized, visible-run binary search O(log n),
-selectedTextRange, lineForIndex/indexForLine, frameForRange,
-rangeForPosition, setAccessibilitySelectedTextRange,
-setAccessibilityFocused.
-
-Tested on macOS 14 with VoiceOver.  Verified: buffer reading,
-line-by-line navigation, word/character announcements.
+(ns_ax_event_is_line_nav_key, ns_ax_completion_text_for_span): New
+functions.
+(EmacsAccessibilityBuffer): Implement core NSAccessibility protocol.
+(ensureTextCache): Validity gated on BUF_CHARS_MODIFF, not BUF_MODIFF,
+to avoid O(buffer-size) rebuilds on every font-lock pass.  Add
+explanatory comment on why lineRangeForRange: in the lineStartOffsets
+loop is safe: it runs only on actual character modifications.
+(accessibilityIndexForCharpos:): O(1) fast path for pure-ASCII runs
+(ax_length == length); fall back to sequence walk for multi-byte runs.
+(charposForAccessibilityIndex:): Symmetric O(1) fast path.
+(accessibilityRole, accessibilityLabel, accessibilityValue)
+(accessibilityNumberOfCharacters, accessibilitySelectedText)
+(accessibilitySelectedTextRange, accessibilityInsertionPointLineNumber)
+(accessibilityLineForIndex:): New method; return the line number for an
+AX character index; defined here so patches 0003+ can call it without
+forward reference.
+(accessibilityRangeForLine:, accessibilityRangeForIndex:)
+(accessibilityStyleRangeForIndex:, accessibilityFrameForRange:)
+(accessibilityRangeForPosition:, accessibilityVisibleCharacterRange)
+(accessibilityFrame, setAccessibilitySelectedTextRange:)
+(setAccessibilityFocused:): Implement NSAccessibility protocol methods.
 ---
- src/nsterm.m | 1346 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 1346 insertions(+)
+ src/nsterm.m | 1135 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 1135 insertions(+)

 diff --git a/src/nsterm.m b/src/nsterm.m
-index 2ac1d9d..fc5906a 100644
+index 3b923ee5fa..41c6b8dc14 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -6867,6 +6867,256 @@ ns_create_font_panel_buttons (id target, SEL select, SEL cancel_action)
- 
- /* ---- Helper: extract buffer text for accessibility ---- */
- 
-+/* Return true if FACE is or contains a face symbol whose name
-+   includes "current" or "selected", indicating a highlighted
-+   completion candidate.  Works for vertico-current,
-+   icomplete-selected-match, ivy-current-match, etc.  */
-+static bool
-+ns_ax_face_is_selected (Lisp_Object face)
-+{
-+  if (SYMBOLP (face) && !NILP (face))
-+    {
-+      const char *name = SSDATA (SYMBOL_NAME (face));
-+      /* Substring match is intentionally broad --- it catches
-+	 vertico-current, icomplete-selected-match, ivy-current-match,
-+	 company-tooltip-selection, and similar.  False positives are
-+	 harmless since this runs only on overlay strings during
-+	 completion.  */
-+      if (strstr (name, "current") || strstr (name, "selected")
-+	  || strstr (name, "selection"))
-+	return true;
-+    }
-+  if (CONSP (face))
-+    {
-+      for (Lisp_Object tail = face; CONSP (tail); tail = XCDR (tail))
-+	if (ns_ax_face_is_selected (XCAR (tail)))
-+	  return true;
-+    }
-+  return false;
-+}
-+
-+/* Extract the currently selected candidate text from overlay display
-+   strings.  Completion frameworks render candidates as overlay
-+   before-string/after-string and highlight the current candidate
-+   with a face whose name contains "current" or "selected"
-+   (e.g. vertico-current, icomplete-selected-match, ivy-current-match).
-+
-+   Scan all overlays in the buffer region [BEG, END), find the line
-+   whose face matches the selection heuristic, and return it (already
-+   trimmed of surrounding whitespace).
-+
-+   Also set *OUT_LINE_INDEX to the 0-based visual line index of the
-+   selected candidate (for Zoom positioning), counting only non-trivial
-+   lines.  Set to -1 if not found.
-+
-+   Returns nil if no selected candidate is found.  */
-+static NSString *
-+ns_ax_selected_overlay_text (struct buffer *b,
-+			     ptrdiff_t beg, ptrdiff_t end,
-+			     int *out_line_index)
-+{
-+  *out_line_index = -1;
-+
-+  Lisp_Object ov_list = Foverlays_in (make_fixnum (beg),
-+				      make_fixnum (end));
-+
-+  for (Lisp_Object tail = ov_list; CONSP (tail); tail = XCDR (tail))
-+    {
-+      Lisp_Object ov = XCAR (tail);
-+      Lisp_Object strings[2];
-+      strings[0] = Foverlay_get (ov, intern_c_string ("before-string"));
-+      strings[1] = Foverlay_get (ov, intern_c_string ("after-string"));
-+
-+      for (int s = 0; s < 2; s++)
-+	{
-+	  if (!STRINGP (strings[s]))
-+	    continue;
-+
-+	  Lisp_Object str = strings[s];
-+	  ptrdiff_t slen = SCHARS (str);
-+	  if (slen == 0)
-+	    continue;
-+
-+	  /* Scan for newline positions using SDATA for efficiency.
-+	     The data pointer is used only in this loop, before any
-+	     Lisp calls (Fget_text_property etc.) that could trigger
-+	     GC and relocate string data.  */
-+	  const unsigned char *data = SDATA (str);
-+	  ptrdiff_t byte_len = SBYTES (str);
-+	  /* 512 lines is sufficient for any completion UI;
-+	     vertico-count defaults to 10.  */
-+	  ptrdiff_t line_starts[512];
-+	  ptrdiff_t line_ends[512];
-+	  int nlines = 0;
-+	  ptrdiff_t char_pos = 0, byte_pos = 0, lstart = 0;
-+
-+	  while (byte_pos < byte_len && nlines < 512)
-+	    {
-+	      if (data[byte_pos] == '\n')
-+		{
-+		  if (char_pos > lstart)
-+		    {
-+		      line_starts[nlines] = lstart;
-+		      line_ends[nlines] = char_pos;
-+		      nlines++;
-+		    }
-+		  lstart = char_pos + 1;
-+		}
-+	      if (STRING_MULTIBYTE (str))
-+		byte_pos += BYTES_BY_CHAR_HEAD (data[byte_pos]);
-+	      else
-+		byte_pos++;
-+	      char_pos++;
-+	    }
-+	  if (char_pos > lstart && nlines < 512)
-+	    {
-+	      line_starts[nlines] = lstart;
-+	      line_ends[nlines] = char_pos;
-+	      nlines++;
-+	    }
-+
-+	  /* Find the line whose face indicates selection.  Track
-+	     visual line index for Zoom (skip whitespace-only lines
-+	     like Vertico's leading cursor-space).  */
-+	  int candidate_idx = 0;
-+	  for (int li = 0; li < nlines; li++)
-+	    {
-+	      Lisp_Object face
-+		= Fget_text_property (make_fixnum (line_starts[li]),
-+				      Qface, str);
-+	      if (ns_ax_face_is_selected (face))
-+		{
-+		  Lisp_Object line
-+		    = Fsubstring_no_properties (
-+			str,
-+			make_fixnum (line_starts[li]),
-+			make_fixnum (line_ends[li]));
-+		  NSString *text = [NSString stringWithLispString:line];
-+		  text = [text stringByTrimmingCharactersInSet:
-+			   [NSCharacterSet
-+			     whitespaceAndNewlineCharacterSet]];
-+		  if ([text length] > 0)
-+		    {
-+		      *out_line_index = candidate_idx;
-+		      return text;
-+		    }
-+		}
-+
-+	      /* Count non-trivial lines as candidates for Zoom.  */
-+	      if (line_ends[li] - line_starts[li] > 1)
-+		candidate_idx++;
-+	    }
-+	}
-+    }
-+
-+  return nil;
-+}
-+
-+
-+/* Scan buffer text of a child frame for the selected completion
-+   candidate.  Used for frameworks that render candidates in a
-+   child frame (e.g. Corfu, Company-box) rather than as overlay
-+   strings.  Check the effective face (text properties + overlays)
-+   at the start of each line via Fget_char_property.
-+
-+   Returns the candidate text (trimmed) or nil.  Sets
-+   *OUT_LINE_INDEX to the 0-based line index for Zoom.  */
-+static NSString *
-+ns_ax_selected_child_frame_text (struct buffer *b, Lisp_Object buf_obj,
-+				 int *out_line_index)
-+{
-+  *out_line_index = -1;
-+  ptrdiff_t beg = BUF_BEGV (b);
-+  ptrdiff_t end = BUF_ZV (b);
-+
-+  if (beg >= end)
-+    return nil;
-+
-+  /* Temporarily switch to the child frame buffer.
-+     Fbuffer_substring_no_properties operates on current_buffer,
-+     which may be a different buffer (e.g., the parent frame's).  */
-+  specpdl_ref count = SPECPDL_INDEX ();
-+  record_unwind_current_buffer ();
-+  set_buffer_internal_1 (b);
-+
-+  /* Get buffer text as a Lisp string for efficient scanning.
-+     The buffer is a small completion popup (typically < 20 lines).  */
-+  Lisp_Object str
-+    = Fbuffer_substring_no_properties (make_fixnum (beg),
-+				       make_fixnum (end));
-+  if (!STRINGP (str) || SCHARS (str) == 0)
-+    {
-+      unbind_to (count, Qnil);
-+      return nil;
-+    }
-+
-+  /* Scan newlines (same pattern as ns_ax_selected_overlay_text).
-+     The data pointer is used only in this loop, before Lisp calls.  */
-+  const unsigned char *data = SDATA (str);
-+  ptrdiff_t byte_len = SBYTES (str);
-+  ptrdiff_t line_starts[128];
-+  ptrdiff_t line_ends[128];
-+  int nlines = 0;
-+  ptrdiff_t char_pos = 0, byte_pos = 0, lstart = 0;
-+
-+  while (byte_pos < byte_len && nlines < 128)
-+    {
-+      if (data[byte_pos] == '\n')
-+	{
-+	  if (char_pos > lstart)
-+	    {
-+	      line_starts[nlines] = lstart;
-+	      line_ends[nlines] = char_pos;
-+	      nlines++;
-+	    }
-+	  lstart = char_pos + 1;
-+	}
-+      if (STRING_MULTIBYTE (str))
-+	byte_pos += BYTES_BY_CHAR_HEAD (data[byte_pos]);
-+      else
-+	byte_pos++;
-+      char_pos++;
-+    }
-+  if (char_pos > lstart && nlines < 128)
-+    {
-+      line_starts[nlines] = lstart;
-+      line_ends[nlines] = char_pos;
-+      nlines++;
-+    }
-+
-+  /* Find the line with a selected face.  Use Fget_char_property on
-+     the BUFFER (not the string) so overlay faces are included.
-+     Offset string positions by beg to get buffer positions.  */
-+  for (int li = 0; li < nlines; li++)
-+    {
-+      ptrdiff_t buf_pos = beg + line_starts[li];
-+      Lisp_Object face
-+	= Fget_char_property (make_fixnum (buf_pos), Qface, buf_obj);
-+
-+      if (ns_ax_face_is_selected (face))
-+	{
-+	  Lisp_Object line
-+	    = Fsubstring_no_properties (str,
-+				       make_fixnum (line_starts[li]),
-+				       make_fixnum (line_ends[li]));
-+	  NSString *text = [NSString stringWithLispString:line];
-+	  text = [text stringByTrimmingCharactersInSet:
-+		   [NSCharacterSet
-+		     whitespaceAndNewlineCharacterSet]];
-+	  if ([text length] > 0)
-+	    {
-+	      *out_line_index = li;
-+	      unbind_to (count, Qnil);
-+	      return text;
-+	    }
-+	}
-+    }
-+
-+  unbind_to (count, Qnil);
-+  return nil;
-+}
-+
-+
- /* Build accessibility text for window W, skipping invisible text.
-    Populates *OUT_START with the buffer start charpos.
-    Populates *OUT_RUNS with an array of visible runs and *OUT_NRUNS
-@@ -7278,6 +7528,1102 @@ ns_ax_post_notification_with_info (id element,
+@@ -7653,6 +7653,1141 @@ - (id)accessibilityTopLevelUIElement
 
 @end
 
@@ -402,18 +156,14 @@ index 2ac1d9d..fc5906a 100644
 +      Lisp_Object cmd = Vthis_command;
 +      /* Forward line commands.  */
 +      if (EQ (cmd, Qns_ax_next_line)
-+	  || EQ (cmd, Qns_ax_dired_next_line)
-+	  || EQ (cmd, Qns_ax_evil_next_line)
-+	  || EQ (cmd, Qns_ax_evil_next_visual_line))
+	  || EQ (cmd, Qns_ax_dired_next_line))
 +	{
 +	  if (which) *which = 1;
 +	  return true;
 +	}
 +      /* Backward line commands.  */
 +      if (EQ (cmd, Qns_ax_previous_line)
-+	  || EQ (cmd, Qns_ax_dired_previous_line)
-+	  || EQ (cmd, Qns_ax_evil_previous_line)
-+	  || EQ (cmd, Qns_ax_evil_previous_visual_line))
+	  || EQ (cmd, Qns_ax_dired_previous_line))
 +	{
 +	  if (which) *which = -1;
 +	  return true;
@@ -456,8 +206,8 @@ index 2ac1d9d..fc5906a 100644
 +  /* Block input to prevent concurrent redisplay from modifying buffer
 +     state while we read text properties.  Unwind-protected so
 +     block_input is always matched by unblock_input on signal.  */
-+  record_unwind_protect_void (unblock_input);
 +  block_input ();
+  record_unwind_protect_void (unblock_input);
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
 +
@@ -608,7 +358,7 @@ index 2ac1d9d..fc5906a 100644
 +  NSTRACE ("EmacsAccessibilityBuffer ensureTextCache");
 +  /* This method is only called from the main thread (AX getters
 +     dispatch_sync to main first).  Reads of cachedText/cachedTextModiff
-+     below are therefore safe without @synchronized — only the
+     below are therefore safe without @synchronized --- only the
 +     write section at the end needs synchronization to protect
 +     against concurrent reads from AX server thread.  */
 +  eassert ([NSThread isMainThread]);
@@ -620,17 +370,25 @@ index 2ac1d9d..fc5906a 100644
 +  if (!b)
 +    return;
 +
-+  ptrdiff_t modiff = BUF_MODIFF (b);
-+  ptrdiff_t overlay_modiff = BUF_OVERLAY_MODIFF (b);
+  /* Use BUF_CHARS_MODIFF, not BUF_MODIFF, for cache validity.
+     BUF_MODIFF is bumped by every text-property change, including
+     font-lock face applications on every redisplay.  AX text contains
+     only characters, not face data, so property-only changes do not
+     affect the cached value.  Rebuilding the full buffer text on
+     each font-lock pass is O(buffer-size) per redisplay --- this
+     causes progressive slowdown when scrolling through large files.
+     BUF_CHARS_MODIFF is bumped only on actual character insertions
+     and deletions, matching the semantic of "did the text change".
+     This is the pattern used by WebKit and NSTextView.
+     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
+     included in the cached AX text (it is handled separately via
+     explicit announcements in postAccessibilityNotificationsForFrame).
+     Including overlay_modiff would silently update cachedOverlayModiff
+     and prevent the notification dispatch from detecting changes.  */
+  ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
 +  ptrdiff_t pt = BUF_PT (b);
 +  NSUInteger textLen = cachedText ? [cachedText length] : 0;
-+  /* Track both BUF_MODIFF and BUF_OVERLAY_MODIFF.  Overlay-only
-+     changes (e.g., timer-based completion highlight move without
-+     text edit) bump overlay_modiff but not modiff.  Also detect
-+     narrowing/widening which changes BUF_BEGV without bumping
-+     either modiff counter.  */
-+  if (cachedText && cachedTextModiff == modiff
-+      && cachedOverlayModiff == overlay_modiff
+  if (cachedText && cachedTextModiff == chars_modiff
 +      && cachedTextStart == BUF_BEGV (b)
 +      && pt >= cachedTextStart
 +      && (textLen == 0
@@ -646,8 +404,7 @@ index 2ac1d9d..fc5906a 100644
 +    {
 +      [cachedText release];
 +      cachedText = [text retain];
-+      cachedTextModiff = modiff;
-+      cachedOverlayModiff = overlay_modiff;
+      cachedTextModiff = chars_modiff;
 +      cachedTextStart = start;
 +
 +      if (visibleRuns)
@@ -656,9 +413,13 @@ index 2ac1d9d..fc5906a 100644
 +      visibleRunCount = nruns;
 +
 +      /* Build line-start index for O(log L) line queries.
-+	 Walk the cached text once, recording the start offset
-+	 of each line.  This runs once per cache rebuild (on text
-+	 change or narrowing), not per cursor move.  */
+	 Walk the cached text once, recording the start offset of each
+	 line.  Uses NSString lineRangeForRange: --- O(N) in the total
+	 text --- but this loop runs only on cache rebuild, which is
+	 gated on BUF_CHARS_MODIFF: actual character insertions or
+	 deletions.  Font-lock (text property changes) does not trigger
+	 a rebuild, so the hot path (cursor movement, redisplay) never
+	 enters this code.  */
 +      if (lineStartOffsets)
 +	xfree (lineStartOffsets);
 +      lineStartOffsets = NULL;
@@ -712,7 +473,7 @@ index 2ac1d9d..fc5906a 100644
 +  /* Binary search: runs are sorted by charpos (ascending).  Find the
 +     run whose [charpos, charpos+length) range contains the target,
 +     or the nearest run after an invisible gap.  O(log n) instead of
-+     O(n) — matters for org-mode with many folded sections.  */
+     O(n) --- matters for org-mode with many folded sections.  */
 +  NSUInteger lo = 0, hi = visibleRunCount;
 +  while (lo < hi)
 +    {
@@ -724,10 +485,21 @@ index 2ac1d9d..fc5906a 100644
 +	lo = mid + 1;
 +      else
 +	{
-+	  /* Found: charpos is inside this run.  Compute UTF-16 delta
-+	     directly from cachedText — no Lisp calls needed.  */
+	  /* Found: charpos is inside this run.  Compute UTF-16 delta.
+	     Fast path for pure-ASCII runs (ax_length == length): every
+	     Emacs charpos maps to exactly one UTF-16 code unit, so the
+	     conversion is O(1).  This matters because ensureTextCache
+	     calls this method on every redisplay frame to validate the
+	     cache --- a O(cursor_position) loop here means O(position)
+	     cost per frame even when the buffer is unchanged.
+	     Multi-byte runs fall through to the sequence walk, bounded
+	     by run length (visible window), not total buffer size.  */
 +	  NSUInteger chars_in = (NSUInteger)(charpos - r->charpos);
-+	  if (chars_in == 0 || !cachedText)
+	  if (chars_in == 0)
+	    return r->ax_start;
+	  if (r->ax_length == (NSUInteger) r->length)
+	    return r->ax_start + chars_in;
+	  if (!cachedText)
 +	    return r->ax_start;
 +	  NSUInteger run_end_ax = r->ax_start + r->ax_length;
 +	  NSUInteger scan = r->ax_start;
@@ -750,10 +522,10 @@ index 2ac1d9d..fc5906a 100644
 +
 +/* Convert accessibility string index to buffer charpos.
 +   Safe to call from any thread: uses only cachedText (NSString) and
-+   visibleRuns — no Lisp calls.  */
+   visibleRuns --- no Lisp calls.  */
 +- (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
 +{
-+  /* May be called from AX server thread — synchronize.  */
+  /* May be called from AX server thread --- synchronize.  */
 +  @synchronized (self)
 +  {
 +  if (visibleRunCount == 0)
@@ -771,8 +543,16 @@ index 2ac1d9d..fc5906a 100644
 +	lo = mid + 1;
 +      else
 +	{
-+	  /* Found: ax_idx is inside this run.  Walk composed character
-+	     sequences to count Emacs characters up to ax_idx.  */
+	  /* Found: ax_idx is inside this run.
+	     Fast path for pure-ASCII runs: ax_length == length means
+	     every Emacs charpos maps to exactly one AX string index.
+	     The conversion is then O(1) instead of O(cursor_position).
+	     Buffers with emoji, CJK, or other non-BMP characters use
+	     the slow path (composed character sequence walk), which is
+	     bounded by run length, not total buffer size.  */
+	  if (r->ax_length == (NSUInteger) r->length)
+	    return r->charpos + (ptrdiff_t) (ax_idx - r->ax_start);
+
 +	  if (!cachedText)
 +	    return r->charpos;
 +	  NSUInteger scan = r->ax_start;
@@ -787,7 +567,7 @@ index 2ac1d9d..fc5906a 100644
 +	  return cp;
 +	}
 +    }
-+  /* Past end — return last charpos.  */
+  /* Past end --- return last charpos.  */
 +  if (lo > 0)
 +    {
 +      ns_ax_visible_run *last = &visibleRuns[visibleRunCount - 1];
@@ -809,7 +589,7 @@ index 2ac1d9d..fc5906a 100644
 +   deadlocking the AX server thread.  This is prevented by:
 +
 +     1. validWindow checks WINDOW_LIVE_P and BUFFERP before every
-+        Lisp access — the window and buffer are verified live.
+        Lisp access --- the window and buffer are verified live.
 +     2. All dispatch_sync blocks run on the main thread where no
 +        concurrent Lisp code can modify state between checks.
 +     3. block_input prevents timer events and process output from
@@ -1039,10 +819,9 @@ index 2ac1d9d..fc5906a 100644
 +
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_current_buffer ();
-+  /* Ensure block_input is always matched by unblock_input even if
-+     Fset_marker or another Lisp call signals (longjmp).  */
-+  record_unwind_protect_void (unblock_input);
+  /* block_input must come before record_unwind_protect_void (unblock_input).  */
 +  block_input ();
+  record_unwind_protect_void (unblock_input);
 +
 +  /* Convert accessibility index to buffer charpos via mapping.  */
 +  ptrdiff_t charpos = [self charposForAccessibilityIndex:range.location];
@@ -1059,20 +838,12 @@ index 2ac1d9d..fc5906a 100644
 +
 +  SET_PT_BOTH (charpos, CHAR_TO_BYTE (charpos));
 +
-+  /* Keep mark state aligned with requested selection range.  */
-+  if (range.length > 0)
-+    {
-+      ptrdiff_t mark_charpos = [self charposForAccessibilityIndex:
-+				       range.location + range.length];
-+      if (mark_charpos > BUF_ZV (b))
-+	mark_charpos = BUF_ZV (b);
-+      Fset_marker (BVAR (b, mark), make_fixnum (mark_charpos),
-+		   Fcurrent_buffer ());
-+      bset_mark_active (b, Qt);
-+    }
-+  else
+  /* Always deactivate mark: VoiceOver range.length is an internal
+     word boundary hint, not a text selection.  Activating the mark
+     makes accessibilitySelectedTextRange return a non-zero length,
+     which confuses VoiceOver into positioning its browse cursor at
+     the END of the selection instead of the start.  */
 +  bset_mark_active (b, Qnil);
-+
 +  unbind_to (count, Qnil);
 +
 +  /* Update cached state so the next notification cycle doesn't
@@ -1104,10 +875,10 @@ index 2ac1d9d..fc5906a 100644
 +  if (!view || !view->emacsframe)
 +    return;
 +
-+  /* Use specpdl unwind protection for block_input safety.  */
+  /* block_input must come before record_unwind_protect_void (unblock_input).  */
 +  specpdl_ref count = SPECPDL_INDEX ();
-+  record_unwind_protect_void (unblock_input);
 +  block_input ();
+  record_unwind_protect_void (unblock_input);
 +
 +  /* Select the Emacs window so keyboard focus follows VoiceOver.  */
 +  struct frame *f = view->emacsframe;
@@ -1160,7 +931,7 @@ index 2ac1d9d..fc5906a 100644
 +  if (point_idx > [cachedText length])
 +    point_idx = [cachedText length];
 +
-+  return [self lineForAXIndex:idx];
+  return [self lineForAXIndex:point_idx];
 +}
 +
 +- (NSRange)accessibilityRangeForLine:(NSInteger)line
@@ -1185,6 +956,27 @@ index 2ac1d9d..fc5906a 100644
 +  return [self rangeForLine:(NSUInteger)line textLength:len];
 +}
 +
+- (NSInteger)accessibilityLineForIndex:(NSInteger)index
+{
+  if (![NSThread isMainThread])
+    {
+      __block NSInteger result;
+      dispatch_sync (dispatch_get_main_queue (), ^{
+	  result = [self accessibilityLineForIndex:index];
+	});
+      return result;
+    }
+  [self ensureTextCache];
+  if (!cachedText || index < 0)
+    return 0;
+
+  NSUInteger idx = (NSUInteger) index;
+  if (idx > [cachedText length])
+    idx = [cachedText length];
+
+  return [self lineForAXIndex:idx];
+}
+
 +- (NSRange)accessibilityRangeForIndex:(NSInteger)index
 +{
 +  if (![NSThread isMainThread])
@@ -1199,7 +991,8 @@ index 2ac1d9d..fc5906a 100644
 +  if (!cachedText || index < 0
 +      || (NSUInteger) index >= [cachedText length])
 +    return NSMakeRange (NSNotFound, 0);
-+  return [cachedText rangeOfComposedCharacterSequenceAtIndex:(NSUInteger)index];
+  return [cachedText
+	  rangeOfComposedCharacterSequenceAtIndex:(NSUInteger)index];
 +}
 +
 +- (NSRange)accessibilityStyleRangeForIndex:(NSInteger)index
@@ -1267,8 +1060,8 @@ index 2ac1d9d..fc5906a 100644
 +     so block_input is always matched by unblock_input, even if
 +     ensureTextCache triggers a Lisp signal (longjmp).  */
 +  specpdl_ref count = SPECPDL_INDEX ();
-+  record_unwind_protect_void (unblock_input);
 +  block_input ();
+  record_unwind_protect_void (unblock_input);
 +
 +  /* Find the glyph row at this y coordinate.  */
 +  struct glyph_matrix *matrix = w->current_matrix;
--- a/patches/0003-ns-add-buffer-notification-dispatch-and-mode-line-el.patch
+++ b/patches/0003-ns-add-buffer-notification-dispatch-and-mode-line-el.patch
@@ -1,40 +1,42 @@
-From 97baf7b5f8b0ccc85342e7d552b69b337c98f772 Mon Sep 17 00:00:00 2001
+From d8a98fc40d8285c19e0a73a7e8a53778926b9836 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 3/8] ns: add buffer notification dispatch and mode-line
+Subject: [PATCH 4/9] ns: add buffer notification dispatch and mode-line
 element

-Add VoiceOver notification methods and mode-line readout.
+Add VoiceOver notification dispatch and mode-line readout.

-* src/nsterm.m (EmacsAccessibilityBuffer(Notifications)): New
-category.
-(postTextChangedNotification:): ValueChanged with edit details.
+* src/nsterm.m (EmacsAccessibilityBuffer(Notifications)): New category.
+(postTextChangedNotification:): Post NSAccessibilityValueChangedNotification
+with AXTextEditType/AXTextChangeValue details.
 (postFocusedCursorNotification:direction:granularity:markActive:
-oldMarkActive:): Hybrid SelectedTextChanged / AnnouncementRequested
-per WebKit pattern.
+oldMarkActive:): Post NSAccessibilitySelectedTextChangedNotification
+following the WebKit hybrid pattern; announce character at point for
+character moves.
 (postCompletionAnnouncementForBuffer:point:): Announce completion
-candidates in non-focused buffers.
-(postAccessibilityNotificationsForFrame:): Main dispatch entry point.
-(EmacsAccessibilityModeLine): Implement AXStaticText element.
-
-Tested on macOS 14.  Verified: cursor movement announcements,
-region selection feedback, completion popups, mode-line reading.
+candidates in non-focused (completion) buffers.  Lisp/buffer
+access is performed inside block_input; ObjC AX calls are made after
+unblock_input to avoid holding block_input during @synchronized.
+(postAccessibilityNotificationsForFrame:): Main dispatch entry point;
+detects text edit, cursor/mark change, or overlay change.
+(EmacsAccessibilityModeLine): Implement AXStaticText element for the
+mode line.
 ---
- src/nsterm.m | 545 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 545 insertions(+)
+ src/nsterm.m | 606 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 606 insertions(+)

 diff --git a/src/nsterm.m b/src/nsterm.m
-index fc5906a..f1a1b42 100644
+index 41c6b8dc14..16343f978a 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -8624,6 +8624,551 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8788,6 +8788,612 @@ - (NSRect)accessibilityFrame
 
 @end
 
 +
 +
 +/* ===================================================================
-+   EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 +
 +   These methods notify VoiceOver of text and selection changes.
 +   Called from the redisplay cycle (postAccessibilityUpdates).
@@ -49,7 +51,7 @@ index fc5906a..f1a1b42 100644
 +  if (point > self.cachedPoint
 +      && point - self.cachedPoint == 1)
 +    {
-+      /* Single char inserted — refresh cache and grab it.  */
+      /* Single char inserted --- refresh cache and grab it.  */
 +      [self invalidateTextCache];
 +      [self ensureTextCache];
 +      if (cachedText)
@@ -68,7 +70,7 @@ index fc5906a..f1a1b42 100644
 +  /* Update cachedPoint here so the selection-move branch does NOT
 +     fire for point changes caused by edits.  WebKit and Chromium
 +     never send both ValueChanged and SelectedTextChanged for the
-+     same user action — they are mutually exclusive.  */
+     same user action --- they are mutually exclusive.  */
 +  self.cachedPoint = point;
 +
 +  NSDictionary *change = @{
@@ -107,7 +109,7 @@ index fc5906a..f1a1b42 100644
 +  moveInfo[@"AXTextChangeElement"] = self;
 +  /* Omit granularity for character moves so VoiceOver does not
 +     derive its own speech (it would read the wrong character
-+     for evil block-cursor mode).  Include it for word/line/
+     for block-cursor mode).  Include it for word/line/
 +     selection so VoiceOver reads the appropriate text.  */
 +  if (!isCharMove)
 +    moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
@@ -119,7 +121,7 @@ index fc5906a..f1a1b42 100644
 +
 +  /* For character moves: explicit announcement of char AT point.
 +     This is the ONLY speech source for character navigation.
-+     Correct for evil block-cursor (cursor ON the character)
+     Correct for block-cursor (cursor ON the character)
 +     and harmless for insert-mode.  */
 +  if (isCharMove && cachedText)
 +    {
@@ -152,6 +154,65 @@ index fc5906a..f1a1b42 100644
 +	}
 +    }
 +
+  /* For word moves: explicit announcement of word AT new point.
+     VO auto-speech from SelectedTextChanged with direction=next
+     and granularity=word reads the word that was traversed (the
+     source word), not the word arrived at.  This explicit
+     announcement reads the destination word instead, matching
+     user expectation ("w" jumps to next word and reads it).  */
+  BOOL isWordMove
+    = (!markActive && !oldMarkActive
+       && granularity == ns_ax_text_selection_granularity_word
+       && direction == ns_ax_text_selection_direction_discontiguous);
+  if (isWordMove && cachedText)
+    {
+      NSCharacterSet *ws
+	= [NSCharacterSet whitespaceAndNewlineCharacterSet];
+      NSUInteger point_idx
+	= [self accessibilityIndexForCharpos:point];
+      NSUInteger tlen = [cachedText length];
+      if (point_idx < tlen
+	  && ![ws characterIsMember:
+		 [cachedText characterAtIndex:point_idx]])
+	{
+	  /* Find word boundaries around point.  */
+	  NSUInteger wstart = point_idx;
+	  while (wstart > 0
+		 && ![ws characterIsMember:
+		      [cachedText characterAtIndex:wstart - 1]])
+	    wstart--;
+	  NSUInteger wend = point_idx;
+	  while (wend < tlen
+		 && ![ws characterIsMember:
+		      [cachedText characterAtIndex:wend]])
+	    wend++;
+	  if (wend > wstart)
+	    {
+	      NSString *word
+		= [cachedText substringWithRange:
+		     NSMakeRange (wstart, wend - wstart)];
+	      NSMutableCharacterSet *trims
+		= [ws mutableCopy];
+	      [trims formUnionWithCharacterSet:
+		  [NSCharacterSet punctuationCharacterSet]];
+	      word = [word stringByTrimmingCharactersInSet:trims];
+	      [trims release];
+	      if ([word length] > 0)
+		{
+		  NSDictionary *annInfo = @{
+		    NSAccessibilityAnnouncementKey: word,
+		    NSAccessibilityPriorityKey:
+		      @(NSAccessibilityPriorityHigh)
+		  };
+		  ns_ax_post_notification_with_info (
+		    NSApp,
+		    NSAccessibilityAnnouncementRequestedNotification,
+		    annInfo);
+		}
+	    }
+	}
+    }
+
 +  /* For focused line moves: always announce line text explicitly.
 +     SelectedTextChanged with granularity=line works for arrow keys,
 +     but C-n/C-p need the explicit announcement (VoiceOver processes
@@ -221,6 +282,8 @@ index fc5906a..f1a1b42 100644
 +  ptrdiff_t currentOverlayEnd = 0;
 +
 +  specpdl_ref count2 = SPECPDL_INDEX ();
+  block_input ();
+  record_unwind_protect_void (unblock_input);
 +  record_unwind_current_buffer ();
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
@@ -408,7 +471,7 @@ index fc5906a..f1a1b42 100644
 +    }
 +
 +  /* --- Cursor moved or selection changed ---
-+     Use 'else if' — edits and selection moves are mutually exclusive
+     Use 'else if' --- edits and selection moves are mutually exclusive
 +     per the WebKit/Chromium pattern.  */
 +  else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
 +    {
--- a/patches/0004-ns-add-interactive-span-elements-for-Tab-navigation.patch
+++ b/patches/0004-ns-add-interactive-span-elements-for-Tab-navigation.patch
@@ -1,33 +1,51 @@
-From 1bd12dd5d464d0c3f9774630014e434b8fb0e19e Mon Sep 17 00:00:00 2001
+From 9c233aa400c2769e1621ec37f326d1e24c0da2df Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 4/8] ns: add interactive span elements for Tab navigation
+Subject: [PATCH 5/9] ns: add interactive span elements for Tab navigation

-* src/nsterm.m (ns_ax_scan_interactive_spans): New function.
-(EmacsAccessibilityInteractiveSpan): Implement AXButton/AXLink
-elements with AXPress action.
+* src/nsterm.m (ns_ax_scan_interactive_spans): New function; scans the
+visible portion of a buffer for interactive text properties
+(ns-ax-widget, ns-ax-button, ns-ax-follow-link, ns-ax-org-link,
+mouse-face, overlay keymap) and builds EmacsAccessibilityInteractiveSpan
+elements.
+(EmacsAccessibilityInteractiveSpan): Implement AXButton and AXLink
+elements with an AXPress action that sends a synthetic TAB keystroke.
 (EmacsAccessibilityBuffer(InteractiveSpans)): New category.
-accessibilityChildrenInNavigationOrder for Tab/Shift-Tab cycling
-with wrap-around.
-
-Tested on macOS 14.  Verified: Tab-cycling through org-mode links,
-*Completions* candidates, widget buttons, customize buffers.
+(accessibilityChildrenInNavigationOrder): Return cached span array,
+rebuilding lazily when interactiveSpansDirty is set.
 ---
- src/nsterm.m | 286 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 286 insertions(+)
+ src/nsterm.m | 302 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 298 insertions(+), 4 deletions(-)

 diff --git a/src/nsterm.m b/src/nsterm.m
-index f1a1b42..91d0241 100644
+index 16343f978a..f5e5cea074 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -9169,6 +9169,292 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8669,12 +8669,12 @@ - (NSRange)accessibilityRangeForPosition:(NSPoint)screenPoint
+     return NSMakeRange (0, 0);
+ 
+   /* Block input to prevent concurrent redisplay from modifying the
+-     glyph matrix while we traverse it.  Use specpdl unwind protection
+-     so block_input is always matched by unblock_input, even if
+-     ensureTextCache triggers a Lisp signal (longjmp).  */
+     glyph matrix while we traverse it.  block_input must come before
+     record_unwind_protect_void (unblock_input) so that the unwind
+     handler is never called without a matching block_input.  */
+   specpdl_ref count = SPECPDL_INDEX ();
+-  record_unwind_protect_void (unblock_input);
+   block_input ();
+  record_unwind_protect_void (unblock_input);
+ 
+   /* Find the glyph row at this y coordinate.  */
+   struct glyph_matrix *matrix = w->current_matrix;
+@@ -9394,6 +9394,300 @@ - (NSRect)accessibilityFrame
 
 @end
 
 +
 +
 +/* ===================================================================
-+   EmacsAccessibilityInteractiveSpan — helpers and implementation
+   EmacsAccessibilityInteractiveSpan --- helpers and implementation
 +   =================================================================== */
 +
 +/* Scan visible range of window W for interactive spans.
@@ -56,6 +74,10 @@ index f1a1b42..91d0241 100644
 +  if (vis_start >= vis_end)
 +    return @[];
 +
+  block_input ();
+  specpdl_ref blk_count = SPECPDL_INDEX ();
+  record_unwind_protect_void (unblock_input);
+
 +  /* Symbols are interned once at startup via DEFSYM in syms_of_nsterm;
 +     reference them directly here (GC-safe, no repeated obarray lookup).  */
 +
@@ -71,6 +93,7 @@ index f1a1b42..91d0241 100644
 +      EmacsAXSpanType span_type = EmacsAXSpanTypeNone;
 +      Lisp_Object limit_prop    = Qnil;
 +
+      /* Fplist_get third arg Qnil: use `eq' predicate (the default).  */
 +      if (!NILP (Fplist_get (plist, Qns_ax_widget, Qnil)))
 +	{
 +	  span_type  = EmacsAXSpanTypeWidget;
@@ -124,7 +147,7 @@ index f1a1b42..91d0241 100644
 +	{
 +	  /* Skip to the next position where any interactive property
 +	     changes.  Try each scannable property in turn and take
-+	     the nearest change point â O(properties) per gap rather
+	     the nearest change point --- O(properties) per gap rather
 +	     than O(chars).  Fall back to pos+1 as safety net.  */
 +	  ptrdiff_t next_interesting = vis_end;
 +	  Lisp_Object skip_props[5]
@@ -176,6 +199,7 @@ index f1a1b42..91d0241 100644
 +      pos = span_end;
 +    }
 +
+  unbind_to (blk_count, Qnil);
 +  return [[spans copy] autorelease];
 +}
 +
@@ -218,7 +242,8 @@ index f1a1b42..91d0241 100644
 +- (BOOL) isAccessibilityFocused
 +{
 +  /* Read the cached point stored by EmacsAccessibilityBuffer on the main
-+     thread — safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
+     thread --- safe to read from any thread (plain ptrdiff_t,
+     no Lisp calls).  */
 +  EmacsAccessibilityBuffer *pb = self.parentBuffer;
 +  if (!pb)
 +    return NO;
@@ -235,16 +260,17 @@ index f1a1b42..91d0241 100644
 +  dispatch_async (dispatch_get_main_queue (), ^{
 +    /* lwin is a Lisp_Object captured by value.  This is GC-safe
 +       because Lisp_Objects are tagged integers/pointers that
-+       remain valid across GC — GC does not relocate objects in
+       remain valid across GC --- GC does not relocate objects in
 +       Emacs.  The WINDOW_LIVE_P check below guards against the
 +       window being deleted between capture and execution.  */
 +    if (!WINDOWP (lwin) || NILP (Fwindow_live_p (lwin)))
 +      return;
-+    /* Use specpdl unwind protection so that block_input is always
-+       matched by unblock_input, even if Fselect_window signals.  */
+    /* block_input must come before record_unwind_protect_void (unblock_input)
+       so the unwind handler is never invoked without a matching block_input,
+       even if Fselect_window signals (longjmp).  */
 +    specpdl_ref count = SPECPDL_INDEX ();
-+    record_unwind_protect_void (unblock_input);
 +    block_input ();
+    record_unwind_protect_void (unblock_input);
 +    record_unwind_current_buffer ();
 +    Fselect_window (lwin, Qnil);
 +    struct window *w = XWINDOW (lwin);
@@ -261,7 +287,7 @@ index f1a1b42..91d0241 100644
 +
 +@end
 +
-+/* EmacsAccessibilityBuffer — InteractiveSpans category.
+/* EmacsAccessibilityBuffer --- InteractiveSpans category.
 +   Methods are kept here (same .m file) so they access the ivars
 +   declared in the @interface ivar block.  */
 +@implementation EmacsAccessibilityBuffer (InteractiveSpans)
--- a/patches/0005-ns-integrate-accessibility-with-EmacsView-and-redisp.patch
+++ b/patches/0005-ns-integrate-accessibility-with-EmacsView-and-redisp.patch
@@ -1,38 +1,37 @@
-From 3bbe8ba29725a4708595befa6b73e5873a2aab43 Mon Sep 17 00:00:00 2001
+From 411c0c3f06ad4c2d5aae2b17b809e8899ea892ba Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 5/8] ns: integrate accessibility with EmacsView and redisplay
+Subject: [PATCH 6/9] ns: integrate accessibility with EmacsView and redisplay

-Wire the accessibility infrastructure into EmacsView and the
-redisplay cycle.  After this patch, VoiceOver and Zoom are active.
+Wire the accessibility element tree into EmacsView and hook it into
+the redisplay cycle.

-* src/nsterm.m (ns_update_end): Call [view postAccessibilityUpdates].
-(ns_draw_phys_cursor): Store cursor rect; call UAZoomChangeFocus.
+* etc/NEWS: Document VoiceOver accessibility support.
+* src/nsterm.m (ns_update_end): Call -[EmacsView postAccessibilityUpdates].
+(EmacsApp ns_update_accessibility_state): New method; query
+AXIsProcessTrustedWithOptions and UAZoomEnabled to set
+ns_accessibility_enabled automatically.
+(EmacsApp ns_accessibility_did_change:): New method; handle
+com.apple.accessibility.api distributed notification.
 (EmacsView dealloc): Release accessibilityElements.
-(EmacsView windowDidBecomeKey): Post accessibility focus notification.
+(EmacsView windowDidBecomeKey:): Post accessibility focus notification.
 (ns_ax_collect_windows): New function.
 (EmacsView rebuildAccessibilityTree, invalidateAccessibilityTree)
 (accessibilityChildren, accessibilityFocusedUIElement)
 (postAccessibilityUpdates, accessibilityBoundsForRange:)
 (accessibilityParameterizedAttributeNames)
 (accessibilityAttributeValue:forParameter:): New methods.
-* etc/NEWS: Document VoiceOver accessibility support.
-
-Tested on macOS 14 with VoiceOver and Zoom.  End-to-end: buffer
-navigation, cursor tracking, window switching, completions, evil-mode
-block cursor, org-mode folded headings, indirect buffers.
-
-Known limitations documented in patch 6 Texinfo node.
 ---
 etc/NEWS     |  13 ++
- src/nsterm.m | 398 ++++++++++++++++++++++++++++++++++++++++++++++++++-
- 2 files changed, 408 insertions(+), 3 deletions(-)
+ src/nsterm.h |   7 +-
+ src/nsterm.m | 474 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 3 files changed, 483 insertions(+), 11 deletions(-)

 diff --git a/etc/NEWS b/etc/NEWS
-index 7367e3c..608650e 100644
+index 4c149e41d6..7f917f93b2 100644
 --- a/etc/NEWS
 +++ b/etc/NEWS
-@@ -4374,6 +4374,19 @@ allowing Emacs users access to speech recognition utilities.
+@@ -4385,6 +4385,19 @@ allowing Emacs users access to speech recognition utilities.
 Note: Accepting this permission allows the use of system APIs, which may
 send user data to Apple's speech recognition servers.
 
@@ -52,67 +51,106 @@ index 7367e3c..608650e 100644
 ---
 ** Re-introduced dictation, lost in Emacs v30 (macOS).
 We lost macOS dictation in v30 when migrating to NSTextInputClient.
+diff --git a/src/nsterm.h b/src/nsterm.h
+index f245675513..4bf79a9adb 100644
+--- a/src/nsterm.h
+++ b/src/nsterm.h
+@@ -590,7 +590,12 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
+   char *old_title;
+   BOOL maximizing_resize;
+   NSMutableArray *accessibilityElements;
+-  /* See GC safety comment on EmacsAccessibilityElement.lispWindow.  */
+  /* Lisp_Object ivars not visible to GC.  Both objects are always
+     reachable via the frame's live window tree, so GC cannot collect
+     them.  After a window-tree rebuild (delete-window, split-window)
+     a stale EQ match would merely skip a focus notification --- the
+     worst case is one spurious VoiceOver focus event per rebuild.
+     No staticpro() needed: the window tree holds a strong reference.  */
+   Lisp_Object lastSelectedWindow;
+   Lisp_Object lastRootWindow;
+   BOOL accessibilityTreeValid;
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 91d0241..125e52c 100644
+index f5e5cea074..c3cd83b774 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -1105,6 +1105,11 @@ ns_update_end (struct frame *f)
- 
-   unblock_input ();
-   ns_updating_frame = NULL;
+@@ -1393,7 +1393,8 @@ so the visual offset is (ov_line + 1) * line_h from
+      (zoomCursorUpdated is NO).  */
+ #if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
+     && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
+-  if (view && !view->zoomCursorUpdated && ns_zoom_enabled_p ()
+  if (view && !view->zoomCursorUpdated
+      && ns_zoom_enabled_p ()
+       && !NSIsEmptyRect (view->lastCursorRect))
+     {
+       NSRect r = view->lastCursorRect;
+@@ -1420,6 +1421,9 @@ so the visual offset is (ov_line + 1) * line_h from
+   if (view)
+     ns_zoom_track_completion (f, view);
+ #endif /* NS_IMPL_COCOA */
 +
-+#ifdef NS_IMPL_COCOA
 +  /* Post accessibility notifications after each redisplay cycle.  */
 +  [view postAccessibilityUpdates];
-+#endif
 }
 
 static void
-@@ -3233,6 +3238,43 @@ ns_draw_window_cursor (struct window *w, struct glyph_row *glyph_row,
-   /* Prevent the cursor from being drawn outside the text area.  */
-   r = NSIntersectionRect (r, ns_row_rect (w, glyph_row, TEXT_AREA));
+@@ -6723,9 +6727,56 @@ - (void)applicationDidFinishLaunching: (NSNotification *)notification
+   }
+ #endif
 
 +#ifdef NS_IMPL_COCOA
-+  /* Accessibility: store cursor rect for Zoom and bounds queries.
-+     Skipped when ns-accessibility-enabled is nil to avoid overhead.
-+     VoiceOver notifications are handled solely by
-+     postAccessibilityUpdates (called from ns_update_end)
-+     to avoid duplicate notifications and mid-redisplay fragility.  */
-+  {
-+    EmacsView *view = FRAME_NS_VIEW (f);
-+    if (view && on_p && active_p && ns_accessibility_enabled)
-+      {
-+	view->lastAccessibilityCursorRect = r;
-+
-+	/* Tell macOS Zoom where the cursor is.  UAZoomChangeFocus()
-+	   expects top-left origin (CG coordinate space).
-+	   These APIs are available since macOS 10.4 (Universal Access
-+	   framework, linked via ApplicationServices umbrella).  */
-+#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
-+    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
-+	if (UAZoomEnabled ())
-+	  {
-+	    NSRect windowRect = [view convertRect:r toView:nil];
-+	    NSRect screenRect = [[view window] convertRectToScreen:windowRect];
-+	    CGRect cgRect = NSRectToCGRect (screenRect);
-+
-+	    CGFloat primaryH
-+	      = [[[NSScreen screens] firstObject] frame].size.height;
-+	    cgRect.origin.y
-+	      = primaryH - cgRect.origin.y - cgRect.size.height;
-+
-+	    UAZoomChangeFocus (&cgRect, &cgRect,
-+			       kUAZoomFocusTypeInsertionPoint);
-+	  }
-+#endif /* MAC_OS_X_VERSION_MIN_REQUIRED >= 101000 */
-+      }
-+  }
+  /* Auto-detect Zoom and VoiceOver at startup and whenever their state
+     changes.  The "com.apple.accessibility.api" distributed notification
+     fires when any assistive technology connects or disconnects.
+     Both code paths set ns_accessibility_enabled so that one variable
+     gates all our accessibility overhead.  */
+  [self ns_update_accessibility_state];
+  [[NSDistributedNotificationCenter defaultCenter]
+    addObserver: self
+       selector: @selector(ns_accessibility_did_change:)
+	   name: @"com.apple.accessibility.api"
+	 object: nil
+suspensionBehavior: NSNotificationSuspensionBehaviorDeliverImmediately];
 +#endif
 +
-   ns_focus (f, NULL, 0);
+   ns_send_appdefined (-2);
+ }
 
-   NSGraphicsContext *ctx = [NSGraphicsContext currentContext];
-@@ -7531,7 +7573,6 @@ ns_ax_post_notification_with_info (id element,
+#ifdef NS_IMPL_COCOA
+/* Set ns_accessibility_enabled based on current AT state.
+   Called at startup and from the "com.apple.accessibility.api"
+   distributed notification handler.  Checks both UAZoomEnabled()
+   (Zoom) and AXIsProcessTrustedWithOptions() (VoiceOver and other
+   ATs that have connected to this process).  */
+- (void) ns_update_accessibility_state
+{
+  NSTRACE ("[EmacsApp ns_update_accessibility_state]");
+  BOOL zoom_on = UAZoomEnabled ();
+  NSDictionary *opts = @{(__bridge id) kAXTrustedCheckOptionPrompt: @NO};
+  BOOL at_on = AXIsProcessTrustedWithOptions ((__bridge CFDictionaryRef) opts);
+  BOOL new_state = zoom_on || at_on;
+  if ((BOOL) ns_accessibility_enabled != new_state)
+    {
+      ns_accessibility_enabled = new_state;
+      /* Reset the UAZoomEnabled cache so ns_zoom_enabled_p() reflects
+	 the new Zoom state on its next call.  */
+      ns_zoom_cache_time = 0;
+    }
+}
+
+/* Handler for the "com.apple.accessibility.api" distributed notification,
+   posted by macOS when any AT (VoiceOver, Switch Control, etc.) starts
+   or stops.  */
+- (void) ns_accessibility_did_change: (NSNotification *) notification
+{
+  NSTRACE ("[EmacsApp ns_accessibility_did_change:]");
+  [self ns_update_accessibility_state];
+}
+#endif
+
+ - (void)antialiasThresholdDidChange:(NSNotification *)notification
+ {
+ #ifdef NS_IMPL_COCOA
+@@ -7656,7 +7707,6 @@ - (id)accessibilityTopLevelUIElement
 
 
 
@@ -120,23 +158,78 @@ index 91d0241..125e52c 100644
 static BOOL
 ns_ax_find_completion_overlay_range (struct buffer *b, ptrdiff_t point,
 				     ptrdiff_t *out_start,
-@@ -8625,7 +8666,6 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8789,7 +8839,6 @@ - (NSRect)accessibilityFrame
 @end
 
 
 -
 /* ===================================================================
-    EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+    EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 
-@@ -9170,7 +9210,6 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -9283,6 +9332,54 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
+ 	  granularity = ns_ax_text_selection_granularity_line;
+ 	}
+ 
+      /* Treat all moves as Emacs-initiated until voiceoverSetPoint
+	 tracking is introduced (subsequent patch).  */
+      BOOL emacsMovedCursor = YES;
+
+      /* Programmatic jumps that cross a line boundary (]], [[, M-<,
+	 xref, imenu, …) are discontiguous: the cursor teleported to an
+	 arbitrary position, not one sequential step forward/backward.
+	 Reporting AXTextSelectionDirectionDiscontiguous causes VoiceOver
+	 to re-anchor its rotor browse cursor at the new
+	 accessibilitySelectedTextRange rather than advancing linearly
+	 from its previous internal position.  */
+      if (!isCtrlNP && granularity == ns_ax_text_selection_granularity_line)
+	direction = ns_ax_text_selection_direction_discontiguous;
+
+      /* If Emacs moved the cursor (not VoiceOver), force discontiguous
+	 so VoiceOver re-anchors its browse cursor to the current
+	 accessibilitySelectedTextRange.  This covers all Emacs-initiated
+	 moves: editing commands, ELisp, isearch, etc.
+	 Exception: C-n/C-p (isCtrlNP) already uses next/previous with
+	 line granularity; those are already sequential and VoiceOver
+	 handles them correctly.  */
+      if (emacsMovedCursor && !isCtrlNP)
+	direction = ns_ax_text_selection_direction_discontiguous;
+
+      /* Re-anchor VoiceOver's browse cursor for discontiguous (teleport)
+	 moves only.  For sequential C-n/C-p (isCtrlNP), posting
+	 FocusedUIElementChanged on the window races with the
+	 AXSelectedTextChanged(granularity=line) notification and
+	 causes VoiceOver to drop the line-read speech.  Sequential
+	 moves are already handled correctly by AXSelectedTextChanged
+	 with direction=next/previous + granularity=line.  */
+      if (emacsMovedCursor && !isCtrlNP && [self isAccessibilityFocused])
+	{
+	  NSWindow *win = [self.emacsView window];
+	  if (win)
+	    ns_ax_post_notification (
+	      win,
+	      NSAccessibilityFocusedUIElementChangedNotification);
+
+	  NSDictionary *layoutInfo = @{
+	    NSAccessibilityUIElementsKey: @[self]
+	  };
+	  ns_ax_post_notification_with_info (
+	    self.emacsView,
+	    NSAccessibilityLayoutChangedNotification,
+	    layoutInfo);
+	}
+
+       /* Post notifications for focused and non-focused elements.  */
+       if ([self isAccessibilityFocused])
+ 	[self postFocusedCursorNotification:point
+@@ -9395,7 +9492,6 @@ - (NSRect)accessibilityFrame
 @end
 
 
 -
 /* ===================================================================
-    EmacsAccessibilityInteractiveSpan — helpers and implementation
+    EmacsAccessibilityInteractiveSpan --- helpers and implementation
    =================================================================== */
-@@ -9500,6 +9539,7 @@ ns_ax_scan_interactive_spans (struct window *w,
+@@ -9733,6 +9829,7 @@ - (void)dealloc
   [layer release];
 #endif
 
@@ -144,7 +237,7 @@ index 91d0241..125e52c 100644
   [[self menu] release];
   [super dealloc];
 }
-@@ -10848,6 +10888,32 @@ ns_in_echo_area (void)
+@@ -11081,6 +11178,32 @@ - (void)windowDidBecomeKey      /* for direct calls */
   XSETFRAME (event.frame_or_window, emacsframe);
   kbd_buffer_store_event (&event);
   ns_send_appdefined (-1);  // Kick main loop
@@ -177,7 +270,7 @@ index 91d0241..125e52c 100644
 }
 
 
-@@ -12085,6 +12151,332 @@ ns_in_echo_area (void)
+@@ -12318,6 +12441,332 @@ - (int) fullscreenState
   return fs_state;
 }
 
@@ -197,7 +290,7 @@ index 91d0241..125e52c 100644
 +
 +  if (WINDOW_LEAF_P (w))
 +    {
-+      /* Buffer element — reuse existing if available.  */
+      /* Buffer element --- reuse existing if available.  */
 +      EmacsAccessibilityBuffer *elem
 +	= [existing objectForKey:[NSValue valueWithPointer:w]];
 +      if (!elem)
@@ -231,7 +324,7 @@ index 91d0241..125e52c 100644
 +    }
 +  else
 +    {
-+      /* Internal (combination) window — recurse into children.  */
+      /* Internal (combination) window --- recurse into children.  */
 +      Lisp_Object child = w->contents;
 +      while (!NILP (child))
 +	{
@@ -343,7 +436,7 @@ index 91d0241..125e52c 100644
 +  accessibilityUpdating = YES;
 +
 +  /* Detect window tree change (split, delete, new buffer).  Compare
-+     FRAME_ROOT_WINDOW — if it changed, the tree structure changed.  */
+     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
 +  Lisp_Object curRoot = FRAME_ROOT_WINDOW (emacsframe);
 +  if (!EQ (curRoot, lastRootWindow))
 +    {
@@ -352,12 +445,12 @@ index 91d0241..125e52c 100644
 +    }
 +
 +  /* If tree is stale, rebuild FIRST so we don't iterate freed
-+     window pointers.  Skip notifications for this cycle — the
+     window pointers.  Skip notifications for this cycle --- the
 +     freshly-built elements have no previous state to diff against.  */
 +  if (!accessibilityTreeValid)
 +    {
 +      [self rebuildAccessibilityTree];
-+      /* Invalidate span cache — window layout changed.  */
+      /* Invalidate span cache --- window layout changed.  */
 +      for (EmacsAccessibilityElement *elem in accessibilityElements)
 +	if ([elem isKindOfClass: [EmacsAccessibilityBuffer class]])
 +	  [(EmacsAccessibilityBuffer *) elem invalidateInteractiveSpans];
@@ -438,7 +531,7 @@ index 91d0241..125e52c 100644
 +	return bufRect;
 +    }
 +
-+  NSRect viewRect = lastAccessibilityCursorRect;
+  NSRect viewRect = lastCursorRect;
 +
 +  if (viewRect.size.width < 1)
 +    viewRect.size.width = 1;
@@ -510,6 +603,30 @@ index 91d0241..125e52c 100644
 @end  /* EmacsView */
 
 
+@@ -14314,12 +14763,17 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
+   ns_use_srgb_colorspace = YES;
+ 
+   DEFVAR_BOOL ("ns-accessibility-enabled", ns_accessibility_enabled,
+-     doc: /* Non-nil means expose buffer content to the macOS accessibility
+-subsystem (VoiceOver, Zoom, and other assistive technology).
+-When nil, the accessibility virtual element tree is not built and no
+-notifications are posted, eliminating the associated overhead.
+-Requires the Cocoa (NS) build on macOS; ignored on GNUstep.
+-Default is nil.  Set to t to enable VoiceOver support.  */);
+     doc: /* Non-nil enables Zoom cursor tracking and VoiceOver support.
+Emacs sets this automatically at startup when macOS Zoom is active or
+any assistive technology (VoiceOver, Switch Control, etc.) is connected,
+and updates it whenever that state changes.  You can override manually:
+
+  (setq ns-accessibility-enabled t)   ; always on
+  (setq ns-accessibility-enabled nil) ; always off
+
+When nil, no AX tree is built and no notifications are posted,
+giving zero per-redisplay overhead.
+Requires the Cocoa (NS) build on macOS; ignored on GNUstep.  */);
+   ns_accessibility_enabled = NO;
+ 
+   DEFVAR_BOOL ("ns-use-mwheel-acceleration",
 -- 
 2.43.0

--- a/patches/0006-doc-add-VoiceOver-accessibility-section-to-macOS-app.patch
+++ b/patches/0006-doc-add-VoiceOver-accessibility-section-to-macOS-app.patch
@@ -1,18 +1,22 @@
-From 5ddf6227b581bf292fc187a1ebcaf80d2cd4cf2a Mon Sep 17 00:00:00 2001
+From 274c545be1a3af3c7e6f416ac3a22e3b98626b0b Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 6/8] doc: add VoiceOver accessibility section to macOS
+Subject: [PATCH 7/9] doc: add VoiceOver accessibility section to macOS
 appendix

-* doc/emacs/macos.texi (VoiceOver Accessibility): New node.  Document
-screen reader usage, keyboard navigation, completion announcements,
-Zoom cursor tracking, ns-accessibility-enabled, known limitations.
+* doc/emacs/macos.texi (VoiceOver Accessibility): New node between
+'Mac / GNUstep Events' and 'GNUstep Support'.  Document screen reader
+usage, keyboard navigation, completion announcements, ns-accessibility-
+enabled, and known limitations.  Use @xref for cross-reference at
+sentence start.  Correct description of ns-accessibility-enabled
+default: initial value is nil, set automatically at startup.
 ---
- doc/emacs/macos.texi | 75 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 75 insertions(+)
+ doc/emacs/macos.texi | 77 ++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m         | 10 ++++--
+ 2 files changed, 84 insertions(+), 3 deletions(-)

 diff --git a/doc/emacs/macos.texi b/doc/emacs/macos.texi
-index 6bd334f..c4dced5 100644
+index 6bd334f48e..72ac3a9aa9 100644
 --- a/doc/emacs/macos.texi
 +++ b/doc/emacs/macos.texi
@@ -36,6 +36,7 @@ Support}), but we hope to improve it in the future.
@@ -23,7 +27,7 @@ index 6bd334f..c4dced5 100644
 * GNUstep Support::             Details on status of GNUstep support.
 @end menu
 
-@@ -272,6 +273,80 @@ and return the result as a string.  You can also use the Lisp function
+@@ -272,6 +273,82 @@ and return the result as a string.  You can also use the Lisp function
 services and receive the results back.  Note that you may need to
 restart Emacs to access newly-available services.
 
@@ -71,19 +75,20 @@ index 6bd334f..c4dced5 100644
 +@vindex ns-accessibility-enabled
 +  To disable the accessibility interface entirely (for instance, to
 +eliminate overhead on systems where assistive technology is not in
-+use), set @code{ns-accessibility-enabled} to @code{nil}.  The default
-+is @code{t}.
+use), set @code{ns-accessibility-enabled} to @code{nil}.  Emacs
+detects the presence of assistive technology at startup and sets this
+variable automatically; the initial value is @code{nil}.
 +
 +@subheading Known Limitations
 +
 +@itemize @bullet
 +@item
-+Accessibility text is capped at 100,000 UTF-16 units per window.
-+Buffers exceeding this limit are truncated for accessibility purposes;
-+VoiceOver will announce ``end of text'' at the cap boundary.
+Very large buffers (tens of megabytes) may cause slow initial
+accessibility text extraction.  Once cached, subsequent queries
+are fast.
 +@item
 +Mode-line text extraction handles only character glyphs.  Mode lines
-+using icon fonts (e.g., @code{doom-modeline} with nerd-font icons)
+using icon fonts (e.g., icon-based mode-lines)
 +produce incomplete accessibility text.
 +@item
 +The accessibility virtual element tree is rebuilt automatically on
@@ -92,18 +97,40 @@ index 6bd334f..c4dced5 100644
 +Right-to-left (bidi) text is exposed correctly as buffer content,
 +but @code{accessibilityRangeForPosition} hit-testing assumes
 +left-to-right glyph layout.
+@item
+Block-style cursors are handled correctly: character navigation
+announces the character at the cursor position, not the character
+before it.
 +@end itemize
 +
-+  This support is available only on the Cocoa build; GNUstep has a
-+different accessibility model and is not yet supported
-+(@pxref{GNUstep Support}).  Evil-mode block cursors are handled
-+correctly: character navigation announces the character at the cursor
-+position, not the character before it.
+  This support is available only on the Cocoa build.  GNUstep has a
+different accessibility model and is not yet supported.
 +
 +
 @node GNUstep Support
 @section GNUstep Support
 
+diff --git a/src/nsterm.m b/src/nsterm.m
+index c3cd83b774..e4e43dd7a3 100644
+--- a/src/nsterm.m
+++ b/src/nsterm.m
+@@ -14764,9 +14764,13 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
+ 
+   DEFVAR_BOOL ("ns-accessibility-enabled", ns_accessibility_enabled,
+      doc: /* Non-nil enables Zoom cursor tracking and VoiceOver support.
+-Emacs sets this automatically at startup when macOS Zoom is active or
+-any assistive technology (VoiceOver, Switch Control, etc.) is connected,
+-and updates it whenever that state changes.  You can override manually:
+Emacs detects at startup whether macOS Zoom is active or an assistive
+technology (VoiceOver, Switch Control, etc.) is connected, and sets
+this variable accordingly.  It updates automatically when accessibility
+state changes.  The initial value is nil; it becomes non-nil only when
+an AT is detected.
+
+You can override the auto-detection:
+ 
+   (setq ns-accessibility-enabled t)   ; always on
+   (setq ns-accessibility-enabled nil) ; always off
 -- 
 2.43.0

--- a/patches/0007-ns-announce-overlay-completion-candidates-for-VoiceO.patch
+++ b/patches/0007-ns-announce-overlay-completion-candidates-for-VoiceO.patch
@@ -1,65 +1,43 @@
-From 8f619411ec75efbd18e663bb3f2ed6f8c9af60d8 Mon Sep 17 00:00:00 2001
+From b87fb2b1824761fe3d91a27afe966eada39c1c45 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
-Date: Sat, 28 Feb 2026 14:46:25 +0100
-Subject: [PATCH 7/8] ns: announce overlay completion candidates for VoiceOver
+Date: Mon, 2 Mar 2026 18:39:46 +0100
+Subject: [PATCH 8/9] ns: announce overlay completion candidates for VoiceOver

 Completion frameworks such as Vertico, Ivy, and Icomplete render
-candidates via overlay before-string/after-string properties rather
-than buffer text.  Without this patch, VoiceOver cannot read
-overlay-based completion UIs.
+candidates via overlay before-string/after-string properties.  Without
+this change VoiceOver cannot read overlay-based completion UIs.

-Identify the selected candidate by scanning overlay strings for a
-face whose symbol name contains "current", "selected", or
-"selection" --- this matches vertico-current, icomplete-selected-match,
-ivy-current-match, company-tooltip-selection, and similar framework
-faces without hard-coding any specific name.
-
-Key implementation details:
-
- The overlay detection branch runs independently (if, not else-if)
-  of the text-change branch, because Vertico bumps both BUF_MODIFF
-  (via text property changes in vertico--prompt-selection) and
-  BUF_OVERLAY_MODIFF (via overlay-put) in the same command cycle.
-
- Use BUF_CHARS_MODIFF to gate ValueChanged notifications, since
-  text property changes bump BUF_MODIFF but not BUF_CHARS_MODIFF.
-
- Remove BUF_OVERLAY_MODIFF from ensureTextCache validity checks
-  to prevent a race condition where VoiceOver AX queries silently
-  consume the overlay change before the notification dispatch runs.
-
- Announce via AnnouncementRequested to NSApp with High priority.
-  Do not post SelectedTextChanged (that reads the AX text at cursor
-  position, which is the minibuffer input, not the candidate).
-
- Zoom tracking: store the selected candidate's rect (at the text
-  area left edge, computed from FRAME_LINE_HEIGHT) in overlayZoomRect.
-  ns_draw_window_cursor checks overlayZoomActive and uses the stored
-  rect instead of the text cursor rect, keeping Zoom focused on the
-  candidate line start.  The flag is cleared when the user types
-  (BUF_CHARS_MODIFF changes) or when no candidate is found
-  (minibuffer exit, C-g).
-
-* src/nsterm.h (EmacsView): Add overlayZoomActive, overlayZoomRect.
-(EmacsAccessibilityBuffer): Add cachedCharsModiff.
-* src/nsterm.m (ns_ax_face_is_selected): New predicate.  Match
-"current", "selected", and "selection" in face symbol names.
-(ns_ax_selected_overlay_text): New function.
-(ns_draw_window_cursor): Use overlayZoomRect when active.
-(EmacsAccessibilityBuffer ensureTextCache): Remove overlay_modiff.
-(EmacsAccessibilityBuffer postAccessibilityNotificationsForFrame:):
-Independent overlay branch, BUF_CHARS_MODIFF gating, candidate
-announcement with overlay Zoom rect storage.
+* src/nsterm.m (ns_ax_selected_overlay_text): New function; scan
+overlay strings in the window for a line with a selected face; return
+its text.
+(accessibilityStringForRange:, accessibilityAttributedStringForRange:)
+(accessibilityRangeForLine:): New NSAccessibility protocol methods.
+Moved here from planned patch 0008 to keep the AX protocol interface
+complete before notification logic uses it.
+(ensureTextCache): Switch cache-validity counter from BUF_CHARS_MODIFF
+to BUF_MODIFF.  Fold/unfold commands (org-mode, outline-mode,
+hideshow-mode) change the 'invisible text property via
+`put-text-property', which bumps BUF_MODIFF but not BUF_CHARS_MODIFF.
+Using BUF_CHARS_MODIFF would serve stale AX text across fold/unfold.
+The rebuild is O(visible-buffer-text) but ensureTextCache is called
+exclusively from AX getters at human interaction speed, never from the
+redisplay notification path; font-lock passes cause zero rebuild cost.
+(postAccessibilityNotificationsForFrame:): Handle BUF_OVERLAY_MODIFF
+changes independently of text changes.  Use BUF_CHARS_MODIFF to gate
+ValueChanged.  Do not call ensureTextCache from the cursor-moved branch:
+the granularity detection uses cachedText directly (falling back to
+granularity_unknown when the cache is absent), so font-lock passes
+cannot trigger O(buffer-size) rebuilds via the notification path.
 ---
- src/nsterm.h |   3 +
- src/nsterm.m | 361 ++++++++++++++++++++++++++++++++++++++++++++++-----
- 2 files changed, 329 insertions(+), 35 deletions(-)
+ src/nsterm.h |   1 +
+ src/nsterm.m | 384 ++++++++++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 306 insertions(+), 79 deletions(-)

 diff --git a/src/nsterm.h b/src/nsterm.h
-index 5298386..a007925 100644
+index 4bf79a9adb..72ca210bb0 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -509,6 +509,7 @@ typedef struct ns_ax_visible_run
+@@ -510,6 +510,7 @@ typedef struct ns_ax_visible_run
 @property (nonatomic, assign) ptrdiff_t cachedOverlayModiff;
 @property (nonatomic, assign) ptrdiff_t cachedTextStart;
 @property (nonatomic, assign) ptrdiff_t cachedModiff;
@@ -67,36 +45,13 @@ index 5298386..a007925 100644
 @property (nonatomic, assign) ptrdiff_t cachedPoint;
 @property (nonatomic, assign) BOOL cachedMarkActive;
 @property (nonatomic, copy) NSString *cachedCompletionAnnouncement;
-@@ -595,6 +596,8 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
-   BOOL accessibilityUpdating;
-   @public  /* Accessed by ns_draw_phys_cursor (C function).  */
-   NSRect lastAccessibilityCursorRect;
-+  BOOL overlayZoomActive;
-+  NSRect overlayZoomRect;
- #endif
-   BOOL font_panel_active;
-   NSFont *font_panel_result;
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 125e52c..ebd52c6 100644
+index e4e43dd7a3..c9fe93a57b 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -3258,7 +3258,12 @@ ns_draw_window_cursor (struct window *w, struct glyph_row *glyph_row,
-     && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
- 	if (UAZoomEnabled ())
- 	  {
-	    NSRect windowRect = [view convertRect:r toView:nil];
-+	    /* When overlay completion is active (e.g. Vertico),
-+	       focus Zoom on the selected candidate row instead
-+	       of the text cursor.  */
-+	    NSRect zoomSrc = view->overlayZoomActive
-+	      ? view->overlayZoomRect : r;
-+	    NSRect windowRect = [view convertRect:zoomSrc toView:nil];
- 	    NSRect screenRect = [[view window] convertRectToScreen:windowRect];
- 	    CGRect cgRect = NSRectToCGRect (screenRect);
- 
-@@ -7159,11 +7164,156 @@ ns_ax_selected_child_frame_text (struct buffer *b, Lisp_Object buf_obj,
- }
+@@ -7263,11 +7263,154 @@ Accessibility virtual elements (macOS / Cocoa only)
 
+ /* ---- Helper: extract buffer text for accessibility ---- */
 
 +/* Return true if FACE is or contains a face symbol whose name
 +   includes "current" or "selected", indicating a highlighted
@@ -155,8 +110,8 @@ index 125e52c..ebd52c6 100644
 +    {
 +      Lisp_Object ov = XCAR (tail);
 +      Lisp_Object strings[2];
-+      strings[0] = Foverlay_get (ov, intern_c_string ("before-string"));
-+      strings[1] = Foverlay_get (ov, intern_c_string ("after-string"));
+      strings[0] = Foverlay_get (ov, Qbefore_string);
+      strings[1] = Foverlay_get (ov, Qafter_string);
 +
 +      for (int s = 0; s < 2; s++)
 +	{
@@ -242,8 +197,6 @@ index 125e52c..ebd52c6 100644
 +
 +  return nil;
 +}
-+
-+
 /* Build accessibility text for window W, skipping invisible text.
    Populates *OUT_START with the buffer start charpos.
    Populates *OUT_RUNS with an array of visible runs and *OUT_NRUNS
@@ -252,25 +205,57 @@ index 125e52c..ebd52c6 100644
 static NSString *
 ns_ax_buffer_text (struct window *w, ptrdiff_t *out_start,
 		   ns_ax_visible_run **out_runs, NSUInteger *out_nruns)
-@@ -7234,7 +7384,7 @@ ns_ax_buffer_text (struct window *w, ptrdiff_t *out_start,
+@@ -7343,7 +7486,7 @@ Accessibility virtual elements (macOS / Cocoa only)
 
       /* Extract this visible run's text.  Use
 	 Fbuffer_substring_no_properties which correctly handles the
-	 buffer gap — raw BUF_BYTE_ADDRESS reads across the gap would
+-	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 +	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 	 include garbage bytes when the run spans the gap position.  */
       Lisp_Object lstr = Fbuffer_substring_no_properties (
 	make_fixnum (pos), make_fixnum (run_end));
-@@ -7315,7 +7465,7 @@ ns_ax_frame_for_range (struct window *w, EmacsView *view,
+@@ -7424,7 +7567,7 @@ Mode lines using icon fonts (e.g. nerd-font icons)
     return NSZeroRect;
 
   /* charpos_start and charpos_len are already in buffer charpos
-     space — the caller maps AX string indices through
+-     space --- the caller maps AX string indices through
 +     space --- the caller maps AX string indices through
      charposForAccessibilityIndex which handles invisible text.  */
   ptrdiff_t cp_start = charpos_start;
   ptrdiff_t cp_end = cp_start + charpos_len;
-@@ -7794,6 +7944,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -7606,31 +7749,6 @@ already on the main queue (e.g., inside postAccessibilityUpdates
+    freeing the main queue for VoiceOver's dispatch_sync calls.  */
+
+-/* Return true if FACE (a symbol or list of symbols) looks like a
+-   "selected item" face.  Substring match is intentionally broad ---
+-   it catches vertico-current, icomplete-selected-match,
+-   ivy-current-match, company-tooltip-selection, and similar.
+-   False positives are harmless: this runs only on overlay/child-frame
+-   strings during completion, never in a hot redisplay path.  */
+-static bool
+-ns_ax_face_is_selected (Lisp_Object face)
+-{
+-  if (SYMBOLP (face) && !NILP (face))
+-    {
+-      const char *name = SSDATA (SYMBOL_NAME (face));
+-      if (strstr (name, "current") || strstr (name, "selected")
+-	  || strstr (name, "selection"))
+-	return true;
+-    }
+-  if (CONSP (face))
+-    {
+-      for (Lisp_Object tail = face; CONSP (tail); tail = XCDR (tail))
+-	if (ns_ax_face_is_selected (XCAR (tail)))
+-	  return true;
+-    }
+-  return false;
+-}
+-
+ static inline void
+ ns_ax_post_notification (id element,
+ 			  NSAccessibilityNotificationName name)
+ {
+@@ -7924,6 +8043,7 @@ @implementation EmacsAccessibilityBuffer
 @synthesize cachedOverlayModiff;
 @synthesize cachedTextStart;
 @synthesize cachedModiff;
@@ -278,175 +263,229 @@ index 125e52c..ebd52c6 100644
 @synthesize cachedPoint;
 @synthesize cachedMarkActive;
 @synthesize cachedCompletionAnnouncement;
-@@ -7891,7 +8042,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8021,7 +8141,7 @@ - (void)ensureTextCache
   NSTRACE ("EmacsAccessibilityBuffer ensureTextCache");
   /* This method is only called from the main thread (AX getters
      dispatch_sync to main first).  Reads of cachedText/cachedTextModiff
-     below are therefore safe without @synchronized — only the
+-     below are therefore safe without @synchronized --- only the
 +     below are therefore safe without @synchronized --- only the
      write section at the end needs synchronization to protect
      against concurrent reads from AX server thread.  */
   eassert ([NSThread isMainThread]);
-@@ -7904,16 +8055,15 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8033,25 +8153,38 @@ - (void)ensureTextCache
+   if (!b)
     return;
 
-   ptrdiff_t modiff = BUF_MODIFF (b);
-  ptrdiff_t overlay_modiff = BUF_OVERLAY_MODIFF (b);
+-  /* Use BUF_CHARS_MODIFF, not BUF_MODIFF, for cache validity.
+-     BUF_MODIFF is bumped by every text-property change, including
+-     font-lock face applications on every redisplay.  AX text contains
+-     only characters, not face data, so property-only changes do not
+-     affect the cached value.  Rebuilding the full buffer text on
+-     each font-lock pass is O(buffer-size) per redisplay --- this
+-     causes progressive slowdown when scrolling through large files.
+-     BUF_CHARS_MODIFF is bumped only on actual character insertions
+-     and deletions, matching the semantic of "did the text change".
+-     This is the pattern used by WebKit and NSTextView.
+-     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
+-     included in the cached AX text (it is handled separately via
+-     explicit announcements in postAccessibilityNotificationsForFrame).
+-     Including overlay_modiff would silently update cachedOverlayModiff
+-     and prevent the notification dispatch from detecting changes.  */
+-  ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
+  /* Use BUF_MODIFF, not BUF_CHARS_MODIFF, for cache validity.
+
+     Fold/unfold commands (org-mode, outline-mode, hideshow-mode) change
+     text visibility by modifying the 'invisible text property via
+     `put-text-property' or `add-text-properties'.  These bump BUF_MODIFF
+     but NOT BUF_CHARS_MODIFF, because no characters are inserted or
+     deleted.  Using only BUF_CHARS_MODIFF would serve stale AX text
+     across fold/unfold: VoiceOver would continue reading hidden content
+     as if it were visible, or miss newly revealed content entirely.
+
+     BUF_MODIFF is bumped by all buffer modifications including
+     text-property changes (e.g. font-lock face assignments).  The
+     per-rebuild cost is O(visible-buffer-text), but `ensureTextCache'
+     is called exclusively from AX getters (accessibilityValue,
+     accessibilitySelectedTextRange, etc.) which run at human interaction
+     speed --- not from the redisplay notification path.  Font-lock
+     passes do not call this method, so the rebuild cost per font-lock
+     cycle is zero.  The redisplay notification path (postAccessibility-
+     NotificationsForFrame:) uses cachedText directly without calling
+     ensureTextCache; granularity detection falls back gracefully when
+     the cache is absent.
+
+     Do NOT use BUF_OVERLAY_MODIFF alone: org-mode >= 29 (org-fold-core)
+     uses text properties, not overlays, for folding, so
+     BUF_OVERLAY_MODIFF would miss those changes.  Additionally, modes
+     like hl-line-mode bump BUF_OVERLAY_MODIFF on every
+     post-command-hook, yielding the same per-keystroke rebuild cost as
+     BUF_MODIFF, with none of its correctness guarantee.  */
+  ptrdiff_t modiff = BUF_MODIFF (b);
   ptrdiff_t pt = BUF_PT (b);
   NSUInteger textLen = cachedText ? [cachedText length] : 0;
-  /* Track both BUF_MODIFF and BUF_OVERLAY_MODIFF.  Overlay-only
-     changes (e.g., timer-based completion highlight move without
-     text edit) bump overlay_modiff but not modiff.  Also detect
-     narrowing/widening which changes BUF_BEGV without bumping
-     either modiff counter.  */
-+  /* Cache validity: track BUF_MODIFF and buffer narrowing.
-+     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
-+     included in the cached AX text (it is handled separately via
-+     explicit announcements).  Including overlay_modiff would
-+     silently update cachedOverlayModiff and prevent the
-+     notification dispatch from detecting overlay changes.  */
-   if (cachedText && cachedTextModiff == modiff
-      && cachedOverlayModiff == overlay_modiff
+-  if (cachedText && cachedTextModiff == chars_modiff
+  if (cachedText && cachedTextModiff == modiff
       && cachedTextStart == BUF_BEGV (b)
       && pt >= cachedTextStart
       && (textLen == 0
-@@ -7930,7 +8080,6 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8067,7 +8200,7 @@ included in the cached AX text (it is handled separately via
+     {
       [cachedText release];
       cachedText = [text retain];
-       cachedTextModiff = modiff;
-      cachedOverlayModiff = overlay_modiff;
+-      cachedTextModiff = chars_modiff;
+      cachedTextModiff = modiff;
       cachedTextStart = start;
 
       if (visibleRuns)
-@@ -7995,7 +8144,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8079,9 +8212,9 @@ included in the cached AX text (it is handled separately via
+ 	 Walk the cached text once, recording the start offset of each
+ 	 line.  Uses NSString lineRangeForRange: --- O(N) in the total
+ 	 text --- but this loop runs only on cache rebuild, which is
+-	 gated on BUF_CHARS_MODIFF: actual character insertions or
+-	 deletions.  Font-lock (text property changes) does not trigger
+-	 a rebuild, so the hot path (cursor movement, redisplay) never
+	 gated on BUF_MODIFF changes.  Rebuilds happen when any buffer
+	 modification occurs (including fold/unfold), ensuring the line
+	 index always matches the currently visible text.
+ 	 enters this code.  */
+       if (lineStartOffsets)
+ 	xfree (lineStartOffsets);
+@@ -8136,7 +8269,7 @@ - (NSUInteger)accessibilityIndexForCharpos:(ptrdiff_t)charpos
   /* Binary search: runs are sorted by charpos (ascending).  Find the
      run whose [charpos, charpos+length) range contains the target,
      or the nearest run after an invisible gap.  O(log n) instead of
-     O(n) — matters for org-mode with many folded sections.  */
+-     O(n) --- matters for org-mode with many folded sections.  */
 +     O(n) --- matters for org-mode with many folded sections.  */
   NSUInteger lo = 0, hi = visibleRunCount;
   while (lo < hi)
     {
-@@ -8008,7 +8157,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
-       else
- 	{
- 	  /* Found: charpos is inside this run.  Compute UTF-16 delta
-	     directly from cachedText — no Lisp calls needed.  */
-+	     directly from cachedText --- no Lisp calls needed.  */
- 	  NSUInteger chars_in = (NSUInteger)(charpos - r->charpos);
- 	  if (chars_in == 0 || !cachedText)
- 	    return r->ax_start;
-@@ -8033,10 +8182,10 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8185,10 +8318,10 @@ by run length (visible window), not total buffer size.  */
 
 /* Convert accessibility string index to buffer charpos.
    Safe to call from any thread: uses only cachedText (NSString) and
-   visibleRuns — no Lisp calls.  */
+-   visibleRuns --- no Lisp calls.  */
 +   visibleRuns --- no Lisp calls.  */
 - (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
 {
-  /* May be called from AX server thread — synchronize.  */
+-  /* May be called from AX server thread --- synchronize.  */
 +  /* May be called from AX server thread --- synchronize.  */
   @synchronized (self)
   {
   if (visibleRunCount == 0)
-@@ -8070,7 +8219,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8230,7 +8363,7 @@ the slow path (composed character sequence walk), which is
 	  return cp;
 	}
     }
-  /* Past end — return last charpos.  */
+-  /* Past end --- return last charpos.  */
 +  /* Past end --- return last charpos.  */
   if (lo > 0)
     {
       ns_ax_visible_run *last = &visibleRuns[visibleRunCount - 1];
-@@ -8092,7 +8241,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8252,7 +8385,7 @@ the slow path (composed character sequence walk), which is
    deadlocking the AX server thread.  This is prevented by:
 
      1. validWindow checks WINDOW_LIVE_P and BUFFERP before every
-        Lisp access — the window and buffer are verified live.
+-        Lisp access --- the window and buffer are verified live.
 +        Lisp access --- the window and buffer are verified live.
      2. All dispatch_sync blocks run on the main thread where no
         concurrent Lisp code can modify state between checks.
      3. block_input prevents timer events and process output from
-@@ -8443,7 +8592,51 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
-   if (point_idx > [cachedText length])
-     point_idx = [cachedText length];
+@@ -8597,26 +8730,26 @@ - (NSInteger)accessibilityInsertionPointLineNumber
+   return [self lineForAXIndex:point_idx];
+ }
 
-+  return [self lineForAXIndex:point_idx];
-+}
-+
+-- (NSRange)accessibilityRangeForLine:(NSInteger)line
 +- (NSString *)accessibilityStringForRange:(NSRange)range
-+{
-+  if (![NSThread isMainThread])
-+    {
+ {
+   if (![NSThread isMainThread])
+     {
+-      __block NSRange result;
 +      __block NSString *result;
-+      dispatch_sync (dispatch_get_main_queue (), ^{
+       dispatch_sync (dispatch_get_main_queue (), ^{
+-	  result = [self accessibilityRangeForLine:line];
 +	  result = [self accessibilityStringForRange:range];
-+	});
-+      return result;
-+    }
-+  [self ensureTextCache];
+ 	});
+       return result;
+     }
+   [self ensureTextCache];
+-  if (!cachedText || line < 0)
+-    return NSMakeRange (NSNotFound, 0);
+-
+-  NSUInteger len = [cachedText length];
+-  if (len == 0)
+-    return (line == 0) ? NSMakeRange (0, 0)
+-		       : NSMakeRange (NSNotFound, 0);
 +  if (!cachedText || range.location + range.length > [cachedText length])
 +    return @"";
 +  return [cachedText substringWithRange:range];
 +}
-+
+ 
+-  return [self rangeForLine:(NSUInteger)line textLength:len];
 +- (NSAttributedString *)accessibilityAttributedStringForRange:(NSRange)range
 +{
 +  NSString *str = [self accessibilityStringForRange:range];
 +  return [[[NSAttributedString alloc] initWithString:str] autorelease];
+ }
+ 
+ - (NSInteger)accessibilityLineForIndex:(NSInteger)index
+@@ -8638,6 +8771,29 @@ - (NSInteger)accessibilityLineForIndex:(NSInteger)index
+     idx = [cachedText length];
+ 
+   return [self lineForAXIndex:idx];
+
 +}
 +
-+- (NSInteger)accessibilityLineForIndex:(NSInteger)index
+- (NSRange)accessibilityRangeForLine:(NSInteger)line
 +{
 +  if (![NSThread isMainThread])
 +    {
-+      __block NSInteger result;
+      __block NSRange result;
 +      dispatch_sync (dispatch_get_main_queue (), ^{
-+	  result = [self accessibilityLineForIndex:index];
+	  result = [self accessibilityRangeForLine:line];
 +	});
 +      return result;
 +    }
 +  [self ensureTextCache];
-+  if (!cachedText || index < 0)
-+    return 0;
+  if (!cachedText || line < 0)
+    return NSMakeRange (NSNotFound, 0);
 +
-+  NSUInteger idx = (NSUInteger) index;
-+  if (idx > [cachedText length])
-+    idx = [cachedText length];
-+
-   return [self lineForAXIndex:idx];
+  NSUInteger len = [cachedText length];
+  if (len == 0)
+    return (line == 0) ? NSMakeRange (0, 0)
+		       : NSMakeRange (NSNotFound, 0);
 +
+  return [self rangeForLine:(NSUInteger)line textLength:len];
 }
 
- - (NSRange)accessibilityRangeForLine:(NSInteger)line
-@@ -8667,7 +8860,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+ - (NSRange)accessibilityRangeForIndex:(NSInteger)index
+@@ -8840,7 +8996,7 @@ - (NSRect)accessibilityFrame
 
 
 /* ===================================================================
-   EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+-   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 +   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 
    These methods notify VoiceOver of text and selection changes.
    Called from the redisplay cycle (postAccessibilityUpdates).
-@@ -8682,7 +8875,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8855,7 +9011,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
   if (point > self.cachedPoint
       && point - self.cachedPoint == 1)
     {
-      /* Single char inserted — refresh cache and grab it.  */
+-      /* Single char inserted --- refresh cache and grab it.  */
 +      /* Single char inserted --- refresh cache and grab it.  */
       [self invalidateTextCache];
       [self ensureTextCache];
       if (cachedText)
-@@ -8701,7 +8894,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -8874,7 +9030,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
   /* Update cachedPoint here so the selection-move branch does NOT
      fire for point changes caused by edits.  WebKit and Chromium
      never send both ValueChanged and SelectedTextChanged for the
-     same user action — they are mutually exclusive.  */
+-     same user action --- they are mutually exclusive.  */
 +     same user action --- they are mutually exclusive.  */
   self.cachedPoint = point;
 
   NSDictionary *change = @{
-@@ -9034,14 +9227,112 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+@@ -9268,16 +9424,80 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
   BOOL markActive = !NILP (BVAR (b, mark_active));
 
   /* --- Text changed (edit) --- */
@@ -464,7 +503,6 @@ index 125e52c..ebd52c6 100644
 +      if (chars_modiff != self.cachedCharsModiff)
 +	{
 +	  self.cachedCharsModiff = chars_modiff;
-+	  self.emacsView->overlayZoomActive = NO;
 +	  [self postTextChangedNotification:point];
 +	}
 +    }
@@ -484,6 +522,13 @@ index 125e52c..ebd52c6 100644
 +    {
 +      self.cachedOverlayModiff = BUF_OVERLAY_MODIFF (b);
 +
+      /* Overlay completion candidates (Vertico, Icomplete, Ivy) are
+	 displayed in the minibuffer.  In normal editing buffers,
+	 font-lock and other modes change BUF_OVERLAY_MODIFF on
+	 every redisplay, triggering O(overlays) work per keystroke.
+	 Restrict the scan to minibuffer windows.  */
+      if (MINI_WINDOW_P (w))
+	{
 +	  int selected_line = -1;
 +	  NSString *candidate
 +	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
@@ -511,146 +556,74 @@ index 125e52c..ebd52c6 100644
 +		    NSApp,
 +		    NSAccessibilityAnnouncementRequestedNotification,
 +		    annInfo);
-+
-+	      /* --- Zoom tracking for overlay candidates ---
-+		 Store the candidate row rect so draw_window_cursor
-+		 focuses Zoom there instead of on the text cursor.
-+		 Cleared when the user types (chars_modiff change).
-+
-+		 Use default line height to compute the Y offset:
-+		 row 0 is the input line, overlay candidates start
-+		 from row 1.  This avoids fragile glyph matrix row
-+		 index mapping which can be off when group titles
-+		 or wrapped lines shift row numbering.  */
-+	      if (selected_line >= 0)
-+		{
-+		  struct window *w2 = [self validWindow];
-+		  if (w2)
-+		    {
-+		      EmacsView *view = self.emacsView;
-+		      struct frame *f2 = XFRAME (w2->frame);
-+		      int line_h = FRAME_LINE_HEIGHT (f2);
-+		      int y_off = (selected_line + 1) * line_h;
-+
-+		      if (y_off < w2->pixel_height)
-+			{
-+			  view->overlayZoomRect = NSMakeRect (
-+			    WINDOW_TEXT_TO_FRAME_PIXEL_X (w2, 0),
-+			    WINDOW_TO_FRAME_PIXEL_Y (w2, y_off),
-+			    FRAME_COLUMN_WIDTH (f2),
-+			    line_h);
-+			  view->overlayZoomActive = YES;
 +		}
 +	    }
-+		}
-+	    }
-+	}
-+      else
-+	{
-+	  /* No selected candidate --- overlay completion ended
-+	     (minibuffer exit, C-g, etc.) or overlay has no
-+	     recognizable selection face.  Return Zoom to the
-+	     text cursor.  */
-+	  self.emacsView->overlayZoomActive = NO;
 +	}
     }
 
   /* --- Cursor moved or selection changed ---
-     Use 'else if' — edits and selection moves are mutually exclusive
-+     Use 'else if' --- edits and selection moves are mutually exclusive
-      per the WebKit/Chromium pattern.  */
-   else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
+-     Use 'else if' --- edits and selection moves are mutually exclusive
+-     per the WebKit/Chromium pattern.  */
+-  else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
+     Independent check from the overlay branch above.  */
+  if (point != self.cachedPoint || markActive != self.cachedMarkActive)
     {
-@@ -9211,7 +9502,7 @@ ns_ax_completion_text_for_span (EmacsAccessibilityBuffer *elem,
+       ptrdiff_t oldPoint = self.cachedPoint;
+       BOOL oldMarkActive = self.cachedMarkActive;
+@@ -9295,8 +9515,14 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
+       bool isCtrlNP = ns_ax_event_is_line_nav_key (&ctrlNP);
 
- 
- /* ===================================================================
-   EmacsAccessibilityInteractiveSpan — helpers and implementation
-+   EmacsAccessibilityInteractiveSpan --- helpers and implementation
-    =================================================================== */
- 
- /* Scan visible range of window W for interactive spans.
-@@ -9402,7 +9693,7 @@ ns_ax_scan_interactive_spans (struct window *w,
- - (BOOL) isAccessibilityFocused
+       /* --- Granularity detection --- */
+      /* Use cached text as-is; do NOT call ensureTextCache here.
+	 ensureTextCache is O(visible-buffer-text) and must not run on
+	 every redisplay cycle.  Using stale cached text for granularity
+	 classification is safe: the worst case is an incorrect
+	 granularity hint (defaulting to unknown), which causes VoiceOver
+	 to make its own determination.  Fresh text is always available
+	 to VoiceOver via the AX getter path (accessibilityValue etc.).  */
+       NSInteger granularity = ns_ax_text_selection_granularity_unknown;
+-      [self ensureTextCache];
+       if (cachedText && oldPoint > 0)
 	{
-   /* Read the cached point stored by EmacsAccessibilityBuffer on the main
-     thread — safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
-+     thread --- safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
-   EmacsAccessibilityBuffer *pb = self.parentBuffer;
-   if (!pb)
-     return NO;
-@@ -9419,7 +9710,7 @@ ns_ax_scan_interactive_spans (struct window *w,
-   dispatch_async (dispatch_get_main_queue (), ^{
-     /* lwin is a Lisp_Object captured by value.  This is GC-safe
-        because Lisp_Objects are tagged integers/pointers that
-       remain valid across GC — GC does not relocate objects in
-+       remain valid across GC --- GC does not relocate objects in
-        Emacs.  The WINDOW_LIVE_P check below guards against the
-        window being deleted between capture and execution.  */
-     if (!WINDOWP (lwin) || NILP (Fwindow_live_p (lwin)))
-@@ -9445,7 +9736,7 @@ ns_ax_scan_interactive_spans (struct window *w,
- 
- @end
- 
-/* EmacsAccessibilityBuffer — InteractiveSpans category.
-+/* EmacsAccessibilityBuffer --- InteractiveSpans category.
-    Methods are kept here (same .m file) so they access the ivars
-    declared in the @interface ivar block.  */
- @implementation EmacsAccessibilityBuffer (InteractiveSpans)
-@@ -10765,13 +11056,13 @@ ns_in_echo_area (void)
-         if (old_title == 0)
-           {
-             char *t = strdup ([[[self window] title] UTF8String]);
-            char *pos = strstr (t, "  —  ");
-+            char *pos = strstr (t, "  ---  ");
-             if (pos)
-               *pos = '\0';
-             old_title = t;
-           }
-         size_title = xmalloc (strlen (old_title) + 40);
-	esprintf (size_title, "%s  —  (%d × %d)", old_title, cols, rows);
-+	esprintf (size_title, "%s  ---  (%d × %d)", old_title, cols, rows);
-         [window setTitle: [NSString stringWithUTF8String: size_title]];
-         [window display];
-         xfree (size_title);
-@@ -12167,7 +12458,7 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+ 	  NSUInteger tlen = [cachedText length];
+@@ -12457,7 +12683,7 @@ - (int) fullscreenState
 
   if (WINDOW_LEAF_P (w))
     {
-      /* Buffer element — reuse existing if available.  */
+-      /* Buffer element --- reuse existing if available.  */
 +      /* Buffer element --- reuse existing if available.  */
       EmacsAccessibilityBuffer *elem
 	= [existing objectForKey:[NSValue valueWithPointer:w]];
       if (!elem)
-@@ -12201,7 +12492,7 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+@@ -12491,7 +12717,7 @@ - (int) fullscreenState
     }
   else
     {
-      /* Internal (combination) window — recurse into children.  */
+-      /* Internal (combination) window --- recurse into children.  */
 +      /* Internal (combination) window --- recurse into children.  */
       Lisp_Object child = w->contents;
       while (!NILP (child))
 	{
-@@ -12313,7 +12604,7 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+@@ -12603,7 +12829,7 @@ - (void)postAccessibilityUpdates
   accessibilityUpdating = YES;
 
   /* Detect window tree change (split, delete, new buffer).  Compare
-     FRAME_ROOT_WINDOW — if it changed, the tree structure changed.  */
+-     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
 +     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
   Lisp_Object curRoot = FRAME_ROOT_WINDOW (emacsframe);
   if (!EQ (curRoot, lastRootWindow))
     {
-@@ -12322,12 +12613,12 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+@@ -12612,12 +12838,12 @@ - (void)postAccessibilityUpdates
     }
 
   /* If tree is stale, rebuild FIRST so we don't iterate freed
-     window pointers.  Skip notifications for this cycle — the
+-     window pointers.  Skip notifications for this cycle --- the
 +     window pointers.  Skip notifications for this cycle --- the
      freshly-built elements have no previous state to diff against.  */
   if (!accessibilityTreeValid)
     {
       [self rebuildAccessibilityTree];
-      /* Invalidate span cache — window layout changed.  */
+-      /* Invalidate span cache --- window layout changed.  */
 +      /* Invalidate span cache --- window layout changed.  */
       for (EmacsAccessibilityElement *elem in accessibilityElements)
 	if ([elem isKindOfClass: [EmacsAccessibilityBuffer class]])
--- a/patches/0008-ns-announce-child-frame-completion-candidates-for-Vo.patch
+++ b/patches/0008-ns-announce-child-frame-completion-candidates-for-Vo.patch
@@ -1,79 +1,203 @@
-From d68d1334147a7de273e39cf26c778389faa424ad Mon Sep 17 00:00:00 2001
+From 5bef7fa553d0dfd9ab933d341a8115d42e026b42 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
-Date: Sat, 28 Feb 2026 16:01:29 +0100
-Subject: [PATCH 8/8] ns: announce child frame completion candidates for
+Date: Mon, 2 Mar 2026 18:49:13 +0100
+Subject: [PATCH 9/9] ns: announce child frame completion candidates for
 VoiceOver

-Completion frameworks such as Corfu, Company-box, and similar
-render candidates in a child frame rather than as overlay strings
-in the minibuffer.  This patch extends the overlay announcement
-support (patch 7/8) to handle child frame popups.
+Child frame popups (Corfu, Company-mode child frames) render completion
+candidates in a separate frame whose buffer is not accessible via the
+minibuffer overlay path.  This patch scans child frame buffers for
+selected candidates and announces them via VoiceOver.

-Detect child frames via FRAME_PARENT_FRAME in postAccessibilityUpdates.
-Scan the child frame buffer text line by line using Fget_char_property
-(which checks both text properties and overlay face properties) to
-find the selected candidate.  Reuse ns_ax_face_is_selected from
-the overlay patch to identify "current", "selected", and
-"selection" faces.
-
-Safety:
- record_unwind_current_buffer / set_buffer_internal_1 to switch to
-  the child frame buffer for Fbuffer_substring_no_properties.
- Re-entrance guard (accessibilityUpdating) before child frame dispatch.
- BUF_MODIFF gating prevents redundant scans.
- WINDOWP, BUFFERP validation for partially initialized frames.
- Buffer size limit (10000 chars) skips non-completion child frames.
-
-When the child frame closes, post FocusedUIElementChangedNotification
-on the parent buffer element to restore VoiceOver's character echo
-and cursor tracking.  The flag childFrameCompletionActive is set by
-the child frame handler and cleared on the parent's next accessibility
-cycle when no child frame is visible (via FOR_EACH_FRAME).
-
-Announce via AnnouncementRequested to NSApp with High priority.
-Use direct UAZoomChangeFocus because the child frame renders
-independently --- its ns_update_end runs after the parent's
-draw_window_cursor, so the last Zoom call wins.
-
-* src/nsterm.h (EmacsView): Add announceChildFrameCompletion,
-childFrameCompletionActive flag.
-* src/nsterm.m (ns_ax_selected_child_frame_text): New function.
-(EmacsView announceChildFrameCompletion): New method, set parent flag.
-(EmacsView postAccessibilityUpdates): Dispatch to child frame handler,
-refocus parent buffer element when child frame closes.
+* src/nsterm.h (EmacsView): Add childFrameLastBuffer, childFrameLastModiff,
+childFrameLastCandidate, childFrameCompletionActive, lastEchoCharsModiff
+ivars.  Initialize childFrameLastBuffer to Qnil in initFrameFromEmacs:.
+(EmacsAccessibilityBuffer): Add voiceoverSetPoint ivar.
+* src/nsterm.m (ns_ax_selected_child_frame_text): New function; scans
+child frame buffer text for the selected completion candidate.
+(announceChildFrameCompletion): New method; scans child frame buffers
+for selected completion candidates.  Store childFrameLastBuffer as
+BVAR(b, name) (buffer name symbol, GC-reachable via obarray) rather
+than a raw buffer pointer to avoid a dangling pointer after buffer kill.
+(postEchoAreaAnnouncementIfNeeded): New method; announces echo area
+changes (e.g., "Wrote file", "Quit") for commands that produce output
+while the minibuffer is inactive.
+(postAccessibilityNotificationsForFrame:): Drive child frame and echo
+area announcements.  Add voiceoverSetPoint flag and singleLineMove
+adjacency detection to distinguish VoiceOver-initiated cursor moves
+from Emacs-initiated moves; sequential adjacent-line moves use
+next/previous direction, teleports use discontiguous.  Add didTextChange
+guard to suppress overlay completion announcements while the user types.
+(setAccessibilitySelectedTextRange:): Set voiceoverSetPoint so that the
+subsequent notification cycle uses sequential direction.
+* doc/emacs/macos.texi (VoiceOver Accessibility): Update to document
+echo area announcements and VoiceOver rotor cursor synchronization.
+Remove Zoom section (covered by patch 0000).  Fix dangling paragraph.
 ---
- src/nsterm.h |   2 +
- src/nsterm.m | 253 ++++++++++++++++++++++++++++++++++++++++++++++++++-
- 2 files changed, 254 insertions(+), 1 deletion(-)
+ doc/emacs/macos.texi |  13 +-
+ etc/NEWS             |  25 +-
+ src/nsterm.h         |  21 ++
+ src/nsterm.m         | 577 +++++++++++++++++++++++++++++++++++++------
+ 4 files changed, 541 insertions(+), 95 deletions(-)
+
+diff --git a/doc/emacs/macos.texi b/doc/emacs/macos.texi
+index 72ac3a9aa9..cf5ed0ff28 100644
+--- a/doc/emacs/macos.texi
+++ b/doc/emacs/macos.texi
+@@ -309,10 +309,15 @@ Shift-modified movement announces selected or deselected text.
+   The @file{*Completions*} buffer announces each completion candidate
+ as you navigate, even while keyboard focus remains in the minibuffer.
+ 
+-  macOS Zoom (System Settings, Accessibility, Zoom) tracks the Emacs
+-cursor automatically when set to follow keyboard focus.  The cursor
+-position is communicated via @code{UAZoomChangeFocus} and the
+-@code{AXBoundsForRange} accessibility attribute.
+  Echo area messages are announced automatically.  When a background
+operation completes and displays a message (e.g., @samp{Git finished},
+@samp{Wrote file}), VoiceOver reads it without requiring any action.
+Messages are suppressed while the minibuffer is active (i.e., while
+you are typing a command) to avoid interrupting prompt reading.
+
+  VoiceOver's rotor browse cursor stays synchronized with the Emacs
+cursor after large programmatic jumps (for example, heading navigation
+in Org mode, @code{xref-find-definitions}, or @code{imenu}).
+ 
+ @vindex ns-accessibility-enabled
+   To disable the accessibility interface entirely (for instance, to
+diff --git a/etc/NEWS b/etc/NEWS
+index 7f917f93b2..bbec21b635 100644
+--- a/etc/NEWS
+++ b/etc/NEWS
+@@ -88,10 +88,9 @@ When macOS Zoom is enabled (System Settings, Accessibility, Zoom,
+ Follow keyboard focus), Emacs informs Zoom of the text cursor position
+ after every cursor redraw via 'UAZoomChangeFocus'.  The zoomed viewport
+ automatically tracks the insertion point across window splits and
+-switches.  Completion frameworks (Vertico, Icomplete, Ivy for overlay
+-candidates; Corfu, Company-box for child frame popups) are also
+-tracked: Zoom follows the selected candidate rather than the text
+-cursor during completion.
+switches.  Overlay-based completion frameworks and child-frame popup completions
+are also tracked: Zoom follows the selected candidate rather than the
+text cursor during completion.
+ 
+ +++
+ ** 'line-spacing' now supports specifying spacing above the line.
+@@ -4385,16 +4384,20 @@ allowing Emacs users access to speech recognition utilities.
+ Note: Accepting this permission allows the use of system APIs, which may
+ send user data to Apple's speech recognition servers.
+ 
+----
++++
+ ** VoiceOver accessibility support on macOS.
+ Emacs now exposes buffer content, cursor position, and interactive
+ elements to the macOS accessibility subsystem (VoiceOver).  This
+-includes AXBoundsForRange for macOS Zoom cursor tracking, line and
+-word navigation announcements, Tab-navigable interactive spans
+-(buttons, links, completion candidates), and completion announcements
+-for the *Completions* buffer.  The implementation uses a virtual
+-accessibility tree with per-window elements, hybrid SelectedTextChanged
+-and AnnouncementRequested notifications, and thread-safe text caching.
+includes:
+- Line and word navigation announcements via standard movement keys.
+- Echo area messages (e.g., "Wrote file", "Git finished") announced
+  automatically as they appear, without user interaction.
+- VoiceOver rotor cursor synchronization after large programmatic
+  jumps (]], M-<, xref, imenu, etc.).
+- Tab-navigable interactive spans (buttons, links, completion
+  candidates) within a buffer.
+- Completion announcements for the *Completions* buffer, overlay
+  completion UIs, and child-frame completion popup UIs.
+ Set 'ns-accessibility-enabled' to nil to disable the accessibility
+ interface and eliminate the associated overhead.
 
 diff --git a/src/nsterm.h b/src/nsterm.h
-index a007925..1a8a84d 100644
+index 72ca210bb0..1c79c8aced 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -598,6 +598,7 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
-   NSRect lastAccessibilityCursorRect;
-   BOOL overlayZoomActive;
-   NSRect overlayZoomRect;
+@@ -504,9 +504,20 @@ typedef struct ns_ax_visible_run
+   NSUInteger         lineCount;          /* Entries in lineStartOffsets.  */
+   NSMutableArray    *cachedInteractiveSpans;
+   BOOL               interactiveSpansDirty;
+  /* Set to YES in setAccessibilitySelectedTextRange: (VoiceOver moved
+     the cursor); reset to NO in postAccessibilityNotificationsForFrame:.
+     When YES, cursor notifications use sequential direction so VoiceOver
+     continues smooth line/character navigation without re-anchoring.
+     When NO, Emacs moved the cursor independently; use discontiguous
+     direction so VoiceOver re-anchors its browse cursor to the new
+     accessibilitySelectedTextRange.  */
+  BOOL               voiceoverSetPoint;
+ }
+ @property (nonatomic, retain) NSString *cachedText;
+ @property (nonatomic, assign) ptrdiff_t cachedTextModiff;
+/* Overlay modiff at last text cache rebuild.  Tracked separately from
+   cachedOverlayModiff (which is used for completion announcements) so
+   that fold/unfold detection is independent of notification dispatch.  */
+ @property (nonatomic, assign) ptrdiff_t cachedOverlayModiff;
+ @property (nonatomic, assign) ptrdiff_t cachedTextStart;
+ @property (nonatomic, assign) ptrdiff_t cachedModiff;
+@@ -601,6 +612,14 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
+   Lisp_Object lastRootWindow;
+   BOOL accessibilityTreeValid;
+   BOOL accessibilityUpdating;
 +  BOOL childFrameCompletionActive;
+  NSString *childFrameLastCandidate;
+  Lisp_Object childFrameLastBuffer;
+  EMACS_INT childFrameLastModiff;
+  /* Last BUF_CHARS_MODIFF seen for echo_area_buffer[0].  Used by
+     postEchoAreaAnnouncementIfNeeded to detect new echo area messages
+     independently of the per-element notification cycle.  */
+  ptrdiff_t lastEchoCharsModiff;
 #endif
   BOOL font_panel_active;
   NSFont *font_panel_result;
-@@ -661,6 +662,7 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+@@ -670,6 +689,8 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
 - (void)rebuildAccessibilityTree;
 - (void)invalidateAccessibilityTree;
 - (void)postAccessibilityUpdates;
+- (void)postEchoAreaAnnouncementIfNeeded;
 +- (void)announceChildFrameCompletion;
 #endif
 @end
 
 diff --git a/src/nsterm.m b/src/nsterm.m
-index ebd52c6..a7025a9 100644
+index c9fe93a57b..f7574efb39 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -7310,6 +7310,110 @@ ns_ax_selected_overlay_text (struct buffer *b,
+@@ -1275,6 +1275,12 @@ If a completion candidate is selected (overlay or child frame),
+ static void
+ ns_zoom_track_completion (struct frame *f, EmacsView *view)
+ {
+  /* Zoom cursor tracking is controlled exclusively by
+     ns_zoom_enabled_p ().  We do NOT gate on ns_accessibility_enabled:
+     users can run Zoom without VoiceOver, and those users should still
+     get completion-candidate tracking.  ns_accessibility_enabled is
+     only set when a screen reader (VoiceOver or similar) activates the
+     AX layer; it has no bearing on the Zoom feature.  */
+   if (!ns_zoom_enabled_p ())
+     return;
+   if (!WINDOWP (f->selected_window))
+@@ -1417,9 +1423,14 @@ so the visual offset is (ov_line + 1) * line_h from
+ 
+   /* Track completion candidates for Zoom (overlay and child frame).
+      Runs after cursor tracking so the selected candidate overrides
+-     the default cursor position.  */
+     the default cursor position.  Guard with the same version check
+     as ns_zoom_track_completion's callee (UAZoomChangeFocus requires
+     macOS 10.10+).  */
+#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
+    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
+   if (view)
+     ns_zoom_track_completion (f, view);
+#endif /* MAC_OS_X_VERSION_MIN_REQUIRED >= 101000 */
+ #endif /* NS_IMPL_COCOA */
+ 
+   /* Post accessibility notifications after each redisplay cycle.  */
+@@ -7407,6 +7418,119 @@ visual line index for Zoom (skip whitespace-only lines
+ 
+   return nil;
 }
- 
- 
+
+
 +/* Scan buffer text of a child frame for the selected completion
 +   candidate.  Used for frameworks that render candidates in a
 +   child frame (e.g. Corfu, Company-box) rather than as overlay
@@ -115,12 +239,19 @@ index ebd52c6..a7025a9 100644
 +     The data pointer is used only in this loop, before Lisp calls.  */
 +  const unsigned char *data = SDATA (str);
 +  ptrdiff_t byte_len = SBYTES (str);
-+  ptrdiff_t line_starts[128];
-+  ptrdiff_t line_ends[128];
+  /* 128 lines is a safe upper bound for a completion child frame.
+     The caller rejects buffers larger than 10,000 characters
+     (BUF_ZV(b) - BUF_BEGV(b) > 10000 guard in announceChildFrameCompletion),
+     so at most ~10,000 / 1-byte-per-line = 10,000 lines could appear,
+     but completion popups are typically < 512 lines.  Use 512 to match
+     the bound in ns_ax_selected_overlay_text; lines beyond 512 are
+     silently skipped.  */
+  ptrdiff_t line_starts[512];
+  ptrdiff_t line_ends[512];
 +  int nlines = 0;
 +  ptrdiff_t char_pos = 0, byte_pos = 0, lstart = 0;
 +
-+  while (byte_pos < byte_len && nlines < 128)
+  while (byte_pos < byte_len && nlines < 512)
 +    {
 +      if (data[byte_pos] == '\n')
 +	{
@@ -138,7 +269,7 @@ index ebd52c6..a7025a9 100644
 +	byte_pos++;
 +      char_pos++;
 +    }
-+  if (char_pos > lstart && nlines < 128)
+  if (char_pos > lstart && nlines < 512)
 +    {
 +      line_starts[nlines] = lstart;
 +      line_ends[nlines] = char_pos;
@@ -181,22 +312,445 @@ index ebd52c6..a7025a9 100644
 /* Build accessibility text for window W, skipping invisible text.
    Populates *OUT_START with the buffer start charpos.
    Populates *OUT_RUNS with an array of visible runs and *OUT_NRUNS
-@@ -12588,6 +12692,105 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+@@ -7440,11 +7564,12 @@ visual line index for Zoom (skip whitespace-only lines
+     return @"";
+ 
+   specpdl_ref count = SPECPDL_INDEX ();
+-  record_unwind_current_buffer ();
+-  /* block_input must come before record_unwind_protect_void (unblock_input):
+-     if specpdl_push were to fail after registration, the unwind handler
+-     would call unblock_input without a matching block_input.  */
+  /* block_input must precede record_unwind_protect_void (unblock_input):
+     if anything between SPECPDL_INDEX and block_input were to throw,
+     the unwind handler would call unblock_input without a matching
+     block_input, corrupting the input-blocking reference count.  */
+   block_input ();
+  record_unwind_current_buffer ();
+   record_unwind_protect_void (unblock_input);
+   if (b != current_buffer)
+     set_buffer_internal_1 (b);
+@@ -8613,6 +8738,11 @@ - (void)setAccessibilitySelectedTextRange:(NSRange)range
+ 
+   [self ensureTextCache];
+ 
+  /* Record that VoiceOver (not Emacs) is moving the cursor so that the
+     subsequent postAccessibilityNotificationsForFrame: call can use the
+     correct sequential direction rather than forcing a re-anchor.  */
+  voiceoverSetPoint = YES;
+
+   specpdl_ref count = SPECPDL_INDEX ();
+   record_unwind_current_buffer ();
+   /* block_input must come before record_unwind_protect_void (unblock_input).  */
+@@ -9060,20 +9190,38 @@ - (void)postFocusedCursorNotification:(ptrdiff_t)point
+        && granularity
+ 	  == ns_ax_text_selection_granularity_character);
+ 
+-  /* Always post SelectedTextChanged to interrupt VoiceOver reading
+-     and update cursor tracking / braille displays.  */
+  /* Post SelectedTextChanged to interrupt VoiceOver reading and
+     update cursor tracking / braille displays.
+     For sequential moves (direction = next/previous): include
+     direction + granularity so VoiceOver reads the destination line
+     or word without additional state queries.
+     For discontiguous jumps (teleports, multi-line leaps): omit
+     direction and granularity and let VoiceOver determine what to read
+     from its own navigation state.  This matches the pre-review
+     behaviour and ensures VoiceOver reads the full destination line
+     even when the jump skips blank or invisible lines (e.g. org-agenda
+     items separated by blank lines, where adjacency detection cannot
+     classify the move as singleLineMove).  */
+   NSMutableDictionary *moveInfo = [NSMutableDictionary dictionary];
+   moveInfo[@"AXTextStateChangeType"]
+     = @(ns_ax_text_state_change_selection_move);
+-  moveInfo[@"AXTextSelectionDirection"] = @(direction);
+   moveInfo[@"AXTextChangeElement"] = self;
+-  /* Omit granularity for character moves so VoiceOver does not
+-     derive its own speech (it would read the wrong character
+-     for block-cursor mode).  Include it for word/line/
+-     selection so VoiceOver reads the appropriate text.  */
+-  if (!isCharMove)
+-    moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
+-
+  BOOL isDiscontiguous
+    = (direction == ns_ax_text_selection_direction_discontiguous);
+  if (!isDiscontiguous && !isCharMove)
+    {
+      moveInfo[@"AXTextSelectionDirection"] = @(direction);
+      moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
+    }
+
+  /* Post on self (the EmacsAXBuffer element), not on the parent
+     EmacsView.  When the notification originates from the element
+     whose selection changed, VoiceOver calls accessibilityLineForIndex:
+     on that element to determine the line to read.  Posting from the
+     parent view with UIElementsKey causes VoiceOver to call
+     accessibilityLineForIndex: on the view instead, which returns an
+     incorrect range in specialised buffers (org-agenda, org-super-agenda)
+     where line geometry differs from plain text.  */
+   ns_ax_post_notification_with_info (
+     self,
+     NSAccessibilitySelectedTextChangedNotification,
+@@ -9173,12 +9321,17 @@ user expectation ("w" jumps to next word and reads it).  */
+ 	}
+     }
+ 
+-  /* For focused line moves: always announce line text explicitly.
+-     SelectedTextChanged with granularity=line works for arrow keys,
+-     but C-n/C-p need the explicit announcement (VoiceOver processes
+-     these keystrokes differently from arrows).
+  /* Announce the destination line text for all line-granularity moves.
+     This covers two cases:
+     - C-n/C-p: SelectedTextChanged carries granularity=line, but
+       VoiceOver processes those keystrokes specially and may not
+       produce speech; the explicit announcement is the reliable path.
+     - Discontiguous jumps (]], M-<, xref, imenu, …): granularity=line
+       in the notification is omitted (see above) so VoiceOver will
+       not announce automatically; this explicit announcement fills
+       the gap.
+      In completion-list-mode, read the completion candidate instead
+-     of the whole line.  */
+     of the full line.  */
+   if (cachedText
+       && granularity == ns_ax_text_selection_granularity_line)
+     {
+@@ -9243,6 +9396,11 @@ - (void)postCompletionAnnouncementForBuffer:(struct buffer *)b
+ 
+   block_input ();
+   specpdl_ref count2 = SPECPDL_INDEX ();
+  /* Register unblock_input as an unwind action so that if any Lisp
+     call below signals (triggering a longjmp through unbind_to),
+     block_input is always paired with an unblock_input.  The
+     unbind_to call at the end of the function unwinds this.
+     record_unwind_protect_void plus unbind_to is idempotent.  */
+   record_unwind_protect_void (unblock_input);
+   record_unwind_current_buffer ();
+   if (b != current_buffer)
+@@ -9419,12 +9577,29 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
+   if (!b)
+     return;
+ 
+  /* Echo area announcements are handled in
+     postEchoAreaAnnouncementIfNeeded (called from postAccessibilityUpdates
+     before this per-element loop) so that they are never lost to a
+     concurrent tree rebuild.  For the inactive minibuffer (minibuf_level
+     == 0), skip normal cursor and completion processing --- there is no
+     meaningful cursor to track.  */
+  if (MINI_WINDOW_P (w) && minibuf_level == 0)
+    return;
+
+   ptrdiff_t modiff = BUF_MODIFF (b);
+   ptrdiff_t point = BUF_PT (b);
+   BOOL markActive = !NILP (BVAR (b, mark_active));
+ 
+   /* --- Text changed (edit) --- */
+   ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
+  /* Track whether the user typed a character this redisplay cycle.
+     Used below to suppress overlay completion announcements: when the
+     user types, character echo (via postTextChangedNotification) must
+     take priority over overlay candidate updates.  Without this guard,
+     Vertico/Ivy updates its overlay immediately after each keystroke,
+     and the High-priority overlay announcement interrupts the character
+     echo, effectively silencing typed characters.  */
+  BOOL didTextChange = NO;
+   if (modiff != self.cachedModiff)
+     {
+       self.cachedModiff = modiff;
+@@ -9438,6 +9613,7 @@ Text property changes (e.g. face updates from
+ 	{
+ 	  self.cachedCharsModiff = chars_modiff;
+ 	  [self postTextChangedNotification:point];
+	  didTextChange = YES;
+ 	}
+     }
+ 
+@@ -9460,41 +9636,49 @@ frameworks like Vertico bump BOTH BUF_MODIFF (via text property
+ 	 displayed in the minibuffer.  In normal editing buffers,
+ 	 font-lock and other modes change BUF_OVERLAY_MODIFF on
+ 	 every redisplay, triggering O(overlays) work per keystroke.
+-	 Restrict the scan to minibuffer windows.  */
+-      if (MINI_WINDOW_P (w))
+	 Restrict the scan to minibuffer windows.
+	 Skip overlay announcements when the user just typed a character
+	 (didTextChange).  Completion frameworks update their overlay
+	 immediately after each keystroke; without this guard, the
+	 overlay High-priority announcement would interrupt the character
+	 echo produced by postTextChangedNotification, making typed
+	 characters inaudible.  VoiceOver should read the overlay
+	 candidate only when the user navigates (C-n/C-p), not types.  */
+      if (MINI_WINDOW_P (w) && !didTextChange)
+	{
+
+	  int selected_line = -1;
+	  NSString *candidate
+	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
+				       &selected_line);
+	  if (candidate)
+-	{
+	    {
+-	  int selected_line = -1;
+-	  NSString *candidate
+-	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
+-					   &selected_line);
+-	  if (candidate)
+	      /* Deduplicate: only announce when the candidate changed.  */
+	      if (![candidate isEqualToString:
+			        self.cachedCompletionAnnouncement])
+-	    {
+		{
+-	      /* Deduplicate: only announce when the candidate changed.  */
+-	      if (![candidate isEqualToString:
+-			        self.cachedCompletionAnnouncement])
+-		{
+-		  self.cachedCompletionAnnouncement = candidate;
+-
+-		  /* Announce the candidate text directly via NSApp.
+-		     Do NOT post SelectedTextChanged --- that would cause
+-		     VoiceOver to read the AX text at the cursor position
+-		     (the minibuffer input line), not the overlay candidate.
+-		     AnnouncementRequested with High priority interrupts
+-		     any current speech and announces our text.  */
+-		  NSDictionary *annInfo = @{
+-		    NSAccessibilityAnnouncementKey: candidate,
+-		    NSAccessibilityPriorityKey:
+-		      @(NSAccessibilityPriorityHigh)
+-		  };
+-		  ns_ax_post_notification_with_info (
+-		    NSApp,
+-		    NSAccessibilityAnnouncementRequestedNotification,
+-		    annInfo);
+-		}
+		  self.cachedCompletionAnnouncement = candidate;
+
+		  /* Announce the candidate text directly via NSApp.
+		     Do NOT post SelectedTextChanged --- that would cause
+		     VoiceOver to read the AX text at the cursor position
+		     (the minibuffer input line), not the overlay candidate.
+		     AnnouncementRequested with High priority interrupts
+		     any current speech and announces our text.  */
+		  NSDictionary *annInfo = @{
+		    NSAccessibilityAnnouncementKey: candidate,
+		    NSAccessibilityPriorityKey:
+		      @(NSAccessibilityPriorityHigh)
+		  };
+		  ns_ax_post_notification_with_info (
+		    NSApp,
+		    NSAccessibilityAnnouncementRequestedNotification,
+		    annInfo);
+-	    }
+		}
+-	}
+	    }
+	}
+     }
+ 
+   /* --- Cursor moved or selection changed ---
+      Independent check from the overlay branch above.  */
+   if (point != self.cachedPoint || markActive != self.cachedMarkActive)
+@@ -9504,7 +9688,18 @@ frameworks like Vertico bump BOTH BUF_MODIFF (via text property
+       self.cachedPoint = point;
+       self.cachedMarkActive = markActive;
+ 
+-      /* Compute direction.  */
+      /* Compute direction.
+	 When VoiceOver moved the cursor via setAccessibilitySelectedTextRange:
+	 (voiceoverSetPoint == YES), use sequential next/previous so VoiceOver
+	 continues smooth navigation from its current position.
+	 When Emacs moved the cursor independently (voiceoverSetPoint == NO),
+	 force discontiguous direction so VoiceOver re-anchors its browse
+	 cursor to accessibilitySelectedTextRange; without this, VoiceOver's
+	 internal browse position diverges from the Emacs insertion point and
+	 subsequent VO+arrow navigation starts from the wrong location.  */
+      BOOL emacsMovedCursor = !voiceoverSetPoint;
+      voiceoverSetPoint = NO;   /* Consume the flag.  */
+
+       NSInteger direction = ns_ax_text_selection_direction_discontiguous;
+       if (point > oldPoint)
+ 	direction = ns_ax_text_selection_direction_next;
+@@ -9523,6 +9718,7 @@ granularity hint (defaulting to unknown), which causes VoiceOver
+ 	 to make its own determination.  Fresh text is always available
+ 	 to VoiceOver via the AX getter path (accessibilityValue etc.).  */
+       NSInteger granularity = ns_ax_text_selection_granularity_unknown;
+      BOOL singleLineMove = NO;
+       if (cachedText && oldPoint > 0)
+ 	{
+ 	  NSUInteger tlen = [cachedText length];
+@@ -9536,7 +9732,18 @@ to VoiceOver via the AX getter path (accessibilityValue etc.).  */
+ 	  NSRange newLine = [cachedText lineRangeForRange:
+ 				  NSMakeRange (newIdx, 0)];
+ 	  if (oldLine.location != newLine.location)
+-	    granularity = ns_ax_text_selection_granularity_line;
+	    {
+	      granularity = ns_ax_text_selection_granularity_line;
+	      /* Detect single adjacent-line move while oldLine/newLine
+		 are in scope.  Any command that steps exactly one line ---
+		 C-n/C-p, evil j/k, outline-next-heading, etc. --- is
+		 sequential.  Multi-line teleports (]], M-<, xref, ...) are
+		 not adjacent and will be marked discontiguous below.
+		 Detected structurally: no package-specific code needed.  */
+	      BOOL adjFwd = (newLine.location == NSMaxRange (oldLine));
+	      BOOL adjBwd = (NSMaxRange (newLine) == oldLine.location);
+	      singleLineMove = adjFwd || adjBwd;
+	    }
+ 	  else
+ 	    {
+ 	      NSUInteger dist = (newIdx > oldIdx
+@@ -9558,38 +9765,23 @@ to VoiceOver via the AX getter path (accessibilityValue etc.).  */
+ 	  granularity = ns_ax_text_selection_granularity_line;
+ 	}
+ 
+-      /* Treat all moves as Emacs-initiated until voiceoverSetPoint
+-	 tracking is introduced (subsequent patch).  */
+-      BOOL emacsMovedCursor = YES;
+-
+-      /* Programmatic jumps that cross a line boundary (]], [[, M-<,
+-	 xref, imenu, …) are discontiguous: the cursor teleported to an
+-	 arbitrary position, not one sequential step forward/backward.
+-	 Reporting AXTextSelectionDirectionDiscontiguous causes VoiceOver
+-	 to re-anchor its rotor browse cursor at the new
+-	 accessibilitySelectedTextRange rather than advancing linearly
+-	 from its previous internal position.  */
+-      if (!isCtrlNP && granularity == ns_ax_text_selection_granularity_line)
+
+      /* Multi-line teleports are discontiguous; single adjacent-line
+	 steps stay sequential.  */
+      if (!isCtrlNP && !singleLineMove
+	  && granularity == ns_ax_text_selection_granularity_line)
+ 	direction = ns_ax_text_selection_direction_discontiguous;
+ 
+-      /* If Emacs moved the cursor (not VoiceOver), force discontiguous
+-	 so VoiceOver re-anchors its browse cursor to the current
+-	 accessibilitySelectedTextRange.  This covers all Emacs-initiated
+-	 moves: editing commands, ELisp, isearch, etc.
+-	 Exception: C-n/C-p (isCtrlNP) already uses next/previous with
+-	 line granularity; those are already sequential and VoiceOver
+-	 handles them correctly.  */
+-      if (emacsMovedCursor && !isCtrlNP)
+      /* Emacs-initiated teleports need re-anchor; sequential steps
+	 (C-n/C-p or any adjacent-line command) do not.  */
+      if (emacsMovedCursor && !isCtrlNP && !singleLineMove)
+ 	direction = ns_ax_text_selection_direction_discontiguous;
+ 
+-      /* Re-anchor VoiceOver's browse cursor for discontiguous (teleport)
+-	 moves only.  For sequential C-n/C-p (isCtrlNP), posting
+-	 FocusedUIElementChanged on the window races with the
+-	 AXSelectedTextChanged(granularity=line) notification and
+-	 causes VoiceOver to drop the line-read speech.  Sequential
+-	 moves are already handled correctly by AXSelectedTextChanged
+-	 with direction=next/previous + granularity=line.  */
+-      if (emacsMovedCursor && !isCtrlNP && [self isAccessibilityFocused])
+      /* FocusedUIElementChanged only for teleports: posting it for
+	 sequential moves races with AXSelectedTextChanged(granularity=line)
+	 and causes VoiceOver to drop the line-read speech.  */
+      if (emacsMovedCursor && !isCtrlNP && !singleLineMove
+	  && [self isAccessibilityFocused])
+ 	{
+ 	  NSWindow *win = [self.emacsView window];
+ 	  if (win)
+@@ -9748,6 +9940,13 @@ - (NSRect)accessibilityFrame
+   if (vis_start >= vis_end)
+     return @[];
+ 
+  /* block_input for the duration of the scan: the Lisp calls below
+     (Ftext_properties_at, Fplist_get, Foverlays_in, Foverlay_get,
+     Fnext_single_property_change, Fbuffer_substring_no_properties)
+     must not be interleaved with timer events or process sentinels
+     that could modify buffer state (e.g. invalidate vis_end).
+     record_unwind_protect_void guarantees unblock_input even if
+     a Lisp call signals.  */
+   block_input ();
+   specpdl_ref blk_count = SPECPDL_INDEX ();
+   record_unwind_protect_void (unblock_input);
+@@ -10056,6 +10255,9 @@ - (void)dealloc
+ #endif
+ 
+   [accessibilityElements release];
+#ifdef NS_IMPL_COCOA
+  [childFrameLastCandidate release];
+#endif
+   [[self menu] release];
+   [super dealloc];
+ }
+@@ -11505,6 +11708,9 @@ - (instancetype) initFrameFromEmacs: (struct frame *)f
+ 
+   windowClosing = NO;
+   processingCompose = NO;
+#ifdef NS_IMPL_COCOA
+  childFrameLastBuffer = Qnil;
+#endif
+   scrollbarsNeedingUpdate = 0;
+   fs_state = FULLSCREEN_NONE;
+   fs_before_fs = next_maximized = -1;
+@@ -12813,6 +13019,158 @@ - (id)accessibilityFocusedUIElement
    The existing elements carry cached state (modiff, point) from the
    previous redisplay cycle.  Rebuilding first would create fresh
    elements with current values, making change detection impossible.  */
 +
+/* Announce new echo area messages to VoiceOver.
+
+   This is called at the top of postAccessibilityUpdates, before any
+   tree rebuild.  Keeping it here, rather than in the per-element loop
+   in postAccessibilityNotificationsForFrame, guarantees that echo area
+   messages (including "Quit" from C-g) are announced even when the
+   accessibility element tree is in the process of being rebuilt.
+
+   The guard minibuf_level == 0 ensures we only announce passive status
+   messages.  While the user is actively typing (minibuf_level > 0),
+   character echo and completion announcements take precedence.
+
+   Reads echo_area_buffer[0] directly because with_echo_area_buffer()
+   sets current_buffer via set_buffer_internal_1() but does NOT call
+   Fset_window_buffer(), so the minibuffer window's contents pointer
+   still points to the inactive " *Minibuf-0*" buffer.
+   echo_area_buffer[] is maintained by setup_echo_area_for_printing()
+   and clear_message() in xdisp.c; its lifetime is the process lifetime
+   and it is valid whenever BUFFERP (echo_area_buffer[0]) is true.  */
+- (void)postEchoAreaAnnouncementIfNeeded
+{
+  if (minibuf_level != 0)
+    return;
+  Lisp_Object ea = echo_area_buffer[0];
+  if (!BUFFERP (ea))
+    return;
+  struct buffer *eb = XBUFFER (ea);
+  if (!BUFFER_LIVE_P (eb))
+    return;
+  ptrdiff_t echo_chars = BUF_CHARS_MODIFF (eb);
+  if (echo_chars == lastEchoCharsModiff || BUF_ZV (eb) <= BUF_BEGV (eb))
+    return;
+  lastEchoCharsModiff = echo_chars;
+  /* Use specpdl to restore current_buffer if Fbuffer_string signals.
+     set_buffer_internal_1 is preferred over set_buffer_internal in
+     a redisplay context: it skips point-motion hooks that could
+     trigger further redisplay or modify buffer state unexpectedly.  */
+  block_input ();
+  specpdl_ref count = SPECPDL_INDEX ();
+  record_unwind_protect_void (unblock_input);
+  record_unwind_current_buffer ();
+  set_buffer_internal_1 (eb);
+  Lisp_Object ls = Fbuffer_string ();
+  unbind_to (count, Qnil);
+  /* stringWithLispString: converts Emacs's internal multibyte encoding
+     to NSString correctly; a raw SSDATA cast would produce invalid
+     UTF-8 for non-ASCII characters.  */
+  NSString *raw = [NSString stringWithLispString: ls];
+  NSString *msg = [raw stringByTrimmingCharactersInSet:
+    [NSCharacterSet whitespaceAndNewlineCharacterSet]];
+  if ([msg length] == 0)
+    return;
+  NSDictionary *info = @{
+    NSAccessibilityAnnouncementKey: msg,
+    NSAccessibilityPriorityKey: @(NSAccessibilityPriorityHigh)
+  };
+  ns_ax_post_notification_with_info (
+    NSApp, NSAccessibilityAnnouncementRequestedNotification, info);
+}
+
 +/* Announce the selected candidate in a child frame completion popup.
 +   Handles Corfu, Company-box, and similar frameworks that render
 +   candidates in a separate child frame rather than as overlay strings
-+   in the minibuffer.  Uses direct UAZoomChangeFocus (not the
-+   overlayZoomRect flag) because the child frame's ns_update_end runs
-+   after the parent's draw_window_cursor.  */
+   in the minibuffer.  */
 +- (void)announceChildFrameCompletion
 +{
-+  static char *lastCandidate;
-+  static struct buffer *lastBuffer;
-+  static EMACS_INT lastModiff;
 +
 +  /* Validate frame state --- child frames may be partially
 +     initialized during creation.  */
@@ -211,11 +765,24 @@ index ebd52c6..a7025a9 100644
 +     This prevents redundant work on every redisplay tick and
 +     also guards against re-entrance: if Lisp calls below
 +     trigger redisplay, the modiff check short-circuits.  */
-+  EMACS_INT modiff = BUF_MODIFF (b);
-+  if (b == lastBuffer && modiff == lastModiff)
+  if (!BUFFER_LIVE_P (b))
 +    return;
-+  lastBuffer = b;
-+  lastModiff = modiff;
+  EMACS_INT modiff = BUF_MODIFF (b);
+  /* Compare buffer identity via the buffer name symbol.  Interned
+     symbols (obarray) are GC-reachable without staticpro(), avoiding
+     a direct struct buffer pointer in a non-GC-visible ObjC ivar.
+     Caveat: if the buffer is renamed (rename-buffer), the stored
+     symbol no longer matches the new name and the equality check
+     returns nil, causing one redundant re-scan.  This is harmless ---
+     completion popups (Corfu, Company) are never renamed during a
+     completion session.  Using a sequence number would avoid the
+     rename edge case but would require another ivar; the name symbol
+     is a pragmatic, GC-safe approximation.  */
+  if (EQ (childFrameLastBuffer, BVAR (b, name))
+      && modiff == childFrameLastModiff)
+    return;
+  childFrameLastBuffer = BVAR (b, name);
+  childFrameLastModiff = modiff;
 +
 +  /* Skip buffers larger than a typical completion popup.
 +     This avoids scanning eldoc, which-key, or other child
@@ -224,18 +791,26 @@ index ebd52c6..a7025a9 100644
 +    return;
 +
 +  int selected_line = -1;
+  /* block_input prevents timer events and process output from
+     interleaving with the Lisp calls inside
+     ns_ax_selected_child_frame_text (Fbuffer_substring_no_properties,
+     Fget_char_property, etc.).  record_unwind_protect_void ensures
+     unblock_input is called even if a Lisp call signals.  */
+  block_input ();
+  specpdl_ref blk_count = SPECPDL_INDEX ();
+  record_unwind_protect_void (unblock_input);
 +  NSString *candidate
 +    = ns_ax_selected_child_frame_text (b, w->contents, &selected_line);
+  unbind_to (blk_count, Qnil);
 +
 +  if (!candidate)
 +    return;
 +
 +  /* Deduplicate --- avoid re-announcing the same candidate.  */
-+  const char *cstr = [candidate UTF8String];
-+  if (lastCandidate && strcmp (cstr, lastCandidate) == 0)
+  if ([candidate isEqualToString:childFrameLastCandidate])
 +    return;
-+  xfree (lastCandidate);
-+  lastCandidate = xstrdup (cstr);
+  [childFrameLastCandidate release];
+  childFrameLastCandidate = [candidate copy];
 +
 +  NSDictionary *annInfo = @{
 +    NSAccessibilityAnnouncementKey: candidate,
@@ -259,35 +834,12 @@ index ebd52c6..a7025a9 100644
 +	parentView->childFrameCompletionActive = YES;
 +    }
 +
-+  /* Zoom tracking: focus on the selected row in the child frame.
-+     Use direct UAZoomChangeFocus rather than overlayZoomRect because
-+     the child frame renders independently of the parent.  */
-+  if (selected_line >= 0 && UAZoomEnabled ())
-+    {
-+      int line_h = FRAME_LINE_HEIGHT (emacsframe);
-+      int y_off = selected_line * line_h;
-+      NSRect r = NSMakeRect (
-+	WINDOW_TEXT_TO_FRAME_PIXEL_X (w, 0),
-+	WINDOW_TO_FRAME_PIXEL_Y (w, y_off),
-+	FRAME_COLUMN_WIDTH (emacsframe),
-+	line_h);
-+      NSRect winRect = [self convertRect:r toView:nil];
-+      NSRect screenRect
-+	= [[self window] convertRectToScreen:winRect];
-+      CGRect cgRect = NSRectToCGRect (screenRect);
-+      CGFloat primaryH
-+	= [[[NSScreen screens] firstObject] frame].size.height;
-+      cgRect.origin.y
-+	= primaryH - cgRect.origin.y - cgRect.size.height;
-+      UAZoomChangeFocus (&cgRect, &cgRect,
-+			 kUAZoomFocusTypeInsertionPoint);
-+    }
 +}
 +
 - (void)postAccessibilityUpdates
 {
   NSTRACE ("[EmacsView postAccessibilityUpdates]");
-@@ -12598,11 +12801,59 @@ ns_ax_collect_windows (Lisp_Object window, EmacsView *view,
+@@ -12823,14 +13182,71 @@ - (void)postAccessibilityUpdates
 
   /* Re-entrance guard: VoiceOver callbacks during notification posting
      can trigger redisplay, which calls ns_update_end, which calls us
@@ -299,6 +851,11 @@ index ebd52c6..a7025a9 100644
     return;
   accessibilityUpdating = YES;
 
+  /* Announce echo area messages (e.g. "Quit", "Wrote file") before
+     any tree-rebuild check.  This must run even when the element tree
+     is being rebuilt to avoid missing time-sensitive status messages.  */
+  [self postEchoAreaAnnouncementIfNeeded];
+
 +  /* Child frame completion popup (Corfu, Company-box, etc.).
 +     Child frames don't participate in the accessibility tree;
 +     announce the selected candidate directly.  */
@@ -317,6 +874,10 @@ index ebd52c6..a7025a9 100644
 +    {
 +      Lisp_Object tail, frame;
 +      BOOL childStillVisible = NO;
+      /* block_input protects the FOR_EACH_FRAME iteration: the
+	 frame list (Vframe_list) is a Lisp_Object chain and must not
+	 be modified by a timer or process sentinel mid-iteration.  */
+      block_input ();
 +      FOR_EACH_FRAME (tail, frame)
 +	if (FRAME_PARENT_FRAME (XFRAME (frame)) == emacsframe
 +	    && FRAME_VISIBLE_P (XFRAME (frame)))
@@ -324,6 +885,7 @@ index ebd52c6..a7025a9 100644
 +	    childStillVisible = YES;
 +	    break;
 +	  }
+      unblock_input ();
 +
 +      if (!childStillVisible)
 +	{
--- a/patches/README.txt
+++ b/patches/README.txt
@@ -1,15 +1,49 @@
-EMACS NS VOICEOVER ACCESSIBILITY PATCH
-========================================
-patch: 0001-0008 (8 patches, see PATCH SERIES below)
+EMACS NS ACCESSIBILITY PATCHES
+================================
 author: Martin Sukany <martin@sukany.cz>
-files: src/nsterm.h (+124 lines)
-        src/nsterm.m (+3577 ins, -185 del, +3392 net)
-        doc/emacs/macos.texi (+53 lines)
-        etc/NEWS (+13 lines)
+
+This directory contains two independent patch sets for the Emacs NS
+(Cocoa) port:
+
+  A. Standalone Zoom patch (0000)
+  B. VoiceOver accessibility patch series (0001-0008)
+
+Each can be applied independently.  They do not depend on each other.


-PATCH SERIES
------------
+PATCH A: ZOOM CURSOR TRACKING (0000)
+-------------------------------------
+
+  0000 ns: integrate with macOS Zoom for cursor tracking
+
+A minimal patch that informs macOS Zoom of the text cursor position
+after every physical cursor redraw.  When Zoom is enabled (System
+Settings -> Accessibility -> Zoom -> Follow keyboard focus), the
+zoomed viewport automatically tracks the Emacs insertion point.
+
+Files modified:
+  src/nsterm.h  (+4 lines: lastZoomCursorRect ivar)
+  src/nsterm.m  (+66 lines: cursor store + UAZoomChangeFocus)
+  etc/NEWS      (+8 lines)
+
+Implementation:
+  ns_draw_window_cursor stores the cursor rect in
+  view->lastZoomCursorRect and calls UAZoomChangeFocus() with
+  CG-space coordinates.  A fallback call in ns_update_end ensures
+  Zoom tracks the cursor even after window switches (C-x o) where
+  the physical cursor may not be redrawn.
+
+  Coordinate conversion: EmacsView pixels (AppKit, flipped) ->
+  NSWindow -> NSScreen -> CGRect with y-flip for CoreGraphics
+  top-left origin.
+
+  No user option is needed: UAZoomEnabled() returns false when Zoom
+  is not active, so the overhead is a single function call per
+  redisplay cycle.
+
+
+PATCH B: VOICEOVER ACCESSIBILITY (0001-0008)
+----------------------------------------------

  0001 ns: add accessibility base classes and text extraction
  0002 ns: implement buffer accessibility element (core protocol)
@@ -19,776 +53,77 @@ PATCH SERIES
  0006 doc: add VoiceOver accessibility section to macOS appendix
  0007 ns: announce overlay completion candidates for VoiceOver
  0008 ns: announce child frame completion candidates for VoiceOver
-  0009  Performance: precomputed line index for O(log L) line queries

+Files modified:
+  src/nsterm.h       (~120 lines: class declarations, ivars)
+  src/nsterm.m       (~3400 lines: implementation)
+  doc/emacs/macos.texi  (~50 lines: documentation)
+  etc/NEWS           (~8 lines)

-OVERVIEW
--------
-
-  This patch adds comprehensive macOS VoiceOver accessibility support
-  to the Emacs NS (Cocoa) port.  Before this patch, Emacs exposed only
-  a minimal, largely broken accessibility interface to macOS assistive
-  technology (AT) clients: EmacsView identified itself as a generic
-  NSAccessibilityGroup with no text content, no cursor tracking, and
-  no notifications.  VoiceOver users could activate the application
-  but received no meaningful speech feedback when editing text.
-
-  The patch introduces a layered virtual element tree above EmacsView.
-  Each visible Emacs window is represented by an EmacsAccessibilityBuffer
-  element (AXTextArea / AXTextField for minibuffer) with a full text
-  cache, a visible-run mapping table that bridges buffer character
-  positions to UTF-16 accessibility string indices, and an interactive
-  span child array for Tab navigation.  A companion
-  EmacsAccessibilityModeLine element (AXStaticText) represents the mode
-  line of each window.  These virtual elements are wired into the macOS
-  Accessibility API through EmacsView acting as the AXGroup root.
-
-  Two additional integration points are provided: (1) macOS Zoom is
-  informed of the cursor position after every physical cursor redraw via
-  UAZoomChangeFocus(), using the correct CoreGraphics (top-left-origin)
-  coordinate space; (2) EmacsView implements accessibilityBoundsForRange:
-  and its legacy parameterized-attribute equivalent so that both Zoom
-  and third-party AT tools can locate the insertion point.  The patch
-  also covers completion announcements for the *Completions* buffer and
-  Tab-navigable interactive spans for buttons, links, checkboxes,
-  Org-mode links, completion candidates, and keymap overlays.
+This patch series adds comprehensive VoiceOver accessibility support
+to the NS port.  Before this patch, Emacs exposed only a minimal,
+largely broken accessibility interface: EmacsView identified itself
+as a generic NSAccessibilityGroup with no text content, no cursor
+tracking, and no notifications.


 ARCHITECTURE
 ------------

-  Class hierarchy (Cocoa only):
+  Virtual element tree above EmacsView:

-    NSAccessibilityElement
-      |
-      +-- EmacsAccessibilityElement     (base: owns emacsView + lispWindow)
-            |
-            +-- EmacsAccessibilityBuffer     (AXTextArea; one per leaf window)
-            |     [category InteractiveSpans] (Tab nav children)
-            |
-            +-- EmacsAccessibilityModeLine   (AXStaticText; one per non-mini)
-            |
-            +-- EmacsAccessibilityInteractiveSpan  (AXButton/Link/etc.)
+    EmacsAccessibilityElement (base)
+      +-- EmacsAccessibilityBuffer     (AXTextArea; one per window)
+      +-- EmacsAccessibilityModeLine   (AXStaticText; mode line)
+      +-- EmacsAccessibilityInteractiveSpan  (AXButton/Link; Tab nav)

-    EmacsView  (NSView subclass, existing)
-      |
-      +-- owns NSMutableArray *accessibilityElements
-            contains EmacsAccessibilityBuffer + EmacsAccessibilityModeLine
-            instances for every visible leaf window and minibuffer.
-            EmacsAccessibilityInteractiveSpan instances are children of
-            their parent EmacsAccessibilityBuffer, NOT of this array.
+  Each buffer element maintains a text cache with visible-run mapping
+  (O(log n) index lookup) and a precomputed line index (O(log L) line
+  queries).  Notifications are posted asynchronously via dispatch_async
+  to prevent VoiceOver deadlocks.

-  EmacsAccessibilityElement (base class)
-    - Stores a weak (unsafe_unretained) pointer to EmacsView and a
-      Lisp_Object lispWindow (GC-safe window reference).
-    - Provides -validWindow which verifies WINDOW_LIVE_P before
-      returning the raw struct window *.  All subclasses use this to
-      avoid dangling pointers after delete-window or kill-buffer.
-    - Provides -screenRectFromEmacsX:y:width:height: which converts
-      EmacsView pixel coordinates (flipped AppKit space) to screen
-      coordinates via the NSWindow coordinate chain.
-
-  EmacsAccessibilityBuffer
-    - Implements the full NSAccessibility text protocol: value, selected
-      text range, line/index/range conversions, frame-for-range,
-      range-for-position, and insertion-point-line-number.
-    - Maintains a text cache (cachedText / visibleRuns) keyed on
-      BUF_MODIFF and BUF_BEGV (narrowing).  BUF_OVERLAY_MODIFF is
-      tracked separately for notification dispatch (patch 0007)
-      but not for cache invalidation.
-      The cache is the single source of truth for all
-      index-to-charpos and charpos-to-index mappings.
-    - Detects buffer edits (modiff change), cursor movement (point
-      change), and mark changes, and posts the appropriate
-      NSAccessibility notifications after each redisplay cycle.
-    - Stores cached values for the previous cycle (cachedModiff,
-      cachedPoint, cachedMarkActive) to enable change detection.
-
-  EmacsAccessibilityModeLine
-    - Reads mode line text directly from the window's current glyph
-      matrix (CHAR_GLYPH rows with mode_line_p set).
-    - Stateless: no cache; text is read fresh on every AX query.
-
-  EmacsAccessibilityInteractiveSpan
-    - Lightweight child element representing one contiguous interactive
-      region (button, link, completion item, etc.).
-    - Reports isAccessibilityFocused by comparing cachedPoint of the
-      parent EmacsAccessibilityBuffer against its charpos range.
-    - On setAccessibilityFocused: dispatches to the main queue via
-      GCD to move Emacs point, using block_input around SET_PT_BOTH.
-
-  EmacsView (extensions)
-    - accessibilityElements array: rebuilt by -rebuildAccessibilityTree
-      when the window tree changes (split, delete, new buffer).
-    - -postAccessibilityUpdates: called from ns_update_end() after
-      every redisplay cycle; drives the notification dispatch loop.
-    - lastAccessibilityCursorRect: updated by ns_draw_phys_cursor
-      (C function) for Zoom integration.
-    - Implements accessibilityBoundsForRange: /
-      accessibilityFrameForRange: and the legacy
-      accessibilityAttributeValue:forParameter: API.
+  Full details in the commit messages of each patch.


-USER OPTION
+PERFORMANCE
 -----------

  ns-accessibility-enabled (DEFVAR_BOOL, default t):
-    When nil, the accessibility virtual element tree is not built, no
-    notifications are posted, and ns_draw_phys_cursor skips the Zoom
-    update.  This eliminates accessibility overhead entirely on systems
-    where assistive technology is not in use.  Guarded at three entry
-    points: postAccessibilityUpdates, ns_draw_phys_cursor, and
-    windowDidBecomeKey.
+    When nil, no virtual elements are built, no notifications are
+    posted, and ns_draw_window_cursor skips the cursor rect store.
+    Zero overhead for users who do not use assistive technology.
+
+  When enabled:
+    - Text cache rebuilds only on BUF_MODIFF change (not per-keystroke)
+    - Index lookups are O(log n) via binary search on visible runs
+    - Line queries are O(log L) via precomputed lineStartOffsets
+    - Interactive span scan runs only when dirty flag is set
+    - No character cap: full buffer exposed, but cache is lazy


 THREADING MODEL
 ---------------

-  Emacs runs all Lisp evaluation and buffer mutation on the main thread
-  (the Cocoa/AppKit main thread).  The macOS Accessibility server
-  (axserver / AT daemon) calls AX getters from a private background
-  thread.
-
-  Rules enforced by this patch:
-
-    Main thread only:
-      - ns_update_end -> postAccessibilityUpdates
-      - rebuildAccessibilityTree / invalidateAccessibilityTree
-      - ensureTextCache / ns_ax_buffer_text (Lisp calls:
-        Fget_char_property, Fnext_single_char_property_change,
-        Fbuffer_substring_no_properties)
-      - postAccessibilityNotificationsForFrame: (full notify logic)
-      - setAccessibilitySelectedTextRange: (SET_PT_BOTH, marker moves)
-      - setAccessibilityFocused: on EmacsAccessibilityInteractiveSpan
-        (dispatches to main queue via dispatch_async; uses specpdl
-         unwind protection so block_input is always matched by
-         unblock_input even if Fselect_window signals an error)
-      - ns_draw_phys_cursor partial update (lastAccessibilityCursorRect,
-        UAZoomChangeFocus)
-
-    Safe from any thread (no Lisp calls, no mutable Emacs state):
-      - accessibilityIndexForCharpos: reads visibleRuns + cachedText
-      - charposForAccessibilityIndex: same
-      - isAccessibilityFocused on EmacsAccessibilityInteractiveSpan
-        (reads cachedPoint, a plain ptrdiff_t)
-
-    Dispatch-gated (marshalled to main thread when called off-thread):
-      - accessibilityValue (EmacsAccessibilityBuffer)
-      - accessibilitySelectedTextRange
-      - accessibilityInsertionPointLineNumber
-      - accessibilityFrameForRange:
-      - accessibilityRangeForPosition:
-      - accessibilityChildrenInNavigationOrder
-
-  The marshalling pattern used throughout:
-
-      if (![NSThread isMainThread]) {
-          __block T result;
-          dispatch_sync(dispatch_get_main_queue(), ^{ result = ...; });
-          return result;
-      }
-
-  Async notification posting (deadlock prevention):
-
-    NSAccessibilityPostNotification may synchronously invoke VoiceOver
-    callbacks from a private AX server thread.  Those callbacks call
-    AX getters which dispatch_sync back to the main queue.  If the
-    main thread is still inside the notification-posting method (e.g.,
-    postAccessibilityUpdates called from ns_update_end), the
-    dispatch_sync deadlocks: the main thread waits for VoiceOver to
-    finish processing the notification, while VoiceOver's thread waits
-    for the main queue to become available.
-
-    To break this cycle, all notification posting goes through two
-    static inline wrappers:
-
-      ns_ax_post_notification(element, name)
-      ns_ax_post_notification_with_info(element, name, info)
-
-    These wrappers defer the actual NSAccessibilityPostNotification
-    call via dispatch_async(dispatch_get_main_queue(), ^{ ... }).
-    The current method returns first, freeing the main queue, so
-    VoiceOver's dispatch_sync calls can proceed without deadlock.
-    Block captures retain ObjC objects (element, info dictionary)
-    for the lifetime of the deferred block.
-
-  Cached data written on main thread and read from any thread:
-    - cachedText (NSString *): written by ensureTextCache on main.
-    - visibleRuns (ns_ax_visible_run *): written by ensureTextCache.
-    - cachedPoint (ptrdiff_t): plain scalar; atomic on 64-bit ARM/x86.
-  No explicit lock is used; the design relies on the fact that index
-  mapping methods make no Lisp calls and read only the above scalars
-  and the immutable NSString object.
-
-
-NOTIFICATION STRATEGY
---------------------
-
-  All notifications are posted asynchronously via
-  ns_ax_post_notification / ns_ax_post_notification_with_info
-  (dispatch_async wrappers -- see THREADING MODEL for rationale).
-
-  Notifications are generated by -postAccessibilityNotificationsForFrame:
-  which runs on the main thread after every redisplay cycle.  The
-  method detects three mutually exclusive events:
-
-  1. TEXT CHANGED (modiff != cachedModiff)
-     Posts NSAccessibilityValueChangedNotification with AXTextEditType
-     = Typing and, when exactly one character was inserted, provides
-     AXTextChangeValue for echo feedback.  cachedPoint is updated here
-     to suppress a spurious selection-move event in the same cycle
-     (WebKit/Chromium convention: edit and selection-move are mutually
-     exclusive per runloop iteration).
-
-  2. CURSOR MOVED OR MARK CHANGED (point != cachedPoint OR mark change)
-     Granularity is computed by comparing oldIdx and newIdx in
-     cachedText:
-       - different line range  ->  LINE granularity
-       - same line, distance > 1 UTF-16 unit  ->  WORD granularity
-       - same line, distance == 1 UTF-16 unit  ->  CHARACTER granularity
-     C-n / C-p / Tab / backtab force LINE granularity
-     (detected by ns_ax_event_is_line_nav_key which inspects
-      last_command_event) regardless.
-
-     For FOCUSED elements the hybrid strategy applies:
-
-       CHARACTER moves:
-         SelectedTextChanged is posted WITHOUT AXTextSelectionGranularity
-         in userInfo.  Omitting the key prevents VoiceOver from deriving
-         its own speech (it would read the character BEFORE point,
-         which is wrong for evil block-cursor mode where the cursor
-         sits ON the character).  Then AnnouncementRequested is posted
-         separately with the character AT point as the announcement.
-         Newline is skipped (VoiceOver handles end-of-line internally).
-
-       WORD and LINE moves:
-         SelectedTextChanged is posted WITH AXTextSelectionGranularity.
-         VoiceOver reads the word/line correctly from the element text
-         using the granularity hint.  For LINE moves an additional
-         AnnouncementRequested is also posted with the line text (or
-         the completion--string at point if in a completion buffer) to
-         handle C-n/C-p -- VoiceOver processes these keystrokes
-         differently from arrow keys internally.
-
-       SELECTION changes (mark becomes active or extends):
-         SelectedTextChanged with LINE or WORD granularity.  VoiceOver
-         reads the newly selected or deselected text.
-
-     For NON-FOCUSED elements (e.g. *Completions* while minibuffer has
-     focus): AnnouncementRequested only.  See COMPLETION ANNOUNCEMENTS.
-
-  3. NO CHANGE
-     Nothing is posted.  Completion cache is cleared for focused buffer.
-
-
-TEXT CACHE AND VISIBLE RUNS
----------------------------
-
-  ns_ax_buffer_text(w, out_start, out_runs, out_nruns) builds the
-  accessibility string for window W.  It operates on the current
-  buffer with set_buffer_internal_1, scanning from BUF_BEGV to BUF_ZV.
-
-  Invisible text detection uses TEXT_PROP_MEANS_INVISIBLE(invis) where
-  invis = Fget_char_property(pos, Qinvisible, Qnil).  This respects
-  buffer-invisibility-spec, correctly handling org-mode folding,
-  outline mode, and hideshow -- not just `invisible t' text properties.
-  When an invisible region is found, the scanner jumps ahead using
-  Fnext_single_char_property_change to skip the entire region in O(1)
-  iterations rather than character by character.
-
-  Text extraction uses Fbuffer_substring_no_properties (not raw
-  BUF_BYTE_ADDRESS) to handle the buffer gap correctly.  Raw byte
-  access across the gap position yields garbage bytes.
-
-  The ns_ax_visible_run structure:
-
-    typedef struct ns_ax_visible_run {
-        ptrdiff_t  charpos;    /* Buffer charpos of run start.          */
-        ptrdiff_t  length;     /* Emacs characters in this run.         */
-        NSUInteger ax_start;   /* UTF-16 index in accessibility string. */
-        NSUInteger ax_length;  /* UTF-16 units for this run.            */
-    } ns_ax_visible_run;
-
-  Multiple runs are produced when invisible text splits the buffer into
-  non-contiguous visible segments.  The mapping array is stored in the
-  EmacsAccessibilityBuffer ivar `visibleRuns' (C array, xmalloc'd).
-
-  Index mapping (charpos <-> ax_index) uses binary search over the
-  sorted run array — O(log n) per lookup.  Within a run, UTF-16 unit
-  counting uses
-  rangeOfComposedCharacterSequenceAtIndex: to handle surrogate pairs
-  (emoji, rare CJK) correctly -- one Emacs character may occupy 2
-  UTF-16 units.
-
-  Cache invalidation is triggered whenever BUF_MODIFF or
-  BUF_OVERLAY_MODIFF changes (ensureTextCache compares both
-  cachedTextModiff and cachedOverlayModiff).  Additionally,
-  narrowing/widening is detected by comparing cachedTextStart
-  against BUF_BEGV — these operations change the visible region
-  without bumping either modiff counter.  The cache is also
-  invalidated when the window tree is rebuilt.
-
-  There is no character cap on the accessibility text.  The entire
-  visible (non-invisible) buffer content is exposed to VoiceOver.
-  Users who do not need accessibility can set ns-accessibility-enabled
-  to nil for zero overhead.
-
-  A lineStartOffsets array is built during each cache rebuild,
-  recording the AX string index where each line begins.  This
-  makes accessibilityLineForIndex: and accessibilityRangeForLine:
-  O(log L) via binary search instead of O(L) linear scanning.
-  The index is freed and rebuilt alongside the text cache.
-
-
-COMPLETION ANNOUNCEMENTS
------------------------
-
-  When point moves in a non-focused buffer (the common case:
-  *Completions* window while the minibuffer retains keyboard focus),
-  VoiceOver does not automatically read the change because it is
-  tracking the focused element.  The patch posts AnnouncementRequested
-  with a 4-step fallback chain to find the best text to announce:
-
-    Step 1 -- completion--string property at point.
-      The `completion--string' text property (set by minibuffer.el
-      since Emacs 29) carries the canonical completion candidate string.
-      It can be a plain Lisp string or a list (CANDIDATE ANNOTATION) where both
-      are strings.
-      ns_ax_completion_string_from_prop handles both: plain string ->
-      use directly; cons -> use car (the candidate without annotation).
-      This is the preferred source: precisely the candidate text with
-      no surrounding whitespace.
-
-    Step 2 -- mouse-face span at point.
-      completion-list-mode marks the active candidate with mouse-face.
-      The code walks backward and forward from point to find the span
-      boundaries, then reads the corresponding slice of cachedText.
-      Used when completion--string is absent (older Emacs or non-
-      standard completion modes).
-
-    Step 3 -- completions-highlight overlay at point.
-      Emacs 29+ highlights the selected completion with the
-      `completions-highlight' face applied via an overlay.  The overlay
-      text is extracted via ns_ax_completion_text_for_span which itself
-      tries completion--string first, then the `completion' property,
-      then falls back to the ax string slice.
-
-    Step 4 -- nearest completions-highlight overlay.
-      ns_ax_find_completion_overlay_range scans the buffer for the
-      closest completions-highlight overlay to point.  Uses fast probes
-      at {point, point+1, point-1} before falling back to a full O(n)
-      scan.
-
-    Final fallback -- current line text.
-      Read the line containing point from cachedText.
-
-  Deduplication: the announcement is posted only when announceText,
-  overlay bounds, or point have changed since the last cycle
-  (cachedCompletionAnnouncement, cachedCompletionOverlayStart/End,
-  cachedCompletionPoint).
-
-
-INTERACTIVE SPANS
-----------------
-
-  ns_ax_scan_interactive_spans(w, parent_buf) scans the visible range
-  of window W looking for text properties that indicate interactive
-  content.  Properties are checked in priority order:
-
-    widget        -> EmacsAXSpanTypeWidget        (AXButton, via default)
-    button        -> EmacsAXSpanTypeButton        (AXButton, via default)
-    follow-link   -> EmacsAXSpanTypeLink          (AXLink)
-    org-link      -> EmacsAXSpanTypeLink          (AXLink)
-    mouse-face    -> EmacsAXSpanTypeCompletionItem
-                      (AXButton; completion-list-mode only)
-    keymap overlay-> EmacsAXSpanTypeButton        (AXButton)
-
-  For completion buffers (major-mode == completion-list-mode), the span
-  boundary for mouse-face regions uses completion--string as the property
-  key when present, rather than mouse-face itself.  This prevents two
-  column-adjacent completion candidates from being merged into one span
-  when their mouse-face regions share padding whitespace.
-
-  All property symbols are registered with DEFSYM in syms_of_nsterm
-  using ns_ax_ prefixed C variable names (e.g., Qns_ax_button for
-  "button") to avoid collisions with other Emacs source files.
-  Referenced directly -- no repeated intern() calls.
-
-  Each span is allocated, configured, added to the spans array, then
-  released (the array retains it).  The function returns an autoreleased
-  immutable copy of the spans array.  Label priority:
-  completion--string > buffer substring > help-echo.
-
-  Tab navigation: -accessibilityChildrenInNavigationOrder returns the
-  cached span array, rebuilt lazily when interactiveSpansDirty is set.
-  Calls from off-thread are marshalled with dispatch_sync.
-
-  Focus movement: -setAccessibilityFocused: on a span dispatches
-  Fselect_window + SET_PT_BOTH to the main queue via dispatch_async,
-  wrapped in block_input/unblock_input.
-
-
-ZOOM INTEGRATION
----------------
-
-  macOS Zoom (accessibility zoom) tracks a "focus element" to keep the
-  zoomed viewport centered on the relevant screen area.  Two mechanisms
-  are provided:
-
-  1. ns_draw_phys_cursor (C function, main thread, called during
-     redisplay).  After clipping the cursor rect to the text area,
-     stores the rect in view->lastAccessibilityCursorRect.  If
-     UAZoomEnabled(), converts the rect to screen coordinates and calls
-     UAZoomChangeFocus(kUAZoomFocusTypeInsertionPoint).
-
-     Coordinate conversion chain:
-       EmacsView pixels (AppKit, flipped, origin at top-left of view)
-         -[convertRect:toView:nil]-> NSWindow coordinates
-         -[convertRectToScreen:]-> NSScreen coordinates
-         NSRectToCGRect -> CGRect (same values, no transform)
-         CG y-flip: cgRect.origin.y = primaryH - y - height
-       The flip is required because CoreGraphics uses top-left origin
-       (primary screen) while AppKit screen rects use bottom-left.
-       primaryH = [[NSScreen screens] firstObject].frame.size.height.
-
-  2. EmacsView -accessibilityBoundsForRange: /
-     -accessibilityFrameForRange:
-     AT tools (including Zoom) call these with the selectedTextRange
-     to locate the insertion point.  The implementation first delegates
-     to the focused EmacsAccessibilityBuffer element for accurate
-     per-range geometry via its accessibilityFrameForRange: method.
-     If the buffer element returns an empty rect (no valid window or
-     glyph data), the fallback uses the cached cursor rect stored in
-     lastAccessibilityCursorRect (minimum size 1x8 pixels).  The legacy
-     parameterized-attribute API
-     (NSAccessibilityBoundsForRangeParameterizedAttribute) is supported
-     via -accessibilityAttributeValue:forParameter: for older AT
-     clients.
-
-
-KEY DESIGN DECISIONS
--------------------
-
-  1. DEFSYM instead of intern for all frequently-used symbols.
-     DEFSYM registers symbols at startup (syms_of_nsterm) and stores
-     them in C globals (e.g. Qns_ax_completion__string, Qns_ax_next_line).
-     This covers both property scanning symbols and line navigation
-     command symbols used in ns_ax_event_is_line_nav_key (hot path:
-     runs on every cursor movement).  Using intern() would perform
-     obarray lookups on each redisplay cycle.  DEFSYM symbols are
-     also always reachable by the GC via staticpro, eliminating any
-     risk of premature collection.
-
-  2. AnnouncementRequested for character moves, not SelectedTextChanged.
-     VoiceOver derives the speech character from SelectedTextChanged by
-     looking at the character BEFORE the new cursor position (the char
-     "passed over").  In evil-mode with a block cursor, the cursor sits
-     ON the character, not between characters.  AnnouncementRequested
-     with the character AT point produces correct speech in both insert
-     and normal (block-cursor) modes.  SelectedTextChanged is still
-     posted without granularity to interrupt ongoing VoiceOver reading
-     and update braille display tracking.
-
-  3. completion--string, not mouse-face, as span boundary.
-     mouse-face regions in completion-list-mode sometimes include
-     leading or trailing whitespace shared between column-adjacent
-     candidates, which could merge two candidates into one span.
-     completion--string changes precisely at candidate boundaries.
-
-  4. Probe order {point, point+1, point-1} for overlay search.
-     After Tab advances to a new completion candidate, point is at the
-     START of the new entry.  The previous entry's overlay covers the
-     position before the new start, so point-1 is inside the OLD
-     overlay.  Trying point+1 before point-1 finds the new (correct)
-     entry first.
-
-  5. Notifications posted BEFORE rebuilding the tree.
-     postAccessibilityUpdates uses existing elements which carry cached
-     state from the previous cycle.  Rebuilding first would create
-     fresh elements with current values, making change detection
-     impossible.  Tree rebuild is deferred to cycles where
-     accessibilityTreeValid is false; no notifications are posted in
-     that cycle.
-
-  6. Re-entrance guard (accessibilityUpdating flag).
-     VoiceOver callbacks triggered by notification posting can cause
-     Cocoa to re-enter the run loop, which may trigger redisplay, which
-     calls ns_update_end -> postAccessibilityUpdates.  The BOOL flag
-     breaks this recursion.
-
-  6a. Async notification posting (dispatch_async wrappers).
-     NSAccessibilityPostNotification can synchronously trigger
-     VoiceOver queries from a background AX server thread.  Those
-     queries dispatch_sync to the main queue.  If the main thread
-     is still inside postAccessibilityUpdates (or windowDidBecomeKey,
-     or setAccessibilityFocused:), the dispatch_sync deadlocks.
-     All 14 notification sites use ns_ax_post_notification / _with_info
-     wrappers that defer posting via dispatch_async, freeing the main
-     queue before VoiceOver's callbacks arrive.  This follows the same
-     pattern used by WebKit's AXObjectCacheMac (deferred posting via
-     performSelector:withObject:afterDelay:0).
-
-  7. lispWindow (Lisp_Object) instead of raw struct window *.
-     struct window pointers can become dangling after delete-window.
-     Storing the Lisp_Object and using WINDOW_LIVE_P + XWINDOW at the
-     call site is the standard safe pattern in Emacs C code.
-
-  8. accessibilityVisibleCharacterRange returns full buffer range.
-     VoiceOver treats the visible range boundary as end-of-text.  If
-     this returned only the on-screen portion, VoiceOver would announce
-     "end of text" prematurely when the cursor reaches the visible
-     bottom, even though more buffer content exists below.
-
-
-OVERLAY COMPLETION ANNOUNCEMENTS (Patch 0007)
----------------------------------------------
-
-  Overlay-based completion frameworks (Vertico, Icomplete, Ivy, etc.)
-  render candidates as overlay strings in the minibuffer.  VoiceOver
-  does not see overlay content changes automatically.  This patch
-  detects overlay candidate changes and announces the selected
-  candidate.
-
-  Detection:
-    ns_ax_face_is_selected(face) checks whether a face name contains
-    "current", "selected", or "selection" (matching vertico-current,
-    icomplete-selected-match, ivy-current-match, etc.).  Supports
-    both single face symbols and face lists.
-
-    ns_ax_selected_overlay_text(b, beg, end, out_line) scans the
-    buffer region line by line using Fget_char_property to check
-    both text properties and overlay face properties.
-
-  Overlay changes are tracked independently of text changes:
-    BUF_OVERLAY_MODIFF is checked in an independent if-branch (not
-    else-if) because Vertico bumps both BUF_MODIFF (text properties)
-    and BUF_OVERLAY_MODIFF (overlays) in the same command cycle.
-
-  textDidChange flag:
-    hl-line-mode and similar packages update face properties (text
-    properties, not characters) on every cursor movement, bumping
-    BUF_MODIFF without changing BUF_CHARS_MODIFF.  The original
-    else-if structure caused the modiff branch to fire (correctly
-    skipping ValueChanged) but also blocked the cursor-move branch
-    (SelectedTextChanged).  A BOOL textDidChange flag decouples the
-    two branches: ValueChanged and SelectedTextChanged remain
-    mutually exclusive for real edits, but SelectedTextChanged fires
-    correctly when only text properties changed.
-
-  Zoom:
-    The selected candidate position is stored in overlayZoomRect /
-    overlayZoomActive on the parent EmacsView.  draw_window_cursor
-    uses this rect instead of the text cursor when a candidate is
-    active.  Cleared when BUF_CHARS_MODIFF changes (user types)
-    or when no candidate is found.
-
-
-CHILD FRAME COMPLETION ANNOUNCEMENTS (Patch 0008)
--------------------------------------------------
-
-  Completion frameworks such as Corfu, Company-box, and similar render
-  candidates in a child frame rather than as overlay strings.  This
-  patch detects child frames via FRAME_PARENT_FRAME and announces
-  the selected candidate.
-
-  Detection:
-    Child frames are dispatched in postAccessibilityUpdates before
-    the main tree rebuild logic.  FRAME_PARENT_FRAME(emacsframe)
-    returns non-NULL for child frames.
-
-    ns_ax_selected_child_frame_text(b, buf_obj, out_line) scans the
-    child frame buffer line by line, reusing ns_ax_face_is_selected
-    from patch 0007.
-
-  Buffer switch safety:
-    Fbuffer_substring_no_properties operates on current_buffer, which
-    may differ from the child frame buffer during ns_update_end.
-    The function uses record_unwind_current_buffer /
-    set_buffer_internal_1 to temporarily switch, with unbind_to on
-    all three return paths after the switch.  Uses specpdl_ref (not
-    ptrdiff_t) for the SPECPDL_INDEX return value.
-
-  Re-entrance protection:
-    The accessibilityUpdating guard MUST precede the child frame
-    dispatch because Lisp calls in the scan function (Fget_char_property,
-    Fbuffer_substring_no_properties) can trigger redisplay.
-    BUF_MODIFF gating provides a secondary guard and prevents
-    redundant scans.
-
-  Validation:
-    - WINDOWP / BUFFERP checks for partially initialized child frames.
-    - Buffer size limit (10000 chars) skips non-completion child frames
-      (eldoc, which-key, etc.).
-
-  Focus restoration:
-    childFrameCompletionActive (BOOL on EmacsView) is set by the child
-    frame handler on the parent view.  On the parent's next accessibility
-    cycle, FOR_EACH_FRAME checks whether any child frame is still
-    visible.  If not, FocusedUIElementChangedNotification is posted on
-    the focused buffer element to restore VoiceOver character echo and
-    cursor tracking.
-
-  Zoom:
-    Direct UAZoomChangeFocus (not overlayZoomRect) because the child
-    frame's ns_update_end runs after the parent's draw_window_cursor,
-    so the last Zoom call wins.
-
-  Deduplication:
-    Static C string cache (lastCandidate via xstrdup/xfree) avoids
-    re-announcing the same candidate.
+  Main thread: all Lisp calls, buffer mutations, notification posting.
+  AX thread: VoiceOver queries dispatch_sync to main thread.
+  Async notifications: dispatch_async prevents deadlock (same pattern
+  as WebKit's AXObjectCacheMac).


 KNOWN LIMITATIONS
 -----------------

-  - Interactive span scan uses Fnext_single_property_change across
-    multiple properties to skip non-interactive regions in bulk, but
-    still visits every property-change boundary.  For buffers with
-    many overlapping text properties (e.g. heavily fontified source
-    code), the number of boundaries can be significant.  The scan
-    runs on every redisplay cycle when interactiveSpansDirty is set.
-
-  - Mode line text is extracted from CHAR_GLYPH rows only.  Image
-    glyphs, stretch glyphs, and composed glyphs are silently skipped.
-    Mode lines with icon fonts (e.g. doom-modeline with nerd-font)
-    produce incomplete or garbled accessibility text.
-
-  - Line counting (accessibilityInsertionPointLineNumber,
-    accessibilityLineForIndex:) uses a precomputed lineStartOffsets
-    array built once per cache rebuild.  Queries are O(log L) via
-    binary search.
-
-  - No multi-frame coordination.  EmacsView.accessibilityElements is
-    per-view; there is no cross-frame notification ordering.
-
-  - Overlay completion (0007) face matching uses string containment
-    ("current", "selected", "selection").  Custom completion frameworks
-    with face names not containing these substrings will not be detected.
-
-  - Child frame completion (0008) static lastBuffer pointer may become
-    stale if the buffer is freed and a new one allocated at the same
-    address.  This is harmless (worst case: one missed announcement).
-
-  - Child frame window-appeared announcement: macOS automatically
-    announces the window title when a child frame NSWindow appears.
-    This cannot be suppressed without breaking VoiceOver focus tracking
-    or Zoom integration.
-
-  - GNUstep is explicitly excluded (#ifdef NS_IMPL_COCOA).  GNUstep
-    has a different accessibility model and requires separate work.
-
-  - Line navigation detection (ns_ax_event_is_line_nav_key) checks
-    Vthis_command against known navigation command symbols
-    (next-line, previous-line, evil-next-line, etc.) and falls back
-    to raw key codes for Tab/backtab.  Custom navigation commands
-    not in the recognized list will not get forced line-granularity
-    announcements.
-
-  - UAZoomChangeFocus always uses kUAZoomFocusTypeInsertionPoint
-    regardless of cursor style (box, bar, hbar).  This is cosmetically
-    imprecise but functionally correct.
+  - Mode line: CHAR_GLYPH only (icon fonts produce incomplete text)
+  - Overlay face matching: string containment ("current", "selected")
+  - GNUstep excluded (#ifdef NS_IMPL_COCOA)
+  - No multi-frame coordination
+  - Child frame static lastCandidate leaks at exit (minor)


-TESTING CHECKLIST
-----------------
+TESTING
+-------

-  Prerequisites:
-    - macOS with VoiceOver (Cmd-F5 to toggle).
-    - Emacs built from source with this patch applied.
-    - Evil-mode recommended for block-cursor tests.
-
-  Basic text reading:
-    1. Open Emacs.  Press Cmd-F5 to start VoiceOver.
-    2. Switch to Emacs (Cmd-Tab).  VoiceOver should announce
-       "Emacs, editor" and read the current line.
-    3. Move cursor with arrow keys.  VoiceOver should read each
-       character (left/right) or line (up/down) as you move.
-    4. Verify: right/left arrow reads the character AT the cursor
-       position, not the character left behind.  (evil block-cursor)
-
-  Word and line navigation:
-    5. Press M-f / M-b (forward/backward word).  VoiceOver should
-       announce the word landed on.
-    6. Press C-n / C-p.  VoiceOver should read the full new line.
-    7. Hold Shift and press arrow keys to extend selection.  VoiceOver
-       should announce the selected text.
-
-  Completion navigation:
-    8. Type M-x to open the minibuffer.
-    9. Type a partial command name.  Press Tab to open *Completions*.
-    10. Press Tab / S-Tab to cycle through completions.  VoiceOver
-        should announce each candidate name as you move.
-    11. Verify no double-speech (each candidate read exactly once).
-
-  Interactive span Tab navigation:
-    12. Open a buffer with buttons (e.g. M-x describe-key).
-    13. Use VoiceOver Item Chooser (VO-I) or Tab with VoiceOver
-        interaction mode to navigate interactive elements.
-    14. Verify each button/link is reachable and its label is read.
-    15. In an org-mode file with links, verify links appear as
-        separate navigable AXLink elements.
-
-  Mode line:
-    16. Use the VoiceOver cursor to navigate to the mode line below a
-        buffer.  VoiceOver should read the mode line text.
-
-  Zoom integration:
-    17. Enable macOS Zoom (System Settings -> Accessibility -> Zoom).
-    18. Set Zoom to "Follow keyboard focus".
-    19. Move cursor in Emacs.  Zoom viewport should track the cursor.
-    20. Verify Zoom follows the cursor across split windows.
-
-  Window operations:
-    21. Split window with C-x 2.  VoiceOver should announce a layout
-        change.  Switch with C-x o; VoiceOver should read the new
-        window content.
-    22. Delete a window with C-x 0.  No crash should occur.
-    23. Switch buffers with C-x b.  VoiceOver should read new buffer.
-
-  Deadlock regression (async notifications):
-    24. With VoiceOver on: M-x, type partial command, M-v to
-        *Completions*, Tab to a candidate, Enter to execute, then
-        C-x o to switch windows.  Emacs must not hang.
-
-  Stress test (line index):
-    25. Open a large file (>50,000 lines).  Navigate to the end with
-        M-> or C-v repeatedly.  VoiceOver speech should remain fluid
-        at all positions (no progressive slowdown).
-    26. Open an org-mode file with many folded sections.  Verify that
-        folded (invisible) text is not announced during navigation.
-
-
-REVIEW CHANGES (post initial implementation)
---------------------------------------------
-
-  The following changes were made based on maintainer-style code review:
-
-  1. ns_ax_window_end_charpos: added window_end_valid guard.  Falls
-     back to BUF_ZV when the window has not been fully redisplayed,
-     preventing stale data in AX getters called before next redisplay.
-
-  2. GC safety documentation: detailed comment on lispWindow ivar
-     explaining why staticpro is not needed (windows reachable from
-     frame tree, GC only on main thread, AX getters dispatch to main).
-
-  3. ns-accessibility-enabled (DEFVAR_BOOL): new user option to
-     disable accessibility entirely.  Guards three entry points.
-
-  4. postAccessibilityNotificationsForFrame: extracted from one ~200
-     line method into four focused helpers:
-     - postTextChangedNotification: (typing echo)
-     - postFocusedCursorNotification:direction:granularity:markActive:
-       oldMarkActive: (focused cursor/selection)
-     - postCompletionAnnouncementForBuffer:point: (completions)
-     - postAccessibilityNotificationsForFrame: (orchestrator, ~60 lines)
-
-  5. ns_ax_completion_text_for_span: added block_input/unblock_input
-     with specpdl unwind protection for signal safety.
-
-  6. Fplist_get third-argument comment (PREDICATE, not default value).
-
-  7. Documentation: macos.texi section updated with
-     ns-accessibility-enabled variable reference.  etc/NEWS updated.
+  See TESTING.txt for the full test matrix and results.


 -- end of README --
--- a/patches/TESTING.txt
+++ b/patches/TESTING.txt
@@ -6,9 +6,41 @@ Date: 2026-02-28

 Environment
 -----------
-Host: CM2D4G-A9635005 (macOS)
+Host: CM2D4G-A9635005 (macOS 14)
 Base: emacs master (upstream HEAD at time of test)

+
+PATCH A: ZOOM (0000)
+=====================
+
+1. Patch Application
+--------------------
+PASS — Standalone Zoom patch applies cleanly via git-am.
+No conflicts, no warnings.
+
+2. Build
+--------
+PASS — Full NS (Cocoa) build completed successfully.
+No warnings related to Zoom code.
+
+3. Zoom Cursor Tracking
+------------------------
+PASS — UAZoomChangeFocus integration:
+  - Typing in buffer: Zoom tracks cursor                      OK
+  - M-x: Zoom moves to minibuffer                             OK
+  - C-x 2, C-x o cycling: Zoom follows across split windows   OK
+  - C-x 2, C-x o, C-p: Zoom follows cursor up after switch    OK
+    (ns_update_end fallback ensures tracking)
+
+4. No-Zoom Overhead
+--------------------
+PASS — UAZoomEnabled() returns false when Zoom is off.
+Single function call overhead per redisplay cycle (negligible).
+
+
+PATCH B: VOICEOVER (0001-0008)
+===============================
+
 1. Patch Application
 --------------------
 PASS — All 8 patches applied cleanly via git-am:
@@ -37,108 +69,77 @@ No warnings related to accessibility code.
 ---------------
 PASS — emacs -Q starts without errors or warnings.

-4. Zoom Cursor Tracking
------------------------
-PASS — UAZoomChangeFocus integration working correctly:
-  - Typing in buffer: cursor tracked, Zoom follows           OK
-  - M-x: Zoom moves focus to minibuffer                      OK
-  - M-x list- TAB M-v: switches to *Completions* buffer,
-    TAB cycles focus across completion candidates             OK
-  - C-x 2, C-x 2, C-x 3 (multiple splits), then C-x o
-    cycling: Zoom focus correctly follows between windows     OK
-
-5. Documentation
----------------
-PASS — Texinfo node accessible via C-h i g (emacs)VoiceOver Accessibility.
-Node correctly linked from macOS appendix menu.
-
-6. VoiceOver — Basic Navigation
+4. VoiceOver — Basic Navigation
 --------------------------------
 PASS — VoiceOver active (Cmd+F5):
-  - Buffer name announced correctly on focus                  OK
-  - Typing: each character announced as typed                 OK
-  - Arrow keys / C-n / C-p: line-by-line navigation,
-    current line announced                                    OK
-  - Word navigation: reads full current word                  OK
+  - Buffer name announced on focus                            OK
+  - Typing: each character announced                          OK
+  - Arrow keys / C-n / C-p: line navigation announced         OK
+  - Word navigation (M-f / M-b): word announced               OK
  - M-x: switches to minibuffer, announces "minibuffer"        OK

-7. VoiceOver — Completions
+5. VoiceOver — Completions
 ---------------------------
 PASS — Completion buffer interaction:
-  - M-x list-* then M-v to switch to *Completions*:
-    buffer content read correctly                             OK
-  - TAB cycling in *Completions*: announces only the
-    current candidate (interactive span focus)                OK
+  - M-x, partial command, Tab → *Completions*                 OK
+  - Tab cycling: announces each candidate                     OK
+  - No double-speech                                          OK

-8. VoiceOver — Window Switching
+6. VoiceOver — Window Switching
 --------------------------------
-PASS — Multiple windows (C-x 2, C-x 3, C-x o cycling):
-  - Announces current buffer name and content on switch       OK
-  - Begins reading buffer content automatically               OK
-  - User action (typing, navigation) correctly interrupts
-    reading and announces new action instead                  OK
-  - Notification priority/preemption working as designed      OK
+PASS — Multiple windows (C-x 2, C-x 3, C-x o):
+  - Announces buffer name and content on switch                OK
+  - Notification priority/preemption working                   OK

-9. VoiceOver — Full Buffer Reading
+7. VoiceOver — Full Buffer Reading
 -----------------------------------
 PASS — VO+A reads entire buffer including off-screen content.
-  - Cursor synchronization between Emacs and VoiceOver
-    virtual cursor working correctly                          OK

-10. VoiceOver — Accessibility Tree
+8. VoiceOver — Accessibility Tree
 -----------------------------------
 PASS — Virtual element tree dynamically maintained:
-  - New AX element created for each open buffer               OK
-  - Minibuffer element present and readable                   OK
-  - Mode-line elements present per buffer, readable via
-    VoiceOver virtual navigation                              OK
-  - Tree correctly updates when windows are split/closed      OK
+  - Buffer elements created per window                         OK
+  - Mode-line elements readable via VO navigation              OK
+  - Tree updates on split/close                                OK

-11. VoiceOver — Selection
+9. VoiceOver — Selection
 --------------------------
-PASS — C-SPC + cursor movement:
-  - Announces "selected" with region feedback                 OK
+PASS — C-SPC + movement: announces "selected" with region.

-12. VoiceOver — Org-mode Invisible Text
+10. VoiceOver — Org-mode Invisible Text
 ----------------------------------------
-PASS — Org-mode folding (Tab on headings):
-  - Folded: hidden text NOT read by VoiceOver                 OK
-  - Unfolded: full content read correctly                     OK
-  - Invisible text filtering (TEXT_PROP_MEANS_INVISIBLE)
-    working as designed                                       OK
+PASS — Folded text NOT read, unfolded text read correctly.

-13. ERT — ns-accessibility-enabled Variable
+11. ERT — ns-accessibility-enabled Variable
 --------------------------------------------
-PASS — Ran 1 test, 1 result as expected:
-  - ns-accessibility-enabled is bound                         OK
-  - ns-accessibility-enabled defaults to t                    OK
-  (ERT 1/1 passed, 2026-02-28 11:45:55 CET)
+PASS — ns-accessibility-enabled bound, defaults to t.

-14. VoiceOver — Overlay Completion (Patch 0007)
+12. VoiceOver — Overlay Completion (Patch 0007)
 ------------------------------------------------
-PASS — Vertico minibuffer overlay completion:
-  - Vertico candidates announced on C-n / C-p navigation     OK
-  - Selected candidate face detected (vertico-current)        OK
-  - Deduplication: same candidate not re-announced            OK
-  - Zoom tracks selected candidate in minibuffer
-    (overlayZoomRect / overlayZoomActive lifecycle)            OK
-  - overlayZoomActive cleared on text input                   OK
-  - hl-line-mode compatibility: cursor movement in dired
-    and read-only buffers correctly announces lines
-    (textDidChange flag decouples modiff branch from
-    cursor-move branch)                                       OK
+PASS — Vertico overlay completion:
+  - Candidates announced on C-n / C-p                         OK
+  - Selected face detected (vertico-current)                   OK
+  - Deduplication working                                      OK
+  - hl-line-mode compatibility (textDidChange flag)            OK

-15. VoiceOver — Child Frame Completion (Patch 0008)
+13. VoiceOver — Child Frame Completion (Patch 0008)
 ----------------------------------------------------
 PASS — Corfu child frame completion:
-  - Corfu popup candidates announced via VoiceOver            OK
-  - Selected candidate face detected (corfu-current)          OK
-  - Zoom tracks selected candidate in child frame
-    (direct UAZoomChangeFocus)                                OK
-  - No Emacs freeze (re-entrance guard before child frame
-    dispatch, buffer switch with unbind_to on all paths)      OK
-  - Focus restored to parent buffer after corfu closes
-    (childFrameCompletionActive flag + FOR_EACH_FRAME
-    visibility check + FocusedUIElementChanged)               OK
-  - Non-completion child frames skipped (10KB buffer limit)   OK
-  - specpdl_ref type used correctly (not ptrdiff_t)           OK
+  - Candidates announced via VoiceOver                         OK
+  - Selected face detected (corfu-current)                     OK
+  - No Emacs freeze (re-entrance guard)                        OK
+  - Focus restored to parent after popup closes                OK
+  - Non-completion child frames skipped (10KB limit)           OK
+
+14. Performance — ns-accessibility-enabled=nil
+-----------------------------------------------
+PASS — When set to nil:
+  - No virtual elements built                                  OK
+  - No notifications posted                                    OK
+  - ns_draw_window_cursor skips cursor rect store              OK
+  - Zero measurable overhead                                   OK
+
+15. Documentation
+-----------------
+PASS — Texinfo node accessible via C-h i g (emacs)VoiceOver.
+etc/NEWS entry present and accurate.