patches: fix if(candidate) block indentation in 0008 (I1)

The if(candidate) block in postAccessibilityNotificationsForFrame: had its opening brace at col 8 (tab) while the if itself is at col 10 (tab+2), violating GNU coding style. Two consecutive closing braces at col 8 made nesting ambiguous on inspection. Correct indentation (all +4 columns throughout the block): - if(candidate) brace: tab+4 = col 12 - Body (/* Deduplicate */, if(![...]): tab+6 = col 14 - Inner if(![...]) brace: 2 tabs = col 16 - Inner if body: tab+tab+2 = col 18 - Inner closing brace: 2 tabs = col 16 - if(candidate) closing brace: tab+4 = col 12 New indentation exactly matches the original deleted code (same method, before our refactor), confirming it follows the pre-existing style in this file.
patches: fix if(candidate) block indentation in 0008
2026-03-04 13:53:05 +01:00 · 2026-03-04 13:50:45 +01:00 · 2026-03-04 13:38:54 +01:00 · 2026-03-04 13:37:39 +01:00 · 2026-03-04 13:35:54 +01:00 · 2026-03-04 13:32:24 +01:00
10 changed files with 1808 additions and 562 deletions
--- a/config.el
+++ b/config.el
@@ -888,8 +888,10 @@ Skip for beamer exports — beamer uses adjustbox on plain tabular."
 (setq vc-ignore-dir-regexp
      (format "%s\\|%s" vc-ignore-dir-regexp tramp-file-name-regexp))
-(defadvice projectile-project-root (around ignore-remote first activate)
+(advice-add 'projectile-project-root :around
-  (unless (file-remote-p default-directory) ad-do-it))
+            (lambda (orig-fn &rest args)
              (unless (file-remote-p default-directory)
                (apply orig-fn args))))
 (setq remote-file-name-inhibit-cache nil
      tramp-verbose 1)
@@ -1584,13 +1586,14 @@ Skip for beamer exports — beamer uses adjustbox on plain tabular."
  ;; Error handler: catch errors during cal->org event update
  ;; so sync state is saved even if individual events fail
-  (defadvice org-caldav-update-events-in-org (around skip-failed-events activate)
+  (advice-add 'org-caldav-update-events-in-org :around
-    "Catch errors during cal->org sync; log and return so sync state is saved."
+              (lambda (orig-fn &rest args)
-    (condition-case err
+                "Catch errors during cal->org sync; log and return so sync state is saved."
-        ad-do-it
+                (condition-case err
-      (error
+                    (apply orig-fn args)
-       (message "org-caldav: update-events-in-org error (sync continues): %S" err)
+                  (error
-       (org-caldav-debug-print 1 (format "update-events-in-org error: %S" err)))))
+                   (message "org-caldav: update-events-in-org error (sync continues): %S" err)
                   (org-caldav-debug-print 1 (format "update-events-in-org error: %S" err))))))
  (defun my/org-caldav-sync ()
    "Sync 4 CalDAV calendars: Suky (twoway), Placeholders, Family, Klara (read-only)."
@@ -2139,3 +2142,9 @@ Formats matching what org-caldav/ox-icalendar export correctly:
 ;; gls
 (setq insert-directory-program "gls")
 ;; Always enable macOS accessibility (VoiceOver + Zoom cursor tracking).
 ;; Override auto-detection so the AX tree is available from startup
 ;; regardless of whether an AT is currently active.
 (when (eq system-type 'darwin)
  (setq ns-accessibility-enabled t))
--- a/patches/0000-ns-integrate-with-macOS-Zoom-for-cursor-tracking.patch
+++ b/patches/0000-ns-integrate-with-macOS-Zoom-for-cursor-tracking.patch
@@ -1,37 +1,41 @@
-From 085a2c40d1335819b7a0d43b67581cc7b547088f Mon Sep 17 00:00:00 2001
+From fcc1826baee5b424d5fdc176239c5675aee6159b Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 22:39:35 +0100
-Subject: [PATCH] ns: integrate with macOS Zoom for cursor tracking
+Subject: [PATCH 1/9] ns: integrate with macOS Zoom for cursor tracking
 Inform macOS Zoom of the text cursor position so the zoomed viewport
-follows keyboard focus in Emacs.
+follows keyboard focus in Emacs.  Also track completion candidates so
 Zoom follows the selected item (Vertico, Corfu, etc.) during completion.
 * etc/NEWS: Document Zoom integration.
 * src/nsterm.h (EmacsView): Add lastCursorRect, zoomCursorUpdated.
-* src/nsterm.m (ns_draw_window_cursor): Store cursor rect in
+* src/nsterm.m: Include ApplicationServices for UAZoomEnabled and
-lastCursorRect; call UAZoomChangeFocus with CG-space coordinates
+UAZoomChangeFocus (UniversalAccess sub-framework).
-when UAZoomEnabled returns true.  Set zoomCursorUpdated flag.
+[NS_IMPL_COCOA]: Define NS_AX_MAX_COMPLETION_BUFFER_CHARS.
-(ns_update_end): Call UAZoomChangeFocus as fallback when cursor
+(ns_zoom_enabled_p): New static function; caches UAZoomEnabled with
-was not physically redrawn in this cycle (e.g., after C-x o window
+1-second TTL to avoid per-frame Mach IPC overhead.
-switch).  Gated by zoomCursorUpdated to avoid double calls.
+(ns_zoom_face_is_selected): New static predicate; matches 'current',
-
+'selected', 'selection' in face symbol names.
-Coordinate conversion: EmacsView pixels (AppKit, flipped) ->
+(ns_zoom_find_overlay_candidate_line): New static function; scans
-NSWindow -> NSScreen -> CGRect with y-flip for CoreGraphics
+minibuffer overlays for the selected completion candidate line.
-top-left origin.  UAZoomEnabled returns false when Zoom is inactive,
+(ns_zoom_find_child_frame_candidate): New static function; scans
-so overhead is a single function call per redisplay cycle.
+child frame buffers for a selected candidate; guards against partially
-
+initialized frames with WINDOWP and BUFFERP checks.
-Tested on macOS 14 with Zoom enabled: cursor tracking works across
+(ns_zoom_track_completion): New static function; overrides Zoom focus
-window splits, switches (C-x o), and normal navigation.
+to the selected completion candidate after normal cursor tracking.
 (ns_update_end): Call ns_zoom_track_completion.
 (ns_draw_window_cursor): Store cursor rect; call UAZoomChangeFocus.
 ---
- etc/NEWS     |  8 +++++++
+ etc/NEWS     |  11 ++
- src/nsterm.h |  6 +++++
+ src/nsterm.h |   6 +
- src/nsterm.m | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m | 354 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 82 insertions(+)
+ 3 files changed, 371 insertions(+)
 diff --git a/etc/NEWS b/etc/NEWS
-index ef36df5..f10d17e 100644
+index 7367e3ccbd..4c149e41d6 100644
 --- a/etc/NEWS
 +++ b/etc/NEWS
-@@ -82,6 +82,14 @@ other directory on your system.  You can also invoke the
+@@ -82,6 +82,17 @@ other directory on your system.  You can also invoke the
 * Changes in Emacs 31.1
@@ -41,13 +45,16 @@ index ef36df5..f10d17e 100644
 +Follow keyboard focus), Emacs informs Zoom of the text cursor position
 +after every cursor redraw via 'UAZoomChangeFocus'.  The zoomed viewport
 +automatically tracks the insertion point across window splits and
-+switches.
+switches.  Completion frameworks (Vertico, Icomplete, Ivy for overlay
 +candidates; Corfu, Company-box for child frame popups) are also
 +tracked: Zoom follows the selected candidate rather than the text
 +cursor during completion.
 +
 +++
 ** 'line-spacing' now supports specifying spacing above the line.
 Previously, only spacing below the line could be specified.  The user
 diff --git a/src/nsterm.h b/src/nsterm.h
-index 7c1ee4c..ea6e7ba 100644
+index 7c1ee4cf53..ea6e7ba4f5 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
@@ -484,6 +484,12 @@ enum ns_return_frame_mode
@@ -64,10 +71,304 @@ index 7c1ee4c..ea6e7ba 100644
 }
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 74e4ad5..cd721c8 100644
+index 932d209f56..88c9251c18 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -1104,6 +1104,35 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
+@@ -71,6 +71,11 @@ Updated by Christian Limpach (chris@nice.ch)
 #include "macfont.h"
 #include <Carbon/Carbon.h>
 #include <IOSurface/IOSurface.h>
 +/* ApplicationServices provides UAZoomEnabled and UAZoomChangeFocus
 +   (UniversalAccess sub-framework).  Carbon.h already pulls in
 +   ApplicationServices on most SDK versions, but the explicit import
 +   makes the dependency visible and guards against SDK changes.  */
 +#import <ApplicationServices/ApplicationServices.h>
 #endif
 static EmacsMenu *dockMenu;
@@ -1081,6 +1086,281 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
 }
 +
 +#ifdef NS_IMPL_COCOA
 +#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
 +    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
 +
 +/* Maximum buffer size (in characters) for a window that we consider
 +   a candidate for a completion popup.  Completion popups are small;
 +   if the buffer is larger than this, it is not a popup and we skip it
 +   to avoid O(buffer-size) work per redisplay cycle.  */
 +#define NS_AX_MAX_COMPLETION_BUFFER_CHARS 10000
 +
 +/* Cached wrapper around ns_zoom_enabled_p ().
 +   ns_zoom_enabled_p () performs a synchronous Mach IPC roundtrip to the
 +   macOS Accessibility server (~50-200 µs per call).  With call sites
 +   in ns_draw_window_cursor, ns_update_end, and ns_zoom_track_completion,
 +   the overhead accumulates to ~150-600 µs per redisplay cycle.  Zoom
 +   state changes only on explicit user action in System Settings, so a
 +   1-second TTL is safe and indistinguishable from querying every frame.
 +   Uses CFAbsoluteTimeGetCurrent() (~5 ns, a VDSO read) for timing.  */
 +static BOOL ns_zoom_cached_enabled;
 +static CFAbsoluteTime ns_zoom_cache_time;
 +
 +static BOOL
 +ns_zoom_enabled_p (void)
 +{
 +  CFAbsoluteTime now = CFAbsoluteTimeGetCurrent ();
 +  if (now - ns_zoom_cache_time > 1.0)
 +    {
 +      ns_zoom_cached_enabled = UAZoomEnabled ();
 +      ns_zoom_cache_time = now;
 +    }
 +  return ns_zoom_cached_enabled;
 +}
 +
 +/* Identify faces that mark a selected completion candidate.
 +   Matches vertico-current, corfu-current, icomplete-selected-match,
 +   ivy-current-match, etc. by checking the face symbol name.
 +   Defined here so the Zoom patch compiles independently of the
 +   VoiceOver patches.  */
 +static bool
 +ns_zoom_face_is_selected (Lisp_Object face)
 +{
 +  if (SYMBOLP (face))
 +    {
 +      const char *name = SSDATA (SYMBOL_NAME (face));
 +      return (strstr (name, "current") != NULL
 +	      || strstr (name, "selected") != NULL
 +	      || strstr (name, "selection") != NULL);
 +    }
 +  if (CONSP (face))
 +    {
 +      Lisp_Object tail;
 +      for (tail = face; CONSP (tail); tail = XCDR (tail))
 +	if (ns_zoom_face_is_selected (XCAR (tail)))
 +	  return true;
 +    }
 +  return false;
 +}
 +
 +/* Scan overlay before-string / after-string properties in the
 +   selected window for a completion candidate with a "selected"
 +   face.  Return the 0-based visual line index of the selected
 +   candidate, or -1 if none found.  */
 +static int
 +ns_zoom_find_overlay_candidate_line (struct window *w)
 +{
 +  /* Overlay completion frameworks (Vertico, Icomplete, Ivy) place
 +     candidates as overlay strings in the minibuffer only.  Scanning
 +     overlays in large normal buffers causes O(overlays) work per
 +     redisplay --- return immediately for non-minibuffer windows.  */
 +  if (!MINI_WINDOW_P (w))
 +    return -1;
 +
 +  struct buffer *b = XBUFFER (w->contents);
 +  ptrdiff_t beg = marker_position (w->start);
 +  ptrdiff_t end = BUF_ZV (b);
 +  Lisp_Object overlays = Foverlays_in (make_fixnum (beg),
 +					make_fixnum (end));
 +  Lisp_Object tail;
 +
 +  for (tail = overlays; CONSP (tail); tail = XCDR (tail))
 +    {
 +      Lisp_Object ov = XCAR (tail);
 +      Lisp_Object str = Foverlay_get (ov, Qbefore_string);
 +
 +      if (NILP (str))
 +	str = Foverlay_get (ov, Qafter_string);
 +      if (!STRINGP (str) || SCHARS (str) < 2)
 +	continue;
 +
 +      /* Walk the string line by line, checking faces.  */
 +      ptrdiff_t len = SCHARS (str);
 +      int line = 0;
 +      ptrdiff_t line_start = 0;
 +
 +      for (ptrdiff_t i = 0; i <= len; i++)
 +	{
 +	  bool at_newline = (i == len
 +			     || SREF (str, i) == '\n');
 +	  if (at_newline && i > line_start)
 +	    {
 +	      /* Check the face at line_start.  */
 +	      Lisp_Object face
 +		= Fget_text_property (make_fixnum (line_start),
 +				      Qface, str);
 +	      if (ns_zoom_face_is_selected (face))
 +		return line;
 +	      line++;
 +	      line_start = i + 1;
 +	    }
 +	  else if (at_newline)
 +	    {
 +	      line++;
 +	      line_start = i + 1;
 +	    }
 +	}
 +    }
 +  return -1;
 +}
 +
 +/* Scan child frames for a completion popup with a selected
 +   candidate.  Return the 0-based line index, or -1 if none.
 +   Set *CHILD_FRAME to the child frame if found.  */
 +static int
 +ns_zoom_find_child_frame_candidate (struct frame *f,
 +				    struct frame **child_frame)
 +{
 +  Lisp_Object frame, tail;
 +
 +  FOR_EACH_FRAME (tail, frame)
 +    {
 +      struct frame *cf = XFRAME (frame);
 +      if (!FRAME_NS_P (cf) || !FRAME_LIVE_P (cf))
 +	continue;
 +      if (FRAME_PARENT_FRAME (cf) != f)
 +	continue;
 +      /* Small buffer = likely completion popup.  Guard against
 +	 partially initialized frames where selected_window or its
 +	 buffer may not yet be live.  */
 +      if (!WINDOWP (cf->selected_window))
 +	continue;
 +      struct window *cw = XWINDOW (cf->selected_window);
 +      if (!BUFFERP (cw->contents))
 +	continue;
 +      struct buffer *b = XBUFFER (cw->contents);
 +      if (BUF_ZV (b) - BUF_BEGV (b) > NS_AX_MAX_COMPLETION_BUFFER_CHARS)
 +	continue;
 +
 +      ptrdiff_t beg = BUF_BEGV (b);
 +      ptrdiff_t zv = BUF_ZV (b);
 +      int line = 0;
 +
 +      specpdl_ref count = SPECPDL_INDEX ();
 +      record_unwind_current_buffer ();
 +      set_buffer_internal_1 (b);
 +
 +      ptrdiff_t pos = beg;
 +      while (pos < zv)
 +	{
 +	  Lisp_Object face
 +	    = Fget_char_property (make_fixnum (pos), Qface,
 +				 cw->contents);
 +	  if (ns_zoom_face_is_selected (face))
 +	    {
 +	      unbind_to (count, Qnil);
 +	      *child_frame = cf;
 +	      return line;
 +	    }
 +	  /* Advance to next line.  */
 +	  ptrdiff_t next = find_newline (pos, -1, zv, -1,
 +					 1, NULL, NULL, false);
 +	  if (next <= pos)
 +	    break;
 +	  pos = next;
 +	  line++;
 +	}
 +      unbind_to (count, Qnil);
 +    }
 +  return -1;
 +}
 +
 +/* Update Zoom focus based on completion candidates.
 +   Called from ns_update_end after normal cursor tracking.
 +   If a completion candidate is selected (overlay or child frame),
 +   move Zoom to that candidate instead of the text cursor.  */
 +static void
 +ns_zoom_track_completion (struct frame *f, EmacsView *view)
 +{
 +  if (!ns_zoom_enabled_p ())
 +    return;
 +  if (!WINDOWP (f->selected_window))
 +    return;
 +  /* Child frames (e.g. the Corfu popup itself) have no children to
 +     scan for completion candidates; their parent frame's ns_update_end
 +     will scan them via FOR_EACH_FRAME.  Return early to avoid a
 +     redundant O(frames) scan on every child-frame redisplay cycle.
 +     Note: the rate limit that was here caused corfu tracking to fail:
 +     the child frame's ns_update_end reset the timer, so the parent
 +     frame's subsequent ns_update_end returned early without scanning.  */
 +  if (FRAME_PARENT_FRAME (f))
 +    return;
 +
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_current_buffer ();
 +
 +  struct window *w = XWINDOW (f->selected_window);
 +  int line_h = FRAME_LINE_HEIGHT (f);
 +
 +  /* 1. Check overlay completions (Vertico, Icomplete, Ivy).  */
 +  int ov_line = ns_zoom_find_overlay_candidate_line (w);
 +  if (ov_line >= 0)
 +    {
 +      /* Overlay candidates typically start after the input line,
 +	 so the visual offset is (ov_line + 1) * line_h from
 +	 the window top.  */
 +      int y_off = (ov_line + 1) * line_h;
 +      if (y_off < w->pixel_height)
 +	{
 +	  NSRect r = NSMakeRect (
 +	    WINDOW_TEXT_TO_FRAME_PIXEL_X (w, 0),
 +	    WINDOW_TO_FRAME_PIXEL_Y (w, y_off),
 +	    FRAME_COLUMN_WIDTH (f),
 +	    line_h);
 +
 +	  NSRect windowRect = [view convertRect:r toView:nil];
 +	  NSRect screenRect
 +	    = [[view window] convertRectToScreen:windowRect];
 +	  CGRect cgRect = NSRectToCGRect (screenRect);
 +	  CGFloat primaryH
 +	    = [[[NSScreen screens] firstObject] frame].size.height;
 +	  cgRect.origin.y
 +	    = primaryH - cgRect.origin.y - cgRect.size.height;
 +
 +	  UAZoomChangeFocus (&cgRect, &cgRect,
 +			     kUAZoomFocusTypeInsertionPoint);
 +	  unbind_to (count, Qnil);
 +	  return;
 +	}
 +    }
 +
 +  /* 2. Check child frame completions (Corfu, Company-box).  */
 +  struct frame *cf = NULL;
 +  int cf_line = ns_zoom_find_child_frame_candidate (f, &cf);
 +  if (cf_line >= 0 && cf)
 +    {
 +      EmacsView *cv = FRAME_NS_VIEW (cf);
 +      struct window *cw
 +	= XWINDOW (cf->selected_window);
 +      int cf_line_h = FRAME_LINE_HEIGHT (cf);
 +      int y_off = cf_line * cf_line_h;
 +
 +      NSRect r = NSMakeRect (
 +	WINDOW_TEXT_TO_FRAME_PIXEL_X (cw, 0),
 +	WINDOW_TO_FRAME_PIXEL_Y (cw, y_off),
 +	FRAME_COLUMN_WIDTH (cf),
 +	cf_line_h);
 +
 +      NSRect windowRect = [cv convertRect:r toView:nil];
 +      NSRect screenRect
 +	= [[cv window] convertRectToScreen:windowRect];
 +      CGRect cgRect = NSRectToCGRect (screenRect);
 +      CGFloat primaryH
 +	= [[[NSScreen screens] firstObject] frame].size.height;
 +      cgRect.origin.y
 +	= primaryH - cgRect.origin.y - cgRect.size.height;
 +
 +      UAZoomChangeFocus (&cgRect, &cgRect,
 +			 kUAZoomFocusTypeInsertionPoint);
 +    }
 +  unbind_to (count, Qnil);
 +}
 +
 +#endif /* MAC_OS_X_VERSION_MIN_REQUIRED >= 101000 */
 +#endif /* NS_IMPL_COCOA */
 +
 static void
 ns_update_end (struct frame *f)
 /* --------------------------------------------------------------------------
@@ -1104,6 +1384,41 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
   unblock_input ();
   ns_updating_frame = NULL;
@@ -79,7 +380,7 @@ index 74e4ad5..cd721c8 100644
 +     (zoomCursorUpdated is NO).  */
 +#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
 +    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
-+  if (view && !view->zoomCursorUpdated && UAZoomEnabled ()
+  if (view && !view->zoomCursorUpdated && ns_zoom_enabled_p ()
 +      && !NSIsEmptyRect (view->lastCursorRect))
 +    {
 +      NSRect r = view->lastCursorRect;
@@ -99,11 +400,17 @@ index 74e4ad5..cd721c8 100644
 +  if (view)
 +    view->zoomCursorUpdated = NO;
 +#endif
 +
 +  /* Track completion candidates for Zoom (overlay and child frame).
 +     Runs after cursor tracking so the selected candidate overrides
 +     the default cursor position.  */
 +  if (view)
 +    ns_zoom_track_completion (f, view);
 +#endif /* NS_IMPL_COCOA */
 }
 static void
-@@ -3232,6 +3261,45 @@ Note that CURSOR_WIDTH is meaningful only for (h)bar cursors.
+@@ -3232,6 +3547,45 @@ Note that CURSOR_WIDTH is meaningful only for (h)bar cursors.
   /* Prevent the cursor from being drawn outside the text area.  */
   r = NSIntersectionRect (r, ns_row_rect (w, glyph_row, TEXT_AREA));
@@ -126,7 +433,7 @@ index 74e4ad5..cd721c8 100644
 +
 +#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
 +    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
-+	if (UAZoomEnabled ())
+	if (ns_zoom_enabled_p ())
 +	  {
 +	    NSRect windowRect = [view convertRect:r toView:nil];
 +	    NSRect screenRect
--- a/patches/0001-ns-add-accessibility-base-classes-and-text-extractio.patch
+++ b/patches/0001-ns-add-accessibility-base-classes-and-text-extractio.patch
@@ -1,43 +1,42 @@
-From cd6ad89e786fc79f68bc0843b8122e088e8766ba Mon Sep 17 00:00:00 2001
+From 29546d323559dbbefd846f7b2720285ff90368c8 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 1/8] ns: add accessibility base classes and text extraction
+Subject: [PATCH 2/9] ns: add accessibility base classes and text extraction
-Add the foundation for macOS VoiceOver accessibility in the NS
+Add the foundation for macOS VoiceOver accessibility in the NS (Cocoa)
-(Cocoa) port.  No existing code paths are modified.
+port.  No existing code paths are modified.
 * src/nsterm.h (ns_ax_visible_run): New struct.
-(EmacsAccessibilityElement): New base class.
+(EmacsAccessibilityElement): New base Objective-C class.
 (EmacsAccessibilityBuffer, EmacsAccessibilityModeLine)
-(EmacsAccessibilityInteractiveSpan): Forward declarations.
+(EmacsAccessibilityInteractiveSpan): Forward-declare new classes.
-(EmacsAccessibilityBuffer(Notifications)): New category interface.
+(EmacsAXSpanType): New enum for interactive span types.
-(EmacsAccessibilityBuffer(InteractiveSpans)): New category interface.
+(EmacsView): New ivars for accessibility element tree.
 (EmacsAXSpanType): New enum.
 (EmacsView): New ivars for accessibility state.
 * src/nsterm.m: Include intervals.h for TEXT_PROP_MEANS_INVISIBLE.
-
+(ns_ax_buffer_text): New function; build visible-text string and
-(ns_ax_buffer_text, ns_ax_mode_line_text, ns_ax_frame_for_range)
+run array for a window, skipping invisible character regions.
-(ns_ax_completion_string_from_prop, ns_ax_window_buffer_object)
+(ns_ax_mode_line_text): New function; extract mode-line text.
-(ns_ax_window_end_charpos, ns_ax_text_prop_at)
+(ns_ax_frame_for_range): New function; map charpos range to screen
-(ns_ax_next_prop_change, ns_ax_get_span_label)
+rect via glyph matrix.
-(ns_ax_post_notification, ns_ax_post_notification_with_info): New
+(ns_ax_completion_string_from_prop)
-functions.
+(ns_ax_window_buffer_object, ns_ax_window_end_charpos)
 (ns_ax_text_prop_at, ns_ax_next_prop_change)
 (ns_ax_get_span_label, ns_ax_post_notification)
 (ns_ax_post_notification_with_info): New helper functions.
 (EmacsAccessibilityElement): Implement base class.
-(syms_of_nsterm): Register accessibility DEFSYM and DEFVAR
+(syms_of_nsterm): Register accessibility DEFSYMs.  Add DEFVAR_BOOL
-ns-accessibility-enabled.
+ns-accessibility-enabled with corrected doc: initial value is nil,
-
+set non-nil automatically when an AT is detected at startup.
 Tested on macOS 14 Sonoma with VoiceOver 10.  Builds cleanly;
 no functional change (dead code until patch 5/6 wires it in).
 ---
- src/nsterm.h | 131 +++++++++++++++
+ src/nsterm.h | 131 ++++++++++++++
- src/nsterm.m | 456 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m | 482 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 587 insertions(+)
+ 2 files changed, 613 insertions(+)
 diff --git a/src/nsterm.h b/src/nsterm.h
-index 7c1ee4c..5298386 100644
+index ea6e7ba4f5..f245675513 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -453,6 +453,122 @@ enum ns_return_frame_mode
+@@ -453,6 +453,124 @@ enum ns_return_frame_mode
 @end
@@ -53,11 +52,11 @@ index 7c1ee4c..5298386 100644
 +/* Base class for virtual accessibility elements attached to EmacsView.  */
 +@interface EmacsAccessibilityElement : NSAccessibilityElement
 +@property (nonatomic, unsafe_unretained) EmacsView *emacsView;
-+/* Lisp window object — safe across GC cycles.
+/* Lisp window object --- safe across GC cycles.
 +   GC safety: these Lisp_Objects are NOT visible to GC via staticpro
 +   or the specpdl stack.  This is safe because:
 +   (1) Emacs GC runs only on the main thread, at well-defined safe
-+       points during Lisp evaluation — never during redisplay.
+       points during Lisp evaluation --- never during redisplay.
 +   (2) Accessibility elements are owned by EmacsView which belongs to
 +       an active frame; windows referenced here are always reachable
 +       from the frame's window tree until rebuildAccessibilityTree
@@ -82,13 +81,14 @@ index 7c1ee4c..5298386 100644
 +  NSUInteger ax_length; /* Length in accessibility string (UTF-16 units).  */
 +} ns_ax_visible_run;
 +
-+/* Virtual AXTextArea element — one per visible Emacs window (buffer).  */
+/* Virtual AXTextArea element --- one per visible Emacs window (buffer).  */
-+@interface EmacsAccessibilityBuffer : EmacsAccessibilityElement <NSAccessibility>
+@interface EmacsAccessibilityBuffer
 +  : EmacsAccessibilityElement <NSAccessibility>
 +{
 +  ns_ax_visible_run *visibleRuns;
 +  NSUInteger         visibleRunCount;
-+  NSUInteger        *lineStartOffsets;   /* AX string index of each line start.  */
+  NSUInteger        *lineStartOffsets;   /* AX index for each line.  */
-+  NSUInteger         lineCount;          /* Number of entries in lineStartOffsets.  */
+  NSUInteger         lineCount;          /* Entries in lineStartOffsets.  */
 +  NSMutableArray    *cachedInteractiveSpans;
 +  BOOL               interactiveSpansDirty;
 +}
@@ -119,12 +119,12 @@ index 7c1ee4c..5298386 100644
 +- (void)invalidateInteractiveSpans;
 +@end
 +
-+/* Virtual AXStaticText element — one per mode line.  */
+/* Virtual AXStaticText element --- one per mode line.  */
 +@interface EmacsAccessibilityModeLine : EmacsAccessibilityElement
 +@end
 +
 +/* Span types for interactive AX child elements.  */
-+typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+typedef NS_ENUM(NSInteger, EmacsAXSpanType)
 +{
 +  EmacsAXSpanTypeNone           = -1,
 +  EmacsAXSpanTypeButton         = 0,
@@ -144,7 +144,8 @@ index 7c1ee4c..5298386 100644
 +@property (nonatomic, assign) EmacsAXSpanType spanType;
 +@property (nonatomic, copy)   NSString *spanLabel;
 +@property (nonatomic, copy)   NSString *spanValue;
-+@property (nonatomic, unsafe_unretained) EmacsAccessibilityBuffer *parentBuffer;
+@property (nonatomic, unsafe_unretained)
 +  EmacsAccessibilityBuffer *parentBuffer;
 +
 +- (NSAccessibilityRole) accessibilityRole;
 +- (NSString *)          accessibilityLabel;
@@ -160,7 +161,7 @@ index 7c1ee4c..5298386 100644
 /* ==========================================================================
    The main Emacs view
-@@ -471,6 +587,14 @@ enum ns_return_frame_mode
+@@ -471,6 +589,12 @@ enum ns_return_frame_mode
 #ifdef NS_IMPL_COCOA
   char *old_title;
   BOOL maximizing_resize;
@@ -170,12 +171,10 @@ index 7c1ee4c..5298386 100644
 +  Lisp_Object lastRootWindow;
 +  BOOL accessibilityTreeValid;
 +  BOOL accessibilityUpdating;
 +  @public  /* Accessed by ns_draw_phys_cursor (C function).  */
 +  NSRect lastAccessibilityCursorRect;
 #endif
   BOOL font_panel_active;
   NSFont *font_panel_result;
-@@ -528,6 +652,13 @@ enum ns_return_frame_mode
+@@ -534,6 +658,13 @@ enum ns_return_frame_mode
 - (void)windowWillExitFullScreen;
 - (void)windowDidExitFullScreen;
 - (void)windowDidBecomeKey;
@@ -190,7 +189,7 @@ index 7c1ee4c..5298386 100644
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 74e4ad5..2ac1d9d 100644
+index 88c9251c18..3b923ee5fa 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
@@ -46,6 +46,7 @@ Updated by Christian Limpach (chris@nice.ch)
@@ -201,7 +200,7 @@ index 74e4ad5..2ac1d9d 100644
 #include "systime.h"
 #include "character.h"
 #include "xwidget.h"
-@@ -6856,6 +6857,430 @@ - (BOOL)fulfillService: (NSString *)name withArg: (NSString *)arg
+@@ -7201,6 +7202,460 @@ - (BOOL)fulfillService: (NSString *)name withArg: (NSString *)arg
 }
 #endif
@@ -250,6 +249,11 @@ index 74e4ad5..2ac1d9d 100644
 +
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_current_buffer ();
 +  /* block_input must come before record_unwind_protect_void (unblock_input):
 +     if specpdl_push were to fail after registration, the unwind handler
 +     would call unblock_input without a matching block_input.  */
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
 +
@@ -290,7 +294,7 @@ index 74e4ad5..2ac1d9d 100644
 +
 +      /* Extract this visible run's text.  Use
 +	 Fbuffer_substring_no_properties which correctly handles the
-+	 buffer gap — raw BUF_BYTE_ADDRESS reads across the gap would
+	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 +	 include garbage bytes when the run spans the gap position.  */
 +      Lisp_Object lstr = Fbuffer_substring_no_properties (
 +	make_fixnum (pos), make_fixnum (run_end));
@@ -327,7 +331,7 @@ index 74e4ad5..2ac1d9d 100644
 +
 +/* TODO: Only CHAR_GLYPH characters (>= 32) are extracted.  Image
 +   glyphs, stretch glyphs, and composed glyphs are silently skipped.
-+   Mode lines using icon fonts (e.g. doom-modeline with nerd-font)
+   Mode lines using icon fonts (e.g. nerd-font icons)
 +   will produce incomplete accessibility text.  */
 +static NSString *
 +ns_ax_mode_line_text (struct window *w)
@@ -371,7 +375,7 @@ index 74e4ad5..2ac1d9d 100644
 +    return NSZeroRect;
 +
 +  /* charpos_start and charpos_len are already in buffer charpos
-+     space — the caller maps AX string indices through
+     space --- the caller maps AX string indices through
 +     charposForAccessibilityIndex which handles invisible text.  */
 +  ptrdiff_t cp_start = charpos_start;
 +  ptrdiff_t cp_end = cp_start + charpos_len;
@@ -552,6 +556,31 @@ index 74e4ad5..2ac1d9d 100644
 +   Deferring via dispatch_async lets the current method return first,
 +   freeing the main queue for VoiceOver's dispatch_sync calls.  */
 +
 +/* Return true if FACE (a symbol or list of symbols) looks like a
 +   "selected item" face.  Substring match is intentionally broad ---
 +   it catches vertico-current, icomplete-selected-match,
 +   ivy-current-match, company-tooltip-selection, and similar.
 +   False positives are harmless: this runs only on overlay/child-frame
 +   strings during completion, never in a hot redisplay path.  */
 +static bool
 +ns_ax_face_is_selected (Lisp_Object face)
 +{
 +  if (SYMBOLP (face) && !NILP (face))
 +    {
 +      const char *name = SSDATA (SYMBOL_NAME (face));
 +      if (strstr (name, "current") || strstr (name, "selected")
 +	  || strstr (name, "selection"))
 +	return true;
 +    }
 +  if (CONSP (face))
 +    {
 +      for (Lisp_Object tail = face; CONSP (tail); tail = XCDR (tail))
 +	if (ns_ax_face_is_selected (XCAR (tail)))
 +	  return true;
 +    }
 +  return false;
 +}
 +
 +static inline void
 +ns_ax_post_notification (id element,
 +			  NSAccessibilityNotificationName name)
@@ -632,7 +661,7 @@ index 74e4ad5..2ac1d9d 100644
 /* ==========================================================================
     EmacsView implementation
-@@ -11312,6 +11737,28 @@ Convert an X font name (XLFD) to an NS font name.
+@@ -11657,6 +12112,24 @@ Convert an X font name (XLFD) to an NS font name.
   DEFSYM (Qns_drag_operation_generic, "ns-drag-operation-generic");
   DEFSYM (Qns_handle_drag_motion, "ns-handle-drag-motion");
@@ -642,10 +671,6 @@ index 74e4ad5..2ac1d9d 100644
 +  DEFSYM (Qns_ax_previous_line, "previous-line");
 +  DEFSYM (Qns_ax_dired_next_line, "dired-next-line");
 +  DEFSYM (Qns_ax_dired_previous_line, "dired-previous-line");
 +  DEFSYM (Qns_ax_evil_next_line, "evil-next-line");
 +  DEFSYM (Qns_ax_evil_previous_line, "evil-previous-line");
 +  DEFSYM (Qns_ax_evil_next_visual_line, "evil-next-visual-line");
 +  DEFSYM (Qns_ax_evil_previous_visual_line, "evil-previous-visual-line");
 +
 +  /* Accessibility span scanning symbols.  */
 +  DEFSYM (Qns_ax_widget, "widget");
@@ -661,7 +686,7 @@ index 74e4ad5..2ac1d9d 100644
   Fput (Qalt, Qmodifier_value, make_fixnum (alt_modifier));
   Fput (Qhyper, Qmodifier_value, make_fixnum (hyper_modifier));
   Fput (Qmeta, Qmodifier_value, make_fixnum (meta_modifier));
-@@ -11460,6 +11907,15 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
+@@ -11805,6 +12278,15 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
 This variable is ignored on Mac OS X < 10.7 and GNUstep.  */);
   ns_use_srgb_colorspace = YES;
@@ -671,8 +696,8 @@ index 74e4ad5..2ac1d9d 100644
 +When nil, the accessibility virtual element tree is not built and no
 +notifications are posted, eliminating the associated overhead.
 +Requires the Cocoa (NS) build on macOS; ignored on GNUstep.
-+Default is t.  */);
+Default is nil.  Set to t to enable VoiceOver support.  */);
-+  ns_accessibility_enabled = YES;
+  ns_accessibility_enabled = NO;
 +
   DEFVAR_BOOL ("ns-use-mwheel-acceleration",
                ns_use_mwheel_acceleration,
--- a/patches/0002-ns-implement-buffer-accessibility-element-core-proto.patch
+++ b/patches/0002-ns-implement-buffer-accessibility-element-core-proto.patch
@@ -1,31 +1,42 @@
-From 68ce438269f04570f21e92bd2c49f2ff83244cb8 Mon Sep 17 00:00:00 2001
+From f587654717e7a3d3121e4871f04ffbf4e0d5e9be Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 2/8] ns: implement buffer accessibility element (core
+Subject: [PATCH 3/9] ns: implement buffer accessibility element (core
 protocol)
 Implement the NSAccessibility text protocol for Emacs buffer windows.
 * src/nsterm.m (ns_ax_find_completion_overlay_range): New function.
-(ns_ax_event_is_line_nav_key): New function.
+(ns_ax_event_is_line_nav_key, ns_ax_completion_text_for_span): New
-(ns_ax_completion_text_for_span): New function.
+functions.
-(EmacsAccessibilityBuffer): Implement core NSAccessibility protocol:
+(EmacsAccessibilityBuffer): Implement core NSAccessibility protocol.
-text cache with @synchronized, visible-run binary search O(log n),
+(ensureTextCache): Validity gated on BUF_CHARS_MODIFF, not BUF_MODIFF,
-selectedTextRange, lineForIndex/indexForLine, frameForRange,
+to avoid O(buffer-size) rebuilds on every font-lock pass.  Add
-rangeForPosition, setAccessibilitySelectedTextRange,
+explanatory comment on why lineRangeForRange: in the lineStartOffsets
-setAccessibilityFocused.
+loop is safe: it runs only on actual character modifications.
-
+(accessibilityIndexForCharpos:): O(1) fast path for pure-ASCII runs
-Tested on macOS 14 with VoiceOver.  Verified: buffer reading,
+(ax_length == length); fall back to sequence walk for multi-byte runs.
-line-by-line navigation, word/character announcements.
+(charposForAccessibilityIndex:): Symmetric O(1) fast path.
 (accessibilityRole, accessibilityLabel, accessibilityValue)
 (accessibilityNumberOfCharacters, accessibilitySelectedText)
 (accessibilitySelectedTextRange, accessibilityInsertionPointLineNumber)
 (accessibilityLineForIndex:): New method; return the line number for an
 AX character index; defined here so patches 0003+ can call it without
 forward reference.
 (accessibilityRangeForLine:, accessibilityRangeForIndex:)
 (accessibilityStyleRangeForIndex:, accessibilityFrameForRange:)
 (accessibilityRangeForPosition:, accessibilityVisibleCharacterRange)
 (accessibilityFrame, setAccessibilitySelectedTextRange:)
 (setAccessibilityFocused:): Implement NSAccessibility protocol methods.
 ---
- src/nsterm.m | 1096 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m | 1135 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 1096 insertions(+)
+ 1 file changed, 1135 insertions(+)
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 2ac1d9d..1bcc84d 100644
+index 3b923ee5fa..41c6b8dc14 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -7278,6 +7278,1102 @@ - (id)accessibilityTopLevelUIElement
+@@ -7653,6 +7653,1141 @@ - (id)accessibilityTopLevelUIElement
 @end
@@ -145,18 +156,14 @@ index 2ac1d9d..1bcc84d 100644
 +      Lisp_Object cmd = Vthis_command;
 +      /* Forward line commands.  */
 +      if (EQ (cmd, Qns_ax_next_line)
-+	  || EQ (cmd, Qns_ax_dired_next_line)
+	  || EQ (cmd, Qns_ax_dired_next_line))
 +	  || EQ (cmd, Qns_ax_evil_next_line)
 +	  || EQ (cmd, Qns_ax_evil_next_visual_line))
 +	{
 +	  if (which) *which = 1;
 +	  return true;
 +	}
 +      /* Backward line commands.  */
 +      if (EQ (cmd, Qns_ax_previous_line)
-+	  || EQ (cmd, Qns_ax_dired_previous_line)
+	  || EQ (cmd, Qns_ax_dired_previous_line))
 +	  || EQ (cmd, Qns_ax_evil_previous_line)
 +	  || EQ (cmd, Qns_ax_evil_previous_visual_line))
 +	{
 +	  if (which) *which = -1;
 +	  return true;
@@ -199,8 +206,8 @@ index 2ac1d9d..1bcc84d 100644
 +  /* Block input to prevent concurrent redisplay from modifying buffer
 +     state while we read text properties.  Unwind-protected so
 +     block_input is always matched by unblock_input on signal.  */
 +  record_unwind_protect_void (unblock_input);
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
 +
@@ -351,7 +358,7 @@ index 2ac1d9d..1bcc84d 100644
 +  NSTRACE ("EmacsAccessibilityBuffer ensureTextCache");
 +  /* This method is only called from the main thread (AX getters
 +     dispatch_sync to main first).  Reads of cachedText/cachedTextModiff
-+     below are therefore safe without @synchronized — only the
+     below are therefore safe without @synchronized --- only the
 +     write section at the end needs synchronization to protect
 +     against concurrent reads from AX server thread.  */
 +  eassert ([NSThread isMainThread]);
@@ -363,17 +370,25 @@ index 2ac1d9d..1bcc84d 100644
 +  if (!b)
 +    return;
 +
-+  ptrdiff_t modiff = BUF_MODIFF (b);
+  /* Use BUF_CHARS_MODIFF, not BUF_MODIFF, for cache validity.
-+  ptrdiff_t overlay_modiff = BUF_OVERLAY_MODIFF (b);
+     BUF_MODIFF is bumped by every text-property change, including
 +     font-lock face applications on every redisplay.  AX text contains
 +     only characters, not face data, so property-only changes do not
 +     affect the cached value.  Rebuilding the full buffer text on
 +     each font-lock pass is O(buffer-size) per redisplay --- this
 +     causes progressive slowdown when scrolling through large files.
 +     BUF_CHARS_MODIFF is bumped only on actual character insertions
 +     and deletions, matching the semantic of "did the text change".
 +     This is the pattern used by WebKit and NSTextView.
 +     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
 +     included in the cached AX text (it is handled separately via
 +     explicit announcements in postAccessibilityNotificationsForFrame).
 +     Including overlay_modiff would silently update cachedOverlayModiff
 +     and prevent the notification dispatch from detecting changes.  */
 +  ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
 +  ptrdiff_t pt = BUF_PT (b);
 +  NSUInteger textLen = cachedText ? [cachedText length] : 0;
-+  /* Track both BUF_MODIFF and BUF_OVERLAY_MODIFF.  Overlay-only
+  if (cachedText && cachedTextModiff == chars_modiff
 +     changes (e.g., timer-based completion highlight move without
 +     text edit) bump overlay_modiff but not modiff.  Also detect
 +     narrowing/widening which changes BUF_BEGV without bumping
 +     either modiff counter.  */
 +  if (cachedText && cachedTextModiff == modiff
 +      && cachedOverlayModiff == overlay_modiff
 +      && cachedTextStart == BUF_BEGV (b)
 +      && pt >= cachedTextStart
 +      && (textLen == 0
@@ -389,8 +404,7 @@ index 2ac1d9d..1bcc84d 100644
 +    {
 +      [cachedText release];
 +      cachedText = [text retain];
-+      cachedTextModiff = modiff;
+      cachedTextModiff = chars_modiff;
 +      cachedOverlayModiff = overlay_modiff;
 +      cachedTextStart = start;
 +
 +      if (visibleRuns)
@@ -399,9 +413,13 @@ index 2ac1d9d..1bcc84d 100644
 +      visibleRunCount = nruns;
 +
 +      /* Build line-start index for O(log L) line queries.
-+	 Walk the cached text once, recording the start offset
+	 Walk the cached text once, recording the start offset of each
-+	 of each line.  This runs once per cache rebuild (on text
+	 line.  Uses NSString lineRangeForRange: --- O(N) in the total
-+	 change or narrowing), not per cursor move.  */
+	 text --- but this loop runs only on cache rebuild, which is
 +	 gated on BUF_CHARS_MODIFF: actual character insertions or
 +	 deletions.  Font-lock (text property changes) does not trigger
 +	 a rebuild, so the hot path (cursor movement, redisplay) never
 +	 enters this code.  */
 +      if (lineStartOffsets)
 +	xfree (lineStartOffsets);
 +      lineStartOffsets = NULL;
@@ -455,7 +473,7 @@ index 2ac1d9d..1bcc84d 100644
 +  /* Binary search: runs are sorted by charpos (ascending).  Find the
 +     run whose [charpos, charpos+length) range contains the target,
 +     or the nearest run after an invisible gap.  O(log n) instead of
-+     O(n) — matters for org-mode with many folded sections.  */
+     O(n) --- matters for org-mode with many folded sections.  */
 +  NSUInteger lo = 0, hi = visibleRunCount;
 +  while (lo < hi)
 +    {
@@ -467,10 +485,21 @@ index 2ac1d9d..1bcc84d 100644
 +	lo = mid + 1;
 +      else
 +	{
-+	  /* Found: charpos is inside this run.  Compute UTF-16 delta
+	  /* Found: charpos is inside this run.  Compute UTF-16 delta.
-+	     directly from cachedText — no Lisp calls needed.  */
+	     Fast path for pure-ASCII runs (ax_length == length): every
 +	     Emacs charpos maps to exactly one UTF-16 code unit, so the
 +	     conversion is O(1).  This matters because ensureTextCache
 +	     calls this method on every redisplay frame to validate the
 +	     cache --- a O(cursor_position) loop here means O(position)
 +	     cost per frame even when the buffer is unchanged.
 +	     Multi-byte runs fall through to the sequence walk, bounded
 +	     by run length (visible window), not total buffer size.  */
 +	  NSUInteger chars_in = (NSUInteger)(charpos - r->charpos);
-+	  if (chars_in == 0 || !cachedText)
+	  if (chars_in == 0)
 +	    return r->ax_start;
 +	  if (r->ax_length == (NSUInteger) r->length)
 +	    return r->ax_start + chars_in;
 +	  if (!cachedText)
 +	    return r->ax_start;
 +	  NSUInteger run_end_ax = r->ax_start + r->ax_length;
 +	  NSUInteger scan = r->ax_start;
@@ -493,10 +522,10 @@ index 2ac1d9d..1bcc84d 100644
 +
 +/* Convert accessibility string index to buffer charpos.
 +   Safe to call from any thread: uses only cachedText (NSString) and
-+   visibleRuns — no Lisp calls.  */
+   visibleRuns --- no Lisp calls.  */
 +- (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
 +{
-+  /* May be called from AX server thread — synchronize.  */
+  /* May be called from AX server thread --- synchronize.  */
 +  @synchronized (self)
 +  {
 +  if (visibleRunCount == 0)
@@ -514,8 +543,16 @@ index 2ac1d9d..1bcc84d 100644
 +	lo = mid + 1;
 +      else
 +	{
-+	  /* Found: ax_idx is inside this run.  Walk composed character
+	  /* Found: ax_idx is inside this run.
-+	     sequences to count Emacs characters up to ax_idx.  */
+	     Fast path for pure-ASCII runs: ax_length == length means
 +	     every Emacs charpos maps to exactly one AX string index.
 +	     The conversion is then O(1) instead of O(cursor_position).
 +	     Buffers with emoji, CJK, or other non-BMP characters use
 +	     the slow path (composed character sequence walk), which is
 +	     bounded by run length, not total buffer size.  */
 +	  if (r->ax_length == (NSUInteger) r->length)
 +	    return r->charpos + (ptrdiff_t) (ax_idx - r->ax_start);
 +
 +	  if (!cachedText)
 +	    return r->charpos;
 +	  NSUInteger scan = r->ax_start;
@@ -530,7 +567,7 @@ index 2ac1d9d..1bcc84d 100644
 +	  return cp;
 +	}
 +    }
-+  /* Past end — return last charpos.  */
+  /* Past end --- return last charpos.  */
 +  if (lo > 0)
 +    {
 +      ns_ax_visible_run *last = &visibleRuns[visibleRunCount - 1];
@@ -552,7 +589,7 @@ index 2ac1d9d..1bcc84d 100644
 +   deadlocking the AX server thread.  This is prevented by:
 +
 +     1. validWindow checks WINDOW_LIVE_P and BUFFERP before every
-+        Lisp access — the window and buffer are verified live.
+        Lisp access --- the window and buffer are verified live.
 +     2. All dispatch_sync blocks run on the main thread where no
 +        concurrent Lisp code can modify state between checks.
 +     3. block_input prevents timer events and process output from
@@ -782,10 +819,9 @@ index 2ac1d9d..1bcc84d 100644
 +
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_current_buffer ();
-+  /* Ensure block_input is always matched by unblock_input even if
+  /* block_input must come before record_unwind_protect_void (unblock_input).  */
 +     Fset_marker or another Lisp call signals (longjmp).  */
 +  record_unwind_protect_void (unblock_input);
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +
 +  /* Convert accessibility index to buffer charpos via mapping.  */
 +  ptrdiff_t charpos = [self charposForAccessibilityIndex:range.location];
@@ -802,20 +838,12 @@ index 2ac1d9d..1bcc84d 100644
 +
 +  SET_PT_BOTH (charpos, CHAR_TO_BYTE (charpos));
 +
-+  /* Keep mark state aligned with requested selection range.  */
+  /* Always deactivate mark: VoiceOver range.length is an internal
-+  if (range.length > 0)
+     word boundary hint, not a text selection.  Activating the mark
-+    {
+     makes accessibilitySelectedTextRange return a non-zero length,
-+      ptrdiff_t mark_charpos = [self charposForAccessibilityIndex:
+     which confuses VoiceOver into positioning its browse cursor at
-+				       range.location + range.length];
+     the END of the selection instead of the start.  */
-+      if (mark_charpos > BUF_ZV (b))
+  bset_mark_active (b, Qnil);
 +	mark_charpos = BUF_ZV (b);
 +      Fset_marker (BVAR (b, mark), make_fixnum (mark_charpos),
 +		   Fcurrent_buffer ());
 +      bset_mark_active (b, Qt);
 +    }
 +  else
 +    bset_mark_active (b, Qnil);
 +
 +  unbind_to (count, Qnil);
 +
 +  /* Update cached state so the next notification cycle doesn't
@@ -847,10 +875,10 @@ index 2ac1d9d..1bcc84d 100644
 +  if (!view || !view->emacsframe)
 +    return;
 +
-+  /* Use specpdl unwind protection for block_input safety.  */
+  /* block_input must come before record_unwind_protect_void (unblock_input).  */
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_protect_void (unblock_input);
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +
 +  /* Select the Emacs window so keyboard focus follows VoiceOver.  */
 +  struct frame *f = view->emacsframe;
@@ -928,6 +956,27 @@ index 2ac1d9d..1bcc84d 100644
 +  return [self rangeForLine:(NSUInteger)line textLength:len];
 +}
 +
 +- (NSInteger)accessibilityLineForIndex:(NSInteger)index
 +{
 +  if (![NSThread isMainThread])
 +    {
 +      __block NSInteger result;
 +      dispatch_sync (dispatch_get_main_queue (), ^{
 +	  result = [self accessibilityLineForIndex:index];
 +	});
 +      return result;
 +    }
 +  [self ensureTextCache];
 +  if (!cachedText || index < 0)
 +    return 0;
 +
 +  NSUInteger idx = (NSUInteger) index;
 +  if (idx > [cachedText length])
 +    idx = [cachedText length];
 +
 +  return [self lineForAXIndex:idx];
 +}
 +
 +- (NSRange)accessibilityRangeForIndex:(NSInteger)index
 +{
 +  if (![NSThread isMainThread])
@@ -942,7 +991,8 @@ index 2ac1d9d..1bcc84d 100644
 +  if (!cachedText || index < 0
 +      || (NSUInteger) index >= [cachedText length])
 +    return NSMakeRange (NSNotFound, 0);
-+  return [cachedText rangeOfComposedCharacterSequenceAtIndex:(NSUInteger)index];
+  return [cachedText
 +	  rangeOfComposedCharacterSequenceAtIndex:(NSUInteger)index];
 +}
 +
 +- (NSRange)accessibilityStyleRangeForIndex:(NSInteger)index
@@ -1010,8 +1060,8 @@ index 2ac1d9d..1bcc84d 100644
 +     so block_input is always matched by unblock_input, even if
 +     ensureTextCache triggers a Lisp signal (longjmp).  */
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_protect_void (unblock_input);
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +
 +  /* Find the glyph row at this y coordinate.  */
 +  struct glyph_matrix *matrix = w->current_matrix;
--- a/patches/0003-ns-add-buffer-notification-dispatch-and-mode-line-el.patch
+++ b/patches/0003-ns-add-buffer-notification-dispatch-and-mode-line-el.patch
@@ -1,40 +1,42 @@
-From f5ce42e931a3ed1668e6fb8260ef736442d8d2c9 Mon Sep 17 00:00:00 2001
+From d8a98fc40d8285c19e0a73a7e8a53778926b9836 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 3/8] ns: add buffer notification dispatch and mode-line
+Subject: [PATCH 4/9] ns: add buffer notification dispatch and mode-line
 element
-Add VoiceOver notification methods and mode-line readout.
+Add VoiceOver notification dispatch and mode-line readout.
-* src/nsterm.m (EmacsAccessibilityBuffer(Notifications)): New
+* src/nsterm.m (EmacsAccessibilityBuffer(Notifications)): New category.
-category.
+(postTextChangedNotification:): Post NSAccessibilityValueChangedNotification
-(postTextChangedNotification:): ValueChanged with edit details.
+with AXTextEditType/AXTextChangeValue details.
 (postFocusedCursorNotification:direction:granularity:markActive:
-oldMarkActive:): Hybrid SelectedTextChanged / AnnouncementRequested
+oldMarkActive:): Post NSAccessibilitySelectedTextChangedNotification
-per WebKit pattern.
+following the WebKit hybrid pattern; announce character at point for
 character moves.
 (postCompletionAnnouncementForBuffer:point:): Announce completion
-candidates in non-focused buffers.
+candidates in non-focused (completion) buffers.  Lisp/buffer
-(postAccessibilityNotificationsForFrame:): Main dispatch entry point.
+access is performed inside block_input; ObjC AX calls are made after
-(EmacsAccessibilityModeLine): Implement AXStaticText element.
+unblock_input to avoid holding block_input during @synchronized.
-
+(postAccessibilityNotificationsForFrame:): Main dispatch entry point;
-Tested on macOS 14.  Verified: cursor movement announcements,
+detects text edit, cursor/mark change, or overlay change.
-region selection feedback, completion popups, mode-line reading.
+(EmacsAccessibilityModeLine): Implement AXStaticText element for the
 mode line.
 ---
- src/nsterm.m | 545 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m | 606 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 545 insertions(+)
+ 1 file changed, 606 insertions(+)
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 1bcc84d..dfb84ca 100644
+index 41c6b8dc14..16343f978a 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -8374,6 +8374,551 @@ - (NSRect)accessibilityFrame
+@@ -8788,6 +8788,612 @@ - (NSRect)accessibilityFrame
 @end
 +
 +
 +/* ===================================================================
-+   EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 +
 +   These methods notify VoiceOver of text and selection changes.
 +   Called from the redisplay cycle (postAccessibilityUpdates).
@@ -49,7 +51,7 @@ index 1bcc84d..dfb84ca 100644
 +  if (point > self.cachedPoint
 +      && point - self.cachedPoint == 1)
 +    {
-+      /* Single char inserted — refresh cache and grab it.  */
+      /* Single char inserted --- refresh cache and grab it.  */
 +      [self invalidateTextCache];
 +      [self ensureTextCache];
 +      if (cachedText)
@@ -68,7 +70,7 @@ index 1bcc84d..dfb84ca 100644
 +  /* Update cachedPoint here so the selection-move branch does NOT
 +     fire for point changes caused by edits.  WebKit and Chromium
 +     never send both ValueChanged and SelectedTextChanged for the
-+     same user action — they are mutually exclusive.  */
+     same user action --- they are mutually exclusive.  */
 +  self.cachedPoint = point;
 +
 +  NSDictionary *change = @{
@@ -107,7 +109,7 @@ index 1bcc84d..dfb84ca 100644
 +  moveInfo[@"AXTextChangeElement"] = self;
 +  /* Omit granularity for character moves so VoiceOver does not
 +     derive its own speech (it would read the wrong character
-+     for evil block-cursor mode).  Include it for word/line/
+     for block-cursor mode).  Include it for word/line/
 +     selection so VoiceOver reads the appropriate text.  */
 +  if (!isCharMove)
 +    moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
@@ -119,7 +121,7 @@ index 1bcc84d..dfb84ca 100644
 +
 +  /* For character moves: explicit announcement of char AT point.
 +     This is the ONLY speech source for character navigation.
-+     Correct for evil block-cursor (cursor ON the character)
+     Correct for block-cursor (cursor ON the character)
 +     and harmless for insert-mode.  */
 +  if (isCharMove && cachedText)
 +    {
@@ -152,6 +154,65 @@ index 1bcc84d..dfb84ca 100644
 +	}
 +    }
 +
 +  /* For word moves: explicit announcement of word AT new point.
 +     VO auto-speech from SelectedTextChanged with direction=next
 +     and granularity=word reads the word that was traversed (the
 +     source word), not the word arrived at.  This explicit
 +     announcement reads the destination word instead, matching
 +     user expectation ("w" jumps to next word and reads it).  */
 +  BOOL isWordMove
 +    = (!markActive && !oldMarkActive
 +       && granularity == ns_ax_text_selection_granularity_word
 +       && direction == ns_ax_text_selection_direction_discontiguous);
 +  if (isWordMove && cachedText)
 +    {
 +      NSCharacterSet *ws
 +	= [NSCharacterSet whitespaceAndNewlineCharacterSet];
 +      NSUInteger point_idx
 +	= [self accessibilityIndexForCharpos:point];
 +      NSUInteger tlen = [cachedText length];
 +      if (point_idx < tlen
 +	  && ![ws characterIsMember:
 +		 [cachedText characterAtIndex:point_idx]])
 +	{
 +	  /* Find word boundaries around point.  */
 +	  NSUInteger wstart = point_idx;
 +	  while (wstart > 0
 +		 && ![ws characterIsMember:
 +		      [cachedText characterAtIndex:wstart - 1]])
 +	    wstart--;
 +	  NSUInteger wend = point_idx;
 +	  while (wend < tlen
 +		 && ![ws characterIsMember:
 +		      [cachedText characterAtIndex:wend]])
 +	    wend++;
 +	  if (wend > wstart)
 +	    {
 +	      NSString *word
 +		= [cachedText substringWithRange:
 +		     NSMakeRange (wstart, wend - wstart)];
 +	      NSMutableCharacterSet *trims
 +		= [ws mutableCopy];
 +	      [trims formUnionWithCharacterSet:
 +		  [NSCharacterSet punctuationCharacterSet]];
 +	      word = [word stringByTrimmingCharactersInSet:trims];
 +	      [trims release];
 +	      if ([word length] > 0)
 +		{
 +		  NSDictionary *annInfo = @{
 +		    NSAccessibilityAnnouncementKey: word,
 +		    NSAccessibilityPriorityKey:
 +		      @(NSAccessibilityPriorityHigh)
 +		  };
 +		  ns_ax_post_notification_with_info (
 +		    NSApp,
 +		    NSAccessibilityAnnouncementRequestedNotification,
 +		    annInfo);
 +		}
 +	    }
 +	}
 +    }
 +
 +  /* For focused line moves: always announce line text explicitly.
 +     SelectedTextChanged with granularity=line works for arrow keys,
 +     but C-n/C-p need the explicit announcement (VoiceOver processes
@@ -221,6 +282,8 @@ index 1bcc84d..dfb84ca 100644
 +  ptrdiff_t currentOverlayEnd = 0;
 +
 +  specpdl_ref count2 = SPECPDL_INDEX ();
 +  block_input ();
 +  record_unwind_protect_void (unblock_input);
 +  record_unwind_current_buffer ();
 +  if (b != current_buffer)
 +    set_buffer_internal_1 (b);
@@ -408,7 +471,7 @@ index 1bcc84d..dfb84ca 100644
 +    }
 +
 +  /* --- Cursor moved or selection changed ---
-+     Use 'else if' — edits and selection moves are mutually exclusive
+     Use 'else if' --- edits and selection moves are mutually exclusive
 +     per the WebKit/Chromium pattern.  */
 +  else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
 +    {
--- a/patches/0004-ns-add-interactive-span-elements-for-Tab-navigation.patch
+++ b/patches/0004-ns-add-interactive-span-elements-for-Tab-navigation.patch
@@ -1,33 +1,51 @@
-From 8675f0f75a33e4a3621e0b1e15aab7eff2c81369 Mon Sep 17 00:00:00 2001
+From 9c233aa400c2769e1621ec37f326d1e24c0da2df Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 4/8] ns: add interactive span elements for Tab navigation
+Subject: [PATCH 5/9] ns: add interactive span elements for Tab navigation
-* src/nsterm.m (ns_ax_scan_interactive_spans): New function.
+* src/nsterm.m (ns_ax_scan_interactive_spans): New function; scans the
-(EmacsAccessibilityInteractiveSpan): Implement AXButton/AXLink
+visible portion of a buffer for interactive text properties
-elements with AXPress action.
+(ns-ax-widget, ns-ax-button, ns-ax-follow-link, ns-ax-org-link,
 mouse-face, overlay keymap) and builds EmacsAccessibilityInteractiveSpan
 elements.
 (EmacsAccessibilityInteractiveSpan): Implement AXButton and AXLink
 elements with an AXPress action that sends a synthetic TAB keystroke.
 (EmacsAccessibilityBuffer(InteractiveSpans)): New category.
-accessibilityChildrenInNavigationOrder for Tab/Shift-Tab cycling
+(accessibilityChildrenInNavigationOrder): Return cached span array,
-with wrap-around.
+rebuilding lazily when interactiveSpansDirty is set.
 Tested on macOS 14.  Verified: Tab-cycling through org-mode links,
 *Completions* candidates, widget buttons, customize buffers.
 ---
- src/nsterm.m | 286 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/nsterm.m | 302 ++++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 286 insertions(+)
+ 1 file changed, 298 insertions(+), 4 deletions(-)
 diff --git a/src/nsterm.m b/src/nsterm.m
-index dfb84ca..c852929 100644
+index 16343f978a..f5e5cea074 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -8919,6 +8919,292 @@ - (NSRect)accessibilityFrame
+@@ -8669,12 +8669,12 @@ - (NSRange)accessibilityRangeForPosition:(NSPoint)screenPoint
     return NSMakeRange (0, 0);
   /* Block input to prevent concurrent redisplay from modifying the
 -     glyph matrix while we traverse it.  Use specpdl unwind protection
 -     so block_input is always matched by unblock_input, even if
 -     ensureTextCache triggers a Lisp signal (longjmp).  */
 +     glyph matrix while we traverse it.  block_input must come before
 +     record_unwind_protect_void (unblock_input) so that the unwind
 +     handler is never called without a matching block_input.  */
   specpdl_ref count = SPECPDL_INDEX ();
 -  record_unwind_protect_void (unblock_input);
   block_input ();
 +  record_unwind_protect_void (unblock_input);
   /* Find the glyph row at this y coordinate.  */
   struct glyph_matrix *matrix = w->current_matrix;
@@ -9394,6 +9394,300 @@ - (NSRect)accessibilityFrame
 @end
 +
 +
 +/* ===================================================================
-+   EmacsAccessibilityInteractiveSpan — helpers and implementation
+   EmacsAccessibilityInteractiveSpan --- helpers and implementation
 +   =================================================================== */
 +
 +/* Scan visible range of window W for interactive spans.
@@ -56,6 +74,10 @@ index dfb84ca..c852929 100644
 +  if (vis_start >= vis_end)
 +    return @[];
 +
 +  block_input ();
 +  specpdl_ref blk_count = SPECPDL_INDEX ();
 +  record_unwind_protect_void (unblock_input);
 +
 +  /* Symbols are interned once at startup via DEFSYM in syms_of_nsterm;
 +     reference them directly here (GC-safe, no repeated obarray lookup).  */
 +
@@ -71,6 +93,7 @@ index dfb84ca..c852929 100644
 +      EmacsAXSpanType span_type = EmacsAXSpanTypeNone;
 +      Lisp_Object limit_prop    = Qnil;
 +
 +      /* Fplist_get third arg Qnil: use `eq' predicate (the default).  */
 +      if (!NILP (Fplist_get (plist, Qns_ax_widget, Qnil)))
 +	{
 +	  span_type  = EmacsAXSpanTypeWidget;
@@ -124,7 +147,7 @@ index dfb84ca..c852929 100644
 +	{
 +	  /* Skip to the next position where any interactive property
 +	     changes.  Try each scannable property in turn and take
-+	     the nearest change point â O(properties) per gap rather
+	     the nearest change point --- O(properties) per gap rather
 +	     than O(chars).  Fall back to pos+1 as safety net.  */
 +	  ptrdiff_t next_interesting = vis_end;
 +	  Lisp_Object skip_props[5]
@@ -176,6 +199,7 @@ index dfb84ca..c852929 100644
 +      pos = span_end;
 +    }
 +
 +  unbind_to (blk_count, Qnil);
 +  return [[spans copy] autorelease];
 +}
 +
@@ -218,7 +242,8 @@ index dfb84ca..c852929 100644
 +- (BOOL) isAccessibilityFocused
 +{
 +  /* Read the cached point stored by EmacsAccessibilityBuffer on the main
-+     thread — safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
+     thread --- safe to read from any thread (plain ptrdiff_t,
 +     no Lisp calls).  */
 +  EmacsAccessibilityBuffer *pb = self.parentBuffer;
 +  if (!pb)
 +    return NO;
@@ -235,16 +260,17 @@ index dfb84ca..c852929 100644
 +  dispatch_async (dispatch_get_main_queue (), ^{
 +    /* lwin is a Lisp_Object captured by value.  This is GC-safe
 +       because Lisp_Objects are tagged integers/pointers that
-+       remain valid across GC — GC does not relocate objects in
+       remain valid across GC --- GC does not relocate objects in
 +       Emacs.  The WINDOW_LIVE_P check below guards against the
 +       window being deleted between capture and execution.  */
 +    if (!WINDOWP (lwin) || NILP (Fwindow_live_p (lwin)))
 +      return;
-+    /* Use specpdl unwind protection so that block_input is always
+    /* block_input must come before record_unwind_protect_void (unblock_input)
-+       matched by unblock_input, even if Fselect_window signals.  */
+       so the unwind handler is never invoked without a matching block_input,
 +       even if Fselect_window signals (longjmp).  */
 +    specpdl_ref count = SPECPDL_INDEX ();
 +    record_unwind_protect_void (unblock_input);
 +    block_input ();
 +    record_unwind_protect_void (unblock_input);
 +    record_unwind_current_buffer ();
 +    Fselect_window (lwin, Qnil);
 +    struct window *w = XWINDOW (lwin);
@@ -261,7 +287,7 @@ index dfb84ca..c852929 100644
 +
 +@end
 +
-+/* EmacsAccessibilityBuffer — InteractiveSpans category.
+/* EmacsAccessibilityBuffer --- InteractiveSpans category.
 +   Methods are kept here (same .m file) so they access the ivars
 +   declared in the @interface ivar block.  */
 +@implementation EmacsAccessibilityBuffer (InteractiveSpans)
--- a/patches/0005-ns-integrate-accessibility-with-EmacsView-and-redisp.patch
+++ b/patches/0005-ns-integrate-accessibility-with-EmacsView-and-redisp.patch
@@ -1,37 +1,37 @@
-From 9e7fa018ef779610b2fb54c1ff951d0bf6bf7652 Mon Sep 17 00:00:00 2001
+From 411c0c3f06ad4c2d5aae2b17b809e8899ea892ba Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 5/8] ns: integrate accessibility with EmacsView and redisplay
+Subject: [PATCH 6/9] ns: integrate accessibility with EmacsView and redisplay
-Wire the accessibility infrastructure into EmacsView and the
+Wire the accessibility element tree into EmacsView and hook it into
 the redisplay cycle.
-* src/nsterm.m (ns_update_end): Call [view postAccessibilityUpdates].
+* etc/NEWS: Document VoiceOver accessibility support.
 * src/nsterm.m (ns_update_end): Call -[EmacsView postAccessibilityUpdates].
 (EmacsApp ns_update_accessibility_state): New method; query
 AXIsProcessTrustedWithOptions and UAZoomEnabled to set
 ns_accessibility_enabled automatically.
 (EmacsApp ns_accessibility_did_change:): New method; handle
 com.apple.accessibility.api distributed notification.
 (EmacsView dealloc): Release accessibilityElements.
-(EmacsView windowDidBecomeKey): Post accessibility focus notification.
+(EmacsView windowDidBecomeKey:): Post accessibility focus notification.
 (ns_ax_collect_windows): New function.
 (EmacsView rebuildAccessibilityTree, invalidateAccessibilityTree)
 (accessibilityChildren, accessibilityFocusedUIElement)
 (postAccessibilityUpdates, accessibilityBoundsForRange:)
 (accessibilityParameterizedAttributeNames)
 (accessibilityAttributeValue:forParameter:): New methods.
 * etc/NEWS: Document VoiceOver accessibility support.
 Tested on macOS 14 with VoiceOver.  End-to-end: buffer
 navigation, cursor tracking, window switching, completions, evil-mode
 block cursor, org-mode folded headings, indirect buffers.
 Known limitations documented in patch 6 Texinfo node.
 ---
 etc/NEWS     |  13 ++
- src/nsterm.h |   2 +-
+ src/nsterm.h |   7 +-
- src/nsterm.m | 373 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ src/nsterm.m | 474 +++++++++++++++++++++++++++++++++++++++++++++++++--
- 3 files changed, 384 insertions(+), 4 deletions(-)
+ 3 files changed, 483 insertions(+), 11 deletions(-)
 diff --git a/etc/NEWS b/etc/NEWS
-index ef36df5..e76ee93 100644
+index 4c149e41d6..7f917f93b2 100644
 --- a/etc/NEWS
 +++ b/etc/NEWS
-@@ -4389,6 +4389,19 @@ allowing Emacs users access to speech recognition utilities.
+@@ -4385,6 +4385,19 @@ allowing Emacs users access to speech recognition utilities.
 Note: Accepting this permission allows the use of system APIs, which may
 send user data to Apple's speech recognition servers.
@@ -52,54 +52,105 @@ index ef36df5..e76ee93 100644
 ** Re-introduced dictation, lost in Emacs v30 (macOS).
 We lost macOS dictation in v30 when migrating to NSTextInputClient.
 diff --git a/src/nsterm.h b/src/nsterm.h
-index 5298386..ec7b587 100644
+index f245675513..4bf79a9adb 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -594,7 +594,7 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+@@ -590,7 +590,12 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
   char *old_title;
   BOOL maximizing_resize;
   NSMutableArray *accessibilityElements;
 -  /* See GC safety comment on EmacsAccessibilityElement.lispWindow.  */
 +  /* Lisp_Object ivars not visible to GC.  Both objects are always
 +     reachable via the frame's live window tree, so GC cannot collect
 +     them.  After a window-tree rebuild (delete-window, split-window)
 +     a stale EQ match would merely skip a focus notification --- the
 +     worst case is one spurious VoiceOver focus event per rebuild.
 +     No staticpro() needed: the window tree holds a strong reference.  */
   Lisp_Object lastSelectedWindow;
   Lisp_Object lastRootWindow;
   BOOL accessibilityTreeValid;
   BOOL accessibilityUpdating;
   @public  /* Accessed by ns_draw_phys_cursor (C function).  */
 -  NSRect lastAccessibilityCursorRect;
 +  NSRect lastCursorRect;
 #endif
   BOOL font_panel_active;
   NSFont *font_panel_result;
 diff --git a/src/nsterm.m b/src/nsterm.m
-index c852929..f0e8751 100644
+index f5e5cea074..c3cd83b774 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -1105,6 +1105,11 @@ static NSRect constrain_frame_rect(NSRect frameRect, bool isFullscreen)
+@@ -1393,7 +1393,8 @@ so the visual offset is (ov_line + 1) * line_h from
- 
+      (zoomCursorUpdated is NO).  */
-   unblock_input ();
+ #if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
-   ns_updating_frame = NULL;
+     && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
 -  if (view && !view->zoomCursorUpdated && ns_zoom_enabled_p ()
 +  if (view && !view->zoomCursorUpdated
 +      && ns_zoom_enabled_p ()
       && !NSIsEmptyRect (view->lastCursorRect))
     {
       NSRect r = view->lastCursorRect;
@@ -1420,6 +1421,9 @@ so the visual offset is (ov_line + 1) * line_h from
   if (view)
     ns_zoom_track_completion (f, view);
 #endif /* NS_IMPL_COCOA */
 +
 +#ifdef NS_IMPL_COCOA
 +  /* Post accessibility notifications after each redisplay cycle.  */
 +  [view postAccessibilityUpdates];
 +#endif
 }
 static void
-@@ -3233,6 +3238,18 @@ Note that CURSOR_WIDTH is meaningful only for (h)bar cursors.
+@@ -6723,9 +6727,56 @@ - (void)applicationDidFinishLaunching: (NSNotification *)notification
-   /* Prevent the cursor from being drawn outside the text area.  */
+   }
-   r = NSIntersectionRect (r, ns_row_rect (w, glyph_row, TEXT_AREA));
+ #endif
 +#ifdef NS_IMPL_COCOA
-+  /* Accessibility: store cursor rect for VoiceOver bounds queries.
+  /* Auto-detect Zoom and VoiceOver at startup and whenever their state
-+     accessibilityBoundsForRange: / accessibilityFrameForRange:
+     changes.  The "com.apple.accessibility.api" distributed notification
-+     use this as a fallback when no valid window/glyph data is
+     fires when any assistive technology connects or disconnects.
-+     available.  Skipped when ns-accessibility-enabled is nil.  */
+     Both code paths set ns_accessibility_enabled so that one variable
-+  {
+     gates all our accessibility overhead.  */
-+    EmacsView *view = FRAME_NS_VIEW (f);
+  [self ns_update_accessibility_state];
-+    if (view && on_p && active_p && ns_accessibility_enabled)
+  [[NSDistributedNotificationCenter defaultCenter]
-+      view->lastCursorRect = r;
+    addObserver: self
-+  }
+       selector: @selector(ns_accessibility_did_change:)
 +	   name: @"com.apple.accessibility.api"
 +	 object: nil
 +suspensionBehavior: NSNotificationSuspensionBehaviorDeliverImmediately];
 +#endif
 +
-   ns_focus (f, NULL, 0);
+   ns_send_appdefined (-2);
 }
-   NSGraphicsContext *ctx = [NSGraphicsContext currentContext];
+#ifdef NS_IMPL_COCOA
-@@ -7281,7 +7298,6 @@ - (id)accessibilityTopLevelUIElement
+/* Set ns_accessibility_enabled based on current AT state.
 +   Called at startup and from the "com.apple.accessibility.api"
 +   distributed notification handler.  Checks both UAZoomEnabled()
 +   (Zoom) and AXIsProcessTrustedWithOptions() (VoiceOver and other
 +   ATs that have connected to this process).  */
 +- (void) ns_update_accessibility_state
 +{
 +  NSTRACE ("[EmacsApp ns_update_accessibility_state]");
 +  BOOL zoom_on = UAZoomEnabled ();
 +  NSDictionary *opts = @{(__bridge id) kAXTrustedCheckOptionPrompt: @NO};
 +  BOOL at_on = AXIsProcessTrustedWithOptions ((__bridge CFDictionaryRef) opts);
 +  BOOL new_state = zoom_on || at_on;
 +  if ((BOOL) ns_accessibility_enabled != new_state)
 +    {
 +      ns_accessibility_enabled = new_state;
 +      /* Reset the UAZoomEnabled cache so ns_zoom_enabled_p() reflects
 +	 the new Zoom state on its next call.  */
 +      ns_zoom_cache_time = 0;
 +    }
 +}
 +
 +/* Handler for the "com.apple.accessibility.api" distributed notification,
 +   posted by macOS when any AT (VoiceOver, Switch Control, etc.) starts
 +   or stops.  */
 +- (void) ns_accessibility_did_change: (NSNotification *) notification
 +{
 +  NSTRACE ("[EmacsApp ns_accessibility_did_change:]");
 +  [self ns_update_accessibility_state];
 +}
 +#endif
 +
 - (void)antialiasThresholdDidChange:(NSNotification *)notification
 {
 #ifdef NS_IMPL_COCOA
@@ -7656,7 +7707,6 @@ - (id)accessibilityTopLevelUIElement
@@ -107,23 +158,78 @@ index c852929..f0e8751 100644
 static BOOL
 ns_ax_find_completion_overlay_range (struct buffer *b, ptrdiff_t point,
 				     ptrdiff_t *out_start,
-@@ -8375,7 +8391,6 @@ - (NSRect)accessibilityFrame
+@@ -8789,7 +8839,6 @@ - (NSRect)accessibilityFrame
 @end
 -
 /* ===================================================================
-    EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+    EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
-@@ -8920,7 +8935,6 @@ - (NSRect)accessibilityFrame
+@@ -9283,6 +9332,54 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
 	  granularity = ns_ax_text_selection_granularity_line;
 	}
 +      /* Treat all moves as Emacs-initiated until voiceoverSetPoint
 +	 tracking is introduced (subsequent patch).  */
 +      BOOL emacsMovedCursor = YES;
 +
 +      /* Programmatic jumps that cross a line boundary (]], [[, M-<,
 +	 xref, imenu, …) are discontiguous: the cursor teleported to an
 +	 arbitrary position, not one sequential step forward/backward.
 +	 Reporting AXTextSelectionDirectionDiscontiguous causes VoiceOver
 +	 to re-anchor its rotor browse cursor at the new
 +	 accessibilitySelectedTextRange rather than advancing linearly
 +	 from its previous internal position.  */
 +      if (!isCtrlNP && granularity == ns_ax_text_selection_granularity_line)
 +	direction = ns_ax_text_selection_direction_discontiguous;
 +
 +      /* If Emacs moved the cursor (not VoiceOver), force discontiguous
 +	 so VoiceOver re-anchors its browse cursor to the current
 +	 accessibilitySelectedTextRange.  This covers all Emacs-initiated
 +	 moves: editing commands, ELisp, isearch, etc.
 +	 Exception: C-n/C-p (isCtrlNP) already uses next/previous with
 +	 line granularity; those are already sequential and VoiceOver
 +	 handles them correctly.  */
 +      if (emacsMovedCursor && !isCtrlNP)
 +	direction = ns_ax_text_selection_direction_discontiguous;
 +
 +      /* Re-anchor VoiceOver's browse cursor for discontiguous (teleport)
 +	 moves only.  For sequential C-n/C-p (isCtrlNP), posting
 +	 FocusedUIElementChanged on the window races with the
 +	 AXSelectedTextChanged(granularity=line) notification and
 +	 causes VoiceOver to drop the line-read speech.  Sequential
 +	 moves are already handled correctly by AXSelectedTextChanged
 +	 with direction=next/previous + granularity=line.  */
 +      if (emacsMovedCursor && !isCtrlNP && [self isAccessibilityFocused])
 +	{
 +	  NSWindow *win = [self.emacsView window];
 +	  if (win)
 +	    ns_ax_post_notification (
 +	      win,
 +	      NSAccessibilityFocusedUIElementChangedNotification);
 +
 +	  NSDictionary *layoutInfo = @{
 +	    NSAccessibilityUIElementsKey: @[self]
 +	  };
 +	  ns_ax_post_notification_with_info (
 +	    self.emacsView,
 +	    NSAccessibilityLayoutChangedNotification,
 +	    layoutInfo);
 +	}
 +
       /* Post notifications for focused and non-focused elements.  */
       if ([self isAccessibilityFocused])
 	[self postFocusedCursorNotification:point
@@ -9395,7 +9492,6 @@ - (NSRect)accessibilityFrame
 @end
 -
 /* ===================================================================
-    EmacsAccessibilityInteractiveSpan — helpers and implementation
+    EmacsAccessibilityInteractiveSpan --- helpers and implementation
    =================================================================== */
-@@ -9250,6 +9264,7 @@ - (void)dealloc
+@@ -9733,6 +9829,7 @@ - (void)dealloc
   [layer release];
 #endif
@@ -131,7 +237,7 @@ index c852929..f0e8751 100644
   [[self menu] release];
   [super dealloc];
 }
-@@ -10598,6 +10613,32 @@ - (void)windowDidBecomeKey      /* for direct calls */
+@@ -11081,6 +11178,32 @@ - (void)windowDidBecomeKey      /* for direct calls */
   XSETFRAME (event.frame_or_window, emacsframe);
   kbd_buffer_store_event (&event);
   ns_send_appdefined (-1);  // Kick main loop
@@ -164,7 +270,7 @@ index c852929..f0e8751 100644
 }
-@@ -11835,6 +11876,332 @@ - (int) fullscreenState
+@@ -12318,6 +12441,332 @@ - (int) fullscreenState
   return fs_state;
 }
@@ -184,7 +290,7 @@ index c852929..f0e8751 100644
 +
 +  if (WINDOW_LEAF_P (w))
 +    {
-+      /* Buffer element — reuse existing if available.  */
+      /* Buffer element --- reuse existing if available.  */
 +      EmacsAccessibilityBuffer *elem
 +	= [existing objectForKey:[NSValue valueWithPointer:w]];
 +      if (!elem)
@@ -218,7 +324,7 @@ index c852929..f0e8751 100644
 +    }
 +  else
 +    {
-+      /* Internal (combination) window — recurse into children.  */
+      /* Internal (combination) window --- recurse into children.  */
 +      Lisp_Object child = w->contents;
 +      while (!NILP (child))
 +	{
@@ -330,7 +436,7 @@ index c852929..f0e8751 100644
 +  accessibilityUpdating = YES;
 +
 +  /* Detect window tree change (split, delete, new buffer).  Compare
-+     FRAME_ROOT_WINDOW — if it changed, the tree structure changed.  */
+     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
 +  Lisp_Object curRoot = FRAME_ROOT_WINDOW (emacsframe);
 +  if (!EQ (curRoot, lastRootWindow))
 +    {
@@ -339,12 +445,12 @@ index c852929..f0e8751 100644
 +    }
 +
 +  /* If tree is stale, rebuild FIRST so we don't iterate freed
-+     window pointers.  Skip notifications for this cycle — the
+     window pointers.  Skip notifications for this cycle --- the
 +     freshly-built elements have no previous state to diff against.  */
 +  if (!accessibilityTreeValid)
 +    {
 +      [self rebuildAccessibilityTree];
-+      /* Invalidate span cache — window layout changed.  */
+      /* Invalidate span cache --- window layout changed.  */
 +      for (EmacsAccessibilityElement *elem in accessibilityElements)
 +	if ([elem isKindOfClass: [EmacsAccessibilityBuffer class]])
 +	  [(EmacsAccessibilityBuffer *) elem invalidateInteractiveSpans];
@@ -497,6 +603,30 @@ index c852929..f0e8751 100644
 @end  /* EmacsView */
@@ -14314,12 +14763,17 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
   ns_use_srgb_colorspace = YES;
   DEFVAR_BOOL ("ns-accessibility-enabled", ns_accessibility_enabled,
 -     doc: /* Non-nil means expose buffer content to the macOS accessibility
 -subsystem (VoiceOver, Zoom, and other assistive technology).
 -When nil, the accessibility virtual element tree is not built and no
 -notifications are posted, eliminating the associated overhead.
 -Requires the Cocoa (NS) build on macOS; ignored on GNUstep.
 -Default is nil.  Set to t to enable VoiceOver support.  */);
 +     doc: /* Non-nil enables Zoom cursor tracking and VoiceOver support.
 +Emacs sets this automatically at startup when macOS Zoom is active or
 +any assistive technology (VoiceOver, Switch Control, etc.) is connected,
 +and updates it whenever that state changes.  You can override manually:
 +
 +  (setq ns-accessibility-enabled t)   ; always on
 +  (setq ns-accessibility-enabled nil) ; always off
 +
 +When nil, no AX tree is built and no notifications are posted,
 +giving zero per-redisplay overhead.
 +Requires the Cocoa (NS) build on macOS; ignored on GNUstep.  */);
   ns_accessibility_enabled = NO;
   DEFVAR_BOOL ("ns-use-mwheel-acceleration",
 -- 
 2.43.0
--- a/patches/0006-doc-add-VoiceOver-accessibility-section-to-macOS-app.patch
+++ b/patches/0006-doc-add-VoiceOver-accessibility-section-to-macOS-app.patch
@@ -1,17 +1,22 @@
-From 683d7497cc3414a231b44363dd28d2748780c38a Mon Sep 17 00:00:00 2001
+From 274c545be1a3af3c7e6f416ac3a22e3b98626b0b Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
 Date: Sat, 28 Feb 2026 12:58:11 +0100
-Subject: [PATCH 6/8] doc: add VoiceOver accessibility section to macOS
+Subject: [PATCH 7/9] doc: add VoiceOver accessibility section to macOS
 appendix
-* doc/emacs/macos.texi (VoiceOver Accessibility): New node.  Document
+* doc/emacs/macos.texi (VoiceOver Accessibility): New node between
-screen reader usage, keyboard navigation, completion announcements,
+'Mac / GNUstep Events' and 'GNUstep Support'.  Document screen reader
 usage, keyboard navigation, completion announcements, ns-accessibility-
 enabled, and known limitations.  Use @xref for cross-reference at
 sentence start.  Correct description of ns-accessibility-enabled
 default: initial value is nil, set automatically at startup.
 ---
- doc/emacs/macos.texi | 75 ++++++++++++++++++++++++++++++++++++++++++++
+ doc/emacs/macos.texi | 77 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 75 insertions(+)
+ src/nsterm.m         | 10 ++++--
 2 files changed, 84 insertions(+), 3 deletions(-)
 diff --git a/doc/emacs/macos.texi b/doc/emacs/macos.texi
-index 6bd334f..4825cf9 100644
+index 6bd334f48e..72ac3a9aa9 100644
 --- a/doc/emacs/macos.texi
 +++ b/doc/emacs/macos.texi
@@ -36,6 +36,7 @@ Support}), but we hope to improve it in the future.
@@ -22,7 +27,7 @@ index 6bd334f..4825cf9 100644
 * GNUstep Support::             Details on status of GNUstep support.
 @end menu
-@@ -272,6 +273,80 @@ and return the result as a string.  You can also use the Lisp function
+@@ -272,6 +273,82 @@ and return the result as a string.  You can also use the Lisp function
 services and receive the results back.  Note that you may need to
 restart Emacs to access newly-available services.
@@ -70,8 +75,9 @@ index 6bd334f..4825cf9 100644
 +@vindex ns-accessibility-enabled
 +  To disable the accessibility interface entirely (for instance, to
 +eliminate overhead on systems where assistive technology is not in
-+use), set @code{ns-accessibility-enabled} to @code{nil}.  The default
+use), set @code{ns-accessibility-enabled} to @code{nil}.  Emacs
-+is @code{t}.
+detects the presence of assistive technology at startup and sets this
 +variable automatically; the initial value is @code{nil}.
 +
 +@subheading Known Limitations
 +
@@ -82,7 +88,7 @@ index 6bd334f..4825cf9 100644
 +are fast.
 +@item
 +Mode-line text extraction handles only character glyphs.  Mode lines
-+using icon fonts (e.g., @code{doom-modeline} with nerd-font icons)
+using icon fonts (e.g., icon-based mode-lines)
 +produce incomplete accessibility text.
 +@item
 +The accessibility virtual element tree is rebuilt automatically on
@@ -91,18 +97,40 @@ index 6bd334f..4825cf9 100644
 +Right-to-left (bidi) text is exposed correctly as buffer content,
 +but @code{accessibilityRangeForPosition} hit-testing assumes
 +left-to-right glyph layout.
 +@item
 +Block-style cursors are handled correctly: character navigation
 +announces the character at the cursor position, not the character
 +before it.
 +@end itemize
 +
-+  This support is available only on the Cocoa build; GNUstep has a
+  This support is available only on the Cocoa build.  GNUstep has a
-+different accessibility model and is not yet supported
+different accessibility model and is not yet supported.
 +(@pxref{GNUstep Support}).  Evil-mode block cursors are handled
 +correctly: character navigation announces the character at the cursor
 +position, not the character before it.
 +
 +
 @node GNUstep Support
 @section GNUstep Support
 diff --git a/src/nsterm.m b/src/nsterm.m
 index c3cd83b774..e4e43dd7a3 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
@@ -14764,9 +14764,13 @@ Nil means use fullscreen the old (< 10.7) way.  The old way works better with
   DEFVAR_BOOL ("ns-accessibility-enabled", ns_accessibility_enabled,
      doc: /* Non-nil enables Zoom cursor tracking and VoiceOver support.
 -Emacs sets this automatically at startup when macOS Zoom is active or
 -any assistive technology (VoiceOver, Switch Control, etc.) is connected,
 -and updates it whenever that state changes.  You can override manually:
 +Emacs detects at startup whether macOS Zoom is active or an assistive
 +technology (VoiceOver, Switch Control, etc.) is connected, and sets
 +this variable accordingly.  It updates automatically when accessibility
 +state changes.  The initial value is nil; it becomes non-nil only when
 +an AT is detected.
 +
 +You can override the auto-detection:
   (setq ns-accessibility-enabled t)   ; always on
   (setq ns-accessibility-enabled nil) ; always off
 -- 
 2.43.0
--- a/patches/0007-ns-announce-overlay-completion-candidates-for-VoiceO.patch
+++ b/patches/0007-ns-announce-overlay-completion-candidates-for-VoiceO.patch
@@ -1,58 +1,43 @@
-From 8561d7b8a00b9a7772c718f86fdde770e1c73d41 Mon Sep 17 00:00:00 2001
+From b87fb2b1824761fe3d91a27afe966eada39c1c45 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
-Date: Sat, 28 Feb 2026 14:46:25 +0100
+Date: Mon, 2 Mar 2026 18:39:46 +0100
-Subject: [PATCH 7/8] ns: announce overlay completion candidates for VoiceOver
+Subject: [PATCH 8/9] ns: announce overlay completion candidates for VoiceOver
 Completion frameworks such as Vertico, Ivy, and Icomplete render
-candidates via overlay before-string/after-string properties rather
+candidates via overlay before-string/after-string properties.  Without
-than buffer text.  Without this patch, VoiceOver cannot read
+this change VoiceOver cannot read overlay-based completion UIs.
 overlay-based completion UIs.
-Identify the selected candidate by scanning overlay strings for a
+* src/nsterm.m (ns_ax_selected_overlay_text): New function; scan
-face whose symbol name contains "current", "selected", or
+overlay strings in the window for a line with a selected face; return
-"selection" --- this matches vertico-current, icomplete-selected-match,
+its text.
-ivy-current-match, company-tooltip-selection, and similar framework
+(accessibilityStringForRange:, accessibilityAttributedStringForRange:)
-faces without hard-coding any specific name.
+(accessibilityRangeForLine:): New NSAccessibility protocol methods.
-
+Moved here from planned patch 0008 to keep the AX protocol interface
-Key implementation details:
+complete before notification logic uses it.
-
+(ensureTextCache): Switch cache-validity counter from BUF_CHARS_MODIFF
- The overlay detection branch runs independently (if, not else-if)
+to BUF_MODIFF.  Fold/unfold commands (org-mode, outline-mode,
-  of the text-change branch, because Vertico bumps both BUF_MODIFF
+hideshow-mode) change the 'invisible text property via
-  (via text property changes in vertico--prompt-selection) and
+`put-text-property', which bumps BUF_MODIFF but not BUF_CHARS_MODIFF.
-  BUF_OVERLAY_MODIFF (via overlay-put) in the same command cycle.
+Using BUF_CHARS_MODIFF would serve stale AX text across fold/unfold.
-
+The rebuild is O(visible-buffer-text) but ensureTextCache is called
- Use BUF_CHARS_MODIFF to gate ValueChanged notifications, since
+exclusively from AX getters at human interaction speed, never from the
-  text property changes bump BUF_MODIFF but not BUF_CHARS_MODIFF.
+redisplay notification path; font-lock passes cause zero rebuild cost.
-
+(postAccessibilityNotificationsForFrame:): Handle BUF_OVERLAY_MODIFF
- Remove BUF_OVERLAY_MODIFF from ensureTextCache validity checks
+changes independently of text changes.  Use BUF_CHARS_MODIFF to gate
-  to prevent a race condition where VoiceOver AX queries silently
+ValueChanged.  Do not call ensureTextCache from the cursor-moved branch:
-  consume the overlay change before the notification dispatch runs.
+the granularity detection uses cachedText directly (falling back to
-
+granularity_unknown when the cache is absent), so font-lock passes
- Announce via AnnouncementRequested to NSApp with High priority.
+cannot trigger O(buffer-size) rebuilds via the notification path.
  Do not post SelectedTextChanged (that reads the AX text at cursor
  position, which is the minibuffer input, not the candidate).
  candidate line start.  The flag is cleared when the user types
  (BUF_CHARS_MODIFF changes) or when no candidate is found
  (minibuffer exit, C-g).
 (EmacsAccessibilityBuffer): Add cachedCharsModiff.
 * src/nsterm.m (ns_ax_face_is_selected): New predicate.  Match
 "current", "selected", and "selection" in face symbol names.
 (ns_ax_selected_overlay_text): New function.
 (EmacsAccessibilityBuffer ensureTextCache): Remove overlay_modiff.
 (EmacsAccessibilityBuffer postAccessibilityNotificationsForFrame:):
 Independent overlay branch, BUF_CHARS_MODIFF gating, candidate
 ---
 src/nsterm.h |   1 +
- src/nsterm.m | 308 +++++++++++++++++++++++++++++++++++++++++++++------
+ src/nsterm.m | 384 ++++++++++++++++++++++++++++++++++++++++-----------
- 2 files changed, 277 insertions(+), 32 deletions(-)
+ 2 files changed, 306 insertions(+), 79 deletions(-)
 diff --git a/src/nsterm.h b/src/nsterm.h
-index ec7b587..19a7e7a 100644
+index 4bf79a9adb..72ca210bb0 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -509,6 +509,7 @@ typedef struct ns_ax_visible_run
+@@ -510,6 +510,7 @@ typedef struct ns_ax_visible_run
 @property (nonatomic, assign) ptrdiff_t cachedOverlayModiff;
 @property (nonatomic, assign) ptrdiff_t cachedTextStart;
 @property (nonatomic, assign) ptrdiff_t cachedModiff;
@@ -61,10 +46,10 @@ index ec7b587..19a7e7a 100644
 @property (nonatomic, assign) BOOL cachedMarkActive;
 @property (nonatomic, copy) NSString *cachedCompletionAnnouncement;
 diff --git a/src/nsterm.m b/src/nsterm.m
-index f0e8751..72478e0 100644
+index e4e43dd7a3..c9fe93a57b 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -6884,11 +6884,154 @@ Accessibility virtual elements (macOS / Cocoa only)
+@@ -7263,11 +7263,154 @@ Accessibility virtual elements (macOS / Cocoa only)
 /* ---- Helper: extract buffer text for accessibility ---- */
@@ -220,25 +205,57 @@ index f0e8751..72478e0 100644
 static NSString *
 ns_ax_buffer_text (struct window *w, ptrdiff_t *out_start,
 		   ns_ax_visible_run **out_runs, NSUInteger *out_nruns)
-@@ -6959,7 +7102,7 @@ Accessibility virtual elements (macOS / Cocoa only)
+@@ -7343,7 +7486,7 @@ Accessibility virtual elements (macOS / Cocoa only)
       /* Extract this visible run's text.  Use
 	 Fbuffer_substring_no_properties which correctly handles the
-	 buffer gap — raw BUF_BYTE_ADDRESS reads across the gap would
+-	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 +	 buffer gap --- raw BUF_BYTE_ADDRESS reads across the gap would
 	 include garbage bytes when the run spans the gap position.  */
       Lisp_Object lstr = Fbuffer_substring_no_properties (
 	make_fixnum (pos), make_fixnum (run_end));
-@@ -7040,7 +7183,7 @@ Mode lines using icon fonts (e.g. doom-modeline with nerd-font)
+@@ -7424,7 +7567,7 @@ Mode lines using icon fonts (e.g. nerd-font icons)
     return NSZeroRect;
   /* charpos_start and charpos_len are already in buffer charpos
-     space — the caller maps AX string indices through
+-     space --- the caller maps AX string indices through
 +     space --- the caller maps AX string indices through
      charposForAccessibilityIndex which handles invisible text.  */
   ptrdiff_t cp_start = charpos_start;
   ptrdiff_t cp_end = cp_start + charpos_len;
-@@ -7519,6 +7662,7 @@ @implementation EmacsAccessibilityBuffer
+@@ -7606,31 +7749,6 @@ already on the main queue (e.g., inside postAccessibilityUpdates
    freeing the main queue for VoiceOver's dispatch_sync calls.  */
 -/* Return true if FACE (a symbol or list of symbols) looks like a
 -   "selected item" face.  Substring match is intentionally broad ---
 -   it catches vertico-current, icomplete-selected-match,
 -   ivy-current-match, company-tooltip-selection, and similar.
 -   False positives are harmless: this runs only on overlay/child-frame
 -   strings during completion, never in a hot redisplay path.  */
 -static bool
 -ns_ax_face_is_selected (Lisp_Object face)
 -{
 -  if (SYMBOLP (face) && !NILP (face))
 -    {
 -      const char *name = SSDATA (SYMBOL_NAME (face));
 -      if (strstr (name, "current") || strstr (name, "selected")
 -	  || strstr (name, "selection"))
 -	return true;
 -    }
 -  if (CONSP (face))
 -    {
 -      for (Lisp_Object tail = face; CONSP (tail); tail = XCDR (tail))
 -	if (ns_ax_face_is_selected (XCAR (tail)))
 -	  return true;
 -    }
 -  return false;
 -}
 -
 static inline void
 ns_ax_post_notification (id element,
 			  NSAccessibilityNotificationName name)
 {
@@ -7924,6 +8043,7 @@ @implementation EmacsAccessibilityBuffer
 @synthesize cachedOverlayModiff;
 @synthesize cachedTextStart;
 @synthesize cachedModiff;
@@ -246,174 +263,229 @@ index f0e8751..72478e0 100644
 @synthesize cachedPoint;
 @synthesize cachedMarkActive;
 @synthesize cachedCompletionAnnouncement;
-@@ -7616,7 +7760,7 @@ - (void)ensureTextCache
+@@ -8021,7 +8141,7 @@ - (void)ensureTextCache
   NSTRACE ("EmacsAccessibilityBuffer ensureTextCache");
   /* This method is only called from the main thread (AX getters
      dispatch_sync to main first).  Reads of cachedText/cachedTextModiff
-     below are therefore safe without @synchronized — only the
+-     below are therefore safe without @synchronized --- only the
 +     below are therefore safe without @synchronized --- only the
      write section at the end needs synchronization to protect
      against concurrent reads from AX server thread.  */
   eassert ([NSThread isMainThread]);
-@@ -7629,16 +7773,15 @@ - (void)ensureTextCache
+@@ -8033,25 +8153,38 @@ - (void)ensureTextCache
   if (!b)
     return;
-   ptrdiff_t modiff = BUF_MODIFF (b);
+-  /* Use BUF_CHARS_MODIFF, not BUF_MODIFF, for cache validity.
-  ptrdiff_t overlay_modiff = BUF_OVERLAY_MODIFF (b);
+-     BUF_MODIFF is bumped by every text-property change, including
 -     font-lock face applications on every redisplay.  AX text contains
 -     only characters, not face data, so property-only changes do not
 -     affect the cached value.  Rebuilding the full buffer text on
 -     each font-lock pass is O(buffer-size) per redisplay --- this
 -     causes progressive slowdown when scrolling through large files.
 -     BUF_CHARS_MODIFF is bumped only on actual character insertions
 -     and deletions, matching the semantic of "did the text change".
 -     This is the pattern used by WebKit and NSTextView.
 -     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
 -     included in the cached AX text (it is handled separately via
 -     explicit announcements in postAccessibilityNotificationsForFrame).
 -     Including overlay_modiff would silently update cachedOverlayModiff
 -     and prevent the notification dispatch from detecting changes.  */
 -  ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
 +  /* Use BUF_MODIFF, not BUF_CHARS_MODIFF, for cache validity.
 +
 +     Fold/unfold commands (org-mode, outline-mode, hideshow-mode) change
 +     text visibility by modifying the 'invisible text property via
 +     `put-text-property' or `add-text-properties'.  These bump BUF_MODIFF
 +     but NOT BUF_CHARS_MODIFF, because no characters are inserted or
 +     deleted.  Using only BUF_CHARS_MODIFF would serve stale AX text
 +     across fold/unfold: VoiceOver would continue reading hidden content
 +     as if it were visible, or miss newly revealed content entirely.
 +
 +     BUF_MODIFF is bumped by all buffer modifications including
 +     text-property changes (e.g. font-lock face assignments).  The
 +     per-rebuild cost is O(visible-buffer-text), but `ensureTextCache'
 +     is called exclusively from AX getters (accessibilityValue,
 +     accessibilitySelectedTextRange, etc.) which run at human interaction
 +     speed --- not from the redisplay notification path.  Font-lock
 +     passes do not call this method, so the rebuild cost per font-lock
 +     cycle is zero.  The redisplay notification path (postAccessibility-
 +     NotificationsForFrame:) uses cachedText directly without calling
 +     ensureTextCache; granularity detection falls back gracefully when
 +     the cache is absent.
 +
 +     Do NOT use BUF_OVERLAY_MODIFF alone: org-mode >= 29 (org-fold-core)
 +     uses text properties, not overlays, for folding, so
 +     BUF_OVERLAY_MODIFF would miss those changes.  Additionally, modes
 +     like hl-line-mode bump BUF_OVERLAY_MODIFF on every
 +     post-command-hook, yielding the same per-keystroke rebuild cost as
 +     BUF_MODIFF, with none of its correctness guarantee.  */
 +  ptrdiff_t modiff = BUF_MODIFF (b);
   ptrdiff_t pt = BUF_PT (b);
   NSUInteger textLen = cachedText ? [cachedText length] : 0;
-  /* Track both BUF_MODIFF and BUF_OVERLAY_MODIFF.  Overlay-only
+-  if (cachedText && cachedTextModiff == chars_modiff
-     changes (e.g., timer-based completion highlight move without
+  if (cachedText && cachedTextModiff == modiff
 -     text edit) bump overlay_modiff but not modiff.  Also detect
 -     narrowing/widening which changes BUF_BEGV without bumping
 -     either modiff counter.  */
 +  /* Cache validity: track BUF_MODIFF and buffer narrowing.
 +     Do NOT track BUF_OVERLAY_MODIFF here --- overlay text is not
 +     included in the cached AX text (it is handled separately via
 +     explicit announcements).  Including overlay_modiff would
 +     silently update cachedOverlayModiff and prevent the
 +     notification dispatch from detecting overlay changes.  */
   if (cachedText && cachedTextModiff == modiff
 -      && cachedOverlayModiff == overlay_modiff
       && cachedTextStart == BUF_BEGV (b)
       && pt >= cachedTextStart
       && (textLen == 0
-@@ -7655,7 +7798,6 @@ - (void)ensureTextCache
+@@ -8067,7 +8200,7 @@ included in the cached AX text (it is handled separately via
     {
       [cachedText release];
       cachedText = [text retain];
-       cachedTextModiff = modiff;
+-      cachedTextModiff = chars_modiff;
-      cachedOverlayModiff = overlay_modiff;
+      cachedTextModiff = modiff;
       cachedTextStart = start;
       if (visibleRuns)
-@@ -7720,7 +7862,7 @@ - (NSUInteger)accessibilityIndexForCharpos:(ptrdiff_t)charpos
+@@ -8079,9 +8212,9 @@ included in the cached AX text (it is handled separately via
 	 Walk the cached text once, recording the start offset of each
 	 line.  Uses NSString lineRangeForRange: --- O(N) in the total
 	 text --- but this loop runs only on cache rebuild, which is
 -	 gated on BUF_CHARS_MODIFF: actual character insertions or
 -	 deletions.  Font-lock (text property changes) does not trigger
 -	 a rebuild, so the hot path (cursor movement, redisplay) never
 +	 gated on BUF_MODIFF changes.  Rebuilds happen when any buffer
 +	 modification occurs (including fold/unfold), ensuring the line
 +	 index always matches the currently visible text.
 	 enters this code.  */
       if (lineStartOffsets)
 	xfree (lineStartOffsets);
@@ -8136,7 +8269,7 @@ - (NSUInteger)accessibilityIndexForCharpos:(ptrdiff_t)charpos
   /* Binary search: runs are sorted by charpos (ascending).  Find the
      run whose [charpos, charpos+length) range contains the target,
      or the nearest run after an invisible gap.  O(log n) instead of
-     O(n) — matters for org-mode with many folded sections.  */
+-     O(n) --- matters for org-mode with many folded sections.  */
 +     O(n) --- matters for org-mode with many folded sections.  */
   NSUInteger lo = 0, hi = visibleRunCount;
   while (lo < hi)
     {
-@@ -7733,7 +7875,7 @@ - (NSUInteger)accessibilityIndexForCharpos:(ptrdiff_t)charpos
+@@ -8185,10 +8318,10 @@ by run length (visible window), not total buffer size.  */
       else
 	{
 	  /* Found: charpos is inside this run.  Compute UTF-16 delta
 -	     directly from cachedText — no Lisp calls needed.  */
 +	     directly from cachedText --- no Lisp calls needed.  */
 	  NSUInteger chars_in = (NSUInteger)(charpos - r->charpos);
 	  if (chars_in == 0 || !cachedText)
 	    return r->ax_start;
@@ -7758,10 +7900,10 @@ - (NSUInteger)accessibilityIndexForCharpos:(ptrdiff_t)charpos
 /* Convert accessibility string index to buffer charpos.
    Safe to call from any thread: uses only cachedText (NSString) and
-   visibleRuns — no Lisp calls.  */
+-   visibleRuns --- no Lisp calls.  */
 +   visibleRuns --- no Lisp calls.  */
 - (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
 {
-  /* May be called from AX server thread — synchronize.  */
+-  /* May be called from AX server thread --- synchronize.  */
 +  /* May be called from AX server thread --- synchronize.  */
   @synchronized (self)
   {
   if (visibleRunCount == 0)
-@@ -7795,7 +7937,7 @@ - (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
+@@ -8230,7 +8363,7 @@ the slow path (composed character sequence walk), which is
 	  return cp;
 	}
     }
-  /* Past end — return last charpos.  */
+-  /* Past end --- return last charpos.  */
 +  /* Past end --- return last charpos.  */
   if (lo > 0)
     {
       ns_ax_visible_run *last = &visibleRuns[visibleRunCount - 1];
-@@ -7817,7 +7959,7 @@ - (ptrdiff_t)charposForAccessibilityIndex:(NSUInteger)ax_idx
+@@ -8252,7 +8385,7 @@ the slow path (composed character sequence walk), which is
    deadlocking the AX server thread.  This is prevented by:
      1. validWindow checks WINDOW_LIVE_P and BUFFERP before every
-        Lisp access — the window and buffer are verified live.
+-        Lisp access --- the window and buffer are verified live.
 +        Lisp access --- the window and buffer are verified live.
      2. All dispatch_sync blocks run on the main thread where no
         concurrent Lisp code can modify state between checks.
      3. block_input prevents timer events and process output from
-@@ -8171,6 +8313,50 @@ - (NSInteger)accessibilityInsertionPointLineNumber
+@@ -8597,26 +8730,26 @@ - (NSInteger)accessibilityInsertionPointLineNumber
   return [self lineForAXIndex:point_idx];
 }
 -- (NSRange)accessibilityRangeForLine:(NSInteger)line
 +- (NSString *)accessibilityStringForRange:(NSRange)range
-+{
+ {
-+  if (![NSThread isMainThread])
+   if (![NSThread isMainThread])
-+    {
+     {
 -      __block NSRange result;
 +      __block NSString *result;
-+      dispatch_sync (dispatch_get_main_queue (), ^{
+       dispatch_sync (dispatch_get_main_queue (), ^{
 -	  result = [self accessibilityRangeForLine:line];
 +	  result = [self accessibilityStringForRange:range];
-+	});
+ 	});
-+      return result;
+       return result;
-+    }
+     }
-+  [self ensureTextCache];
+   [self ensureTextCache];
 -  if (!cachedText || line < 0)
 -    return NSMakeRange (NSNotFound, 0);
 -
 -  NSUInteger len = [cachedText length];
 -  if (len == 0)
 -    return (line == 0) ? NSMakeRange (0, 0)
 -		       : NSMakeRange (NSNotFound, 0);
 +  if (!cachedText || range.location + range.length > [cachedText length])
 +    return @"";
 +  return [cachedText substringWithRange:range];
 +}
-+
+ 
 -  return [self rangeForLine:(NSUInteger)line textLength:len];
 +- (NSAttributedString *)accessibilityAttributedStringForRange:(NSRange)range
 +{
 +  NSString *str = [self accessibilityStringForRange:range];
 +  return [[[NSAttributedString alloc] initWithString:str] autorelease];
 }
 - (NSInteger)accessibilityLineForIndex:(NSInteger)index
@@ -8638,6 +8771,29 @@ - (NSInteger)accessibilityLineForIndex:(NSInteger)index
     idx = [cachedText length];
   return [self lineForAXIndex:idx];
 +
 +}
 +
-+- (NSInteger)accessibilityLineForIndex:(NSInteger)index
+- (NSRange)accessibilityRangeForLine:(NSInteger)line
 +{
 +  if (![NSThread isMainThread])
 +    {
-+      __block NSInteger result;
+      __block NSRange result;
 +      dispatch_sync (dispatch_get_main_queue (), ^{
-+	  result = [self accessibilityLineForIndex:index];
+	  result = [self accessibilityRangeForLine:line];
 +	});
 +      return result;
 +    }
 +  [self ensureTextCache];
-+  if (!cachedText || index < 0)
+  if (!cachedText || line < 0)
-+    return 0;
+    return NSMakeRange (NSNotFound, 0);
 +
-+  NSUInteger idx = (NSUInteger) index;
+  NSUInteger len = [cachedText length];
-+  if (idx > [cachedText length])
+  if (len == 0)
-+    idx = [cachedText length];
+    return (line == 0) ? NSMakeRange (0, 0)
 +		       : NSMakeRange (NSNotFound, 0);
 +
-+  return [self lineForAXIndex:idx];
+  return [self rangeForLine:(NSUInteger)line textLength:len];
-+
+ }
-+}
+ 
-+
+ - (NSRange)accessibilityRangeForIndex:(NSInteger)index
- - (NSRange)accessibilityRangeForLine:(NSInteger)line
+@@ -8840,7 +8996,7 @@ - (NSRect)accessibilityFrame
 {
   if (![NSThread isMainThread])
@@ -8392,7 +8578,7 @@ - (NSRect)accessibilityFrame
 /* ===================================================================
-   EmacsAccessibilityBuffer (Notifications) — AX event dispatch
+-   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
 +   EmacsAccessibilityBuffer (Notifications) --- AX event dispatch
    These methods notify VoiceOver of text and selection changes.
    Called from the redisplay cycle (postAccessibilityUpdates).
-@@ -8407,7 +8593,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
+@@ -8855,7 +9011,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
   if (point > self.cachedPoint
       && point - self.cachedPoint == 1)
     {
-      /* Single char inserted — refresh cache and grab it.  */
+-      /* Single char inserted --- refresh cache and grab it.  */
 +      /* Single char inserted --- refresh cache and grab it.  */
       [self invalidateTextCache];
       [self ensureTextCache];
       if (cachedText)
-@@ -8426,7 +8612,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
+@@ -8874,7 +9030,7 @@ - (void)postTextChangedNotification:(ptrdiff_t)point
   /* Update cachedPoint here so the selection-move branch does NOT
      fire for point changes caused by edits.  WebKit and Chromium
      never send both ValueChanged and SelectedTextChanged for the
-     same user action — they are mutually exclusive.  */
+-     same user action --- they are mutually exclusive.  */
 +     same user action --- they are mutually exclusive.  */
   self.cachedPoint = point;
   NSDictionary *change = @{
-@@ -8759,14 +8945,72 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
+@@ -9268,16 +9424,80 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
   BOOL markActive = !NILP (BVAR (b, mark_active));
   /* --- Text changed (edit) --- */
@@ -450,118 +522,108 @@ index f0e8751..72478e0 100644
 +    {
 +      self.cachedOverlayModiff = BUF_OVERLAY_MODIFF (b);
 +
-+      int selected_line = -1;
+      /* Overlay completion candidates (Vertico, Icomplete, Ivy) are
-+      NSString *candidate
+	 displayed in the minibuffer.  In normal editing buffers,
-+	= ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
+	 font-lock and other modes change BUF_OVERLAY_MODIFF on
-+				       &selected_line);
+	 every redisplay, triggering O(overlays) work per keystroke.
-+      if (candidate)
+	 Restrict the scan to minibuffer windows.  */
 +      if (MINI_WINDOW_P (w))
 +	{
-+	  /* Deduplicate: only announce when the candidate changed.  */
+	  int selected_line = -1;
-+	  if (![candidate isEqualToString:
+	  NSString *candidate
-+			    self.cachedCompletionAnnouncement])
+	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
 +					   &selected_line);
 +	  if (candidate)
 +	    {
-+	      self.cachedCompletionAnnouncement = candidate;
+	      /* Deduplicate: only announce when the candidate changed.  */
-+
+	      if (![candidate isEqualToString:
-+	      /* Announce the candidate text directly via NSApp.
+			        self.cachedCompletionAnnouncement])
-+		 Do NOT post SelectedTextChanged --- that would cause
+		{
-+		 VoiceOver to read the AX text at the cursor position
+		  self.cachedCompletionAnnouncement = candidate;
 +		 (the minibuffer input line), not the overlay candidate.
 +		 AnnouncementRequested with High priority interrupts
 +		 any current speech and announces our text.  */
 +	      NSDictionary *annInfo = @{
 +		NSAccessibilityAnnouncementKey: candidate,
 +		NSAccessibilityPriorityKey:
 +		  @(NSAccessibilityPriorityHigh)
 +	      };
 +	      ns_ax_post_notification_with_info (
 +		NSApp,
 +		NSAccessibilityAnnouncementRequestedNotification,
 +		annInfo);
 +
 +		  /* Announce the candidate text directly via NSApp.
 +		     Do NOT post SelectedTextChanged --- that would cause
 +		     VoiceOver to read the AX text at the cursor position
 +		     (the minibuffer input line), not the overlay candidate.
 +		     AnnouncementRequested with High priority interrupts
 +		     any current speech and announces our text.  */
 +		  NSDictionary *annInfo = @{
 +		    NSAccessibilityAnnouncementKey: candidate,
 +		    NSAccessibilityPriorityKey:
 +		      @(NSAccessibilityPriorityHigh)
 +		  };
 +		  ns_ax_post_notification_with_info (
 +		    NSApp,
 +		    NSAccessibilityAnnouncementRequestedNotification,
 +		    annInfo);
 +		}
 +	    }
 +	}
     }
   /* --- Cursor moved or selection changed ---
-     Use 'else if' — edits and selection moves are mutually exclusive
+-     Use 'else if' --- edits and selection moves are mutually exclusive
-+     Use 'else if' --- edits and selection moves are mutually exclusive
+-     per the WebKit/Chromium pattern.  */
-      per the WebKit/Chromium pattern.  */
+-  else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
-   else if (point != self.cachedPoint || markActive != self.cachedMarkActive)
+     Independent check from the overlay branch above.  */
 +  if (point != self.cachedPoint || markActive != self.cachedMarkActive)
     {
-@@ -8936,7 +9180,7 @@ - (NSRect)accessibilityFrame
+       ptrdiff_t oldPoint = self.cachedPoint;
       BOOL oldMarkActive = self.cachedMarkActive;
@@ -9295,8 +9515,14 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
       bool isCtrlNP = ns_ax_event_is_line_nav_key (&ctrlNP);
- 
+       /* --- Granularity detection --- */
- /* ===================================================================
+      /* Use cached text as-is; do NOT call ensureTextCache here.
-   EmacsAccessibilityInteractiveSpan — helpers and implementation
+	 ensureTextCache is O(visible-buffer-text) and must not run on
-+   EmacsAccessibilityInteractiveSpan --- helpers and implementation
+	 every redisplay cycle.  Using stale cached text for granularity
-    =================================================================== */
+	 classification is safe: the worst case is an incorrect
- 
+	 granularity hint (defaulting to unknown), which causes VoiceOver
- /* Scan visible range of window W for interactive spans.
+	 to make its own determination.  Fresh text is always available
-@@ -9127,7 +9371,7 @@ - (NSRect) accessibilityFrame
+	 to VoiceOver via the AX getter path (accessibilityValue etc.).  */
- - (BOOL) isAccessibilityFocused
+       NSInteger granularity = ns_ax_text_selection_granularity_unknown;
- {
+-      [self ensureTextCache];
-   /* Read the cached point stored by EmacsAccessibilityBuffer on the main
+       if (cachedText && oldPoint > 0)
-     thread — safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
+ 	{
-+     thread --- safe to read from any thread (plain ptrdiff_t, no Lisp calls).  */
+ 	  NSUInteger tlen = [cachedText length];
-   EmacsAccessibilityBuffer *pb = self.parentBuffer;
+@@ -12457,7 +12683,7 @@ - (int) fullscreenState
   if (!pb)
     return NO;
@@ -9144,7 +9388,7 @@ - (void) setAccessibilityFocused: (BOOL) focused
   dispatch_async (dispatch_get_main_queue (), ^{
     /* lwin is a Lisp_Object captured by value.  This is GC-safe
        because Lisp_Objects are tagged integers/pointers that
 -       remain valid across GC — GC does not relocate objects in
 +       remain valid across GC --- GC does not relocate objects in
        Emacs.  The WINDOW_LIVE_P check below guards against the
        window being deleted between capture and execution.  */
     if (!WINDOWP (lwin) || NILP (Fwindow_live_p (lwin)))
@@ -9170,7 +9414,7 @@ - (void) setAccessibilityFocused: (BOOL) focused
 @end
 -/* EmacsAccessibilityBuffer — InteractiveSpans category.
 +/* EmacsAccessibilityBuffer --- InteractiveSpans category.
    Methods are kept here (same .m file) so they access the ivars
    declared in the @interface ivar block.  */
 @implementation EmacsAccessibilityBuffer (InteractiveSpans)
@@ -11892,7 +12136,7 @@ - (int) fullscreenState
   if (WINDOW_LEAF_P (w))
     {
-      /* Buffer element — reuse existing if available.  */
+-      /* Buffer element --- reuse existing if available.  */
 +      /* Buffer element --- reuse existing if available.  */
       EmacsAccessibilityBuffer *elem
 	= [existing objectForKey:[NSValue valueWithPointer:w]];
       if (!elem)
-@@ -11926,7 +12170,7 @@ - (int) fullscreenState
+@@ -12491,7 +12717,7 @@ - (int) fullscreenState
     }
   else
     {
-      /* Internal (combination) window — recurse into children.  */
+-      /* Internal (combination) window --- recurse into children.  */
 +      /* Internal (combination) window --- recurse into children.  */
       Lisp_Object child = w->contents;
       while (!NILP (child))
 	{
-@@ -12038,7 +12282,7 @@ - (void)postAccessibilityUpdates
+@@ -12603,7 +12829,7 @@ - (void)postAccessibilityUpdates
   accessibilityUpdating = YES;
   /* Detect window tree change (split, delete, new buffer).  Compare
-     FRAME_ROOT_WINDOW — if it changed, the tree structure changed.  */
+-     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
 +     FRAME_ROOT_WINDOW --- if it changed, the tree structure changed.  */
   Lisp_Object curRoot = FRAME_ROOT_WINDOW (emacsframe);
   if (!EQ (curRoot, lastRootWindow))
     {
-@@ -12047,12 +12291,12 @@ - (void)postAccessibilityUpdates
+@@ -12612,12 +12838,12 @@ - (void)postAccessibilityUpdates
     }
   /* If tree is stale, rebuild FIRST so we don't iterate freed
-     window pointers.  Skip notifications for this cycle — the
+-     window pointers.  Skip notifications for this cycle --- the
 +     window pointers.  Skip notifications for this cycle --- the
      freshly-built elements have no previous state to diff against.  */
   if (!accessibilityTreeValid)
     {
       [self rebuildAccessibilityTree];
-      /* Invalidate span cache — window layout changed.  */
+-      /* Invalidate span cache --- window layout changed.  */
 +      /* Invalidate span cache --- window layout changed.  */
       for (EmacsAccessibilityElement *elem in accessibilityElements)
 	if ([elem isKindOfClass: [EmacsAccessibilityBuffer class]])
--- a/patches/0008-ns-announce-child-frame-completion-candidates-for-Vo.patch
+++ b/patches/0008-ns-announce-child-frame-completion-candidates-for-Vo.patch
@@ -1,64 +1,50 @@
-From 058cc9aad5c34796206749844df28acc9e09f0eb Mon Sep 17 00:00:00 2001
+From 5bef7fa553d0dfd9ab933d341a8115d42e026b42 Mon Sep 17 00:00:00 2001
 From: Martin Sukany <martin@sukany.cz>
-Date: Sat, 28 Feb 2026 16:01:29 +0100
+Date: Mon, 2 Mar 2026 18:49:13 +0100
-Subject: [PATCH 8/8] ns: announce child frame completion candidates for
+Subject: [PATCH 9/9] ns: announce child frame completion candidates for
 VoiceOver
-Completion frameworks such as Corfu, Company-box, and similar
+Child frame popups (Corfu, Company-mode child frames) render completion
-render candidates in a child frame rather than as overlay strings
+candidates in a separate frame whose buffer is not accessible via the
-in the minibuffer.  This patch extends the overlay announcement
+minibuffer overlay path.  This patch scans child frame buffers for
-support (patch 7/8) to handle child frame popups.
+selected candidates and announces them via VoiceOver.
-Detect child frames via FRAME_PARENT_FRAME in postAccessibilityUpdates.
+* src/nsterm.h (EmacsView): Add childFrameLastBuffer, childFrameLastModiff,
-Scan the child frame buffer text line by line using Fget_char_property
+childFrameLastCandidate, childFrameCompletionActive, lastEchoCharsModiff
-(which checks both text properties and overlay face properties) to
+ivars.  Initialize childFrameLastBuffer to Qnil in initFrameFromEmacs:.
-find the selected candidate.  Reuse ns_ax_face_is_selected from
+(EmacsAccessibilityBuffer): Add voiceoverSetPoint ivar.
-the overlay patch to identify "current", "selected", and
+* src/nsterm.m (ns_ax_selected_child_frame_text): New function; scans
-"selection" faces.
+child frame buffer text for the selected completion candidate.
-
+(announceChildFrameCompletion): New method; scans child frame buffers
-Safety:
+for selected completion candidates.  Store childFrameLastBuffer as
- record_unwind_current_buffer / set_buffer_internal_1 to switch to
+BVAR(b, name) (buffer name symbol, GC-reachable via obarray) rather
-  the child frame buffer for Fbuffer_substring_no_properties.
+than a raw buffer pointer to avoid a dangling pointer after buffer kill.
- Re-entrance guard (accessibilityUpdating) before child frame dispatch.
+(postEchoAreaAnnouncementIfNeeded): New method; announces echo area
- BUF_MODIFF gating prevents redundant scans.
+changes (e.g., "Wrote file", "Quit") for commands that produce output
- WINDOWP, BUFFERP validation for partially initialized frames.
+while the minibuffer is inactive.
- Buffer size limit (10000 chars) skips non-completion child frames.
+(postAccessibilityNotificationsForFrame:): Drive child frame and echo
-
+area announcements.  Add voiceoverSetPoint flag and singleLineMove
-When the child frame closes, post FocusedUIElementChangedNotification
+adjacency detection to distinguish VoiceOver-initiated cursor moves
-on the parent buffer element to restore VoiceOver's character echo
+from Emacs-initiated moves; sequential adjacent-line moves use
-and cursor tracking.  The flag childFrameCompletionActive is set by
+next/previous direction, teleports use discontiguous.  Add didTextChange
-the child frame handler and cleared on the parent's next accessibility
+guard to suppress overlay completion announcements while the user types.
-cycle when no child frame is visible (via FOR_EACH_FRAME).
+(setAccessibilitySelectedTextRange:): Set voiceoverSetPoint so that the
-
+subsequent notification cycle uses sequential direction.
-Announce via AnnouncementRequested to NSApp with High priority.
+* doc/emacs/macos.texi (VoiceOver Accessibility): Update to document
-independently --- its ns_update_end runs after the parent's
+echo area announcements and VoiceOver rotor cursor synchronization.
-
+Remove Zoom section (covered by patch 0000).  Fix dangling paragraph.
 * src/nsterm.h (EmacsView): Add announceChildFrameCompletion,
 childFrameCompletionActive flag.
 * src/nsterm.m (ns_ax_selected_child_frame_text): New function.
 (EmacsView announceChildFrameCompletion): New method, set parent flag.
 (EmacsView postAccessibilityUpdates): Dispatch to child frame handler,
 refocus parent buffer element when child frame closes.
 ---
- doc/emacs/macos.texi |   6 --
+ doc/emacs/macos.texi |  13 +-
- etc/NEWS             |   4 +-
+ etc/NEWS             |  25 +-
- src/nsterm.h         |   5 +
+ src/nsterm.h         |  21 ++
- src/nsterm.m         | 227 ++++++++++++++++++++++++++++++++++++++++++-
+ src/nsterm.m         | 577 +++++++++++++++++++++++++++++++++++++------
- 4 files changed, 233 insertions(+), 9 deletions(-)
+ 4 files changed, 541 insertions(+), 95 deletions(-)
 diff --git a/doc/emacs/macos.texi b/doc/emacs/macos.texi
-index 4825cf9..97777e2 100644
+index 72ac3a9aa9..cf5ed0ff28 100644
 --- a/doc/emacs/macos.texi
 +++ b/doc/emacs/macos.texi
-@@ -278,7 +278,6 @@ restart Emacs to access newly-available services.
+@@ -309,10 +309,15 @@ Shift-modified movement announces selected or deselected text.
 @cindex VoiceOver
 @cindex accessibility (macOS)
 @cindex screen reader (macOS)
 -@cindex Zoom, cursor tracking (macOS)
   When built with the Cocoa interface on macOS, Emacs exposes buffer
 content, cursor position, mode lines, and interactive elements to the
@@ -309,11 +308,6 @@ Shift-modified movement announces selected or deselected text.
   The @file{*Completions*} buffer announces each completion candidate
 as you navigate, even while keyboard focus remains in the minibuffer.
@@ -66,53 +52,147 @@ index 4825cf9..97777e2 100644
 -cursor automatically when set to follow keyboard focus.  The cursor
 -position is communicated via @code{UAZoomChangeFocus} and the
 -@code{AXBoundsForRange} accessibility attribute.
-
+  Echo area messages are announced automatically.  When a background
 +operation completes and displays a message (e.g., @samp{Git finished},
 +@samp{Wrote file}), VoiceOver reads it without requiring any action.
 +Messages are suppressed while the minibuffer is active (i.e., while
 +you are typing a command) to avoid interrupting prompt reading.
 +
 +  VoiceOver's rotor browse cursor stays synchronized with the Emacs
 +cursor after large programmatic jumps (for example, heading navigation
 +in Org mode, @code{xref-find-definitions}, or @code{imenu}).
 @vindex ns-accessibility-enabled
   To disable the accessibility interface entirely (for instance, to
 eliminate overhead on systems where assistive technology is not in
 diff --git a/etc/NEWS b/etc/NEWS
-index e76ee93..c3e0b40 100644
+index 7f917f93b2..bbec21b635 100644
 --- a/etc/NEWS
 +++ b/etc/NEWS
-@@ -4393,8 +4393,8 @@ send user data to Apple's speech recognition servers.
+@@ -88,10 +88,9 @@ When macOS Zoom is enabled (System Settings, Accessibility, Zoom,
 Follow keyboard focus), Emacs informs Zoom of the text cursor position
 after every cursor redraw via 'UAZoomChangeFocus'.  The zoomed viewport
 automatically tracks the insertion point across window splits and
 -switches.  Completion frameworks (Vertico, Icomplete, Ivy for overlay
 -candidates; Corfu, Company-box for child frame popups) are also
 -tracked: Zoom follows the selected candidate rather than the text
 -cursor during completion.
 +switches.  Overlay-based completion frameworks and child-frame popup completions
 +are also tracked: Zoom follows the selected candidate rather than the
 +text cursor during completion.
 +++
 ** 'line-spacing' now supports specifying spacing above the line.
@@ -4385,16 +4384,20 @@ allowing Emacs users access to speech recognition utilities.
 Note: Accepting this permission allows the use of system APIs, which may
 send user data to Apple's speech recognition servers.
 ----
 ++++
 ** VoiceOver accessibility support on macOS.
 Emacs now exposes buffer content, cursor position, and interactive
 elements to the macOS accessibility subsystem (VoiceOver).  This
 -includes AXBoundsForRange for macOS Zoom cursor tracking, line and
 -word navigation announcements, Tab-navigable interactive spans
-+includes line and word navigation announcements, Tab-navigable
+-(buttons, links, completion candidates), and completion announcements
-+interactive spans
+-for the *Completions* buffer.  The implementation uses a virtual
- (buttons, links, completion candidates), and completion announcements
+-accessibility tree with per-window elements, hybrid SelectedTextChanged
- for the *Completions* buffer.  The implementation uses a virtual
+-and AnnouncementRequested notifications, and thread-safe text caching.
- accessibility tree with per-window elements, hybrid SelectedTextChanged
+includes:
 +- Line and word navigation announcements via standard movement keys.
 +- Echo area messages (e.g., "Wrote file", "Git finished") announced
 +  automatically as they appear, without user interaction.
 +- VoiceOver rotor cursor synchronization after large programmatic
 +  jumps (]], M-<, xref, imenu, etc.).
 +- Tab-navigable interactive spans (buttons, links, completion
 +  candidates) within a buffer.
 +- Completion announcements for the *Completions* buffer, overlay
 +  completion UIs, and child-frame completion popup UIs.
 Set 'ns-accessibility-enabled' to nil to disable the accessibility
 interface and eliminate the associated overhead.
 diff --git a/src/nsterm.h b/src/nsterm.h
-index 19a7e7a..49e8f00 100644
+index 72ca210bb0..1c79c8aced 100644
 --- a/src/nsterm.h
 +++ b/src/nsterm.h
-@@ -596,6 +596,10 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+@@ -504,9 +504,20 @@ typedef struct ns_ax_visible_run
   NSUInteger         lineCount;          /* Entries in lineStartOffsets.  */
   NSMutableArray    *cachedInteractiveSpans;
   BOOL               interactiveSpansDirty;
 +  /* Set to YES in setAccessibilitySelectedTextRange: (VoiceOver moved
 +     the cursor); reset to NO in postAccessibilityNotificationsForFrame:.
 +     When YES, cursor notifications use sequential direction so VoiceOver
 +     continues smooth line/character navigation without re-anchoring.
 +     When NO, Emacs moved the cursor independently; use discontiguous
 +     direction so VoiceOver re-anchors its browse cursor to the new
 +     accessibilitySelectedTextRange.  */
 +  BOOL               voiceoverSetPoint;
 }
 @property (nonatomic, retain) NSString *cachedText;
 @property (nonatomic, assign) ptrdiff_t cachedTextModiff;
 +/* Overlay modiff at last text cache rebuild.  Tracked separately from
 +   cachedOverlayModiff (which is used for completion announcements) so
 +   that fold/unfold detection is independent of notification dispatch.  */
 @property (nonatomic, assign) ptrdiff_t cachedOverlayModiff;
 @property (nonatomic, assign) ptrdiff_t cachedTextStart;
 @property (nonatomic, assign) ptrdiff_t cachedModiff;
@@ -601,6 +612,14 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
   Lisp_Object lastRootWindow;
   BOOL accessibilityTreeValid;
   BOOL accessibilityUpdating;
   @public  /* Accessed by ns_draw_phys_cursor (C function).  */
   NSRect lastCursorRect;
 +  BOOL childFrameCompletionActive;
-+  char *childFrameLastCandidate;
+  NSString *childFrameLastCandidate;
-+  struct buffer *childFrameLastBuffer;
+  Lisp_Object childFrameLastBuffer;
 +  EMACS_INT childFrameLastModiff;
 +  /* Last BUF_CHARS_MODIFF seen for echo_area_buffer[0].  Used by
 +     postEchoAreaAnnouncementIfNeeded to detect new echo area messages
 +     independently of the per-element notification cycle.  */
 +  ptrdiff_t lastEchoCharsModiff;
 #endif
   BOOL font_panel_active;
   NSFont *font_panel_result;
-@@ -659,6 +663,7 @@ typedef NS_ENUM (NSInteger, EmacsAXSpanType)
+@@ -670,6 +689,8 @@ typedef NS_ENUM(NSInteger, EmacsAXSpanType)
 - (void)rebuildAccessibilityTree;
 - (void)invalidateAccessibilityTree;
 - (void)postAccessibilityUpdates;
 +- (void)postEchoAreaAnnouncementIfNeeded;
 +- (void)announceChildFrameCompletion;
 #endif
 @end
 diff --git a/src/nsterm.m b/src/nsterm.m
-index 72478e0..daa8f61 100644
+index c9fe93a57b..f7574efb39 100644
 --- a/src/nsterm.m
 +++ b/src/nsterm.m
-@@ -7028,6 +7028,112 @@ visual line index for Zoom (skip whitespace-only lines
+@@ -1275,6 +1275,12 @@ If a completion candidate is selected (overlay or child frame),
 static void
 ns_zoom_track_completion (struct frame *f, EmacsView *view)
 {
 +  /* Zoom cursor tracking is controlled exclusively by
 +     ns_zoom_enabled_p ().  We do NOT gate on ns_accessibility_enabled:
 +     users can run Zoom without VoiceOver, and those users should still
 +     get completion-candidate tracking.  ns_accessibility_enabled is
 +     only set when a screen reader (VoiceOver or similar) activates the
 +     AX layer; it has no bearing on the Zoom feature.  */
   if (!ns_zoom_enabled_p ())
     return;
   if (!WINDOWP (f->selected_window))
@@ -1417,9 +1423,14 @@ so the visual offset is (ov_line + 1) * line_h from
   /* Track completion candidates for Zoom (overlay and child frame).
      Runs after cursor tracking so the selected candidate overrides
 -     the default cursor position.  */
 +     the default cursor position.  Guard with the same version check
 +     as ns_zoom_track_completion's callee (UAZoomChangeFocus requires
 +     macOS 10.10+).  */
 +#if defined (MAC_OS_X_VERSION_MIN_REQUIRED) \
 +    && MAC_OS_X_VERSION_MIN_REQUIRED >= 101000
   if (view)
     ns_zoom_track_completion (f, view);
 +#endif /* MAC_OS_X_VERSION_MIN_REQUIRED >= 101000 */
 #endif /* NS_IMPL_COCOA */
   /* Post accessibility notifications after each redisplay cycle.  */
@@ -7407,6 +7418,119 @@ visual line index for Zoom (skip whitespace-only lines
   return nil;
 }
@@ -159,12 +239,19 @@ index 72478e0..daa8f61 100644
 +     The data pointer is used only in this loop, before Lisp calls.  */
 +  const unsigned char *data = SDATA (str);
 +  ptrdiff_t byte_len = SBYTES (str);
-+  ptrdiff_t line_starts[128];
+  /* 128 lines is a safe upper bound for a completion child frame.
-+  ptrdiff_t line_ends[128];
+     The caller rejects buffers larger than 10,000 characters
 +     (BUF_ZV(b) - BUF_BEGV(b) > 10000 guard in announceChildFrameCompletion),
 +     so at most ~10,000 / 1-byte-per-line = 10,000 lines could appear,
 +     but completion popups are typically < 512 lines.  Use 512 to match
 +     the bound in ns_ax_selected_overlay_text; lines beyond 512 are
 +     silently skipped.  */
 +  ptrdiff_t line_starts[512];
 +  ptrdiff_t line_ends[512];
 +  int nlines = 0;
 +  ptrdiff_t char_pos = 0, byte_pos = 0, lstart = 0;
 +
-+  while (byte_pos < byte_len && nlines < 128)
+  while (byte_pos < byte_len && nlines < 512)
 +    {
 +      if (data[byte_pos] == '\n')
 +	{
@@ -182,7 +269,7 @@ index 72478e0..daa8f61 100644
 +	byte_pos++;
 +      char_pos++;
 +    }
-+  if (char_pos > lstart && nlines < 128)
+  if (char_pos > lstart && nlines < 512)
 +    {
 +      line_starts[nlines] = lstart;
 +      line_ends[nlines] = char_pos;
@@ -225,11 +312,439 @@ index 72478e0..daa8f61 100644
 /* Build accessibility text for window W, skipping invisible text.
    Populates *OUT_START with the buffer start charpos.
    Populates *OUT_RUNS with an array of visible runs and *OUT_NRUNS
-@@ -12266,6 +12372,77 @@ - (id)accessibilityFocusedUIElement
+@@ -7440,11 +7564,12 @@ visual line index for Zoom (skip whitespace-only lines
     return @"";
   specpdl_ref count = SPECPDL_INDEX ();
 -  record_unwind_current_buffer ();
 -  /* block_input must come before record_unwind_protect_void (unblock_input):
 -     if specpdl_push were to fail after registration, the unwind handler
 -     would call unblock_input without a matching block_input.  */
 +  /* block_input must precede record_unwind_protect_void (unblock_input):
 +     if anything between SPECPDL_INDEX and block_input were to throw,
 +     the unwind handler would call unblock_input without a matching
 +     block_input, corrupting the input-blocking reference count.  */
   block_input ();
 +  record_unwind_current_buffer ();
   record_unwind_protect_void (unblock_input);
   if (b != current_buffer)
     set_buffer_internal_1 (b);
@@ -8613,6 +8738,11 @@ - (void)setAccessibilitySelectedTextRange:(NSRange)range
   [self ensureTextCache];
 +  /* Record that VoiceOver (not Emacs) is moving the cursor so that the
 +     subsequent postAccessibilityNotificationsForFrame: call can use the
 +     correct sequential direction rather than forcing a re-anchor.  */
 +  voiceoverSetPoint = YES;
 +
   specpdl_ref count = SPECPDL_INDEX ();
   record_unwind_current_buffer ();
   /* block_input must come before record_unwind_protect_void (unblock_input).  */
@@ -9060,20 +9190,38 @@ - (void)postFocusedCursorNotification:(ptrdiff_t)point
        && granularity
 	  == ns_ax_text_selection_granularity_character);
 -  /* Always post SelectedTextChanged to interrupt VoiceOver reading
 -     and update cursor tracking / braille displays.  */
 +  /* Post SelectedTextChanged to interrupt VoiceOver reading and
 +     update cursor tracking / braille displays.
 +     For sequential moves (direction = next/previous): include
 +     direction + granularity so VoiceOver reads the destination line
 +     or word without additional state queries.
 +     For discontiguous jumps (teleports, multi-line leaps): omit
 +     direction and granularity and let VoiceOver determine what to read
 +     from its own navigation state.  This matches the pre-review
 +     behaviour and ensures VoiceOver reads the full destination line
 +     even when the jump skips blank or invisible lines (e.g. org-agenda
 +     items separated by blank lines, where adjacency detection cannot
 +     classify the move as singleLineMove).  */
   NSMutableDictionary *moveInfo = [NSMutableDictionary dictionary];
   moveInfo[@"AXTextStateChangeType"]
     = @(ns_ax_text_state_change_selection_move);
 -  moveInfo[@"AXTextSelectionDirection"] = @(direction);
   moveInfo[@"AXTextChangeElement"] = self;
 -  /* Omit granularity for character moves so VoiceOver does not
 -     derive its own speech (it would read the wrong character
 -     for block-cursor mode).  Include it for word/line/
 -     selection so VoiceOver reads the appropriate text.  */
 -  if (!isCharMove)
 -    moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
 -
 +  BOOL isDiscontiguous
 +    = (direction == ns_ax_text_selection_direction_discontiguous);
 +  if (!isDiscontiguous && !isCharMove)
 +    {
 +      moveInfo[@"AXTextSelectionDirection"] = @(direction);
 +      moveInfo[@"AXTextSelectionGranularity"] = @(granularity);
 +    }
 +
 +  /* Post on self (the EmacsAXBuffer element), not on the parent
 +     EmacsView.  When the notification originates from the element
 +     whose selection changed, VoiceOver calls accessibilityLineForIndex:
 +     on that element to determine the line to read.  Posting from the
 +     parent view with UIElementsKey causes VoiceOver to call
 +     accessibilityLineForIndex: on the view instead, which returns an
 +     incorrect range in specialised buffers (org-agenda, org-super-agenda)
 +     where line geometry differs from plain text.  */
   ns_ax_post_notification_with_info (
     self,
     NSAccessibilitySelectedTextChangedNotification,
@@ -9173,12 +9321,17 @@ user expectation ("w" jumps to next word and reads it).  */
 	}
     }
 -  /* For focused line moves: always announce line text explicitly.
 -     SelectedTextChanged with granularity=line works for arrow keys,
 -     but C-n/C-p need the explicit announcement (VoiceOver processes
 -     these keystrokes differently from arrows).
 +  /* Announce the destination line text for all line-granularity moves.
 +     This covers two cases:
 +     - C-n/C-p: SelectedTextChanged carries granularity=line, but
 +       VoiceOver processes those keystrokes specially and may not
 +       produce speech; the explicit announcement is the reliable path.
 +     - Discontiguous jumps (]], M-<, xref, imenu, …): granularity=line
 +       in the notification is omitted (see above) so VoiceOver will
 +       not announce automatically; this explicit announcement fills
 +       the gap.
      In completion-list-mode, read the completion candidate instead
 -     of the whole line.  */
 +     of the full line.  */
   if (cachedText
       && granularity == ns_ax_text_selection_granularity_line)
     {
@@ -9243,6 +9396,11 @@ - (void)postCompletionAnnouncementForBuffer:(struct buffer *)b
   block_input ();
   specpdl_ref count2 = SPECPDL_INDEX ();
 +  /* Register unblock_input as an unwind action so that if any Lisp
 +     call below signals (triggering a longjmp through unbind_to),
 +     block_input is always paired with an unblock_input.  The
 +     unbind_to call at the end of the function unwinds this.
 +     record_unwind_protect_void plus unbind_to is idempotent.  */
   record_unwind_protect_void (unblock_input);
   record_unwind_current_buffer ();
   if (b != current_buffer)
@@ -9419,12 +9577,29 @@ - (void)postAccessibilityNotificationsForFrame:(struct frame *)f
   if (!b)
     return;
 +  /* Echo area announcements are handled in
 +     postEchoAreaAnnouncementIfNeeded (called from postAccessibilityUpdates
 +     before this per-element loop) so that they are never lost to a
 +     concurrent tree rebuild.  For the inactive minibuffer (minibuf_level
 +     == 0), skip normal cursor and completion processing --- there is no
 +     meaningful cursor to track.  */
 +  if (MINI_WINDOW_P (w) && minibuf_level == 0)
 +    return;
 +
   ptrdiff_t modiff = BUF_MODIFF (b);
   ptrdiff_t point = BUF_PT (b);
   BOOL markActive = !NILP (BVAR (b, mark_active));
   /* --- Text changed (edit) --- */
   ptrdiff_t chars_modiff = BUF_CHARS_MODIFF (b);
 +  /* Track whether the user typed a character this redisplay cycle.
 +     Used below to suppress overlay completion announcements: when the
 +     user types, character echo (via postTextChangedNotification) must
 +     take priority over overlay candidate updates.  Without this guard,
 +     Vertico/Ivy updates its overlay immediately after each keystroke,
 +     and the High-priority overlay announcement interrupts the character
 +     echo, effectively silencing typed characters.  */
 +  BOOL didTextChange = NO;
   if (modiff != self.cachedModiff)
     {
       self.cachedModiff = modiff;
@@ -9438,6 +9613,7 @@ Text property changes (e.g. face updates from
 	{
 	  self.cachedCharsModiff = chars_modiff;
 	  [self postTextChangedNotification:point];
 +	  didTextChange = YES;
 	}
     }
@@ -9460,41 +9636,49 @@ frameworks like Vertico bump BOTH BUF_MODIFF (via text property
 	 displayed in the minibuffer.  In normal editing buffers,
 	 font-lock and other modes change BUF_OVERLAY_MODIFF on
 	 every redisplay, triggering O(overlays) work per keystroke.
 -	 Restrict the scan to minibuffer windows.  */
 -      if (MINI_WINDOW_P (w))
 +	 Restrict the scan to minibuffer windows.
 +	 Skip overlay announcements when the user just typed a character
 +	 (didTextChange).  Completion frameworks update their overlay
 +	 immediately after each keystroke; without this guard, the
 +	 overlay High-priority announcement would interrupt the character
 +	 echo produced by postTextChangedNotification, making typed
 +	 characters inaudible.  VoiceOver should read the overlay
 +	 candidate only when the user navigates (C-n/C-p), not types.  */
 +      if (MINI_WINDOW_P (w) && !didTextChange)
 +	{
 +
 +	  int selected_line = -1;
 +	  NSString *candidate
 +	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
 +				       &selected_line);
 +	  if (candidate)
 -	{
 +	    {
 -	  int selected_line = -1;
 -	  NSString *candidate
 -	    = ns_ax_selected_overlay_text (b, BUF_BEGV (b), BUF_ZV (b),
 -					   &selected_line);
 -	  if (candidate)
 +	      /* Deduplicate: only announce when the candidate changed.  */
 +	      if (![candidate isEqualToString:
 +			        self.cachedCompletionAnnouncement])
 -	    {
 +		{
 -	      /* Deduplicate: only announce when the candidate changed.  */
 -	      if (![candidate isEqualToString:
 -			        self.cachedCompletionAnnouncement])
 -		{
 -		  self.cachedCompletionAnnouncement = candidate;
 -
 -		  /* Announce the candidate text directly via NSApp.
 -		     Do NOT post SelectedTextChanged --- that would cause
 -		     VoiceOver to read the AX text at the cursor position
 -		     (the minibuffer input line), not the overlay candidate.
 -		     AnnouncementRequested with High priority interrupts
 -		     any current speech and announces our text.  */
 -		  NSDictionary *annInfo = @{
 -		    NSAccessibilityAnnouncementKey: candidate,
 -		    NSAccessibilityPriorityKey:
 -		      @(NSAccessibilityPriorityHigh)
 -		  };
 -		  ns_ax_post_notification_with_info (
 -		    NSApp,
 -		    NSAccessibilityAnnouncementRequestedNotification,
 -		    annInfo);
 -		}
 +		  self.cachedCompletionAnnouncement = candidate;
 +
 +		  /* Announce the candidate text directly via NSApp.
 +		     Do NOT post SelectedTextChanged --- that would cause
 +		     VoiceOver to read the AX text at the cursor position
 +		     (the minibuffer input line), not the overlay candidate.
 +		     AnnouncementRequested with High priority interrupts
 +		     any current speech and announces our text.  */
 +		  NSDictionary *annInfo = @{
 +		    NSAccessibilityAnnouncementKey: candidate,
 +		    NSAccessibilityPriorityKey:
 +		      @(NSAccessibilityPriorityHigh)
 +		  };
 +		  ns_ax_post_notification_with_info (
 +		    NSApp,
 +		    NSAccessibilityAnnouncementRequestedNotification,
 +		    annInfo);
 -	    }
 +		}
 -	}
 +	    }
 +	}
     }
   /* --- Cursor moved or selection changed ---
      Independent check from the overlay branch above.  */
   if (point != self.cachedPoint || markActive != self.cachedMarkActive)
@@ -9504,7 +9688,18 @@ frameworks like Vertico bump BOTH BUF_MODIFF (via text property
       self.cachedPoint = point;
       self.cachedMarkActive = markActive;
 -      /* Compute direction.  */
 +      /* Compute direction.
 +	 When VoiceOver moved the cursor via setAccessibilitySelectedTextRange:
 +	 (voiceoverSetPoint == YES), use sequential next/previous so VoiceOver
 +	 continues smooth navigation from its current position.
 +	 When Emacs moved the cursor independently (voiceoverSetPoint == NO),
 +	 force discontiguous direction so VoiceOver re-anchors its browse
 +	 cursor to accessibilitySelectedTextRange; without this, VoiceOver's
 +	 internal browse position diverges from the Emacs insertion point and
 +	 subsequent VO+arrow navigation starts from the wrong location.  */
 +      BOOL emacsMovedCursor = !voiceoverSetPoint;
 +      voiceoverSetPoint = NO;   /* Consume the flag.  */
 +
       NSInteger direction = ns_ax_text_selection_direction_discontiguous;
       if (point > oldPoint)
 	direction = ns_ax_text_selection_direction_next;
@@ -9523,6 +9718,7 @@ granularity hint (defaulting to unknown), which causes VoiceOver
 	 to make its own determination.  Fresh text is always available
 	 to VoiceOver via the AX getter path (accessibilityValue etc.).  */
       NSInteger granularity = ns_ax_text_selection_granularity_unknown;
 +      BOOL singleLineMove = NO;
       if (cachedText && oldPoint > 0)
 	{
 	  NSUInteger tlen = [cachedText length];
@@ -9536,7 +9732,18 @@ to VoiceOver via the AX getter path (accessibilityValue etc.).  */
 	  NSRange newLine = [cachedText lineRangeForRange:
 				  NSMakeRange (newIdx, 0)];
 	  if (oldLine.location != newLine.location)
 -	    granularity = ns_ax_text_selection_granularity_line;
 +	    {
 +	      granularity = ns_ax_text_selection_granularity_line;
 +	      /* Detect single adjacent-line move while oldLine/newLine
 +		 are in scope.  Any command that steps exactly one line ---
 +		 C-n/C-p, evil j/k, outline-next-heading, etc. --- is
 +		 sequential.  Multi-line teleports (]], M-<, xref, ...) are
 +		 not adjacent and will be marked discontiguous below.
 +		 Detected structurally: no package-specific code needed.  */
 +	      BOOL adjFwd = (newLine.location == NSMaxRange (oldLine));
 +	      BOOL adjBwd = (NSMaxRange (newLine) == oldLine.location);
 +	      singleLineMove = adjFwd || adjBwd;
 +	    }
 	  else
 	    {
 	      NSUInteger dist = (newIdx > oldIdx
@@ -9558,38 +9765,23 @@ to VoiceOver via the AX getter path (accessibilityValue etc.).  */
 	  granularity = ns_ax_text_selection_granularity_line;
 	}
 -      /* Treat all moves as Emacs-initiated until voiceoverSetPoint
 -	 tracking is introduced (subsequent patch).  */
 -      BOOL emacsMovedCursor = YES;
 -
 -      /* Programmatic jumps that cross a line boundary (]], [[, M-<,
 -	 xref, imenu, …) are discontiguous: the cursor teleported to an
 -	 arbitrary position, not one sequential step forward/backward.
 -	 Reporting AXTextSelectionDirectionDiscontiguous causes VoiceOver
 -	 to re-anchor its rotor browse cursor at the new
 -	 accessibilitySelectedTextRange rather than advancing linearly
 -	 from its previous internal position.  */
 -      if (!isCtrlNP && granularity == ns_ax_text_selection_granularity_line)
 +
 +      /* Multi-line teleports are discontiguous; single adjacent-line
 +	 steps stay sequential.  */
 +      if (!isCtrlNP && !singleLineMove
 +	  && granularity == ns_ax_text_selection_granularity_line)
 	direction = ns_ax_text_selection_direction_discontiguous;
 -      /* If Emacs moved the cursor (not VoiceOver), force discontiguous
 -	 so VoiceOver re-anchors its browse cursor to the current
 -	 accessibilitySelectedTextRange.  This covers all Emacs-initiated
 -	 moves: editing commands, ELisp, isearch, etc.
 -	 Exception: C-n/C-p (isCtrlNP) already uses next/previous with
 -	 line granularity; those are already sequential and VoiceOver
 -	 handles them correctly.  */
 -      if (emacsMovedCursor && !isCtrlNP)
 +      /* Emacs-initiated teleports need re-anchor; sequential steps
 +	 (C-n/C-p or any adjacent-line command) do not.  */
 +      if (emacsMovedCursor && !isCtrlNP && !singleLineMove)
 	direction = ns_ax_text_selection_direction_discontiguous;
 -      /* Re-anchor VoiceOver's browse cursor for discontiguous (teleport)
 -	 moves only.  For sequential C-n/C-p (isCtrlNP), posting
 -	 FocusedUIElementChanged on the window races with the
 -	 AXSelectedTextChanged(granularity=line) notification and
 -	 causes VoiceOver to drop the line-read speech.  Sequential
 -	 moves are already handled correctly by AXSelectedTextChanged
 -	 with direction=next/previous + granularity=line.  */
 -      if (emacsMovedCursor && !isCtrlNP && [self isAccessibilityFocused])
 +      /* FocusedUIElementChanged only for teleports: posting it for
 +	 sequential moves races with AXSelectedTextChanged(granularity=line)
 +	 and causes VoiceOver to drop the line-read speech.  */
 +      if (emacsMovedCursor && !isCtrlNP && !singleLineMove
 +	  && [self isAccessibilityFocused])
 	{
 	  NSWindow *win = [self.emacsView window];
 	  if (win)
@@ -9748,6 +9940,13 @@ - (NSRect)accessibilityFrame
   if (vis_start >= vis_end)
     return @[];
 +  /* block_input for the duration of the scan: the Lisp calls below
 +     (Ftext_properties_at, Fplist_get, Foverlays_in, Foverlay_get,
 +     Fnext_single_property_change, Fbuffer_substring_no_properties)
 +     must not be interleaved with timer events or process sentinels
 +     that could modify buffer state (e.g. invalidate vis_end).
 +     record_unwind_protect_void guarantees unblock_input even if
 +     a Lisp call signals.  */
   block_input ();
   specpdl_ref blk_count = SPECPDL_INDEX ();
   record_unwind_protect_void (unblock_input);
@@ -10056,6 +10255,9 @@ - (void)dealloc
 #endif
   [accessibilityElements release];
 +#ifdef NS_IMPL_COCOA
 +  [childFrameLastCandidate release];
 +#endif
   [[self menu] release];
   [super dealloc];
 }
@@ -11505,6 +11708,9 @@ - (instancetype) initFrameFromEmacs: (struct frame *)f
   windowClosing = NO;
   processingCompose = NO;
 +#ifdef NS_IMPL_COCOA
 +  childFrameLastBuffer = Qnil;
 +#endif
   scrollbarsNeedingUpdate = 0;
   fs_state = FULLSCREEN_NONE;
   fs_before_fs = next_maximized = -1;
@@ -12813,6 +13019,158 @@ - (id)accessibilityFocusedUIElement
    The existing elements carry cached state (modiff, point) from the
    previous redisplay cycle.  Rebuilding first would create fresh
    elements with current values, making change detection impossible.  */
 +
 +/* Announce new echo area messages to VoiceOver.
 +
 +   This is called at the top of postAccessibilityUpdates, before any
 +   tree rebuild.  Keeping it here, rather than in the per-element loop
 +   in postAccessibilityNotificationsForFrame, guarantees that echo area
 +   messages (including "Quit" from C-g) are announced even when the
 +   accessibility element tree is in the process of being rebuilt.
 +
 +   The guard minibuf_level == 0 ensures we only announce passive status
 +   messages.  While the user is actively typing (minibuf_level > 0),
 +   character echo and completion announcements take precedence.
 +
 +   Reads echo_area_buffer[0] directly because with_echo_area_buffer()
 +   sets current_buffer via set_buffer_internal_1() but does NOT call
 +   Fset_window_buffer(), so the minibuffer window's contents pointer
 +   still points to the inactive " *Minibuf-0*" buffer.
 +   echo_area_buffer[] is maintained by setup_echo_area_for_printing()
 +   and clear_message() in xdisp.c; its lifetime is the process lifetime
 +   and it is valid whenever BUFFERP (echo_area_buffer[0]) is true.  */
 +- (void)postEchoAreaAnnouncementIfNeeded
 +{
 +  if (minibuf_level != 0)
 +    return;
 +  Lisp_Object ea = echo_area_buffer[0];
 +  if (!BUFFERP (ea))
 +    return;
 +  struct buffer *eb = XBUFFER (ea);
 +  if (!BUFFER_LIVE_P (eb))
 +    return;
 +  ptrdiff_t echo_chars = BUF_CHARS_MODIFF (eb);
 +  if (echo_chars == lastEchoCharsModiff || BUF_ZV (eb) <= BUF_BEGV (eb))
 +    return;
 +  lastEchoCharsModiff = echo_chars;
 +  /* Use specpdl to restore current_buffer if Fbuffer_string signals.
 +     set_buffer_internal_1 is preferred over set_buffer_internal in
 +     a redisplay context: it skips point-motion hooks that could
 +     trigger further redisplay or modify buffer state unexpectedly.  */
 +  block_input ();
 +  specpdl_ref count = SPECPDL_INDEX ();
 +  record_unwind_protect_void (unblock_input);
 +  record_unwind_current_buffer ();
 +  set_buffer_internal_1 (eb);
 +  Lisp_Object ls = Fbuffer_string ();
 +  unbind_to (count, Qnil);
 +  /* stringWithLispString: converts Emacs's internal multibyte encoding
 +     to NSString correctly; a raw SSDATA cast would produce invalid
 +     UTF-8 for non-ASCII characters.  */
 +  NSString *raw = [NSString stringWithLispString: ls];
 +  NSString *msg = [raw stringByTrimmingCharactersInSet:
 +    [NSCharacterSet whitespaceAndNewlineCharacterSet]];
 +  if ([msg length] == 0)
 +    return;
 +  NSDictionary *info = @{
 +    NSAccessibilityAnnouncementKey: msg,
 +    NSAccessibilityPriorityKey: @(NSAccessibilityPriorityHigh)
 +  };
 +  ns_ax_post_notification_with_info (
 +    NSApp, NSAccessibilityAnnouncementRequestedNotification, info);
 +}
 +
 +/* Announce the selected candidate in a child frame completion popup.
 +   Handles Corfu, Company-box, and similar frameworks that render
 +   candidates in a separate child frame rather than as overlay strings
@@ -250,10 +765,23 @@ index 72478e0..daa8f61 100644
 +     This prevents redundant work on every redisplay tick and
 +     also guards against re-entrance: if Lisp calls below
 +     trigger redisplay, the modiff check short-circuits.  */
-+  EMACS_INT modiff = BUF_MODIFF (b);
+  if (!BUFFER_LIVE_P (b))
 +  if (b == childFrameLastBuffer && modiff == childFrameLastModiff)
 +    return;
-+  childFrameLastBuffer = b;
+  EMACS_INT modiff = BUF_MODIFF (b);
 +  /* Compare buffer identity via the buffer name symbol.  Interned
 +     symbols (obarray) are GC-reachable without staticpro(), avoiding
 +     a direct struct buffer pointer in a non-GC-visible ObjC ivar.
 +     Caveat: if the buffer is renamed (rename-buffer), the stored
 +     symbol no longer matches the new name and the equality check
 +     returns nil, causing one redundant re-scan.  This is harmless ---
 +     completion popups (Corfu, Company) are never renamed during a
 +     completion session.  Using a sequence number would avoid the
 +     rename edge case but would require another ivar; the name symbol
 +     is a pragmatic, GC-safe approximation.  */
 +  if (EQ (childFrameLastBuffer, BVAR (b, name))
 +      && modiff == childFrameLastModiff)
 +    return;
 +  childFrameLastBuffer = BVAR (b, name);
 +  childFrameLastModiff = modiff;
 +
 +  /* Skip buffers larger than a typical completion popup.
@@ -263,18 +791,26 @@ index 72478e0..daa8f61 100644
 +    return;
 +
 +  int selected_line = -1;
 +  /* block_input prevents timer events and process output from
 +     interleaving with the Lisp calls inside
 +     ns_ax_selected_child_frame_text (Fbuffer_substring_no_properties,
 +     Fget_char_property, etc.).  record_unwind_protect_void ensures
 +     unblock_input is called even if a Lisp call signals.  */
 +  block_input ();
 +  specpdl_ref blk_count = SPECPDL_INDEX ();
 +  record_unwind_protect_void (unblock_input);
 +  NSString *candidate
 +    = ns_ax_selected_child_frame_text (b, w->contents, &selected_line);
 +  unbind_to (blk_count, Qnil);
 +
 +  if (!candidate)
 +    return;
 +
 +  /* Deduplicate --- avoid re-announcing the same candidate.  */
-+  const char *cstr = [candidate UTF8String];
+  if ([candidate isEqualToString:childFrameLastCandidate])
 +  if (childFrameLastCandidate && strcmp (cstr, childFrameLastCandidate) == 0)
 +    return;
-+  xfree (childFrameLastCandidate);
+  [childFrameLastCandidate release];
-+  childFrameLastCandidate = xstrdup (cstr);
+  childFrameLastCandidate = [candidate copy];
 +
 +  NSDictionary *annInfo = @{
 +    NSAccessibilityAnnouncementKey: candidate,
@@ -303,7 +839,7 @@ index 72478e0..daa8f61 100644
 - (void)postAccessibilityUpdates
 {
   NSTRACE ("[EmacsView postAccessibilityUpdates]");
-@@ -12276,11 +12453,59 @@ - (void)postAccessibilityUpdates
+@@ -12823,14 +13182,71 @@ - (void)postAccessibilityUpdates
   /* Re-entrance guard: VoiceOver callbacks during notification posting
      can trigger redisplay, which calls ns_update_end, which calls us
@@ -315,6 +851,11 @@ index 72478e0..daa8f61 100644
     return;
   accessibilityUpdating = YES;
 +  /* Announce echo area messages (e.g. "Quit", "Wrote file") before
 +     any tree-rebuild check.  This must run even when the element tree
 +     is being rebuilt to avoid missing time-sensitive status messages.  */
 +  [self postEchoAreaAnnouncementIfNeeded];
 +
 +  /* Child frame completion popup (Corfu, Company-box, etc.).
 +     Child frames don't participate in the accessibility tree;
 +     announce the selected candidate directly.  */
@@ -333,6 +874,10 @@ index 72478e0..daa8f61 100644
 +    {
 +      Lisp_Object tail, frame;
 +      BOOL childStillVisible = NO;
 +      /* block_input protects the FOR_EACH_FRAME iteration: the
 +	 frame list (Vframe_list) is a Lisp_Object chain and must not
 +	 be modified by a timer or process sentinel mid-iteration.  */
 +      block_input ();
 +      FOR_EACH_FRAME (tail, frame)
 +	if (FRAME_PARENT_FRAME (XFRAME (frame)) == emacsframe
 +	    && FRAME_VISIBLE_P (XFRAME (frame)))
@@ -340,6 +885,7 @@ index 72478e0..daa8f61 100644
 +	    childStillVisible = YES;
 +	    break;
 +	  }
 +      unblock_input ();
 +
 +      if (!childStillVisible)
 +	{