diff --git a/Cargo.lock b/Cargo.lock
index f8f2544..312b8df 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -173,6 +173,47 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "anyrender"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1755d0ef8e00e87b6b825dfbe5a35d34d3b302e97e80a48e93f9cd361fbada06"
+dependencies = [
+ "kurbo",
+ "peniko",
+ "raw-window-handle",
+ "smallvec",
+]
+
+[[package]]
+name = "anyrender_vello"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04d545f71a3f13b1099d5787c44cfeb00322cebbebbf90c4f8cdae78bee423f7"
+dependencies = [
+ "anyrender",
+ "debug_timer",
+ "futures-channel",
+ "kurbo",
+ "peniko",
+ "pollster 0.4.0",
+ "rustc-hash 2.1.3",
+ "vello",
+ "wasm-bindgen-futures",
+ "wgpu",
+ "wgpu_context",
+]
+
+[[package]]
+name = "app_units"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "467b60e4ee6761cd6fd4e03ea58acefc8eec0d1b1def995c1b3b783fa7be8a60"
+dependencies = [
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "arboard"
 version = "3.7.0"
@@ -334,6 +375,12 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "atomic_refcell"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21e4227379beff4205943696e6c3e0cd809bacdf3f0edd6e3dd153e2269571a4"
+
 [[package]]
 name = "audio-codec-algorithms"
 version = "0.8.1"
@@ -569,6 +616,100 @@ dependencies = [
  "no_std_io2",
 ]
 
+[[package]]
+name = "blitz-dom"
+version = "0.3.0-beta.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a814bfd3ad19e6d8d26f99c75188062baca499564f9abe44250230962427d183"
+dependencies = [
+ "app_units",
+ "atomic_refcell",
+ "bitflags 2.13.2",
+ "blitz-traits",
+ "color",
+ "cssparser",
+ "cursor-icon",
+ "debug_timer",
+ "euclid",
+ "html-escape",
+ "icu_locale_core",
+ "icu_properties",
+ "icu_segmenter",
+ "image",
+ "keyboard-types",
+ "kurbo",
+ "linebender_resource_handle",
+ "markup5ever",
+ "objc2 0.6.5",
+ "parley",
+ "percent-encoding",
+ "rayon",
+ "selectors",
+ "skrifa",
+ "slotmap",
+ "smallvec",
+ "stylo",
+ "stylo_dom",
+ "stylo_static_prefs",
+ "stylo_taffy",
+ "stylo_traits",
+ "taffy",
+ "thin-vec",
+ "thread_local",
+ "url",
+ "web-time",
+]
+
+[[package]]
+name = "blitz-html"
+version = "0.3.0-beta.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd638e05f3f3efb9f2d37f0406e7834ea023727e1678524488aa70eb639615"
+dependencies = [
+ "blitz-dom",
+ "blitz-traits",
+ "html5ever",
+ "xml5ever",
+]
+
+[[package]]
+name = "blitz-paint"
+version = "0.3.0-beta.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28803328124d7b7ea5f8f41501513ccb005559e9f6baf33fa0c1fb7612654a93"
+dependencies = [
+ "anyrender",
+ "blitz-dom",
+ "blitz-traits",
+ "bytemuck",
+ "color",
+ "euclid",
+ "kurbo",
+ "parley",
+ "peniko",
+ "skrifa",
+ "smallvec",
+ "stylo",
+ "taffy",
+]
+
+[[package]]
+name = "blitz-traits"
+version = "0.3.0-beta.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d339c3ff7fe8bed623e27695a4c15dd1ec8faa9bf9158b7475bf180280e4018c"
+dependencies = [
+ "atomic_refcell",
+ "bitflags 2.13.2",
+ "bytes",
+ "cursor-icon",
+ "http",
+ "keyboard-types",
+ "serde",
+ "smol_str 0.3.7",
+ "url",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -596,6 +737,16 @@ dependencies = [
  "objc2 0.6.5",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+]
+
 [[package]]
 name = "bs58"
 version = "0.5.1"
@@ -1104,6 +1255,21 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
 [[package]]
 name = "coreaudio-rs"
 version = "0.14.2"
@@ -1203,6 +1369,16 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-epoch"
 version = "0.9.21"
@@ -1233,6 +1409,30 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11119743ad110e8c1bdccd930d7f5c30c99e5fc76a7b63ec9807e84eef0c5f59"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "serde",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
+dependencies = [
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "ctutils"
 version = "0.4.6"
@@ -1282,14 +1482,37 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
 [[package]]
 name = "darling"
 version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1305,13 +1528,24 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
- "darling_core",
+ "darling_core 0.24.1",
  "quote",
  "syn 3.0.6",
 ]
@@ -1328,6 +1562,12 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
+[[package]]
+name = "debug_timer"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da220af51a1a335e9a930beaaef53d261e41ea9eecfb3d973a3ddae1a7284b9c"
+
 [[package]]
 name = "defmt"
 version = "1.1.1"
@@ -1533,6 +1773,15 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
 
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -1619,7 +1868,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "pollster",
+ "pollster 1.0.1",
  "profiling",
  "raw-window-handle",
  "static_assertions",
@@ -1750,6 +1999,20 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
+[[package]]
+name = "encoding_rs"
+version = "0.8.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -1837,6 +2100,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
 dependencies = [
  "num-traits",
+ "serde",
 ]
 
 [[package]]
@@ -1964,6 +2228,20 @@ dependencies = [
  "bytemuck",
 ]
 
+[[package]]
+name = "fontique"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbf1df16263783918b7da396077521f92b729ef7c429444dfcf03581f1448b77"
+dependencies = [
+ "hashbrown 0.17.1",
+ "linebender_resource_handle",
+ "memmap2",
+ "parlance",
+ "read-fonts",
+ "smallvec",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -2073,6 +2351,17 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.34"
@@ -2313,6 +2602,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
 dependencies = [
  "euclid",
+ "svg_fmt",
 ]
 
 [[package]]
@@ -2529,6 +2819,23 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "html-escape"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9356095b4b41197bba32173600e1582792cda618f65d12f68e2e77d273413c5"
+
+[[package]]
+name = "html5ever"
+version = "0.40.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456a1a377e608e555d22ddab27ac0114bc7a7b4199078108e34c2aeae6c9b130"
+dependencies = [
+ "log",
+ "markup5ever",
+ "memchr",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -2766,11 +3073,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -2820,6 +3148,8 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2827,6 +3157,29 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_segmenter"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
+dependencies = [
+ "core_maths",
+ "icu_collections",
+ "icu_locale_fallback",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "smallvec",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2947,6 +3300,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.15.0"
@@ -3112,6 +3474,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "khronos-egl"
 version = "6.0.0"
@@ -3403,6 +3775,28 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b"
 
+[[package]]
+name = "malloc_size_of_derive"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f44db74bde26fdf427af23f1d146c211aed857c59e3be750cf2617f6b0b05c94"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.119",
+ "synstructure 0.13.2",
+]
+
+[[package]]
+name = "markup5ever"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab3dc68ac4a0f5719e560136778c1ee716e296030d75dbd4484e37e39e3a842"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+
 [[package]]
 name = "matchers"
 version = "0.2.0"
@@ -3763,9 +4157,15 @@ dependencies = [
 name = "moq-scene"
 version = "0.1.0"
 dependencies = [
+ "anyrender_vello",
+ "blitz-dom",
+ "blitz-html",
+ "blitz-paint",
+ "blitz-traits",
  "bytemuck",
  "bytes",
  "cef",
+ "cssparser",
  "hang",
  "humantime-serde",
  "image",
@@ -3774,15 +4174,20 @@ dependencies = [
  "moq-mux",
  "moq-net",
  "moq-video",
+ "notosans",
+ "parley",
  "postcard",
  "rustix 1.1.5",
  "serde",
  "serde_with",
+ "stylo",
  "tempfile",
  "thiserror 2.0.21",
  "tokio",
  "toml",
  "tracing",
+ "url",
+ "vello",
 ]
 
 [[package]]
@@ -3839,7 +4244,7 @@ dependencies = [
  "moq-tokio",
  "moq-video",
  "mp4-atom",
- "pollster",
+ "pollster 1.0.1",
  "qrcodegen",
  "serde",
  "tempfile",
@@ -4015,6 +4420,12 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3720a0d1569be60cd7b0ff00d31c8e1397f6928957a5d9ad0724592f3e78f24c"
 
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
 [[package]]
 name = "naga"
 version = "30.0.1"
@@ -4092,6 +4503,12 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "no_std_io2"
 version = "0.9.4"
@@ -4153,6 +4570,12 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
+[[package]]
+name = "notosans"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "004d578bbfc8a6bdd4690576a8381af234ef051dd4cc358604e1784821e8205c"
+
 [[package]]
 name = "ntapi"
 version = "0.4.3"
@@ -4920,6 +5343,65 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "parlance"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73072a9470554c8e794778acece2312661218aaabb635600957d952cf01c716e"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "parley"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61bd0c0c1737f0b3d3726dc06b225083af213b61913e4fbae1670613a106c6ce"
+dependencies = [
+ "fontique",
+ "hashbrown 0.17.1",
+ "linebender_resource_handle",
+ "parlance",
+ "parley_engine",
+ "smallvec",
+]
+
+[[package]]
+name = "parley_data"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c43b63f808f6cc8f4a3b07de0d62a977bddd2e0bb5c232bd9e93ba8ef92e5e4b"
+dependencies = [
+ "icu_collections",
+ "icu_properties",
+]
+
+[[package]]
+name = "parley_emoji"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c4482d912d7671a7cd2089794f90ef3bb5f5f8c738230fb0fcd50fa020f0ed3"
+
+[[package]]
+name = "parley_engine"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b74c0d373e462e504ad4436710a39f099e18e848e1ee711f70cd2dcd5a69b290"
+dependencies = [
+ "fontique",
+ "harfrust",
+ "hashbrown 0.17.1",
+ "icu_locale_core",
+ "icu_normalizer",
+ "icu_properties",
+ "icu_segmenter",
+ "linebender_resource_handle",
+ "parlance",
+ "parley_data",
+ "parley_emoji",
+ "skrifa",
+]
+
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -4961,6 +5443,59 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "phf"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b585a510fb76fdebead6897982ef2a03a21d8e6cbcca904999742a4afc6ffe"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project"
 version = "1.1.13"
@@ -5082,6 +5617,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "pollster"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
+
 [[package]]
 name = "pollster"
 version = "1.0.1"
@@ -5130,6 +5671,8 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
@@ -5139,6 +5682,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
 [[package]]
 name = "presser"
 version = "0.3.1"
@@ -5425,6 +5974,26 @@ dependencies = [
  "objc2-quartz-core 0.3.2",
 ]
 
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "rcgen"
 version = "0.14.10"
@@ -5977,6 +6546,25 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "selectors"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8322aebea94a6cc288ff884e8a49bdbceef60206c400c6c46d22e62fc4fd91a6"
+dependencies = [
+ "bitflags 2.13.2",
+ "cssparser",
+ "derive_more",
+ "log",
+ "new_debug_unreachable",
+ "precomputed-hash",
+ "rustc-hash 2.1.3",
+ "servo_arc",
+ "smallvec",
+ "to_shmem",
+ "to_shmem_derive",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.3.0"
@@ -6102,12 +6690,22 @@ version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3e17bbc68e28663bbbb90df47e058aa7eda4fb445b89fe70457bb94fbccf6e49"
 dependencies = [
- "darling",
+ "darling 0.24.1",
  "proc-macro2",
  "quote",
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "servo_arc"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4eceb519ec34d8290aaf6e46f435102f2bfa63f22b05a144fb16ab266d3b198"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "sfv"
 version = "0.15.0"
@@ -6252,6 +6850,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "smallbitvec"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b0e903ee191d8f7a8fbf0d712c3a1699d19e04ceba5ad1eb673053c7d938a09"
+
 [[package]]
 name = "smallvec"
 version = "1.16.3"
@@ -6330,6 +6934,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "smol_str"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeb7109d23f319619d4cc0de5464613c8b7b1a09db2774a58101459cf6be2f10"
+dependencies = [
+ "borsh",
+ "serde_core",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.5"
@@ -6453,18 +7067,219 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "string_cache"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffa8a5dbe8b3f0bbe29d4c3225daafaeead63afdc1b65fc4c01a1384166038e6"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "928dcdf75e47626b3617a976ec205d9f057584c371c1f23b782129268d0e6edc"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "stylo"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a255e46af2478628c48daab3774090caabd7812b1dd3ca98801c2b9c53491ed"
+dependencies = [
+ "app_units",
+ "arrayvec",
+ "atomic_refcell",
+ "bitflags 2.13.2",
+ "byteorder",
+ "cssparser",
+ "derive_more",
+ "encoding_rs",
+ "euclid",
+ "icu_segmenter",
+ "indexmap 2.14.2",
+ "itertools 0.14.0",
+ "itoa",
+ "log",
+ "malloc_size_of_derive",
+ "mime",
+ "new_debug_unreachable",
+ "num-derive",
+ "num-integer",
+ "num-traits",
+ "num_cpus",
+ "parking_lot",
+ "precomputed-hash",
+ "rayon",
+ "rayon-core",
+ "rustc-hash 2.1.3",
+ "selectors",
+ "serde",
+ "servo_arc",
+ "smallbitvec",
+ "smallvec",
+ "static_assertions",
+ "string_cache",
+ "strum",
+ "strum_macros",
+ "stylo_atoms",
+ "stylo_derive",
+ "stylo_dom",
+ "stylo_malloc_size_of",
+ "stylo_static_prefs",
+ "stylo_traits",
+ "thin-vec",
+ "to_shmem",
+ "to_shmem_derive",
+ "uluru",
+ "url",
+ "void",
+ "walkdir",
+ "web_atoms",
+]
+
+[[package]]
+name = "stylo_atoms"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee1771588fd747ef16f8b1990061b6f37c7d3251a0f9b74f405a44c0c5fb8966"
+dependencies = [
+ "string_cache",
+ "string_cache_codegen",
+]
+
+[[package]]
+name = "stylo_derive"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ee5c550c2e00a0b3c046bef84a9ee217e04e7c014142eeb96f9e48781c5cfd3"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure 0.13.2",
+]
+
+[[package]]
+name = "stylo_dom"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9febcb03f2b669ef06b3e8a5209e6280971ed55cecf83fbf3c0562fcf2aa2ec6"
+dependencies = [
+ "bitflags 2.13.2",
+ "stylo_malloc_size_of",
+]
+
+[[package]]
+name = "stylo_malloc_size_of"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83ed69d55ee907599f093221004a28371925236f09f20961963020abf38bab6a"
+dependencies = [
+ "app_units",
+ "cssparser",
+ "euclid",
+ "parking_lot",
+ "selectors",
+ "servo_arc",
+ "smallbitvec",
+ "smallvec",
+ "string_cache",
+ "thin-vec",
+ "void",
+]
+
+[[package]]
+name = "stylo_static_prefs"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6767c48a1590461db79f8b434ccc5a2d65600a3b716751f7999b35ccead1e024"
+dependencies = [
+ "toml",
+]
+
+[[package]]
+name = "stylo_taffy"
+version = "0.3.0-beta.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d932deb3145f9e1c4159d09237f7999a29632fba9125896abb364dab080e0c0"
+dependencies = [
+ "bitflags 2.13.2",
+ "stylo",
+ "stylo_atoms",
+ "taffy",
+]
+
+[[package]]
+name = "stylo_traits"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645d6bfe40eb6e86ebe9f2d2adadcbced41bfa96175de7cb13d4d178d27bc83d"
+dependencies = [
+ "app_units",
+ "bitflags 2.13.2",
+ "cssparser",
+ "euclid",
+ "malloc_size_of_derive",
+ "selectors",
+ "serde",
+ "servo_arc",
+ "stylo_atoms",
+ "stylo_malloc_size_of",
+ "thin-vec",
+ "to_shmem",
+ "to_shmem_derive",
+ "url",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "svg_fmt"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0193cc4331cfd2f3d2011ef287590868599a2f33c3e69bc22c1a3d3acf9e02fb"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -6556,6 +7371,17 @@ dependencies = [
  "version-compare",
 ]
 
+[[package]]
+name = "taffy"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31f7bd2d97198df05186f93a3a3c306845f40e8b3c22bf9279cdd7e5cf5fea7d"
+dependencies = [
+ "serde",
+ "slotmap",
+ "smallvec",
+]
+
 [[package]]
 name = "tagptr"
 version = "0.2.0"
@@ -6592,6 +7418,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -6601,6 +7436,12 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "thin-vec"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6a4b9ba8738cb4a4f399d37e266becfd475e75eb73425b87a05a2f2039ba63e"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -6701,6 +7542,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
+ "serde_core",
  "zerovec",
 ]
 
@@ -6710,6 +7552,33 @@ version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
+[[package]]
+name = "to_shmem"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbf077da8dd01cc18453bd7d9bc3a945c262f5f344562e5f6deb3914b4dd6f14"
+dependencies = [
+ "cssparser",
+ "servo_arc",
+ "smallbitvec",
+ "smallvec",
+ "string_cache",
+ "thin-vec",
+]
+
+[[package]]
+name = "to_shmem_derive"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f8e91a023810fd2019648410d00eea13a71f21d849e71d6d9ed936fb8061174"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure 0.13.2",
+]
+
 [[package]]
 name = "tokio"
 version = "1.54.1"
@@ -6998,6 +7867,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "uluru"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c8a2469e56e6e5095c82ccd3afb98dad95f7af7929aab6d8ba8d6e0f73657da"
+dependencies = [
+ "arrayvec",
+]
+
 [[package]]
 name = "unicode-general-category"
 version = "1.1.0"
@@ -7182,6 +8060,25 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "vello"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "913abde56cab6131b62c0cc69b1a93b671d3c34b3097beb3714fd1dc93be8115"
+dependencies = [
+ "bytemuck",
+ "futures-intrusive",
+ "log",
+ "peniko",
+ "png",
+ "skrifa",
+ "static_assertions",
+ "thiserror 2.0.21",
+ "vello_encoding",
+ "vello_shaders",
+ "wgpu",
+]
+
 [[package]]
 name = "vello_common"
 version = "0.1.0"
@@ -7209,6 +8106,32 @@ dependencies = [
  "vello_common",
 ]
 
+[[package]]
+name = "vello_encoding"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1fb9548d2b46b0f79137b5b1d208ecbd76d432f74e7a2ba838615d117f11532"
+dependencies = [
+ "bytemuck",
+ "guillotiere",
+ "peniko",
+ "skrifa",
+ "smallvec",
+]
+
+[[package]]
+name = "vello_shaders"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e653222cee49f2571729c3e4b0fa99bc4f826c6bb9487dbb88b825d552b3a27"
+dependencies = [
+ "bytemuck",
+ "log",
+ "naga",
+ "thiserror 2.0.21",
+ "vello_encoding",
+]
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -7232,6 +8155,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "void"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -7504,6 +8433,18 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "web_atoms"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7572660c8890448ba236b7376f27e389c6a7e1c70195622faced601f855c0ada"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
 [[package]]
 name = "webm-iterable"
 version = "0.7.1"
@@ -7720,6 +8661,16 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wgpu_context"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5277f9d30e7087f1eeb0034206dce7d3377e76da017fdceb8aa4faebb1df68e2"
+dependencies = [
+ "futures-intrusive",
+ "wgpu",
+]
+
 [[package]]
 name = "wide"
 version = "1.7.1"
@@ -8070,7 +9021,7 @@ dependencies = [
  "redox_syscall 0.4.1",
  "rustix 0.38.44",
  "smithay-client-toolkit 0.19.2",
- "smol_str",
+ "smol_str 0.2.2",
  "tracing",
  "unicode-segmentation",
  "wasm-bindgen",
@@ -8216,6 +9167,16 @@ version = "0.8.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
+[[package]]
+name = "xml5ever"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73290529dc9bc6c6155bf77fdd70ce0061f98ad387586aa3104cddab29206961"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
 [[package]]
 name = "yasna"
 version = "0.6.0"
@@ -8393,6 +9354,7 @@ dependencies = [
  "displaydoc",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
@@ -8401,6 +9363,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
+ "serde",
  "yoke",
  "zerofrom",
  "zerovec-derive",
diff --git a/README.md b/README.md
index f69271f..c3cc1be 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # MoQ Studio
 
 `moq-studio` is a native streaming studio for Linux, macOS, and Windows. It
-composes cameras, screens, windows, images, colors, web pages, and broadcasts
-from a relay into scenes on the GPU, mixes their audio, and publishes the result to a
+composes cameras, screens, windows, images, colors, web pages, HTML and CSS
+overlays, and broadcasts from a relay into scenes on the GPU, mixes their audio, and publishes the result to a
 [MoQ](https://github.com/moq-dev/moq) relay. It is early and not packaged yet,
 so build it from source. The moq crates come from the `moq` submodule:
 
@@ -154,6 +154,38 @@ stream carries on. A crash of the browser itself fails every browser source.
 windows (`window.open` and new-tab links do nothing), and its dropdown lists,
 such as a `<select>`'s, are not drawn yet.
 
+An overlay is a title, lower third, or other graphic written as HTML and CSS,
+drawn by the studio itself (through [Blitz](https://github.com/DioxusLabs/blitz))
+rather than a browser, on every platform. Its CSS animations and transitions
+run on the program clock, so they land on the same frame in the program and in
+a recording or replay of it, whatever the studio's load. It runs no scripts
+and loads nothing: no images, stylesheets, or fonts from anywhere. Its text is
+set in the bundled Noto Sans, regular, bold, or italic, whatever `font-family`
+names, so it looks the same on every machine. An overlay outside what
+overlays draw fails to start, naming the first element, attribute, rule, or
+property it refused:
+
+- Elements: text and the boxes around it (`div`, `span`, `p`, headings,
+  lists, tables, and the like), plus `style`, `title`, and `meta`. Not
+  `script`, `img`, `link`, `iframe`, `svg`, `canvas`, or form controls.
+- Attributes: `id`, `class`, `style`, `lang`, `dir`, `title`, `hidden`,
+  table and list numbering ones, and `data-*` and `aria-*`.
+- CSS rules: style rules, nested ones included, `@media`, and `@keyframes`.
+  Not `@import` or `@font-face`, nor any `url()` or `image-set()`.
+- CSS properties: box layout, flexbox, grid, positioning, margins and
+  padding, colors, opacity, gradients, borders and their radii, `box-shadow`,
+  outlines, transforms, `clip-path`, fonts and text layout, text decoration,
+  `content`, and animations and transitions, by their usual shorthands too.
+  Not yet `filter`, `backdrop-filter`, `mix-blend-mode`, `text-shadow`,
+  `mask`, `text-overflow`, or multi-column layout; the list grows as Blitz
+  draws more.
+
+An overlay's animation starts when the overlay does: when the studio opens
+it, and again whenever it is edited. One that no preview or program shows
+costs nothing until it is shown again, where its animation has carried on.
+Overlays publish no track of their own, so viewers see them only in the
+program.
+
 ## Guests
 
 Guests and phones join a room the studio owns on its relay, from a web page,
@@ -271,6 +303,20 @@ url = "https://example.com/alerts"
 width = 800 # the page's own size, whatever its items stretch it to
 height = 600
 
+[sources.name]
+kind = "overlay"
+width = 1920 # the overlay's own size, like a page's
+height = 1080
+html = '''
+<style>
+  .third { position: absolute; left: 80px; bottom: 120px; padding: 16px 32px;
+    background: linear-gradient(90deg, #1e3a8a, #2563eb); border-radius: 12px;
+    font: bold 48px sans-serif; color: white; animation: in 400ms ease-out both; }
+  @keyframes in { from { transform: translateX(-40px); opacity: 0 } }
+</style>
+<div class="third">Ada Lovelace</div>
+'''
+
 [audio.guest]
 gain = 0.5
 
@@ -315,7 +361,7 @@ Source kinds are `camera`, `display`, and `microphone` (each with an optional
 `id`, the default device without one), `window` (with an `id`), `system_audio`
 (macOS), `image` (PNG or JPEG), `color` (`#rrggbb` or `#rrggbbaa`),
 `broadcast`, `browser` (a `url`, and a `width` and `height` up to 4096),
-`clone` (with the `source` it shows), `lut` (a 3D Adobe or Resolve `.cube`
+`overlay` (its `html`, and a `width` and `height` up to 4096), `clone` (with the `source` it shows), `lut` (a 3D Adobe or Resolve `.cube`
 file, which no item places, but which grades what a `lut` filter names it in),
 and `replay`, where the Replay panel plays replays. The Devices panel fills in
 ids. `[[top]]` items make up the top layer.
@@ -435,7 +481,7 @@ colors publish once, as the image file and as a one-pixel PNG. Removing or
 editing a source ends its track. A track carries the plain capture, before any
 filter, and a clone publishes none, since it shows its source's capture.
 Microphones and system audio do not publish tracks of their own yet. A browser
-source publishes none, so viewers see its page only in the program, and a
+source or overlay publishes none, so viewers see it only in the program, and a
 broadcast source is already its publisher's.
 
 Every captured source opens an encode session as it starts, and consumer GPUs
diff --git a/quest/m0/README.md b/quest/m0/README.md
index d5e84d3..6d3413d 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -94,7 +94,6 @@ repository.
 - [Broadcast sources play in sync](/quest/m0/broadcast-sync.md) - subscribed broadcasts and guests play audio and video on the publisher's timestamps, with `moq play`'s delay
 - [Wayland display and window sources](/quest/m0/wayland-sources.md) - portal-picked sources that reopen without the picker
 - [Live encode control](/quest/m0/encode-control.md) - simulcast rungs that follow the bandwidth grant, live bitrate and resolution, keyframes on request
-- [HTML/CSS overlays](/quest/m0/overlays.md) - script-free HTML and CSS graphics through Blitz natively and the DOM in the browser
 - [Animation and transitions](/quest/m0/animation.md) - move, slide, wipe, and stinger transitions, and keyframed item properties
 - [ML video effects](/quest/m0/effects.md) - background removal and other ML effects, baked into their source's track
 - [Destinations](/quest/m0/destinations.md) - RTMP, RTMPS, and WHIP push with per-destination codecs and shared encoders, on a UI-free egress library a hosted service can reuse
diff --git a/quest/m0/overlays.md b/quest/m0/overlays.md
deleted file mode 100644
index 9cd63c3..0000000
--- a/quest/m0/overlays.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# [L] HTML/CSS overlays
-
-## Goal
-
-Titles, lower thirds, tickers, and other graphics in `moq-studio` are written
-as HTML and CSS without JavaScript and render through Blitz into the program.
-CSS animations and transitions run on the media clock, so an overlay animates
-on the same frame in the program, a recording, and a replay.
-
-## Plan
-
-Decided 2026-10-26 (maintainer):
-
-- **Format:** HTML and CSS, no JavaScript, so creators author in a format they
-  know and nothing executes in a viewer.
-- **Native renderer:** Blitz (Stylo, Taffy, Parley) drawing through Vello into
-  the studio's wgpu device, with its animation clock driven by the media
-  clock. Servo was passed over: it outputs OpenGL rather than wgpu, bundles a
-  JavaScript engine, and has no clock injection.
-- **Browser:** the DOM layered over the composited video, so no HTML-in-Canvas
-  and it works in every browser today.
-- **Subset:** an overlay accepts only the CSS Blitz renders and refuses
-  the rest at setup with the property named. Blitz is beta (no blend modes or
-  `text-shadow`, filters limited to blur and drop-shadow), and the subset
-  grows as it does.
-- **Parity:** layout parity per the [composition epic](/quest/m1/compose/README.md);
-  the fixture compares boxes and timing, and pixels only loosely.
-
-An overlay is hostile input to every viewer, so it fetches nothing from the
-network: fonts and images travel with the broadcast or are bundled. The
-browser enforces it rather than trusting the studio: the overlay renders in a
-sandboxed frame with scripts off and a content security policy that loads
-only those carried resources. First check
-whether Blitz can draw into a caller's wgpu texture without a readback, and
-upstream that if it cannot. Arbitrary web pages and JavaScript graphics stay
-browser sources (`moq_scene::browser`), baked into their own
-track.
-
-Changed 2026-11-04 (maintainer): the program comes first, so this quest
-renders overlays in the studio only. Carrying them in the layout track, the
-browser's DOM rendering, and the headless compositor wait for the m1
-[composition epic](/quest/m1/compose/README.md); keep the overlay model free
-of studio-only state so that epic can serialize it.
-
-## Related
-
-- [Layout track](/quest/m1/compose/layout.md) - where overlays travel to viewers in m1
diff --git a/rs/moq-scene/Cargo.toml b/rs/moq-scene/Cargo.toml
index ae7117d..7d03c13 100644
--- a/rs/moq-scene/Cargo.toml
+++ b/rs/moq-scene/Cargo.toml
@@ -32,8 +32,23 @@ pipewire = ["capture", "moq-video/pipewire", "moq-audio/pipewire"]
 cef = ["dep:cef"]
 
 [dependencies]
+# Overlays: Blitz lays HTML and CSS out and paints it into a Vello scene, which
+# Vello renders on the compositor's device. Pinned to the beta whose Vello and
+# wgpu match moq-video's: the stable 0.2 line is on wgpu 26, which cannot share
+# the device. Fonts and network access are left off, so an overlay loads nothing.
+anyrender_vello = "0.15"
+blitz-dom = { version = "=0.3.0-beta.4", default-features = false }
+blitz-html = "=0.3.0-beta.4"
+blitz-paint = { version = "=0.3.0-beta.4", default-features = false }
+blitz-traits = "=0.3.0-beta.4"
 bytemuck = { version = "1", features = ["derive"] }
 bytes = { workspace = true }
+# Reads the declarations an overlay's CSS checks, as Stylo serializes them.
+cssparser = "0.38"
+# The faces every overlay's text is set in: Noto Sans, regular, bold, and italic.
+notosans = "0.1"
+# Blitz's text layout, to register those faces as every family's.
+parley = { version = "0.12", default-features = false, features = ["std"] }
 # The catalog's rendition configs, which a broadcast source follows.
 hang = { workspace = true }
 humantime-serde = { workspace = true }
@@ -48,10 +63,14 @@ moq-net = { workspace = true }
 moq-video = { workspace = true, features = ["render"] }
 serde = { workspace = true }
 serde_with = { workspace = true }
+# Stylo, Blitz's style engine, which parses an overlay's CSS to check it.
+style = { package = "stylo", version = "0.22" }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["macros", "sync", "time"] }
 toml = { workspace = true }
 tracing = { workspace = true }
+url = { workspace = true }
+vello = "0.11"
 
 # The helper process a browser source runs CEF in, and the socket between them.
 [target.'cfg(target_os = "linux")'.dependencies]
diff --git a/rs/moq-scene/src/collection.rs b/rs/moq-scene/src/collection.rs
index 9ab7c88..3ef19cc 100644
--- a/rs/moq-scene/src/collection.rs
+++ b/rs/moq-scene/src/collection.rs
@@ -847,6 +847,20 @@ pub enum Source {
 		/// The page's viewport height in pixels.
 		height: u32,
 	},
+	/// A graphic written as HTML and CSS without scripts, such as a title or
+	/// lower third. Its CSS animations run on the program clock, so they land
+	/// on the same frame in the program and everything made from it. It loads
+	/// nothing, and HTML or CSS outside what overlays draw fails the source,
+	/// naming it.
+	Overlay {
+		/// The document, its CSS in `<style>` elements and `style` attributes.
+		html: String,
+		/// The overlay's viewport width in pixels, independent of where it is
+		/// placed.
+		width: u32,
+		/// The overlay's viewport height in pixels.
+		height: u32,
+	},
 	/// Another source's picture, captured once, with [`Collection::video`]
 	/// filters of its own. Its sound is not mixed a second time.
 	Clone {
@@ -902,16 +916,21 @@ impl Source {
 	}
 
 	fn validate(&self, name: &str) -> Result<(), Error> {
-		if let Self::Browser { url, width, height } = self {
-			if url.trim().is_empty() {
-				return Err(Error::Invalid(format!("browser source `{name}` has no url")));
-			}
-			let max = crate::browser::MAX_SIDE;
-			if *width == 0 || *height == 0 || *width > max || *height > max {
-				return Err(Error::Invalid(format!(
-					"browser source `{name}` is {width}x{height}; each side must be 1 to {max} pixels"
-				)));
+		let (kind, width, height) = match self {
+			Self::Browser { url, width, height } => {
+				if url.trim().is_empty() {
+					return Err(Error::Invalid(format!("browser source `{name}` has no url")));
+				}
+				("browser", width, height)
 			}
+			Self::Overlay { width, height, .. } => ("overlay", width, height),
+			_ => return Ok(()),
+		};
+		let max = crate::browser::MAX_SIDE;
+		if *width == 0 || *height == 0 || *width > max || *height > max {
+			return Err(Error::Invalid(format!(
+				"{kind} source `{name}` is {width}x{height}; each side must be 1 to {max} pixels"
+			)));
 		}
 		Ok(())
 	}
diff --git a/rs/moq-scene/src/compositor.rs b/rs/moq-scene/src/compositor.rs
index a38f06c..9fa3bf0 100644
--- a/rs/moq-scene/src/compositor.rs
+++ b/rs/moq-scene/src/compositor.rs
@@ -1,15 +1,16 @@
 //! Draw scenes onto the canvas on the GPU: a preview, a program, and the fade
 //! between them.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::time::Duration;
 
 use kio::clock::Instant;
 use moq_video::render::{Renderer, wgpu};
 
 use crate::Error;
-use crate::collection::{Canvas, Collection, Item, Layer as Place, Source};
+use crate::collection::{Canvas, Collection, Filter, Item, Layer as Place, Source};
 use crate::effect::{self, Effects, Frame, Lut, Picture, Prepared};
+use crate::overlay::{Overlay, Overlays};
 use crate::source::{self, Sources};
 
 /// The format of every canvas texture: gamma-encoded RGBA, what
@@ -41,6 +42,8 @@ pub struct Compositor {
 	incoming: Target,
 
 	layers: HashMap<String, Layer>,
+	/// Lays out and paints overlays, started with the first one.
+	overlays: Option<Overlays>,
 	preview_scene: Option<String>,
 	program_scene: Option<String>,
 	fade: Option<Fade>,
@@ -70,6 +73,8 @@ struct Layer {
 	picture: Option<Picture>,
 	/// A LUT source's table; `None` until it is read.
 	lut: Option<Lut>,
+	/// An overlay's document, which paints `picture`.
+	overlay: Option<Overlay>,
 	/// Why the newest picture failed to draw, logged when it first does.
 	error: Option<String>,
 }
@@ -106,6 +111,7 @@ impl Compositor {
 			canvas,
 			effects,
 			layers: HashMap::new(),
+			overlays: None,
 			preview_scene: None,
 			program_scene: None,
 			fade: None,
@@ -240,7 +246,8 @@ impl Compositor {
 	/// through [`error`](Self::error); this fails only when the canvas itself
 	/// cannot be drawn.
 	pub fn render(&mut self, collection: &Collection, sources: &Sources, now: Instant) -> Result<(), Error> {
-		self.update(collection, sources);
+		self.update(collection, sources, now);
+		self.paint(collection, now);
 
 		let progress = self.fade.as_ref().map(|fade| {
 			let elapsed = now.saturating_duration_since(fade.start);
@@ -286,8 +293,9 @@ impl Compositor {
 	}
 
 	/// Pull the newest picture from every source onto the GPU, and forget the
-	/// sources the collection no longer has or has since edited.
-	fn update(&mut self, collection: &Collection, sources: &Sources) {
+	/// sources the collection no longer has or has since edited. An overlay
+	/// that arrives now starts its CSS timeline at `now`.
+	fn update(&mut self, collection: &Collection, sources: &Sources, now: Instant) {
 		self.layers
 			.retain(|name, layer| collection.sources.get(name) == Some(&layer.source));
 
@@ -303,6 +311,7 @@ impl Compositor {
 				renderer: None,
 				picture: None,
 				lut: None,
+				overlay: None,
 				error: None,
 			});
 			// A page arrives premultiplied; frames and images are straight.
@@ -324,6 +333,24 @@ impl Compositor {
 					layer.lut = Some(self.effects.lut(&cube));
 					continue;
 				}
+				source::Picture::Overlay => {
+					let Source::Overlay { html, width, height } = source else {
+						unreachable!("only an overlay source shows an overlay")
+					};
+					let overlays = match &mut self.overlays {
+						Some(overlays) => Ok(overlays),
+						None => Overlays::new(&self.device, &self.queue).map(|overlays| self.overlays.insert(overlays)),
+					};
+					match overlays {
+						Ok(overlays) => {
+							let overlay = overlays.open(html, *width, *height, now);
+							layer.picture = Some(self.effects.picture(overlay.texture(), false));
+							layer.overlay = Some(overlay);
+						}
+						Err(err) => layer.error = Some(err.to_string()),
+					}
+					continue;
+				}
 			};
 
 			match texture {
@@ -340,6 +367,75 @@ impl Compositor {
 			}
 		}
 	}
+
+	/// Paint each overlay preview or program draws as of `now`, where it moved
+	/// since its last paint. One drawn nowhere waits: its CSS runs on the
+	/// program clock, so it lands where it should whenever it is drawn again.
+	fn paint(&mut self, collection: &Collection, now: Instant) {
+		let Some(overlays) = &self.overlays else { return };
+		let shown = self.shown(collection);
+		let painting: Vec<_> = self
+			.layers
+			.iter()
+			.filter(|(name, _)| shown.contains(name.as_str()))
+			.filter_map(|(_, layer)| layer.overlay.as_ref().map(Overlay::id))
+			.collect();
+		if painting.is_empty() {
+			return;
+		}
+
+		let failed = overlays.paint(now, painting.clone());
+		for (name, layer) in &mut self.layers {
+			let Some(overlay) = &layer.overlay else { continue };
+			let error = match &failed {
+				// The thread is gone, and with it every overlay it held, drawn or
+				// not, until each is edited.
+				Err(err) => {
+					layer.overlay = None;
+					layer.picture = None;
+					Some(err.to_string())
+				}
+				Ok(_) if !painting.contains(&overlay.id()) => continue,
+				Ok(failed) => failed.get(&overlay.id()).cloned(),
+			};
+			if let Some(err) = &error
+				&& layer.error.is_none()
+			{
+				tracing::warn!(source = %name, %err, "cannot paint overlay");
+			}
+			layer.error = error;
+		}
+		if failed.is_err() {
+			self.overlays = None;
+		}
+	}
+
+	/// The sources whose pictures preview and program draw: each visible
+	/// item's, and each mask's, through clones.
+	fn shown<'a>(&self, collection: &'a Collection) -> HashSet<&'a str> {
+		let leaving = self.fade.as_ref().and_then(|fade| fade.from.as_deref());
+		let scenes = [self.preview_scene.as_deref(), self.program_scene.as_deref(), leaving]
+			.into_iter()
+			.flatten()
+			.map(|name| Place::Scene(name.to_string()));
+		let mut shown = HashSet::new();
+		for place in scenes.chain([Place::Top]) {
+			for item in collection
+				.items(&place)
+				.into_iter()
+				.flatten()
+				.filter(|item| item.visible)
+			{
+				shown.insert(collection.capture(&item.source));
+				for filter in collection.filters(item) {
+					if let Filter::Mask { source, .. } = filter {
+						shown.insert(collection.capture(source));
+					}
+				}
+			}
+		}
+		shown
+	}
 }
 
 /// Refuse an invalid canvas, or one larger than `device` can hold as a
@@ -1368,4 +1464,93 @@ mod tests {
 		})
 		.await;
 	}
+
+	/// An overlay's CSS animation runs on the program clock from when the
+	/// overlay opens: a frame shows it where the program time says, however late
+	/// that frame is drawn, even the first one to show it.
+	#[tokio::test]
+	#[ignore = "needs a Vulkan device; run by just rs render-sw"]
+	async fn an_overlay_animates_on_the_program_clock() {
+		local(async {
+			let mut collection = collection();
+			collection.sources.insert(
+				"overlay".into(),
+				Source::Overlay {
+					html: "<style>
+						body { margin: 0 }
+						div { width: 8px; height: 4px; animation: fade 1s linear both }
+						@keyframes fade { from { background: red } to { background: blue } }
+					</style><div></div>"
+						.into(),
+					width: 8,
+					height: 8,
+				},
+			);
+			collection.scenes[1].items = vec![Item::new("overlay", Rect::fill(&collection.canvas))];
+			let mut studio = Studio::new(collection).await;
+			studio.compositor.set_preview(Some("red".into()));
+			studio.compositor.cut();
+			// Opened here, but drawn nowhere until the cut.
+			let start = Instant::now();
+			studio.render(start);
+			studio.compositor.set_preview(Some("blue".into()));
+			studio.compositor.cut();
+
+			for (at, expected) in [(500, [128, 0, 128, 255]), (750, [64, 0, 191, 255]), (2000, BLUE)] {
+				studio.render(start + Duration::from_millis(at));
+				let program = studio.program();
+				let actual = pixel(&program, 3, 1);
+				assert!(
+					actual.iter().zip(expected).all(|(a, e)| a.abs_diff(e) <= 2),
+					"{at} ms: {actual:?}"
+				);
+				assert_eq!(pixel(&program, 3, 6), BLACK, "{at} ms: the rest is transparent");
+			}
+		})
+		.await;
+	}
+
+	/// When the overlay thread stops, every overlay it held fails, including
+	/// one off air, rather than showing its last paint when cut to.
+	#[tokio::test]
+	#[ignore = "needs a Vulkan device; run by just rs render-sw"]
+	async fn a_stopped_overlay_thread_fails_every_overlay() {
+		local(async {
+			let mut collection = collection();
+			let overlay = |color: &str| Source::Overlay {
+				html: format!("<body style=\"margin: 0; background: {color}\"></body>"),
+				width: 8,
+				height: 8,
+			};
+			collection.sources.insert("shown".into(), overlay("lime"));
+			collection.sources.insert("aside".into(), overlay("yellow"));
+			let fill = Rect::fill(&collection.canvas);
+			collection.scenes[0].items = vec![Item::new("red", fill), Item::new("aside", fill)];
+			collection.scenes[1].items = vec![Item::new("blue", fill), Item::new("shown", fill)];
+			let mut studio = Studio::new(collection).await;
+			let start = Instant::now();
+
+			// Paint the aside overlay, then leave it off air.
+			studio.compositor.set_preview(Some("red".into()));
+			studio.compositor.cut();
+			studio.render(start);
+			assert_eq!(pixel(&studio.program(), 3, 3), [255, 255, 0, 255]);
+			studio.compositor.set_preview(Some("blue".into()));
+			studio.compositor.cut();
+			studio.render(start);
+
+			studio.compositor.overlays.as_ref().unwrap().panic();
+			studio.render(start);
+			for name in ["shown", "aside"] {
+				let err = studio.compositor.error(name).unwrap_or_else(|| panic!("{name} fails"));
+				assert!(err.contains("overlay thread stopped"), "{name}: {err}");
+			}
+
+			studio.compositor.set_preview(Some("red".into()));
+			studio.compositor.cut();
+			studio.render(start);
+			assert_eq!(pixel(&studio.program(), 3, 3), RED, "no frozen overlay");
+		})
+		.await;
+	}
 }
diff --git a/rs/moq-scene/src/lib.rs b/rs/moq-scene/src/lib.rs
index 6da4f34..b08e144 100644
--- a/rs/moq-scene/src/lib.rs
+++ b/rs/moq-scene/src/lib.rs
@@ -35,6 +35,7 @@ mod compositor;
 mod edit;
 mod effect;
 mod lut;
+mod overlay;
 pub mod publish;
 pub mod replay;
 pub mod source;
@@ -112,4 +113,9 @@ pub enum Error {
 	/// A browser source's page failed, or its helper process stopped.
 	#[error("browser: {0}")]
 	Browser(String),
+
+	/// An overlay holds HTML or CSS outside what overlays draw, named, or
+	/// failed to draw.
+	#[error("overlay: {0}")]
+	Overlay(String),
 }
diff --git a/rs/moq-scene/src/overlay.rs b/rs/moq-scene/src/overlay.rs
new file mode 100644
index 0000000..f8e95fd
--- /dev/null
+++ b/rs/moq-scene/src/overlay.rs
@@ -0,0 +1,887 @@
+//! Overlays: titles, lower thirds, and other graphics written as HTML and CSS,
+//! laid out by Blitz and painted by Vello straight into a texture on the
+//! compositor's device, on the program clock.
+//!
+//! An overlay is untrusted, so it loads and runs nothing: Blitz has no script
+//! engine, its document has no network or navigation provider, and [`check`]
+//! refuses any element, attribute, CSS rule, or property outside the subset an
+//! overlay draws, naming it.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::sync::{Arc, mpsc};
+
+use blitz_dom::{BaseDocument, DocumentConfig, FontContext, Node, ns};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use kio::clock::Instant;
+use moq_video::render::wgpu;
+use style::context::QuirksMode;
+use style::error_reporting::{ContextualParseError, ParseErrorReporter};
+use style::properties::PropertyDeclarationBlock;
+use style::shared_lock::{SharedRwLock, SharedRwLockReadGuard, ToCssWithGuard};
+use style::stylesheets::{AllowImportRules, CssRule, CssRuleType, Origin, StylesheetContents, UrlExtraData};
+
+use crate::Error;
+
+/// The elements an overlay may hold: text and the boxes around it. Anything
+/// that loads a resource (`img`, `link`, `iframe`), runs code (`script`),
+/// takes input (`input`, `button`), or draws outside CSS (`svg`, `canvas`) is
+/// refused.
+const ELEMENTS: &[&str] = &[
+	"html",
+	"head",
+	"title",
+	"meta",
+	"style",
+	"body",
+	"div",
+	"span",
+	"p",
+	"h1",
+	"h2",
+	"h3",
+	"h4",
+	"h5",
+	"h6",
+	"header",
+	"footer",
+	"main",
+	"section",
+	"article",
+	"aside",
+	"nav",
+	"figure",
+	"figcaption",
+	"blockquote",
+	"pre",
+	"code",
+	"kbd",
+	"samp",
+	"var",
+	"b",
+	"i",
+	"u",
+	"s",
+	"strong",
+	"em",
+	"small",
+	"mark",
+	"sub",
+	"sup",
+	"abbr",
+	"cite",
+	"q",
+	"del",
+	"ins",
+	"time",
+	"data",
+	"bdi",
+	"bdo",
+	"br",
+	"wbr",
+	"hr",
+	"ul",
+	"ol",
+	"li",
+	"dl",
+	"dt",
+	"dd",
+	"table",
+	"caption",
+	"colgroup",
+	"col",
+	"thead",
+	"tbody",
+	"tfoot",
+	"tr",
+	"th",
+	"td",
+];
+
+/// The attributes an overlay's elements may carry, besides `aria-*` and
+/// `data-*`: none names a resource or styles an element outside CSS.
+const ATTRIBUTES: &[&str] = &[
+	"id", "class", "style", "lang", "dir", "title", "hidden", "charset", "colspan", "rowspan", "span", "start",
+	"reversed", "value", "datetime",
+];
+
+/// The CSS properties an overlay may set, as written, shorthands included: the
+/// ones Blitz lays out and paints through Vello. Missing are those it ignores
+/// or Vello cannot draw yet, such as `filter`, `backdrop-filter`,
+/// `mix-blend-mode`, `text-shadow`, `mask`, `text-overflow`, multi-column
+/// layout, and logical borders, so an overlay never looks different from what
+/// its CSS says.
+const PROPERTIES: &[&str] = &[
+	// Boxes.
+	"display",
+	"position",
+	"top",
+	"right",
+	"bottom",
+	"left",
+	"inset",
+	"inset-block",
+	"inset-block-start",
+	"inset-block-end",
+	"inset-inline",
+	"inset-inline-start",
+	"inset-inline-end",
+	"width",
+	"height",
+	"min-width",
+	"min-height",
+	"max-width",
+	"max-height",
+	"block-size",
+	"inline-size",
+	"min-block-size",
+	"min-inline-size",
+	"max-block-size",
+	"max-inline-size",
+	"box-sizing",
+	"aspect-ratio",
+	"margin",
+	"margin-top",
+	"margin-right",
+	"margin-bottom",
+	"margin-left",
+	"margin-block",
+	"margin-block-start",
+	"margin-block-end",
+	"margin-inline",
+	"margin-inline-start",
+	"margin-inline-end",
+	"padding",
+	"padding-top",
+	"padding-right",
+	"padding-bottom",
+	"padding-left",
+	"padding-block",
+	"padding-block-start",
+	"padding-block-end",
+	"padding-inline",
+	"padding-inline-start",
+	"padding-inline-end",
+	"overflow",
+	"overflow-x",
+	"overflow-y",
+	"z-index",
+	"float",
+	"clear",
+	"visibility",
+	"direction",
+	// Flexbox and grid.
+	"flex",
+	"flex-flow",
+	"flex-direction",
+	"flex-wrap",
+	"flex-grow",
+	"flex-shrink",
+	"flex-basis",
+	"order",
+	"align-items",
+	"align-self",
+	"align-content",
+	"justify-content",
+	"justify-items",
+	"justify-self",
+	"place-items",
+	"place-self",
+	"place-content",
+	"gap",
+	"row-gap",
+	"column-gap",
+	"grid",
+	"grid-template",
+	"grid-template-columns",
+	"grid-template-rows",
+	"grid-template-areas",
+	"grid-auto-columns",
+	"grid-auto-rows",
+	"grid-auto-flow",
+	"grid-area",
+	"grid-row",
+	"grid-row-start",
+	"grid-row-end",
+	"grid-column",
+	"grid-column-start",
+	"grid-column-end",
+	// Tables and lists.
+	"border-collapse",
+	"border-spacing",
+	"table-layout",
+	"list-style",
+	"list-style-type",
+	"list-style-position",
+	// Paint.
+	"color",
+	"opacity",
+	"background",
+	"background-color",
+	"background-image",
+	"background-position",
+	"background-position-x",
+	"background-position-y",
+	"background-size",
+	"background-repeat",
+	"background-clip",
+	"background-origin",
+	"border",
+	"border-width",
+	"border-style",
+	"border-color",
+	"border-top",
+	"border-right",
+	"border-bottom",
+	"border-left",
+	"border-top-width",
+	"border-right-width",
+	"border-bottom-width",
+	"border-left-width",
+	"border-top-style",
+	"border-right-style",
+	"border-bottom-style",
+	"border-left-style",
+	"border-top-color",
+	"border-right-color",
+	"border-bottom-color",
+	"border-left-color",
+	"border-radius",
+	"border-top-left-radius",
+	"border-top-right-radius",
+	"border-bottom-right-radius",
+	"border-bottom-left-radius",
+	"box-shadow",
+	"outline",
+	"outline-color",
+	"outline-style",
+	"outline-width",
+	"transform",
+	"transform-origin",
+	"translate",
+	"rotate",
+	"scale",
+	"clip-path",
+	"clip",
+	// Text.
+	"font",
+	"font-family",
+	"font-size",
+	"font-style",
+	"font-weight",
+	"font-stretch",
+	"font-width",
+	"font-feature-settings",
+	"font-variation-settings",
+	"line-height",
+	"letter-spacing",
+	"word-spacing",
+	"text-align",
+	"text-indent",
+	"text-transform",
+	"text-decoration",
+	"text-decoration-line",
+	"text-decoration-color",
+	"text-decoration-style",
+	"text-decoration-thickness",
+	"text-underline-offset",
+	"white-space",
+	"white-space-collapse",
+	"text-wrap-mode",
+	"word-break",
+	"overflow-wrap",
+	"word-wrap",
+	"line-break",
+	"vertical-align",
+	"content",
+	// Motion, on the program clock.
+	"animation",
+	"animation-name",
+	"animation-duration",
+	"animation-timing-function",
+	"animation-delay",
+	"animation-iteration-count",
+	"animation-direction",
+	"animation-fill-mode",
+	"animation-play-state",
+	"transition",
+	"transition-property",
+	"transition-duration",
+	"transition-timing-function",
+	"transition-delay",
+	"transition-behavior",
+];
+
+/// CSS functions that load a resource, which an overlay cannot.
+const LOADS: &[&str] = &["url(", "image-set("];
+
+/// Refuse `html` unless every element, attribute, CSS rule, and CSS property
+/// in it is one an overlay draws, naming the first that is not.
+pub(crate) fn check(html: &str) -> Result<(), Error> {
+	let document = document(html, 1, 1);
+	check_node(&document, document.root_node())
+}
+
+fn check_node(document: &BaseDocument, node: &Node) -> Result<(), Error> {
+	if let Some(element) = node.element_data() {
+		let name: &str = &element.name.local;
+		if element.name.ns != ns!(html) || !ELEMENTS.contains(&name) {
+			return Err(refused(format!("the `<{name}>` element")));
+		}
+		for attribute in element.attrs.iter() {
+			let attribute: &str = &attribute.name.local;
+			let inert = attribute.starts_with("aria-") || attribute.starts_with("data-");
+			if !inert && !ATTRIBUTES.contains(&attribute) {
+				return Err(refused(format!("the `{attribute}` attribute on `<{name}>`")));
+			}
+		}
+		if name == "style" {
+			check_sheet(&node.text_content())?;
+		}
+		if let Some(style) = node.attr(blitz_dom::local_name!("style")) {
+			check_attribute(style)?;
+		}
+	}
+	for &child in &node.children {
+		if let Some(child) = document.get_node(child) {
+			check_node(document, child)?;
+		}
+	}
+	Ok(())
+}
+
+/// Collects the first error Stylo reports, such as an unknown property or an
+/// invalid value.
+#[derive(Default)]
+struct Reporter(RefCell<Option<String>>);
+
+impl ParseErrorReporter for Reporter {
+	fn report_error(&self, _url: &UrlExtraData, location: cssparser::SourceLocation, error: ContextualParseError) {
+		self.0
+			.borrow_mut()
+			.get_or_insert_with(|| format!("line {}: {error}", location.line + 1));
+	}
+}
+
+impl Reporter {
+	fn result(self) -> Result<(), Error> {
+		match self.0.into_inner() {
+			Some(error) => Err(Error::Overlay(format!("CSS {error}"))),
+			None => Ok(()),
+		}
+	}
+}
+
+fn url() -> UrlExtraData {
+	url::Url::parse("about:blank").expect("a valid url").into()
+}
+
+fn check_sheet(css: &str) -> Result<(), Error> {
+	let lock = SharedRwLock::new();
+	let reporter = Reporter::default();
+	let sheet = StylesheetContents::from_str(
+		css,
+		url(),
+		Origin::Author,
+		&lock,
+		None,
+		Some(&reporter),
+		QuirksMode::NoQuirks,
+		AllowImportRules::No,
+		None,
+	);
+	reporter.result()?;
+	let guard = lock.read();
+	check_rules(&sheet.rules.read_with(&guard).0, &guard)
+}
+
+fn check_rules(rules: &[CssRule], guard: &SharedRwLockReadGuard) -> Result<(), Error> {
+	for rule in rules {
+		match rule {
+			CssRule::Style(style) => {
+				let style = style.read_with(guard);
+				check_block(style.block.read_with(guard))?;
+				if let Some(nested) = &style.rules {
+					check_rules(&nested.read_with(guard).0, guard)?;
+				}
+			}
+			CssRule::NestedDeclarations(nested) => check_block(nested.read_with(guard).block.read_with(guard))?,
+			CssRule::Media(media) => check_rules(&media.rules.read_with(guard).0, guard)?,
+			CssRule::Keyframes(keyframes) => {
+				for keyframe in &keyframes.read_with(guard).keyframes {
+					check_block(keyframe.read_with(guard).block.read_with(guard))?;
+				}
+			}
+			other => {
+				let css = other.to_css_string(guard);
+				let name = css.split(|c: char| c.is_whitespace() || c == '{' || c == ';').next();
+				return Err(refused(format!("the `{}` rule", name.unwrap_or_default())));
+			}
+		}
+	}
+	Ok(())
+}
+
+fn check_attribute(css: &str) -> Result<(), Error> {
+	let reporter = Reporter::default();
+	let block = style::properties::parse_style_attribute(
+		css,
+		&url(),
+		Some(&reporter),
+		QuirksMode::NoQuirks,
+		CssRuleType::Style,
+	);
+	reporter.result()?;
+	check_block(&block)
+}
+
+/// Check a block's declarations by the names they serialize under, which are
+/// shorthands wherever one covers them, so `border: 1px solid` is checked as
+/// `border` rather than as the `border-image` it resets.
+fn check_block(block: &PropertyDeclarationBlock) -> Result<(), Error> {
+	let mut css = String::new();
+	block.to_css(&mut css).expect("writing to a string");
+
+	let mut parser = cssparser::Parser::new(&css);
+	while !parser.is_exhausted() {
+		let name = parser.expect_ident_cloned().map_err(|_| unreadable(&css))?;
+		parser.expect_colon().map_err(|_| unreadable(&css))?;
+		let start = parser.position();
+		parser
+			.parse_until_after(cssparser::Delimiter::Semicolon, |value| {
+				while value.next().is_ok() {}
+				Ok::<_, cssparser::ParseError<()>>(())
+			})
+			.map_err(|_| unreadable(&css))?;
+		let value = parser.slice_from(start).to_ascii_lowercase();
+
+		if !name.starts_with("--") && !PROPERTIES.contains(&name.as_ref()) {
+			return Err(refused(format!("the `{name}` property")));
+		}
+		if let Some(load) = LOADS.iter().find(|load| value.contains(*load)) {
+			return Err(Error::Overlay(format!(
+				"`{name}` uses `{load}`, but an overlay loads nothing"
+			)));
+		}
+	}
+	Ok(())
+}
+
+fn unreadable(css: &str) -> Error {
+	Error::Overlay(format!("cannot read back the declarations `{css}`"))
+}
+
+fn refused(what: String) -> Error {
+	Error::Overlay(format!("{what} is not supported in an overlay"))
+}
+
+/// Parse `html` into a `width` by `height` document with no network access.
+fn document(html: &str, width: u32, height: u32) -> BaseDocument {
+	let config = DocumentConfig {
+		viewport: Some(Viewport::new(width, height, 1.0, ColorScheme::Light)),
+		font_ctx: Some(fonts()),
+		..Default::default()
+	};
+	blitz_html::HtmlDocument::from_html(html, config).into_inner()
+}
+
+/// Noto Sans, regular, bold, and italic, as every family: an overlay loads no
+/// fonts, and leaves the machine's out so that it looks the same on any.
+fn fonts() -> FontContext {
+	use parley::fontique::{Blob, Collection, CollectionOptions, GenericFamily, SourceCache};
+
+	let mut fonts = FontContext {
+		source_cache: SourceCache::new_shared(),
+		collection: Collection::new(CollectionOptions {
+			shared: false,
+			system_fonts: false,
+		}),
+	};
+	let mut families = Vec::new();
+	for face in [
+		notosans::REGULAR_TTF,
+		notosans::BOLD_TTF,
+		notosans::ITALIC_TTF,
+		notosans::BOLD_ITALIC_TTF,
+	] {
+		let registered = fonts.collection.register_fonts(Blob::new(Arc::new(face)), None);
+		families.extend(registered.into_iter().map(|(family, _)| family));
+	}
+	families.dedup();
+	for generic in [
+		GenericFamily::SansSerif,
+		GenericFamily::Serif,
+		GenericFamily::Monospace,
+		GenericFamily::Cursive,
+		GenericFamily::Fantasy,
+		GenericFamily::SystemUi,
+		GenericFamily::UiSansSerif,
+		GenericFamily::UiSerif,
+		GenericFamily::UiMonospace,
+		GenericFamily::UiRounded,
+	] {
+		fonts.collection.set_generic_families(generic, families.iter().copied());
+	}
+	fonts
+}
+
+/// The overlays a compositor draws. Their documents live on a thread of their
+/// own, since a Blitz document cannot leave the thread that made it, and a
+/// panic there fails the overlays rather than the compositor.
+pub(crate) struct Overlays {
+	device: wgpu::Device,
+	requests: mpsc::Sender<Request>,
+	/// What each paint failed on, by overlay.
+	painted: mpsc::Receiver<Vec<(u64, String)>>,
+	next: u64,
+}
+
+enum Request {
+	Open {
+		id: u64,
+		html: String,
+		view: wgpu::TextureView,
+		start: Instant,
+	},
+	Close(u64),
+	/// Paint these overlays as of this time on the program clock.
+	Paint(Instant, Vec<u64>),
+	/// Stop the thread the way a panic in Blitz would.
+	#[cfg(test)]
+	Panic,
+}
+
+impl Overlays {
+	/// Start the thread overlays are laid out and painted on, onto `device`.
+	pub fn new(device: &wgpu::Device, queue: &wgpu::Queue) -> Result<Self, Error> {
+		let (requests, received) = mpsc::channel();
+		let (reply, painted) = mpsc::channel();
+		let (device, queue) = (device.clone(), queue.clone());
+		std::thread::Builder::new()
+			.name("overlays".into())
+			.spawn({
+				let device = device.clone();
+				move || run(&device, &queue, &received, &reply)
+			})
+			.map_err(|err| Error::Overlay(format!("cannot start the overlay thread: {err}")))?;
+		Ok(Self {
+			device,
+			requests,
+			painted,
+			next: 0,
+		})
+	}
+
+	/// Lay out `html` at `width` by `height`, its CSS timeline starting at
+	/// `start` on the program clock. The HTML has passed [`check`].
+	pub fn open(&mut self, html: &str, width: u32, height: u32, start: Instant) -> Overlay {
+		let texture = self.device.create_texture(&wgpu::TextureDescriptor {
+			label: Some("moq-scene overlay"),
+			size: wgpu::Extent3d {
+				width,
+				height,
+				depth_or_array_layers: 1,
+			},
+			mip_level_count: 1,
+			sample_count: 1,
+			dimension: wgpu::TextureDimension::D2,
+			// Vello writes gamma-encoded straight alpha, what the compositor reads.
+			format: crate::FORMAT,
+			usage: wgpu::TextureUsages::STORAGE_BINDING | wgpu::TextureUsages::TEXTURE_BINDING,
+			view_formats: &[],
+		});
+		let id = self.next;
+		self.next += 1;
+		// A thread that stopped fails the next paint, which says so.
+		let _ = self.requests.send(Request::Open {
+			id,
+			html: html.to_string(),
+			view: texture.create_view(&Default::default()),
+			start,
+		});
+		Overlay {
+			id,
+			texture,
+			requests: self.requests.clone(),
+		}
+	}
+
+	/// Paint the overlays named by [`Overlay::id`] as of `now` on the program
+	/// clock, where each moved since its last paint, before anything drawn
+	/// after this samples them. Returns why each that failed did, by id.
+	pub fn paint(&self, now: Instant, overlays: Vec<u64>) -> Result<HashMap<u64, String>, Error> {
+		let stopped = || Error::Overlay("the overlay thread stopped".into());
+		self.requests
+			.send(Request::Paint(now, overlays))
+			.map_err(|_| stopped())?;
+		let failed = self.painted.recv().map_err(|_| stopped())?;
+		Ok(failed.into_iter().collect())
+	}
+}
+
+#[cfg(test)]
+impl Overlays {
+	/// Stop the thread as a panic in Blitz would.
+	pub fn panic(&self) {
+		self.requests.send(Request::Panic).unwrap();
+	}
+}
+
+/// One open overlay, which closes when dropped.
+pub(crate) struct Overlay {
+	id: u64,
+	texture: wgpu::Texture,
+	requests: mpsc::Sender<Request>,
+}
+
+impl Overlay {
+	/// The overlay's key in what [`Overlays::paint`] returns.
+	pub fn id(&self) -> u64 {
+		self.id
+	}
+
+	/// The texture the overlay paints into, straight alpha.
+	pub fn texture(&self) -> &wgpu::Texture {
+		&self.texture
+	}
+}
+
+impl Drop for Overlay {
+	fn drop(&mut self) {
+		let _ = self.requests.send(Request::Close(self.id));
+	}
+}
+
+/// The overlay thread: serve requests until every sender is gone.
+fn run(
+	device: &wgpu::Device,
+	queue: &wgpu::Queue,
+	requests: &mpsc::Receiver<Request>,
+	painted: &mpsc::Sender<Vec<(u64, String)>>,
+) {
+	let mut documents = HashMap::new();
+	// Created with the first paint, or why it could not be.
+	let mut painter: Option<Result<Painter, String>> = None;
+	for request in requests {
+		match request {
+			Request::Open { id, html, view, start } => {
+				let size = view.texture().size();
+				let mut document = document(&html, size.width, size.height);
+				// Stylo starts an animation at the time of the resolve that
+				// creates it, so this one starts every animation at the start of
+				// the timeline, however late the overlay is first drawn.
+				document.resolve(0.0);
+				let document = Document {
+					document,
+					view,
+					start,
+					painted: false,
+				};
+				documents.insert(id, document);
+			}
+			Request::Close(id) => {
+				documents.remove(&id);
+			}
+			#[cfg(test)]
+			Request::Panic => panic!("a test stopped the overlay thread"),
+			Request::Paint(now, ids) => {
+				let painter = painter.get_or_insert_with(|| Painter::new(device));
+				let failed = ids
+					.into_iter()
+					.filter_map(|id| {
+						let document = documents.get_mut(&id)?;
+						let result = match painter {
+							Ok(painter) => document.paint(painter, device, queue, now),
+							Err(err) => Err(err.clone()),
+						};
+						result.err().map(|err| (id, err))
+					})
+					.collect();
+				if painted.send(failed).is_err() {
+					return;
+				}
+			}
+		}
+	}
+}
+
+/// Vello's compute pipelines on the compositor's device, compiled once and
+/// shared by every overlay.
+struct Painter {
+	renderer: vello::Renderer,
+	scene: vello::Scene,
+}
+
+impl Painter {
+	fn new(device: &wgpu::Device) -> Result<Self, String> {
+		let options = vello::RendererOptions {
+			// Area coverage only: compiling the MSAA variants too would slow the
+			// first overlay for no visible gain at overlay sizes.
+			antialiasing_support: vello::AaSupport::area_only(),
+			// Vello compiles on one thread on macOS by default, which took 1 s
+			// there before the first overlay drew, against 22 ms on many.
+			num_init_threads: None,
+			..Default::default()
+		};
+		let renderer = vello::Renderer::new(device, options).map_err(|err| err.to_string())?;
+		Ok(Self {
+			renderer,
+			scene: vello::Scene::new(),
+		})
+	}
+}
+
+/// An overlay's document on the overlay thread, and where it paints.
+struct Document {
+	document: BaseDocument,
+	view: wgpu::TextureView,
+	/// Where its CSS timeline starts on the program clock.
+	start: Instant,
+	/// Whether the texture holds a paint yet.
+	painted: bool,
+}
+
+impl Document {
+	/// Paint as of `now` on the program clock, unless nothing has moved since
+	/// the last paint.
+	fn paint(
+		&mut self,
+		painter: &mut Painter,
+		device: &wgpu::Device,
+		queue: &wgpu::Queue,
+		now: Instant,
+	) -> Result<(), String> {
+		if self.painted && !self.document.is_animating() {
+			return Ok(());
+		}
+		self.document
+			.resolve(now.saturating_duration_since(self.start).as_secs_f64());
+
+		let size = self.view.texture().size();
+		painter.scene.reset();
+		let mut scene = anyrender_vello::VelloScenePainter::new(&mut painter.scene);
+		blitz_paint::paint_scene(&mut scene, &mut self.document, 1.0, size.width, size.height, 0, 0);
+		let params = vello::RenderParams {
+			base_color: vello::peniko::Color::TRANSPARENT,
+			width: size.width,
+			height: size.height,
+			antialiasing_method: vello::AaConfig::Area,
+		};
+		painter
+			.renderer
+			.render_to_texture(device, queue, &painter.scene, &self.view, &params)
+			.map_err(|err| err.to_string())?;
+		self.painted = true;
+		Ok(())
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	fn refusal(html: &str) -> String {
+		check(html).unwrap_err().to_string()
+	}
+
+	#[test]
+	fn a_lower_third_passes() {
+		check(
+			r#"<!doctype html><html><head><meta charset="utf-8"><title>Name</title><style>
+				.third {
+					position: absolute; left: 40px; bottom: 40px; padding: 12px 24px;
+					background: linear-gradient(90deg, #1e3a8a, #2563eb);
+					border: 2px solid white; border-radius: 8px;
+					font: bold 32px sans-serif; color: white;
+					box-shadow: 0 4px 12px rgba(0, 0, 0, 0.5);
+					animation: slide 500ms ease-out both;
+					--accent: #facc15;
+				}
+				.third small { display: block; color: var(--accent); }
+				@keyframes slide { from { transform: translateX(-120%); opacity: 0 } to { transform: none; opacity: 1 } }
+				@media (min-width: 1000px) { .third { font-size: 48px } }
+			</style></head>
+			<body><div class="third" data-role="name">Ada Lovelace <small style="opacity: 0.8">Analyst</small></div></body></html>"#,
+		)
+		.unwrap();
+	}
+
+	#[test]
+	fn what_loads_or_runs_is_refused() {
+		for (html, named) in [
+			("<script>alert(1)</script>", "`<script>`"),
+			(r#"<img src="https://example.com/a.png">"#, "`<img>`"),
+			(
+				r#"<link rel="stylesheet" href="https://example.com/a.css">"#,
+				"`<link>`",
+			),
+			(r#"<iframe src="https://example.com"></iframe>"#, "`<iframe>`"),
+			("<svg></svg>", "`<svg>`"),
+			(r#"<div onclick="go()">x</div>"#, "`onclick`"),
+			(r#"<style>@import "https://example.com/a.css";</style>"#, "@import"),
+			(
+				"<style>@font-face { font-family: x; src: url(https://example.com/x.woff2) }</style>",
+				"`@font-face`",
+			),
+			(
+				r#"<div style="background: url(https://example.com/a.png)">x</div>"#,
+				"`url(`",
+			),
+		] {
+			let err = refusal(html);
+			assert!(err.contains(named), "{html}: {err}");
+		}
+	}
+
+	#[test]
+	fn css_outside_the_subset_is_named() {
+		for (css, named) in [
+			("text-shadow: 0 0 2px black", "`text-shadow`"),
+			("filter: blur(2px)", "`filter`"),
+			("mix-blend-mode: multiply", "`mix-blend-mode`"),
+			("colr: red", "colr"),
+			("color: nope", "color"),
+		] {
+			let err = refusal(&format!(r#"<div style="{css}">x</div>"#));
+			assert!(err.contains(named), "{css}: {err}");
+			let err = refusal(&format!("<style>div {{ {css} }}</style>"));
+			assert!(err.contains(named), "{css}: {err}");
+		}
+	}
+
+	/// Bold text is set in the bold face rather than the regular one, which
+	/// is narrower.
+	#[test]
+	fn bold_has_a_face_of_its_own() {
+		let mut document = document(
+			r#"<span style="display: inline-block">Lower third</span>
+			<span style="display: inline-block; font: bold 16px Arial">Lower third</span>"#,
+			400,
+			100,
+		);
+		document.resolve(0.0);
+		let widths: Vec<f32> = document
+			.tree()
+			.iter()
+			.filter(|(_, node)| node.data.is_element_with_tag_name(&blitz_dom::local_name!("span")))
+			.map(|(_, node)| node.final_layout().size.width)
+			.collect();
+		let [regular, bold] = widths[..] else {
+			panic!("two spans: {widths:?}");
+		};
+		assert!(bold > regular * 1.05, "regular {regular}, bold {bold}");
+	}
+
+	#[test]
+	fn every_property_listed_is_one_stylo_parses() {
+		// Stylo enables some properties, such as grid's, through preferences a
+		// document sets.
+		document("", 1, 1);
+		for name in PROPERTIES {
+			assert!(
+				style::properties::PropertyId::parse_enabled_for_all_content(name).is_ok(),
+				"{name}"
+			);
+		}
+	}
+}
diff --git a/rs/moq-scene/src/source.rs b/rs/moq-scene/src/source.rs
index 5e3f820..2264931 100644
--- a/rs/moq-scene/src/source.rs
+++ b/rs/moq-scene/src/source.rs
@@ -43,6 +43,9 @@ pub(crate) enum Picture {
 	Texture(moq_video::render::wgpu::Texture),
 	/// A LUT source's table, which is not drawn but looked up.
 	Lut(Cube),
+	/// An overlay whose HTML passed [`crate::overlay::check`], which the
+	/// compositor lays out and paints itself, on the program clock.
+	Overlay,
 }
 
 /// The one picture a source holds for the compositor. A newer picture replaces
@@ -463,6 +466,11 @@ impl Driver {
 				self.show(Picture::Lut(cube));
 				std::future::pending().await
 			}
+			Source::Overlay { html, .. } => {
+				crate::overlay::check(html)?;
+				self.show(Picture::Overlay);
+				std::future::pending().await
+			}
 			Source::Broadcast { path } => self.broadcast(path).await,
 			Source::Browser { url, width, height } => self.browser(url, *width, *height).await,
 			Source::Replay => {
@@ -512,6 +520,7 @@ impl Driver {
 			| Source::Image { .. }
 			| Source::Broadcast { .. }
 			| Source::Browser { .. }
+			| Source::Overlay { .. }
 			| Source::Clone { .. }
 			| Source::Lut { .. }
 			| Source::Replay => unreachable!("not a device source"),
@@ -1017,14 +1026,14 @@ fn open(name: &str, source: &Source, context: &Context) -> (Feed, Driver) {
 /// layout rather than encoded again.
 ///
 /// Microphones and system audio do not yet: moq-audio offers no capture that
-/// feeds both the program bus and an encoder. Nor do web pages, which viewers
-/// see only in the program: H.264 would encode a transparent overlay over
-/// black.
+/// feeds both the program bus and an encoder. Nor do web pages and overlays,
+/// which viewers see only in the program: H.264 would encode their
+/// transparency over black.
 fn publishes(source: &Source) -> bool {
 	source.has_video()
 		&& !matches!(
 			source,
-			Source::Broadcast { .. } | Source::Clone { .. } | Source::Browser { .. }
+			Source::Broadcast { .. } | Source::Clone { .. } | Source::Browser { .. } | Source::Overlay { .. }
 		)
 }
 
@@ -1567,6 +1576,39 @@ mod tests {
 		.await;
 	}
 
+	/// An overlay goes live for the compositor to paint, and one outside what
+	/// overlays draw fails the source, naming what.
+	#[tokio::test]
+	async fn an_overlay_fails_on_what_it_cannot_draw() {
+		local(async {
+			let dir = tempfile::tempdir().unwrap();
+			let overlay = |html: &str| Source::Overlay {
+				html: html.into(),
+				width: 640,
+				height: 360,
+			};
+			let mut collection = Collection::new();
+			collection.sources.insert("title".into(), overlay("<h1>Live</h1>"));
+			collection.sources.insert(
+				"shadow".into(),
+				overlay(r#"<h1 style="text-shadow: 0 0 4px">Live</h1>"#),
+			);
+			let (context, _origin) = context(dir.path());
+			let mut sources = Sources::new(context);
+			let drivers = sources.sync(&collection);
+			start(&sources, drivers).await;
+
+			let title = sources.get("title").unwrap();
+			assert_eq!(title.status(), Status::Live);
+			assert!(matches!(title.take(), Some(Picture::Overlay)));
+			let Status::Failed(reason) = sources.get("shadow").unwrap().status() else {
+				panic!("an overlay outside the subset fails");
+			};
+			assert!(reason.contains("`text-shadow`"), "{reason}");
+		})
+		.await;
+	}
+
 	#[cfg(not(feature = "capture"))]
 	#[tokio::test]
 	async fn a_build_without_capture_says_so() {
diff --git a/rs/moq-studio/src/replay.rs b/rs/moq-studio/src/replay.rs
index 8eeaf0d..cb8d263 100644
--- a/rs/moq-studio/src/replay.rs
+++ b/rs/moq-studio/src/replay.rs
@@ -71,6 +71,11 @@ impl Engine {
 					"`{name}` is a web page, which publishes no track of its own, so it has no past to replay"
 				)
 			}
+			Some(Source::Overlay { .. }) => {
+				anyhow::bail!(
+					"`{name}` is an overlay, which publishes no track of its own, so it has no past to replay"
+				)
+			}
 			Some(source) if source.has_video() => output()?
 				.source(capture)
 				.with_context(|| format!("`{name}` publishes no video to replay")),
diff --git a/rs/moq-studio/src/ui.rs b/rs/moq-studio/src/ui.rs
index b10a2cf..5f80a5e 100644
--- a/rs/moq-studio/src/ui.rs
+++ b/rs/moq-studio/src/ui.rs
@@ -1842,7 +1842,9 @@ impl Panels {
 						source.has_video()
 							&& !matches!(
 								source,
-								Source::Image { .. } | Source::Color { .. } | Source::Browser { .. }
+								Source::Image { .. }
+									| Source::Color { .. } | Source::Browser { .. }
+									| Source::Overlay { .. }
 							)
 					})
 				})
@@ -2457,14 +2459,14 @@ fn add(
 	);
 	let canvas = state.collection().canvas;
 	let place = source.has_video();
-	// A page, or a clone of one, lands at the page's size, pixel for pixel;
-	// anything else fills the canvas.
+	// A page or overlay, or a clone of one, lands at its own size, pixel for
+	// pixel; anything else fills the canvas.
 	let shown = match &source {
 		Source::Clone { source } => state.collection().sources.get(source),
 		source => Some(source),
 	};
 	let rect = match shown {
-		Some(Source::Browser { width, height, .. }) => Rect {
+		Some(Source::Browser { width, height, .. } | Source::Overlay { width, height, .. }) => Rect {
 			x: 0.0,
 			y: 0.0,
 			width: *width as f32,
@@ -2739,6 +2741,7 @@ fn describe(source: &Source) -> String {
 		Source::Color { color } => format!("color: {color}"),
 		Source::Broadcast { path } => format!("broadcast: {path}"),
 		Source::Browser { url, width, height } => format!("browser: {url} ({width}x{height})"),
+		Source::Overlay { width, height, .. } => format!("overlay ({width}x{height})"),
 		Source::Clone { source } => format!("clone of {source}"),
 		Source::Replay => "replay".into(),
 		Source::Lut { path } => format!("LUT: {}", path.display()),
@@ -2790,10 +2793,11 @@ fn meter(ui: &mut Ui, level: moq_audio::Level) {
 struct AddSource {
 	name: String,
 	kind: Kind,
-	/// A path, broadcast path, url, or device id, depending on the kind.
+	/// A path, broadcast path, url, device id, or an overlay's HTML, depending
+	/// on the kind.
 	value: String,
 	color: Color32,
-	/// A browser source's page size.
+	/// A browser source's page size, or an overlay's.
 	width: u32,
 	height: u32,
 }
@@ -2824,12 +2828,13 @@ enum Kind {
 	Microphone,
 	SystemAudio,
 	Browser,
+	Overlay,
 	Replay,
 	Lut,
 }
 
 impl Kind {
-	const ALL: [Self; 11] = [
+	const ALL: [Self; 12] = [
 		Self::Color,
 		Self::Image,
 		Self::Broadcast,
@@ -2839,6 +2844,7 @@ impl Kind {
 		Self::Microphone,
 		Self::SystemAudio,
 		Self::Browser,
+		Self::Overlay,
 		Self::Replay,
 		Self::Lut,
 	];
@@ -2854,6 +2860,7 @@ impl Kind {
 			Self::Microphone => "Microphone",
 			Self::SystemAudio => "System audio",
 			Self::Browser => "Browser",
+			Self::Overlay => "Overlay",
 			Self::Replay => "Replay",
 			Self::Lut => "LUT",
 		}
@@ -2868,6 +2875,7 @@ impl Kind {
 			Self::Broadcast => Some("path"),
 			Self::Window => Some("window id"),
 			Self::Browser => Some("url"),
+			Self::Overlay => Some("HTML and CSS"),
 			Self::Camera | Self::Display | Self::Microphone => Some("id (empty for the default)"),
 		}
 	}
@@ -2892,10 +2900,14 @@ impl AddSource {
 			ui.end_row();
 			if let Some(label) = self.kind.value() {
 				ui.label(label);
-				ui.text_edit_singleline(&mut self.value);
+				if self.kind == Kind::Overlay {
+					ui.add(egui::TextEdit::multiline(&mut self.value).code_editor());
+				} else {
+					ui.text_edit_singleline(&mut self.value);
+				}
 				ui.end_row();
 			}
-			if self.kind == Kind::Browser {
+			if matches!(self.kind, Kind::Browser | Kind::Overlay) {
 				ui.label("Size");
 				ui.horizontal(|ui| {
 					ui.add(egui::DragValue::new(&mut self.width).range(1..=4096));
@@ -2935,6 +2947,11 @@ impl AddSource {
 				width: self.width,
 				height: self.height,
 			},
+			Kind::Overlay => Source::Overlay {
+				html: value,
+				width: self.width,
+				height: self.height,
+			},
 			Kind::Replay => Source::Replay,
 		})
 	}