diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..bce2dc92e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,25 @@
+version: 2
+updates:
+  # Gradle dependencies. org.json is declared separately in sdk-java, app-java
+  # and app-javafx; Dependabot opens one PR per module, so check that a bump
+  # lands everywhere before closing the others.
+  - package-ecosystem: gradle
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    labels:
+      - dependencies
+      - ci
+    commit-message:
+      prefix: "chore(ci)"
diff --git a/.github/dependency-scan-allowlist.txt b/.github/dependency-scan-allowlist.txt
new file mode 100644
index 000000000..8b301cee2
--- /dev/null
+++ b/.github/dependency-scan-allowlist.txt
@@ -0,0 +1,8 @@
+# Vulnerabilities the dependency security scan may ignore, one per line:
+#
+#   <OSV id>  <YYYY-MM-DD expiry>  <reason>
+#
+# The expiry is mandatory. Once it passes, the finding blocks the scan again and the entry
+# has to be re-reviewed — a temporary exception must not become a permanent silence.
+# Only add an entry when there is a concrete reason the advisory cannot or need not be acted
+# on right now, and say what that reason is.
diff --git a/.github/scripts/coverage_report.py b/.github/scripts/coverage_report.py
new file mode 100755
index 000000000..cd4271268
--- /dev/null
+++ b/.github/scripts/coverage_report.py
@@ -0,0 +1,305 @@
+#!/usr/bin/env python3
+"""Turn jacoco XML reports into a Markdown coverage report for a pull request comment.
+
+Reads one report per Gradle module, plus the list of files the pull request touched, and
+writes:
+
+  * a per-module line and branch coverage table
+  * coverage of the source files this pull request actually changed, which is the part a
+    reviewer can act on
+  * the least covered classes, as a standing to-do list
+  * the test failure count, so nobody reads coverage numbers off a broken run
+
+Exit code is 0 unless a configured minimum is missed and enforcement is switched on, so the
+job can start out advisory and become a gate later without touching this script.
+
+Usage:
+  coverage_report.py --out coverage-report.md
+                     --changed-files changed.txt
+                     --module <label>:<jacoco xml>:<test-results dir>:<source root> ...
+"""
+
+import argparse
+import os
+import sys
+import xml.etree.ElementTree as ET
+
+# Reported but not enforced unless ENFORCE_COVERAGE is truthy, so the job can be introduced
+# on a repository that is not at target yet.
+MIN_OVERALL = float(os.environ.get("COVERAGE_MIN_OVERALL", "0"))
+MIN_CHANGED = float(os.environ.get("COVERAGE_MIN_CHANGED", "0"))
+ENFORCE = os.environ.get("ENFORCE_COVERAGE", "").lower() in ("1", "true", "yes")
+WORST_CLASS_COUNT = int(os.environ.get("COVERAGE_WORST_CLASSES", "10"))
+
+
+class Counter:
+    """Covered and missed totals for one jacoco counter type."""
+
+    def __init__(self, covered=0, missed=0):
+        self.covered = covered
+        self.missed = missed
+
+    @property
+    def total(self):
+        return self.covered + self.missed
+
+    @property
+    def percent(self):
+        if self.total == 0:
+            return None
+        return 100.0 * self.covered / self.total
+
+    def add(self, other):
+        self.covered += other.covered
+        self.missed += other.missed
+
+    def __str__(self):
+        if self.total == 0:
+            return "n/a"
+        return "{:.1f}% ({}/{})".format(self.percent, self.covered, self.total)
+
+
+def counters_of(element):
+    """The counters declared directly on a jacoco element, keyed by type."""
+    result = {}
+    for counter in element.findall("counter"):
+        result[counter.get("type")] = Counter(
+            covered=int(counter.get("covered", 0)),
+            missed=int(counter.get("missed", 0)),
+        )
+    return result
+
+
+def parse_report(path):
+    """A jacoco report as (report counters, {(package, sourcefile): counters}, [(class, counters)])."""
+    # The report declares a DOCTYPE pointing at a remote DTD. ElementTree does not fetch
+    # external entities, so parsing stays offline.
+    root = ET.parse(path).getroot()
+
+    overall = counters_of(root)
+    source_files = {}
+    classes = []
+
+    for package in root.iter("package"):
+        package_name = package.get("name", "")
+
+        for source_file in package.findall("sourcefile"):
+            key = (package_name, source_file.get("name", ""))
+            source_files[key] = counters_of(source_file)
+
+        for klass in package.findall("class"):
+            name = klass.get("name", "")
+            # Nested and anonymous classes roll up into their outer class for reporting.
+            if "$" in name:
+                continue
+            classes.append((name.replace("/", "."), counters_of(klass)))
+
+    return overall, source_files, classes
+
+
+def count_test_failures(results_dir):
+    """Failures plus errors across a Gradle module's JUnit XML results."""
+    if not results_dir or not os.path.isdir(results_dir):
+        return 0
+
+    failures = 0
+    for entry in os.listdir(results_dir):
+        if not entry.endswith(".xml"):
+            continue
+        try:
+            suite = ET.parse(os.path.join(results_dir, entry)).getroot()
+            failures += int(suite.get("failures", 0)) + int(suite.get("errors", 0))
+        except ET.ParseError:
+            # An unreadable result file is not worth failing the report over.
+            continue
+    return failures
+
+
+def read_build_log_tail(path, limit=40):
+    """The last few lines of the build output, for when there is no report to show."""
+    if not path or not os.path.isfile(path):
+        return []
+    try:
+        with open(path, encoding="utf-8", errors="replace") as handle:
+            return [line.rstrip() for line in handle.readlines()[-limit:]]
+    except OSError:
+        return []
+
+
+def read_changed_files(path):
+    if not path or not os.path.isfile(path):
+        return []
+    with open(path, encoding="utf-8") as handle:
+        return [line.strip() for line in handle if line.strip().endswith(".java")]
+
+
+def percent_cell(counter):
+    return str(counter) if counter else "n/a"
+
+
+def format_percent(value):
+    return "n/a" if value is None else "{:.1f}%".format(value)
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--out", required=True)
+    parser.add_argument("--changed-files")
+    parser.add_argument("--build-log", help="Build output, shown when no report was produced.")
+    parser.add_argument(
+        "--module",
+        action="append",
+        default=[],
+        help="<label>:<jacoco xml>:<test-results dir>:<source root>",
+    )
+    args = parser.parse_args()
+
+    changed_files = read_changed_files(args.changed_files)
+
+    lines = ["## Code coverage", ""]
+    module_rows = []
+    changed_rows = []
+    worst = []
+    total_failures = 0
+    missing_reports = []
+
+    for spec in args.module:
+        label, report_path, results_dir, source_root = (spec.split(":") + ["", "", ""])[:4]
+
+        if not os.path.isfile(report_path):
+            missing_reports.append(label)
+            module_rows.append((label, "no report", "no report"))
+            continue
+
+        overall, source_files, classes = parse_report(report_path)
+        total_failures += count_test_failures(results_dir)
+
+        module_rows.append(
+            (label, percent_cell(overall.get("LINE")), percent_cell(overall.get("BRANCH")))
+        )
+
+        for name, counters in classes:
+            line_counter = counters.get("LINE")
+            if line_counter and line_counter.missed > 0:
+                worst.append((line_counter.missed, name, label, line_counter))
+
+        # Match a changed path back to the report through its package and file name.
+        for changed in changed_files:
+            if source_root and not changed.startswith(source_root):
+                continue
+            file_name = os.path.basename(changed)
+            package = os.path.dirname(changed)
+            if source_root:
+                package = package[len(source_root):]
+            package = package.strip("/")
+
+            counters = source_files.get((package, file_name))
+            if counters:
+                changed_rows.append((changed, percent_cell(counters.get("LINE")), counters.get("LINE")))
+
+    lines.append("| module | lines | branches |")
+    lines.append("|---|---|---|")
+    for label, line_cell, branch_cell in module_rows:
+        lines.append("| `{}` | {} | {} |".format(label, line_cell, branch_cell))
+    lines.append("")
+
+    if changed_rows:
+        lines.append("### Files changed by this pull request")
+        lines.append("")
+        lines.append("| file | lines covered |")
+        lines.append("|---|---|")
+        for path, cell, _ in sorted(changed_rows):
+            lines.append("| `{}` | {} |".format(path, cell))
+        lines.append("")
+    elif changed_files:
+        lines.append("_No changed file appears in a coverage report. Either none of the changed "
+                     "Java files are in a measured module, or they are test sources._")
+        lines.append("")
+
+    if worst:
+        worst.sort(reverse=True)
+        lines.append("<details><summary>Least covered classes ({} shown)</summary>".format(
+            min(WORST_CLASS_COUNT, len(worst))))
+        lines.append("")
+        lines.append("| class | module | lines covered | uncovered |")
+        lines.append("|---|---|---|---|")
+        for missed, name, label, counter in worst[:WORST_CLASS_COUNT]:
+            lines.append("| `{}` | `{}` | {} | {} |".format(name, label, counter, missed))
+        lines.append("")
+        lines.append("</details>")
+        lines.append("")
+
+    if total_failures > 0:
+        lines.append("> **{} test(s) failed in this run.** Coverage is still measured over the whole "
+                     "run, but read the test results before trusting these numbers."
+                     .format(total_failures))
+        lines.append("")
+
+    if missing_reports:
+        lines.append("> No coverage report was produced for: {}."
+                     .format(", ".join("`{}`".format(m) for m in missing_reports)))
+        lines.append("")
+
+        # A missing report almost always means the build failed before jacoco ran. Putting the
+        # tail of the build output in the comment saves a trip to the workflow logs.
+        tail = read_build_log_tail(args.build_log)
+        if tail:
+            lines.append("<details><summary>Build output (last {} lines)</summary>".format(len(tail)))
+            lines.append("")
+            lines.append("```")
+            lines.extend(tail)
+            lines.append("```")
+            lines.append("")
+            lines.append("</details>")
+            lines.append("")
+
+    # Threshold checks, reported either way and enforced only when asked to be.
+    problems = []
+
+    for label, line_cell, _ in module_rows:
+        if MIN_OVERALL > 0 and line_cell not in ("no report",):
+            value = float(line_cell.split("%")[0])
+            if value < MIN_OVERALL:
+                problems.append("`{}` line coverage {} is below the {:.1f}% minimum"
+                                .format(label, format_percent(value), MIN_OVERALL))
+
+    if MIN_CHANGED > 0 and changed_rows:
+        changed_total = Counter()
+        for _, _, counter in changed_rows:
+            if counter:
+                changed_total.add(counter)
+        if changed_total.percent is not None and changed_total.percent < MIN_CHANGED:
+            problems.append("changed files line coverage {} is below the {:.1f}% minimum"
+                            .format(format_percent(changed_total.percent), MIN_CHANGED))
+
+    if problems:
+        lines.append("**Coverage below the configured minimum:**")
+        lines.append("")
+        for problem in problems:
+            lines.append("* {}".format(problem))
+        lines.append("")
+        if not ENFORCE:
+            lines.append("_Advisory only. Set `ENFORCE_COVERAGE=true` on the workflow to make this "
+                         "fail the build._")
+            lines.append("")
+
+    body = "\n".join(lines)
+
+    with open(args.out, "w", encoding="utf-8") as handle:
+        handle.write(body)
+
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary_path:
+        with open(summary_path, "a", encoding="utf-8") as handle:
+            handle.write(body + "\n")
+
+    print(body)
+
+    if problems and ENFORCE:
+        print("::error::Coverage is below the configured minimum")
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/scripts/dependency-report.init.gradle b/.github/scripts/dependency-report.init.gradle
new file mode 100644
index 000000000..d2f6c3628
--- /dev/null
+++ b/.github/scripts/dependency-report.init.gradle
@@ -0,0 +1,170 @@
+// Prints every resolved external dependency coordinate, for every module, as
+//
+//     COORD <projectPath> <group>:<artifact>:<version> <scope>
+//
+// Applied via `--init-script` so no build file in the repo has to change.
+// Consumed by .github/scripts/osv_scan.py via .github/workflows/dependency-security.yml.
+//
+// Resolving the real configurations rather than parsing build files is deliberate: it
+// captures transitive dependencies and the version conflict resolution actually picks,
+// which is what ends up in the artifact. These projects have no Gradle lockfile, so
+// lockfile-based scanners see nothing at all.
+//
+// THREE SCOPES, because a finding's weight depends entirely on who inherits it:
+//
+//   published   — on the runtime classpath of a module we publish to Maven Central.
+//                 Every integrator inherits these. Blocks the scan.
+//   sample      — demo applications and test-only dependencies. Never reaches an
+//                 integrator, but it is still our code and our upgrade to make, so it
+//                 blocks too. (This is the scope that catches a vulnerable JSON library
+//                 left behind in a demo module after the SDK itself was fixed.)
+//   buildscript — the Gradle plugin classpath. Mostly the Android Gradle Plugin's own
+//                 internals, which cannot be upgraded independently of AGP, so these are
+//                 reported and never block.
+//
+// The published module list is passed in with -DpublishedModules=:a,:b so this file stays
+// identical across repositories. Any module that applies the vanniktech publish plugin is
+// added automatically, and one that does so without being declared is reported as an error
+// rather than being quietly downgraded to `sample`.
+//
+// Run locally with:
+//   ./gradlew -I .github/scripts/dependency-report.init.gradle \
+//     -DpublishedModules=:sdk,:sdk-native,:upload-plugin printResolvedDependencies
+
+import org.gradle.api.artifacts.component.ModuleComponentIdentifier
+
+// Configure-on-demand leaves subprojects unevaluated unless something asks for them, and an
+// unevaluated project reports no configurations — the scan would silently cover part of the
+// build and still look clean.
+gradle.startParameter.configureOnDemand = false
+
+// Configurations carrying what a consumer of the published artifact actually gets.
+def PUBLISHED_CONFIGS = ["runtimeClasspath", "releaseRuntimeClasspath"] as Set
+
+// Configurations carrying dependencies we declare for demo apps and tests.
+//
+// This is a closed list on purpose. "Every resolvable configuration that is not a published
+// runtime classpath" looks equivalent and is not: the Android Gradle Plugin hangs its own
+// tooling configurations off each project (lintChecks, androidTestUtil, androidJdkImage,
+// _internal_aapt2_binary, kotlinCompilerClasspath, ...), which drag in netty, bouncycastle
+// and jose4j. Treating those as `sample` makes the scan block on AGP internals we cannot
+// upgrade -- the very thing the buildscript scope exists to avoid.
+//
+// Compile classpaths are included as well as runtime ones. A stale declaration can be
+// masked at runtime: if a demo module declares an old version of a library that a project
+// dependency also supplies at a newer version, `runtimeClasspath` resolves up and the old
+// version disappears, while `compileClasspath` still shows what was actually declared.
+def SAMPLE_CONFIGS = [
+  "runtimeClasspath",
+  "compileClasspath",
+  "releaseRuntimeClasspath",
+  "releaseCompileClasspath",
+  "debugRuntimeClasspath",
+  "debugCompileClasspath",
+  "debugAndroidTestRuntimeClasspath",
+  "debugAndroidTestCompileClasspath",
+  "releaseUnitTestRuntimeClasspath",
+  "debugUnitTestRuntimeClasspath",
+  "debugUnitTestCompileClasspath",
+  "testRuntimeClasspath",
+  "testCompileClasspath",
+] as Set
+
+// Local project artifacts have no upstream version to look up.
+def SKIP_VERSIONS = ["unspecified", ""] as Set
+
+def PUBLISH_PLUGIN = "com.vanniktech.maven.publish"
+
+gradle.rootProject { rootProject ->
+  rootProject.tasks.register("printResolvedDependencies") {
+    group = "verification"
+    description = "Print every resolved external dependency coordinate for security scanning."
+    notCompatibleWithConfigurationCache("Resolves every project's configurations at execution time.")
+
+    doLast {
+      def declared = (System.getProperty("publishedModules") ?: "")
+        .split(",").collect { it.trim() }.findAll { it } as Set
+
+      // "<modulePath> <coordinate>" -> scope. Each line reports the scope that module
+      // reaches the coordinate through; the scanner takes the widest scope across lines.
+      def found = new TreeMap<String, String>()
+      def skipped = []
+      def undeclared = []
+
+      def precedence = ["buildscript": 0, "sample": 1, "published": 2]
+
+      def record = { String coordinate, String scope, String modulePath ->
+        def key = "${modulePath} ${coordinate}".toString()
+        def existing = found[key]
+        if (existing == null || precedence[scope] > precedence[existing]) {
+          found[key] = scope
+        }
+      }
+
+      def collectFrom = { configuration, String scope, String modulePath, String label ->
+        try {
+          configuration.incoming.resolutionResult.allComponents.each { component ->
+            def id = component.id
+            if (id instanceof ModuleComponentIdentifier && !SKIP_VERSIONS.contains(id.version)) {
+              record("${id.group}:${id.module}:${id.version}".toString(), scope, modulePath)
+            }
+          }
+        } catch (Exception e) {
+          // A configuration that cannot resolve here (missing variant, platform-only, needs
+          // credentials) must not take the whole scan down, but it must be visible: an
+          // unreported skip reads as "clean" when it is really "unchecked".
+          skipped << "${label}: ${e.class.simpleName}: ${e.message?.readLines()?.first()}".toString()
+        }
+      }
+
+      rootProject.allprojects.each { project ->
+        def appliesPublishPlugin = project.plugins.hasPlugin(PUBLISH_PLUGIN)
+        def isPublished = declared.contains(project.path) || appliesPublishPlugin
+        if (appliesPublishPlugin && !declared.contains(project.path)) {
+          undeclared << project.path
+        }
+
+        project.configurations.each { configuration ->
+          if (!configuration.canBeResolved) {
+            return
+          }
+          def name = configuration.name
+          def scope
+          if (isPublished && PUBLISHED_CONFIGS.contains(name)) {
+            scope = "published"
+          } else if (SAMPLE_CONFIGS.contains(name)) {
+            scope = "sample"
+          } else {
+            // An AGP/Gradle tooling configuration. Reported, but not ours to upgrade.
+            scope = "buildscript"
+          }
+          collectFrom(configuration, scope, project.path, "${project.path}:${name}")
+        }
+
+        def buildscriptClasspath = project.buildscript.configurations.findByName("classpath")
+        if (buildscriptClasspath != null) {
+          collectFrom(buildscriptClasspath, "buildscript", project.path,
+            "${project.path}:buildscript.classpath")
+        }
+      }
+
+      found.each { key, scope ->
+        println "COORD ${key} ${scope}"
+      }
+
+      def distinct = found.keySet().collect { it.split(' ')[1] } as Set
+      def publishedCoordinates = found.findAll { it.value == "published" }
+        .keySet().collect { it.split(' ')[1] } as Set
+      logger.lifecycle("Resolved ${distinct.size()} distinct coordinates " +
+        "(${publishedCoordinates.size()} published) across ${rootProject.allprojects.size()} modules")
+      skipped.each { logger.warn("[dependency-report] could not resolve ${it}") }
+
+      if (!undeclared.isEmpty()) {
+        throw new GradleException(
+          "These modules apply ${PUBLISH_PLUGIN} but are missing from -DpublishedModules: " +
+          "${undeclared.join(', ')}. Add them, otherwise their dependencies are scanned as " +
+          "'sample' and a vulnerability shipped to integrators would not be reported as such.")
+      }
+    }
+  }
+}
diff --git a/.github/scripts/osv_scan.py b/.github/scripts/osv_scan.py
new file mode 100755
index 000000000..adbac0d88
--- /dev/null
+++ b/.github/scripts/osv_scan.py
@@ -0,0 +1,318 @@
+#!/usr/bin/env python3
+"""Check resolved Gradle dependencies against the OSV vulnerability database.
+
+Reads "COORD <projectPath> <group>:<artifact>:<version> <scope>" lines (produced by
+dependency-report.init.gradle) on stdin and queries https://osv.dev.
+
+Why this rather than a stock scanner: these projects have no Gradle lockfile, so
+lockfile-based scanners see nothing. Scanning the *resolved* graph of every module is
+what catches a dependency that only appears transitively, or one that was upgraded in
+the SDK but left behind in a demo module.
+
+Scopes, and which of them fail the run:
+
+  published   ships to integrators           -> blocks
+  sample      demo apps and test-only deps   -> blocks (ours to fix, just not shipped)
+  buildscript Gradle plugin classpath        -> reported, never blocks
+
+`buildscript` is exempt because it is largely the Android Gradle Plugin's own transitive
+internals, which cannot be upgraded independently of AGP. Blocking on them would make the
+job permanently red, and a permanently red check is one nobody reads.
+
+  python3 .github/scripts/osv_scan.py < resolved-dependencies.txt
+
+Options come from the environment so the workflow stays declarative:
+  OSV_FAIL_ON         lowest severity that fails the run (default HIGH)
+  OSV_ALLOWLIST       allowlist file (default .github/dependency-scan-allowlist.txt)
+  OSV_BLOCKING_SCOPES comma-separated scopes that may fail the run
+                      (default "published,sample")
+  OSV_REPORT_FILE     markdown report for the PR comment (default osv-report.md)
+
+OSV needs no API key, so this runs on forks and without repository secrets.
+"""
+
+import datetime
+import json
+import os
+import re
+import sys
+import time
+import urllib.error
+import urllib.request
+
+OSV_HOST_PREFIX = "https://api.osv.dev/"
+OSV_BATCH_URL = OSV_HOST_PREFIX + "v1/querybatch"
+OSV_VULN_URL = OSV_HOST_PREFIX + "v1/vulns/"
+BATCH_SIZE = 100
+SEVERITY_ORDER = ["UNKNOWN", "LOW", "MODERATE", "HIGH", "CRITICAL"]
+SCOPE_PRECEDENCE = {"buildscript": 0, "sample": 1, "published": 2}
+KNOWN_SCOPES = set(SCOPE_PRECEDENCE)
+
+# Advisory ids arrive inside an OSV response, i.e. from outside this repo, and are
+# interpolated into a URL. Accept only the documented shape.
+VULN_ID_RE = re.compile(r"^[A-Za-z0-9._-]{1,100}$")
+
+
+def rank(severity):
+    try:
+        return SEVERITY_ORDER.index(severity)
+    except ValueError:
+        return 0
+
+
+def _check_url(url):
+    """Reject any URL that is not a plain https OSV endpoint.
+
+    urlopen would happily accept file:/ or a custom scheme, so the host and scheme are
+    pinned here rather than trusted from the caller.
+    """
+    if not url.startswith(OSV_HOST_PREFIX):
+        raise ValueError(f"refusing to fetch a non-OSV URL: {url}")
+    return url
+
+
+def post_json(url, payload, attempts=4):
+    """POST with retries. A network failure must abort the scan, never quietly pass it."""
+    body = json.dumps(payload).encode()
+    request = urllib.request.Request(_check_url(url), body, {"Content-Type": "application/json"})
+    return _send(request, url, attempts)
+
+
+def get_json(url, attempts=4):
+    return _send(urllib.request.Request(_check_url(url)), url, attempts)
+
+
+def _send(request, url, attempts):
+    last_error = None
+    for attempt in range(attempts):
+        try:
+            with urllib.request.urlopen(request, timeout=60) as response:
+                return json.load(response)
+        except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+            last_error = error
+            if attempt < attempts - 1:
+                time.sleep(2 ** attempt)
+    raise SystemExit(f"error: could not reach OSV at {url}: {last_error}")
+
+
+def read_coordinates(stream):
+    """Return {coordinate: {"scope": str, "modules": [str, ...]}}."""
+    entries = {}
+    for line in stream:
+        parts = line.split()
+        if len(parts) != 4 or parts[0] != "COORD":
+            continue
+        _, module, coordinate, scope = parts
+        if coordinate.count(":") != 2:
+            print(f"warning: skipping unparseable coordinate {coordinate!r}", file=sys.stderr)
+            continue
+        if scope not in KNOWN_SCOPES:
+            raise SystemExit(f"error: unknown scope {scope!r} for {coordinate}")
+
+        entry = entries.setdefault(coordinate, {"scope": scope, "modules": set()})
+        entry["modules"].add(module)
+        # The widest-reaching scope wins: an artifact reached both ways still ships.
+        if SCOPE_PRECEDENCE[scope] > SCOPE_PRECEDENCE[entry["scope"]]:
+            entry["scope"] = scope
+
+    return {c: {"scope": e["scope"], "modules": sorted(e["modules"])}
+            for c, e in sorted(entries.items())}
+
+
+def read_allowlist(path):
+    """Parse "<OSV id> <YYYY-MM-DD expiry> <reason>" lines.
+
+    An expiry is mandatory. An entry that has passed its date stops suppressing its
+    finding, so a temporary exception cannot quietly become permanent.
+    """
+    allowed = {}
+    if not os.path.exists(path):
+        return allowed
+    today = datetime.date.today()
+    with open(path) as handle:
+        for number, line in enumerate(handle, 1):
+            line = line.split("#", 1)[0].strip()
+            if not line:
+                continue
+            parts = line.split(None, 2)
+            if len(parts) < 3:
+                raise SystemExit(
+                    f"error: {path}:{number}: expected '<OSV id> <YYYY-MM-DD> <reason>', "
+                    f"got {line!r}")
+            vuln_id, expiry_text, reason = parts
+            try:
+                expiry = datetime.date.fromisoformat(expiry_text)
+            except ValueError:
+                raise SystemExit(f"error: {path}:{number}: {expiry_text!r} is not a YYYY-MM-DD date")
+            allowed[vuln_id] = {"expiry": expiry, "reason": reason, "expired": expiry < today}
+    return allowed
+
+
+def query_osv(coordinates):
+    """Return {coordinate: [vuln id, ...]} for coordinates OSV knows something about."""
+    queries = []
+    for coordinate in coordinates:
+        group, name, version = coordinate.split(":")
+        queries.append({"version": version,
+                        "package": {"name": f"{group}:{name}", "ecosystem": "Maven"}})
+
+    results = []
+    for start in range(0, len(queries), BATCH_SIZE):
+        chunk = queries[start:start + BATCH_SIZE]
+        batch = post_json(OSV_BATCH_URL, {"queries": chunk}).get("results", [])
+        if len(batch) != len(chunk):
+            raise SystemExit(
+                f"error: OSV returned {len(batch)} results for {len(chunk)} queries; "
+                "refusing to report a partial scan as clean")
+        results.extend(batch)
+
+    hits = {}
+    for coordinate, result in zip(coordinates, results):
+        ids = []
+        for vuln in result.get("vulns", []):
+            vuln_id = vuln.get("id", "")
+            if VULN_ID_RE.match(vuln_id):
+                ids.append(vuln_id)
+            else:
+                print(f"warning: ignoring malformed advisory id {vuln_id!r}", file=sys.stderr)
+        if ids:
+            hits[coordinate] = ids
+    return hits
+
+
+def describe(vuln_id, package_name, cache):
+    """Fetch severity, summary and fixed versions for one advisory."""
+    if vuln_id not in cache:
+        cache[vuln_id] = get_json(OSV_VULN_URL + vuln_id)
+    vuln = cache[vuln_id]
+
+    fixed = set()
+    for affected in vuln.get("affected", []):
+        if affected.get("package", {}).get("name") != package_name:
+            continue
+        for entry in affected.get("ranges", []):
+            for event in entry.get("events", []):
+                if "fixed" in event:
+                    fixed.add(event["fixed"])
+
+    return {
+        "id": vuln_id,
+        "severity": (vuln.get("database_specific", {}).get("severity") or "UNKNOWN").upper(),
+        "summary": (vuln.get("summary") or "").strip(),
+        "fixed": sorted(fixed),
+    }
+
+
+def main():
+    fail_on = os.environ.get("OSV_FAIL_ON", "HIGH").upper()
+    if fail_on not in SEVERITY_ORDER:
+        raise SystemExit(f"error: OSV_FAIL_ON must be one of {', '.join(SEVERITY_ORDER)}")
+
+    blocking_scopes = {s.strip() for s in
+                       os.environ.get("OSV_BLOCKING_SCOPES", "published,sample").split(",")
+                       if s.strip()}
+    unknown = blocking_scopes - KNOWN_SCOPES
+    if unknown:
+        raise SystemExit(f"error: unknown scope(s) in OSV_BLOCKING_SCOPES: {', '.join(sorted(unknown))}")
+
+    allowlist = read_allowlist(
+        os.environ.get("OSV_ALLOWLIST", ".github/dependency-scan-allowlist.txt"))
+
+    entries = read_coordinates(sys.stdin)
+    if not entries:
+        raise SystemExit("error: no dependency coordinates on stdin; the Gradle report step "
+                         "produced nothing, so nothing was actually scanned")
+
+    counts = {scope: sum(1 for e in entries.values() if e["scope"] == scope)
+              for scope in sorted(KNOWN_SCOPES)}
+    print(f"Scanning {len(entries)} resolved dependencies "
+          f"({', '.join(f'{n} {s}' for s, n in counts.items())}), "
+          f"failing on {fail_on}+ in {'/'.join(sorted(blocking_scopes))}")
+
+    hits = query_osv(list(entries))
+
+    cache = {}
+    blocking, suppressed, informational = [], [], []
+    for coordinate in sorted(hits):
+        group, name, _ = coordinate.split(":")
+        for vuln_id in hits[coordinate]:
+            finding = describe(vuln_id, f"{group}:{name}", cache)
+            finding["coordinate"] = coordinate
+            finding["scope"] = entries[coordinate]["scope"]
+            finding["modules"] = entries[coordinate]["modules"]
+            entry = allowlist.get(vuln_id)
+
+            can_block = finding["scope"] in blocking_scopes
+
+            if entry and not entry["expired"]:
+                finding["reason"] = entry["reason"]
+                finding["expiry"] = entry["expiry"]
+                suppressed.append(finding)
+            elif can_block and rank(finding["severity"]) >= rank(fail_on):
+                finding["expired_allowlist"] = bool(entry)
+                blocking.append(finding)
+            else:
+                informational.append(finding)
+
+    blocking.sort(key=lambda f: (-rank(f["severity"]), f["coordinate"]))
+    report(entries, blocking, suppressed, informational, fail_on)
+    return 1 if blocking else 0
+
+
+def format_finding(finding):
+    fixed = ", ".join(finding["fixed"]) if finding["fixed"] else "no fixed version published"
+    return (f"[{finding['scope']}] {finding['coordinate']} — {finding['id']} "
+            f"[{finding['severity']}]\n"
+            f"    {finding['summary'] or '(no summary)'}\n"
+            f"    fixed in: {fixed}\n"
+            f"    used by: {', '.join(finding['modules'])}")
+
+
+def report(entries, blocking, suppressed, informational, fail_on):
+    lines = []
+
+    if blocking:
+        lines.append(f"BLOCKING — {len(blocking)} vulnerability(ies) at or above {fail_on}:\n")
+        for finding in blocking:
+            lines.append(format_finding(finding))
+            if finding.get("expired_allowlist"):
+                lines.append("    note: this advisory's allowlist entry has expired "
+                             "and needs re-review")
+        lines.append("")
+    if suppressed:
+        lines.append(f"ALLOWLISTED — {len(suppressed)}:\n")
+        for finding in suppressed:
+            lines.append(f"[{finding['scope']}] {finding['coordinate']} — {finding['id']} "
+                         f"[{finding['severity']}] until {finding['expiry']}: {finding['reason']}")
+        lines.append("")
+    if informational:
+        lines.append(f"INFORMATIONAL — {len(informational)} "
+                     f"(non-blocking scope, or below the {fail_on} threshold):\n")
+        for finding in informational:
+            lines.append(format_finding(finding))
+        lines.append("")
+    if not (blocking or suppressed or informational):
+        lines.append(f"No known vulnerabilities in {len(entries)} resolved dependencies.")
+    elif not blocking:
+        lines.append("No blocking findings.")
+
+    text = "\n".join(lines).strip()
+    print("\n" + text)
+
+    markdown = ("## Dependency security scan\n\n"
+                f"Scanned **{len(entries)}** resolved dependencies, failing on **{fail_on}** "
+                f"and above.\n\n```\n{text}\n```\n")
+
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary_path:
+        with open(summary_path, "a", encoding="utf-8") as handle:
+            handle.write(markdown)
+
+    # The job summary only shows on the workflow run page. This file is what the workflow
+    # posts onto the pull request, where people actually look.
+    with open(os.environ.get("OSV_REPORT_FILE", "osv-report.md"), "w", encoding="utf-8") as handle:
+        handle.write(markdown)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 000000000..ff34f30af
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,157 @@
+name: "Code Coverage"
+
+# Separate from gradle.yml on purpose. That job runs on JDK 8 to prove the SDK's Java 8
+# floor, and settings.gradle only includes :sdk-java-ui on Java 11+, so a JDK 8 run would
+# silently report no coverage at all for that module. Same blind spot the dependency scan
+# workflow documents.
+on:
+  push:
+    branches:
+      - master
+      - staging
+  pull_request:
+    branches:
+      - master
+      - staging
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Advisory to begin with: the repository is not at target yet, and a gate that fails every
+  # pull request from day one just gets ignored. Raise these, then set ENFORCE_COVERAGE to
+  # make them block.
+  COVERAGE_MIN_OVERALL: "0"
+  COVERAGE_MIN_CHANGED: "0"
+  ENFORCE_COVERAGE: "false"
+
+jobs:
+  coverage:
+    name: Measure and report coverage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Needed to post the report as a comment on the pull request.
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # The changed-file list is computed by diffing against the base branch, which needs
+          # more than the default single commit.
+          fetch-depth: 0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      # The task deliberately lets tests fail so a flake cannot block the report. The report
+      # itself carries the failure count, and gradle.yml is what actually gates on tests.
+      # The output is kept so a build failure can be shown in the pull request comment rather
+      # than sending the reader off to the workflow logs.
+      # sdk-java-ui's tests need a real JavaFX toolkit, and this runner has no display, so without
+      # xvfb every one of them skips itself and the module reports about a third of its real
+      # coverage. Note this is NOT paired with -Dcountly.ui.pageLoadTests: that flag additionally
+      # enables the one class which shows a transparent stage, and that class segfaults the JVM.
+      - name: Install a virtual display
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq xvfb
+
+      # continue-on-error because a crashed JVM is not a test failure: ignoreFailures does not cover
+      # it, so without this a crash would kill the job and lose sdk-java's numbers as collateral.
+      # The report step below runs either way and explains what happened.
+      - name: Run tests under jacoco
+        id: gradle
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          xvfb-run -a ./gradlew coverage --console=plain 2>&1 | tee coverage-run.log
+
+      # Best effort, and never allowed to fail the job: without it the report simply has no
+      # changed-files section. checkout already fetched the full history, so this only makes
+      # sure the base branch ref itself is present.
+      - name: Collect the files this pull request changed
+        if: always() && github.event_name == 'pull_request'
+        continue-on-error: true
+        run: |
+          git fetch --no-tags origin "${{ github.base_ref }}"
+          git diff --name-only --diff-filter=d \
+            "origin/${{ github.base_ref }}...HEAD" > changed-files.txt
+          echo "Changed files:"
+          cat changed-files.txt
+
+      # always(): when the build above fails there is no report, and this step is what turns
+      # that into a comment explaining why instead of a silent skip.
+      - name: Build the coverage report
+        id: report
+        if: always()
+        run: |
+          python3 .github/scripts/coverage_report.py \
+            --out coverage-report.md \
+            --changed-files changed-files.txt \
+            --build-log coverage-run.log \
+            --module "sdk-java:sdk-java/build/reports/jacoco/test/jacocoTestReport.xml:sdk-java/build/test-results/test:sdk-java/src/main/java" \
+            --module "sdk-java-ui:sdk-java-ui/build/reports/jacoco/test/jacocoTestReport.xml:sdk-java-ui/build/test-results/test:sdk-java-ui/src/main/java"
+
+      # Updates one sticky comment instead of adding a new one on every push, matching the
+      # dependency security scan. Skipped for fork pull requests, which are not granted
+      # pull-requests: write.
+      - name: Comment the report on the pull request
+        if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- countly-coverage-report -->';
+            let report = '';
+            try {
+              report = fs.readFileSync('coverage-report.md', 'utf8');
+            } catch (e) {
+              report = `## Code coverage\n\nThe coverage step did not produce a report (outcome: ${{ steps.report.outcome }}). See the workflow logs.`;
+            }
+            const body = [
+              marker,
+              report,
+              `[Full run log](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
+            ].join('\n');
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Upload the coverage reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-reports
+          path: |
+            coverage-report.md
+            coverage-run.log
+            sdk-java/build/reports/jacoco/test/
+            sdk-java-ui/build/reports/jacoco/test/
+          if-no-files-found: warn
diff --git a/.github/workflows/cross-platform-tests.yml b/.github/workflows/cross-platform-tests.yml
new file mode 100644
index 000000000..b3bed7bc7
--- /dev/null
+++ b/.github/workflows/cross-platform-tests.yml
@@ -0,0 +1,81 @@
+name: "Cross Platform Tests"
+
+# The JavaFX UI module is the platform sensitive part of this repo: it drives a headless web view
+# through Monocle, and that stack behaves differently per OS. JavaFX 21's WebKit segfaults when
+# loading a page headlessly on macOS/aarch64, which is why those tests carry a platform gate, so the
+# other platforms have to be exercised deliberately rather than assumed.
+#
+# The core SDK is run here too, because its storage layer builds file paths by hand and Windows is
+# the only place a separator bug would show up.
+on:
+  push:
+    branches:
+      - master
+      - staging
+  pull_request:
+    branches:
+      - master
+      - staging
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      # One platform failing must not cancel the others: knowing WHICH platforms are affected is
+      # the entire point of this job.
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      # bash on both platforms so one command works everywhere; Git Bash ships on the Windows runner.
+      - name: Run the core SDK tests
+        shell: bash
+        run: ./gradlew :sdk-java:test --console=plain
+
+      # These tests need a real JavaFX toolkit. Linux runners have no display, so xvfb provides
+      # one; the Windows runner has a desktop session already. Classes still skip themselves with a
+      # reason if no toolkit can start, so this never fails for the wrong reason.
+      #
+      # Deliberately without -Dcountly.ui.pageLoadTests: that enables the one class showing a
+      # transparent stage, which segfaults the JVM everywhere it has been tried.
+      - name: Run the JavaFX UI tests
+        if: always()
+        shell: bash
+        run: |
+          if [ "$RUNNER_OS" = "Linux" ]; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq xvfb
+            xvfb-run -a ./gradlew :sdk-java-ui:test --console=plain
+          else
+            ./gradlew :sdk-java-ui:test --console=plain
+          fi
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-${{ matrix.os }}
+          path: |
+            sdk-java/build/reports/tests/test/
+            sdk-java/build/test-results/test/
+            sdk-java-ui/build/reports/tests/test/
+            sdk-java-ui/build/test-results/test/
+            **/hs_err_pid*.log
+          if-no-files-found: warn
diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml
new file mode 100644
index 000000000..6bb2b948f
--- /dev/null
+++ b/.github/workflows/dependency-security.yml
@@ -0,0 +1,181 @@
+name: "Dependency Security Scan"
+
+# Runs on pushes/PRs so a bad upgrade is caught immediately, and on a schedule because a
+# dependency can become vulnerable without this repo changing at all.
+on:
+  push:
+    branches:
+      - master
+      - staging
+  pull_request:
+    branches:
+      - master
+      - staging
+  schedule:
+    # Mondays 06:00 UTC
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Modules published to Maven Central. Their runtime dependencies are what every
+  # integrator inherits, so they are scanned as `published` and always block.
+  # NOTE: sdk-java only applies the publish plugin when a publish task is requested, so the
+  # report step cannot auto-detect it -- this list is the only signal.
+  PUBLISHED_MODULES: ":sdk-java"
+
+jobs:
+  osv-scan:
+    name: OSV scan (all modules)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Needed to post the scan result as a comment on the pull request.
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # NOTE: JDK 17, not the JDK 8 used by gradle.yml. settings.gradle only includes
+      # :app-javafx on Java 11+, so a JDK 8 run would silently skip that module's
+      # dependencies -- exactly the blind spot that let a known org.json CVE sit in the demo
+      # modules after sdk-java had been fixed.
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Resolve dependencies for every module
+        run: |
+          set -o pipefail
+          ./gradlew -q --init-script .github/scripts/dependency-report.init.gradle \
+            "-DpublishedModules=$PUBLISHED_MODULES" \
+            printResolvedDependencies | tee resolved-dependencies.txt
+          count=$(grep -c '^COORD' resolved-dependencies.txt || true)
+          echo "Resolved $count coordinate lines."
+          if [ "$count" -eq 0 ]; then
+            echo "::error::Gradle produced no dependency coordinates"
+            exit 1
+          fi
+
+      # Blocks on `published` and `sample` findings -- everything we declare ourselves,
+      # including the demo modules. `buildscript` is reported only: it is Gradle plugin
+      # internals, which cannot be upgraded independently of the plugins themselves.
+      - name: Check resolved dependencies against OSV
+        id: osv
+        env:
+          OSV_FAIL_ON: HIGH
+          OSV_BLOCKING_SCOPES: published,sample
+        run: python3 .github/scripts/osv_scan.py < resolved-dependencies.txt
+
+      # The job summary written above only shows on the workflow run page. This is what
+      # actually puts the result on the pull request. It updates one sticky comment
+      # instead of adding a new one on every push.
+      - name: Comment scan result on the pull request
+        if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- countly-dependency-security-scan -->';
+            const outcome = '${{ steps.osv.outcome }}';
+            // The report body already carries its own heading.
+            const status = outcome === 'success'
+              ? '**Result: passed**'
+              : '**Result: FAILED — a dependency has a known vulnerability**';
+            let report = '';
+            try {
+              report = fs.readFileSync('osv-report.md', 'utf8');
+            } catch (e) {
+              report = `The scan step did not produce a report (outcome: ${outcome}). See the workflow logs.`;
+            }
+            const body = [
+              marker,
+              report,
+              status,
+              '',
+              `[Full run log](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
+            ].join('\n');
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Upload dependency list
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: resolved-dependencies
+          path: |
+            resolved-dependencies.txt
+            osv-report.md
+          if-no-files-found: warn
+
+  dependency-submission:
+    name: Submit dependency graph
+    # Runs on pushes to the long-lived branches, on the weekly cron, on manual dispatch,
+    # AND on same-repo pull requests -- the last one is what gives dependency-review a head
+    # snapshot to diff against.
+    # Fork PRs are skipped on purpose: `contents: write` is not granted to a workflow
+    # triggered by a PR from a public fork, so the submit would fail. Covering forks needs
+    # the two-workflow generate-and-upload + workflow_run pattern from the gradle/actions docs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+      - name: Submit resolved dependency graph to GitHub
+        uses: gradle/actions/dependency-submission@v4
+
+  dependency-review:
+    name: Review dependency changes
+    # Needs the submission job so the head snapshot exists before the diff.
+    # `always()` keeps this running on fork PRs, where submission is skipped -- without it,
+    # a skipped dependency-submission would skip this job too.
+    # SCOPE: this can only diff Gradle dependencies once BOTH the base branch and the head
+    # have a submitted snapshot, so expect Actions-only output until master has been through
+    # dependency-submission at least once. osv-scan is the job that covers Gradle
+    # dependencies unconditionally.
+    if: always() && github.event_name == 'pull_request'
+    needs: dependency-submission
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fail the PR on newly introduced vulnerable dependencies
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: low
+          comment-summary-in-pr: on-failure
diff --git a/.gitignore b/.gitignore
index da46f720d..3d2559448 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,14 +3,21 @@
 /.idea/workspace.xml
 /.idea/libraries
 .DS_Store
-/build
 .idea/caches/
-sdkJava/build/
-core/build/
-sdk-java/build/
 *.attach_pid*
-app-java/out/
 data
-sdk-java/out/
 /.vscode/
-*.class
\ No newline at end of file
+*.class
+
+# Gradle build output (all modules, current and future)
+build/
+out/
+
+# Dependency security scan output
+osv-report.md
+resolved-dependencies.txt
+
+# JVM crash dumps, produced when the JavaFX toolkit dies during tests
+hs_err_pid*.log
+replay_pid*.log
+*.mdmp
diff --git a/.idea/AndroidProjectSystem.xml b/.idea/AndroidProjectSystem.xml
new file mode 100644
index 000000000..4a53bee8c
--- /dev/null
+++ b/.idea/AndroidProjectSystem.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="AndroidProjectSystem">
+    <option name="providerId" value="com.android.tools.idea.GradleProjectSystem" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/compiler.xml b/.idea/compiler.xml
index 43f43bae0..8144c3cf0 100644
--- a/.idea/compiler.xml
+++ b/.idea/compiler.xml
@@ -11,13 +11,6 @@
       <entry name="!?*.kt" />
       <entry name="!?*.clj" />
     </wildcardResourcePatterns>
-    <bytecodeTargetLevel target="1.8">
-      <module name="countly-sdk-java.app-java" target="11" />
-      <module name="countly-sdk-java.app-java.main" target="11" />
-      <module name="countly-sdk-java.app-java.test" target="11" />
-      <module name="countly-sdk-java.app-javafx" target="11" />
-      <module name="countly-sdk-java.app-javafx.main" target="11" />
-      <module name="countly-sdk-java.app-javafx.test" target="11" />
-    </bytecodeTargetLevel>
+    <bytecodeTargetLevel target="1.8" />
   </component>
 </project>
\ No newline at end of file
diff --git a/.idea/gradle.xml b/.idea/gradle.xml
index 7d4c91b5b..e2c9312ad 100644
--- a/.idea/gradle.xml
+++ b/.idea/gradle.xml
@@ -4,15 +4,16 @@
   <component name="GradleSettings">
     <option name="linkedExternalProjectsSettings">
       <GradleProjectSettings>
-        <option name="testRunner" value="PLATFORM" />
+        <option name="testRunner" value="CHOOSE_PER_TEST" />
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="gradleHome" value="$APPLICATION_HOME_DIR$/gradle/gradle-2.14.1" />
+        <option name="gradleJvm" value="#GRADLE_LOCAL_JAVA_HOME" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />
             <option value="$PROJECT_DIR$/app-java" />
             <option value="$PROJECT_DIR$/app-javafx" />
             <option value="$PROJECT_DIR$/sdk-java" />
+            <option value="$PROJECT_DIR$/sdk-java-ui" />
           </set>
         </option>
       </GradleProjectSettings>
diff --git a/.idea/migrations.xml b/.idea/migrations.xml
new file mode 100644
index 000000000..f8051a6f9
--- /dev/null
+++ b/.idea/migrations.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectMigrations">
+    <option name="MigrateToGradleLocalJavaHome">
+      <set>
+        <option value="$PROJECT_DIR$" />
+      </set>
+    </option>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/misc.xml b/.idea/misc.xml
index b9445a488..e60a4f506 100644
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@@ -1,56 +1,58 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
+  <component name="ExternalStorageConfigurationManager" enabled="true" />
   <component name="FrameworkDetectionExcludesConfiguration">
     <file type="web" url="file://$PROJECT_DIR$" />
   </component>
   <component name="NullableNotNullManager">
     <option name="myDefaultNullable" value="android.support.annotation.Nullable" />
     <option name="myDefaultNotNull" value="android.support.annotation.NonNull" />
+    <option name="myOrdered" value="true" />
     <option name="myNullables">
       <value>
         <list size="18">
-          <item index="0" class="java.lang.String" itemvalue="org.jetbrains.annotations.Nullable" />
-          <item index="1" class="java.lang.String" itemvalue="javax.annotation.Nullable" />
-          <item index="2" class="java.lang.String" itemvalue="edu.umd.cs.findbugs.annotations.Nullable" />
-          <item index="3" class="java.lang.String" itemvalue="android.support.annotation.Nullable" />
-          <item index="4" class="java.lang.String" itemvalue="javax.annotation.CheckForNull" />
-          <item index="5" class="java.lang.String" itemvalue="androidx.annotation.Nullable" />
-          <item index="6" class="java.lang.String" itemvalue="androidx.annotation.RecentlyNullable" />
-          <item index="7" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.qual.Nullable" />
-          <item index="8" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NullableDecl" />
-          <item index="9" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NullableType" />
-          <item index="10" class="java.lang.String" itemvalue="android.annotation.Nullable" />
-          <item index="11" class="java.lang.String" itemvalue="com.android.annotations.Nullable" />
-          <item index="12" class="java.lang.String" itemvalue="org.eclipse.jdt.annotation.Nullable" />
-          <item index="13" class="java.lang.String" itemvalue="io.reactivex.annotations.Nullable" />
-          <item index="14" class="java.lang.String" itemvalue="io.reactivex.rxjava3.annotations.Nullable" />
-          <item index="15" class="java.lang.String" itemvalue="org.jspecify.nullness.Nullable" />
-          <item index="16" class="java.lang.String" itemvalue="org.jspecify.annotations.Nullable" />
-          <item index="17" class="java.lang.String" itemvalue="jakarta.annotation.Nullable" />
+          <item index="0" class="java.lang.String" itemvalue="android.support.annotation.Nullable" />
+          <item index="1" class="java.lang.String" itemvalue="io.reactivex.annotations.Nullable" />
+          <item index="2" class="java.lang.String" itemvalue="io.reactivex.rxjava3.annotations.Nullable" />
+          <item index="3" class="java.lang.String" itemvalue="org.jspecify.nullness.Nullable" />
+          <item index="4" class="java.lang.String" itemvalue="androidx.annotation.Nullable" />
+          <item index="5" class="java.lang.String" itemvalue="android.annotation.Nullable" />
+          <item index="6" class="java.lang.String" itemvalue="com.android.annotations.Nullable" />
+          <item index="7" class="java.lang.String" itemvalue="androidx.annotation.RecentlyNullable" />
+          <item index="8" class="java.lang.String" itemvalue="org.jspecify.annotations.Nullable" />
+          <item index="9" class="java.lang.String" itemvalue="org.jetbrains.annotations.Nullable" />
+          <item index="10" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.qual.Nullable" />
+          <item index="11" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NullableDecl" />
+          <item index="12" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NullableType" />
+          <item index="13" class="java.lang.String" itemvalue="org.eclipse.jdt.annotation.Nullable" />
+          <item index="14" class="java.lang.String" itemvalue="edu.umd.cs.findbugs.annotations.Nullable" />
+          <item index="15" class="java.lang.String" itemvalue="jakarta.annotation.Nullable" />
+          <item index="16" class="java.lang.String" itemvalue="javax.annotation.Nullable" />
+          <item index="17" class="java.lang.String" itemvalue="javax.annotation.CheckForNull" />
         </list>
       </value>
     </option>
     <option name="myNotNulls">
       <value>
         <list size="18">
-          <item index="0" class="java.lang.String" itemvalue="org.jetbrains.annotations.NotNull" />
-          <item index="1" class="java.lang.String" itemvalue="javax.annotation.Nonnull" />
-          <item index="2" class="java.lang.String" itemvalue="edu.umd.cs.findbugs.annotations.NonNull" />
-          <item index="3" class="java.lang.String" itemvalue="android.support.annotation.NonNull" />
-          <item index="4" class="java.lang.String" itemvalue="androidx.annotation.NonNull" />
-          <item index="5" class="java.lang.String" itemvalue="androidx.annotation.RecentlyNonNull" />
-          <item index="6" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.qual.NonNull" />
-          <item index="7" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NonNullDecl" />
-          <item index="8" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NonNullType" />
-          <item index="9" class="java.lang.String" itemvalue="android.annotation.NonNull" />
-          <item index="10" class="java.lang.String" itemvalue="com.android.annotations.NonNull" />
-          <item index="11" class="java.lang.String" itemvalue="org.eclipse.jdt.annotation.NonNull" />
-          <item index="12" class="java.lang.String" itemvalue="io.reactivex.annotations.NonNull" />
-          <item index="13" class="java.lang.String" itemvalue="io.reactivex.rxjava3.annotations.NonNull" />
-          <item index="14" class="java.lang.String" itemvalue="lombok.NonNull" />
-          <item index="15" class="java.lang.String" itemvalue="org.jspecify.nullness.NonNull" />
-          <item index="16" class="java.lang.String" itemvalue="org.jspecify.annotations.NonNull" />
-          <item index="17" class="java.lang.String" itemvalue="jakarta.annotation.Nonnull" />
+          <item index="0" class="java.lang.String" itemvalue="android.support.annotation.NonNull" />
+          <item index="1" class="java.lang.String" itemvalue="io.reactivex.annotations.NonNull" />
+          <item index="2" class="java.lang.String" itemvalue="io.reactivex.rxjava3.annotations.NonNull" />
+          <item index="3" class="java.lang.String" itemvalue="lombok.NonNull" />
+          <item index="4" class="java.lang.String" itemvalue="org.jspecify.nullness.NonNull" />
+          <item index="5" class="java.lang.String" itemvalue="androidx.annotation.NonNull" />
+          <item index="6" class="java.lang.String" itemvalue="android.annotation.NonNull" />
+          <item index="7" class="java.lang.String" itemvalue="com.android.annotations.NonNull" />
+          <item index="8" class="java.lang.String" itemvalue="androidx.annotation.RecentlyNonNull" />
+          <item index="9" class="java.lang.String" itemvalue="org.jspecify.annotations.NonNull" />
+          <item index="10" class="java.lang.String" itemvalue="org.jetbrains.annotations.NotNull" />
+          <item index="11" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.qual.NonNull" />
+          <item index="12" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NonNullDecl" />
+          <item index="13" class="java.lang.String" itemvalue="org.checkerframework.checker.nullness.compatqual.NonNullType" />
+          <item index="14" class="java.lang.String" itemvalue="org.eclipse.jdt.annotation.NonNull" />
+          <item index="15" class="java.lang.String" itemvalue="edu.umd.cs.findbugs.annotations.NonNull" />
+          <item index="16" class="java.lang.String" itemvalue="jakarta.annotation.Nonnull" />
+          <item index="17" class="java.lang.String" itemvalue="javax.annotation.Nonnull" />
         </list>
       </value>
     </option>
diff --git a/.idea/modules.xml b/.idea/modules.xml
deleted file mode 100644
index ad4fd665f..000000000
--- a/.idea/modules.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/countly-sdk-java.iml" filepath="$PROJECT_DIR$/.idea/modules/countly-sdk-java.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.iml" filepath="$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.main.iml" filepath="$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.main.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.test.iml" filepath="$PROJECT_DIR$/.idea/modules/app-java/countly-sdk-java.app-java.test.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.iml" filepath="$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.main.iml" filepath="$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.main.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.test.iml" filepath="$PROJECT_DIR$/.idea/modules/app-javafx/countly-sdk-java.app-javafx.test.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.iml" filepath="$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.main.iml" filepath="$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.main.iml" />
-      <module fileurl="file://$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.test.iml" filepath="$PROJECT_DIR$/.idea/modules/sdk-java/countly-sdk-java.sdk-java.test.iml" />
-    </modules>
-  </component>
-</project>
\ No newline at end of file
diff --git a/.idea/modules/app-java/countly-sdk-java.app-java.iml b/.idea/modules/app-java/countly-sdk-java.app-java.iml
deleted file mode 100644
index adfeacd90..000000000
--- a/.idea/modules/app-java/countly-sdk-java.app-java.iml
+++ /dev/null
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-java" external.linked.project.path="$MODULE_DIR$/../../../app-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11" inherit-compiler-output="true">
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-java">
-      <excludeFolder url="file://$MODULE_DIR$/../../../app-java/.gradle" />
-      <excludeFolder url="file://$MODULE_DIR$/../../../app-java/build" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/app-java/countly-sdk-java.app-java.main.iml b/.idea/modules/app-java/countly-sdk-java.app-java.main.iml
deleted file mode 100644
index 1dce0390c..000000000
--- a/.idea/modules/app-java/countly-sdk-java.app-java.main.iml
+++ /dev/null
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-java:main" external.linked.project.path="$MODULE_DIR$/../../../app-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11">
-    <output url="file://$MODULE_DIR$/../../../app-java/build/classes/java/main" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-java/src/main">
-      <sourceFolder url="file://$MODULE_DIR$/../../../app-java/src/main/java" isTestSource="false" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="library" scope="PROVIDED" name="Gradle: org.json:json:20230227" level="project" />
-    <orderEntry type="module" module-name="countly-sdk-java.sdk-java.main" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/app-java/countly-sdk-java.app-java.test.iml b/.idea/modules/app-java/countly-sdk-java.app-java.test.iml
deleted file mode 100644
index 05c052b7c..000000000
--- a/.idea/modules/app-java/countly-sdk-java.app-java.test.iml
+++ /dev/null
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-java:test" external.linked.project.path="$MODULE_DIR$/../../../app-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11">
-    <output-test url="file://$MODULE_DIR$/../../../app-java/build/classes/java/test" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-java/src/test" />
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="module" module-name="countly-sdk-java.app-java.main" />
-    <orderEntry type="library" scope="PROVIDED" name="Gradle: org.json:json:20230227" level="project" />
-    <orderEntry type="module" module-name="countly-sdk-java.sdk-java.main" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-  </component>
-  <component name="TestModuleProperties" production-module="countly-sdk-java.app-java.main" />
-</module>
\ No newline at end of file
diff --git a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.iml b/.idea/modules/app-javafx/countly-sdk-java.app-javafx.iml
deleted file mode 100644
index 8bf65008b..000000000
--- a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.iml
+++ /dev/null
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-javafx" external.linked.project.path="$MODULE_DIR$/../../../app-javafx" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11" inherit-compiler-output="true">
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-javafx">
-      <excludeFolder url="file://$MODULE_DIR$/../../../app-javafx/.gradle" />
-      <excludeFolder url="file://$MODULE_DIR$/../../../app-javafx/build" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.main.iml b/.idea/modules/app-javafx/countly-sdk-java.app-javafx.main.iml
deleted file mode 100644
index 8cc8f9058..000000000
--- a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.main.iml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-javafx:main" external.linked.project.path="$MODULE_DIR$/../../../app-javafx" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11">
-    <output url="file://$MODULE_DIR$/../../../app-javafx/build/classes/java/main" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-javafx/src/main">
-      <sourceFolder url="file://$MODULE_DIR$/../../../app-javafx/src/main/java" isTestSource="false" />
-      <sourceFolder url="file://$MODULE_DIR$/../../../app-javafx/src/main/resources" type="java-resource" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="module" module-name="countly-sdk-java.sdk-java.main" />
-    <orderEntry type="library" scope="PROVIDED" name="Gradle: org.json:json:20230227" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-web:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-controls:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-media:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-graphics:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-base:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.test.iml b/.idea/modules/app-javafx/countly-sdk-java.app-javafx.test.iml
deleted file mode 100644
index b8269e278..000000000
--- a/.idea/modules/app-javafx/countly-sdk-java.app-javafx.test.iml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":app-javafx:test" external.linked.project.path="$MODULE_DIR$/../../../app-javafx" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_11">
-    <output-test url="file://$MODULE_DIR$/../../../app-javafx/build/classes/java/test" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../app-javafx/src/test" />
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="module" module-name="countly-sdk-java.app-javafx.main" />
-    <orderEntry type="module" module-name="countly-sdk-java.sdk-java.main" />
-    <orderEntry type="library" scope="PROVIDED" name="Gradle: org.json:json:20230227" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-web:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-controls:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-media:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-graphics:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" name="Gradle: org.openjfx:javafx-base:mac-aarch64:17.0.10" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-  </component>
-  <component name="TestModuleProperties" production-module="countly-sdk-java.app-javafx.main" />
-</module>
\ No newline at end of file
diff --git a/.idea/modules/countly-sdk-java.iml b/.idea/modules/countly-sdk-java.iml
deleted file mode 100644
index ee2f2ecae..000000000
--- a/.idea/modules/countly-sdk-java.iml
+++ /dev/null
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id="countly-sdk-java" external.linked.project.path="$MODULE_DIR$/../.." external.root.project.path="$MODULE_DIR$/../.." external.system.id="GRADLE" external.system.module.group="" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" inherit-compiler-output="true">
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../..">
-      <excludeFolder url="file://$MODULE_DIR$/../../.gradle" />
-      <excludeFolder url="file://$MODULE_DIR$/../../build" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.iml b/.idea/modules/sdk-java/countly-sdk-java.sdk-java.iml
deleted file mode 100644
index cc291a72a..000000000
--- a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.iml
+++ /dev/null
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":sdk-java" external.linked.project.path="$MODULE_DIR$/../../../sdk-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" inherit-compiler-output="true">
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../sdk-java">
-      <excludeFolder url="file://$MODULE_DIR$/../../../sdk-java/.gradle" />
-      <excludeFolder url="file://$MODULE_DIR$/../../../sdk-java/build" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.main.iml b/.idea/modules/sdk-java/countly-sdk-java.sdk-java.main.iml
deleted file mode 100644
index 711ac017d..000000000
--- a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.main.iml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":sdk-java:main" external.linked.project.path="$MODULE_DIR$/../../../sdk-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <output url="file://$MODULE_DIR$/../../../sdk-java/build/classes/java/main" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../sdk-java/src/main">
-      <sourceFolder url="file://$MODULE_DIR$/../../../sdk-java/src/main/java" isTestSource="false" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="library" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-  </component>
-</module>
\ No newline at end of file
diff --git a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.test.iml b/.idea/modules/sdk-java/countly-sdk-java.sdk-java.test.iml
deleted file mode 100644
index 0b72ac134..000000000
--- a/.idea/modules/sdk-java/countly-sdk-java.sdk-java.test.iml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module external.linked.project.id=":sdk-java:test" external.linked.project.path="$MODULE_DIR$/../../../sdk-java" external.root.project.path="$MODULE_DIR$/../../.." external.system.id="GRADLE" external.system.module.group="countly-sdk-java" external.system.module.type="sourceSet" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <output-test url="file://$MODULE_DIR$/../../../sdk-java/build/classes/java/test" />
-    <exclude-output />
-    <content url="file://$MODULE_DIR$/../../../sdk-java/src/test">
-      <sourceFolder url="file://$MODULE_DIR$/../../../sdk-java/src/test/java" isTestSource="true" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="module" module-name="countly-sdk-java.sdk-java.main" />
-    <orderEntry type="library" name="Gradle: org.json:json:20250107" level="project" />
-    <orderEntry type="library" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
-    <orderEntry type="library" name="Gradle: junit:junit:4.13.1" level="project" />
-    <orderEntry type="library" name="Gradle: org.mockito:mockito-core:4.11.0" level="project" />
-    <orderEntry type="library" name="Gradle: org.hamcrest:hamcrest-core:1.3" level="project" />
-    <orderEntry type="library" name="Gradle: net.bytebuddy:byte-buddy:1.12.19" level="project" />
-    <orderEntry type="library" name="Gradle: net.bytebuddy:byte-buddy-agent:1.12.19" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Gradle: org.objenesis:objenesis:3.3" level="project" />
-  </component>
-  <component name="TestModuleProperties" production-module="countly-sdk-java.sdk-java.main" />
-</module>
\ No newline at end of file
diff --git a/.idea/runConfigurations.xml b/.idea/runConfigurations.xml
new file mode 100644
index 000000000..16660f1d8
--- /dev/null
+++ b/.idea/runConfigurations.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="RunConfigurationProducerService">
+    <option name="ignoredProducers">
+      <set>
+        <option value="com.intellij.execution.junit.AbstractAllInDirectoryConfigurationProducer" />
+        <option value="com.intellij.execution.junit.AllInPackageConfigurationProducer" />
+        <option value="com.intellij.execution.junit.PatternConfigurationProducer" />
+        <option value="com.intellij.execution.junit.TestInClassConfigurationProducer" />
+        <option value="com.intellij.execution.junit.UniqueIdConfigurationProducer" />
+        <option value="com.intellij.execution.junit.testDiscovery.JUnitTestDiscoveryConfigurationProducer" />
+        <option value="org.jetbrains.kotlin.idea.junit.KotlinJUnitRunConfigurationProducer" />
+        <option value="org.jetbrains.kotlin.idea.junit.KotlinPatternConfigurationProducer" />
+      </set>
+    </option>
+  </component>
+</project>
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5df6f63c3..f088611b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,20 @@
+## 26.8.0
+* Added support for the Content feature, accessible through the "Countly.instance().content()" interface:
+  * "enterContentZone" / "exitContentZone" for starting and stopping periodic content fetching
+  * "refreshContentZone" for flushing the event queue and fetching again right away
+  * "previewContent" for showing one specific content block by its ID
+  * "setContentDisplay" for registering the component that draws content
+  * Added the "content" configuration group with "setZoneTimerInterval" and "setGlobalContentCallback"
+  * This feature uses "Content" consent.
+  * Needs the new "ly.count.sdk:java-ui" artifact for displaying content.
+* Added a separately published artifact "ly.count.sdk:java-ui" (Java 17+, JavaFX 20+) that displays feedback widgets and content on the desktop:
+  * "presentNPS", "presentSurvey" and "presentRating" for fetching, picking and showing a widget in one call, optionally by widget ID, name or tag
+  * "CountlyWebView.presentFeedbackWidget" for showing a feedback widget you picked yourself
+  * "CountlyWebView.enableContentZone" / "CountlyWebView.disableContentZone" for showing content
+  * "CountlyWebView.setShowWidgetsWithinApp" for laying widget cards and content out inside the application window instead of over the screen
+  * Implement "ContentDisplay" yourself to draw content with another toolkit.
+* Updated JSON library version from "20250107" to "20250517".
+
 ## 24.1.6
 * Fixed a bug where the request queue would stall after sending the first request, preventing subsequent persisted requests from being sent.
 
diff --git a/README.md b/README.md
index 8dc956c30..6bf7eaa88 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,23 @@ This SDK supports the following features:
 * [User Profiles](https://support.count.ly/hc/en-us/articles/4403281285913-User-Profiles)
 * [Crash Reports](https://support.count.ly/hc/en-us/articles/4404213566105-Crashes-Errors)
 
+## Building and testing
+
+```bash
+./gradlew :sdk-java:build      # compile the core SDK and run its tests
+./gradlew :sdk-java-ui:build   # compile the JavaFX UI artifact and run its tests (Java 17+)
+./gradlew coverage             # run every published module's tests and print a coverage summary
+./gradlew :app-java:run        # console demo
+./gradlew :app-javafx:run      # JavaFX demo (Java 17+)
+```
+
+`coverage` writes a jacoco report per module to `<module>/build/reports/jacoco/test/`, HTML to read
+and XML for tooling, and prints line and branch coverage for each one.
+
+The same task runs in CI on every pull request and posts the result as a comment, including
+coverage of the files that pull request changed. Minimums live in the `env` block of
+`.github/workflows/coverage.yml` and are advisory until `ENFORCE_COVERAGE` is set to `true`.
+
 ## Security
 
 Security is very important to us. If you discover any issue regarding security, please disclose the information responsibly by sending an email to security@count.ly and **not by creating a GitHub issue**.
diff --git a/app-java/build.gradle b/app-java/build.gradle
index 3b90276a2..7b39c889a 100644
--- a/app-java/build.gradle
+++ b/app-java/build.gradle
@@ -9,7 +9,7 @@ repositories {
 }
 
 dependencies {
-  implementation 'org.json:json:20230227'
+  implementation 'org.json:json:20250517'
 
   implementation fileTree(dir: 'libs', include: ['*.jar'])
   implementation project(path: ':sdk-java')
diff --git a/app-javafx/build.gradle b/app-javafx/build.gradle
index d175b4a50..fe048f2d7 100644
--- a/app-javafx/build.gradle
+++ b/app-javafx/build.gradle
@@ -5,12 +5,14 @@ plugins {
 }
 
 java {
-    sourceCompatibility = JavaVersion.VERSION_11
-    targetCompatibility = JavaVersion.VERSION_11
+    // Matches sdk-java-ui: JavaFX 21 needs Java 17.
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(17)
+    }
 }
 
 javafx {
-    version = '17.0.10'
+    version = '21.0.5'
     modules = [ 'javafx.controls', 'javafx.web' ]
 }
 
@@ -19,9 +21,12 @@ dependencies {
     // picked up without publishing or copying a jar.
     implementation project(':sdk-java')
 
+    // The JavaFX UI artifact: feedback widget cards and the content overlay.
+    implementation project(':sdk-java-ui')
+
     // org.json is used by the demo for pretty-printing widget data; the
     // SDK also uses it internally (and exposes JSONObject in its API).
-    implementation 'org.json:json:20230227'
+    implementation 'org.json:json:20250517'
 }
 
 application {
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/AppContext.java b/app-javafx/src/main/java/ly/count/javafx/demo/AppContext.java
index 4b4eb2db7..fd70e38e2 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/AppContext.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/AppContext.java
@@ -13,7 +13,7 @@ public final class AppContext {
     // flows, so our raw feedback HTTP call (used to recover the wv field
     // for URL construction) identifies the same client.
     public static final String SDK_NAME = "java-native";
-    public static final String SDK_VERSION = "24.1.6";
+    public static final String SDK_VERSION = "26.8.0";
     public static final String PLATFORM = "desktop";
 
     // Populated from the Init tab once the user initializes the SDK; the
@@ -21,7 +21,7 @@ public final class AppContext {
     // the raw /o/sdk?method=feedback call (the SDK's Config does not expose
     // them publicly to code outside its package).
     public static volatile String liveServerUrl = DEFAULT_SERVER_URL;
-    public static volatile String liveAppKey    = DEFAULT_APP_KEY;
+    public static volatile String liveAppKey = DEFAULT_APP_KEY;
 
     public static File storageDir() {
         File dir = new File(
@@ -35,5 +35,6 @@ public static File storageDir() {
         return dir;
     }
 
-    private AppContext() {}
+    private AppContext() {
+    }
 }
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/Main.java b/app-javafx/src/main/java/ly/count/javafx/demo/Main.java
index 062cfb4bf..0631c1983 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/Main.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/Main.java
@@ -1,21 +1,35 @@
 package ly.count.javafx.demo;
 
+import java.awt.MouseInfo;
+import java.awt.Point;
+import java.util.List;
 import javafx.application.Application;
 import javafx.application.Platform;
+import javafx.geometry.Rectangle2D;
 import javafx.scene.Scene;
+import javafx.stage.Screen;
 import javafx.stage.Stage;
 import ly.count.javafx.demo.ui.MainView;
 import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.ui.CountlyWebView;
 
 public class Main extends Application {
 
+    private static final int WIDTH = 1280;
+    private static final int HEIGHT = 820;
+
     @Override
     public void start(Stage stage) {
         MainView view = new MainView();
-        Scene scene = new Scene(view.getRoot(), 1280, 820);
+        Scene scene = new Scene(view.getRoot(), WIDTH, HEIGHT);
         scene.getStylesheets().add(
             getClass().getResource("/styles/app.css").toExternalForm()
         );
+        // A demo is exactly where the extra logging is wanted: it reports the bundled WebKit
+        // version and anything a widget or content page failed to fetch. Needs the SDK's logging
+        // level set to DEBUG or VERBOSE on the Init tab to show up in the log panel.
+        CountlyWebView.setWebViewDiagnosticsEnabled(true);
+
         stage.setTitle("Countly Java SDK - JavaFX Demo");
         stage.setScene(scene);
         stage.setOnCloseRequest(e -> {
@@ -24,9 +38,35 @@ public void start(Stage stage) {
             }
             Platform.exit();
         });
+        centreOnActiveScreen(stage);
         stage.show();
     }
 
+    /**
+     * JavaFX centres a new stage on the primary screen, which on a multiple monitor desk is often
+     * not the one being used. Centre on the screen holding the mouse pointer instead, so the demo,
+     * and the content the SDK places relative to it, opens where the user is looking.
+     */
+    private static void centreOnActiveScreen(Stage stage) {
+        try {
+            Point pointer = MouseInfo.getPointerInfo().getLocation();
+            List<Screen> screens = Screen.getScreensForRectangle(pointer.x, pointer.y, 1, 1);
+            Rectangle2D bounds = screens.isEmpty()
+                ? Screen.getPrimary().getVisualBounds()
+                : screens.get(0).getVisualBounds();
+
+            double width = Math.min(WIDTH, bounds.getWidth());
+            double height = Math.min(HEIGHT, bounds.getHeight());
+            stage.setWidth(width);
+            stage.setHeight(height);
+            stage.setX(bounds.getMinX() + (bounds.getWidth() - width) / 2);
+            stage.setY(bounds.getMinY() + (bounds.getHeight() - height) / 2);
+        } catch (Throwable t) {
+            // Headless, no pointer, or a locked down desktop: let JavaFX place the window.
+            System.out.println("[Demo] Could not centre on the active screen: " + t);
+        }
+    }
+
     public static void main(String[] args) {
         launch(args);
     }
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/ui/ContentPane.java b/app-javafx/src/main/java/ly/count/javafx/demo/ui/ContentPane.java
new file mode 100644
index 000000000..01e4114a7
--- /dev/null
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/ui/ContentPane.java
@@ -0,0 +1,142 @@
+package ly.count.javafx.demo.ui;
+
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import javafx.scene.Parent;
+import javafx.scene.control.Button;
+import javafx.scene.control.Label;
+import javafx.scene.control.TextField;
+import javafx.scene.layout.HBox;
+import javafx.scene.layout.VBox;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.ui.CountlyWebView;
+
+/**
+ * Drives the Content feature through the JavaFX UI artifact: enter and leave the content zone, force
+ * a refresh, preview one specific content block by ID, and switch users to see how the zone reacts.
+ *
+ * <p>Content is fetched by the core SDK and drawn by {@code sdk-java-ui} as a borderless, always on
+ * top window placed where the server asked for it. The area around it stays usable.
+ */
+public class ContentPane {
+
+    private final VBox root = new VBox(12);
+    private final LogPanel log;
+    private final TextField previewIdField = new TextField();
+    private final TextField deviceIdField = new TextField();
+
+    public ContentPane(LogPanel log) {
+        this.log = log;
+
+        root.setPadding(new Insets(14));
+
+        Label title = new Label("Content zone");
+        title.getStyleClass().add("section-title");
+
+        Button enter = new Button("Enter content zone");
+        enter.setOnAction(event -> SdkUtil.run(log, "[Content] enterContentZone", CountlyWebView::enableContentZone));
+
+        Button exit = new Button("Exit content zone");
+        exit.setOnAction(event -> SdkUtil.run(log, "[Content] exitContentZone", CountlyWebView::disableContentZone));
+
+        Button refresh = new Button("Refresh content zone");
+        refresh.setOnAction(event -> SdkUtil.run(log, "[Content] refreshContentZone",
+            () -> Countly.instance().content().refreshContentZone()));
+
+        previewIdField.setPromptText("content block ID");
+        previewIdField.setPrefColumnCount(24);
+
+        Button preview = new Button("Preview by ID");
+        preview.setOnAction(event -> previewContent());
+
+        HBox zoneRow = new HBox(8, enter, exit, refresh);
+        zoneRow.setAlignment(Pos.CENTER_LEFT);
+
+        HBox previewRow = new HBox(8, new Label("Preview:"), previewIdField, preview);
+        previewRow.setAlignment(Pos.CENTER_LEFT);
+
+        Label hint = new Label(
+            "Enable the Content feature on the Init tab before entering a zone. "
+                + "The first fetch waits about 4 seconds, then the SDK polls on the configured interval.");
+        hint.setWrapText(true);
+        hint.getStyleClass().add("placeholder");
+
+        root.getChildren().addAll(title, zoneRow, previewRow, hint, buildDeviceIdSection());
+    }
+
+    /**
+     * Changing the user while a content zone is running. "setID" changes the device ID without merge
+     * when the previous ID was developer supplied, which is a different user, so the SDK leaves the
+     * content zone. Consents are then granted again for the new user and the zone is entered again,
+     * which is the flow an application would run on a login.
+     */
+    private Parent buildDeviceIdSection() {
+        Label title = new Label("Device ID");
+        title.getStyleClass().add("section-title");
+
+        deviceIdField.setPromptText("new device ID");
+        deviceIdField.setPrefColumnCount(24);
+
+        Button setId = new Button("setID + grant all consents");
+        setId.setOnAction(event -> changeDeviceId(true));
+
+        Button setIdOnly = new Button("setID only");
+        setIdOnly.setOnAction(event -> changeDeviceId(false));
+
+        Label hint = new Label(
+            "A device ID change without merge is a different user, so the SDK leaves the content zone. "
+                + "Grant the consents again and enter the zone again to keep serving content.");
+        hint.setWrapText(true);
+        hint.getStyleClass().add("placeholder");
+
+        HBox row = new HBox(8, deviceIdField, setId, setIdOnly);
+        row.setAlignment(Pos.CENTER_LEFT);
+
+        VBox box = new VBox(8, title, row, hint);
+        box.setPadding(new Insets(10, 0, 0, 0));
+        return box;
+    }
+
+    private void changeDeviceId(boolean grantConsentsAndReEnter) {
+        String newId = deviceIdField.getText().trim();
+        if (newId.isEmpty()) {
+            log.warn("[Content] Enter a device ID first.");
+            return;
+        }
+
+        SdkUtil.run(log, "[Content] setID " + newId, () -> {
+            Countly.instance().deviceId().setID(newId);
+            log.info("[Content] device ID is now " + Countly.instance().deviceId().getID());
+
+            if (!grantConsentsAndReEnter) {
+                return;
+            }
+
+            Countly.onConsent(Config.Feature.values());
+            log.info("[Content] granted all consents for the new user");
+
+            // The device ID change tore the zone down, so it has to be entered again. This also
+            // re-registers the display, because a consent change rebuilds the content module.
+            //CountlyWebView.enableContentZone();
+            log.info("[Content] re-entered the content zone for the new user");
+        });
+    }
+
+    private void previewContent() {
+        String id = previewIdField.getText().trim();
+        if (id.isEmpty()) {
+            log.warn("[Content] Enter a content block ID to preview.");
+            return;
+        }
+        SdkUtil.run(log, "[Content] previewContent " + id, () -> {
+            // Previewing still needs a display registered, which entering the zone does for us.
+            CountlyWebView.enableContentZone();
+            Countly.instance().content().previewContent(id);
+        });
+    }
+
+    public Parent getRoot() {
+        return root;
+    }
+}
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/ui/FeedbackWidgetsPane.java b/app-javafx/src/main/java/ly/count/javafx/demo/ui/FeedbackWidgetsPane.java
index 024fdeb63..8aa36a294 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/ui/FeedbackWidgetsPane.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/ui/FeedbackWidgetsPane.java
@@ -31,10 +31,12 @@
 import javafx.scene.layout.VBox;
 import javafx.scene.web.WebEngine;
 import javafx.scene.web.WebView;
+import javafx.stage.Window;
 import ly.count.javafx.demo.AppContext;
 import ly.count.sdk.java.Countly;
 import ly.count.sdk.java.internal.CountlyFeedbackWidget;
 import ly.count.sdk.java.internal.FeedbackWidgetType;
+import ly.count.sdk.java.ui.CountlyWebView;
 
 /**
  * Mirrors cpp_demo/main.cpp + Countly_Feedback_Widget_Implementation_Guide.html:
@@ -75,7 +77,23 @@ public FeedbackWidgetsPane(LogPanel log) {
         headerLabel.getStyleClass().add("section-title");
         HBox headerRow = new HBox(8, headerLabel, refresh);
         headerRow.setAlignment(javafx.geometry.Pos.CENTER_LEFT);
-        leftBox.getChildren().addAll(headerRow, cardList);
+
+        // The one-call shortcuts of the SDK UI artifact: fetch, pick by type and show.
+        TextField selector = new TextField();
+        selector.setPromptText("widget ID, name or tag (optional)");
+        Button nps = new Button("Present NPS");
+        nps.setOnAction(e -> presentByType("NPS", selector.getText().trim()));
+        Button survey = new Button("Present Survey");
+        survey.setOnAction(e -> presentByType("Survey", selector.getText().trim()));
+        Button rating = new Button("Present Rating");
+        rating.setOnAction(e -> presentByType("Rating", selector.getText().trim()));
+
+        Label quickLabel = new Label("Quick calls");
+        quickLabel.getStyleClass().add("section-title");
+        HBox quickRow = new HBox(6, nps, survey, rating);
+        quickRow.setAlignment(javafx.geometry.Pos.CENTER_LEFT);
+
+        leftBox.getChildren().addAll(headerRow, quickLabel, selector, quickRow, cardList);
 
         ScrollPane leftScroll = new ScrollPane(leftBox);
         leftScroll.setFitToWidth(true);
@@ -164,7 +182,8 @@ private void refreshCards() {
             cardList.getChildren().add(new WidgetCard(w, wv,
                 widget -> openWidget(widget, wv),
                 this::inspectWidget,
-                this::openManualReportDialog));
+                this::openManualReportDialog,
+                this::presentWithSdkUi));
         }
     }
 
@@ -213,6 +232,45 @@ private void showPlaceholder(String text) {
         webView.setVisible(false);
     }
 
+    // ------------------- Quick calls of the SDK UI artifact -------------------
+
+    private void presentByType(String type, String nameIDorTag) {
+        if (!SdkUtil.requireSdk(log)) {
+            return;
+        }
+        log.info("[Widget] present" + type + " nameIDorTag:[" + nameIDorTag + "]");
+        Window owner = root.getScene() == null ? null : root.getScene().getWindow();
+        Runnable onClosed = () -> log.info("[Widget] " + type + " card was dismissed");
+
+        switch (type) {
+            case "NPS":
+                CountlyWebView.presentNPS(owner, nameIDorTag, onClosed);
+                break;
+            case "Survey":
+                CountlyWebView.presentSurvey(owner, nameIDorTag, onClosed);
+                break;
+            default:
+                CountlyWebView.presentRating(owner, nameIDorTag, onClosed);
+                break;
+        }
+    }
+
+    // ------------------- Presentation by the SDK UI artifact -------------------
+
+    /**
+     * Hands the widget to {@code sdk-java-ui}, which builds the URL, drives the card and reports the
+     * dismissal itself. The panel above stays as the hand rolled reference implementation.
+     */
+    private void presentWithSdkUi(CountlyFeedbackWidget widget) {
+        if (!SdkUtil.requireSdk(log)) {
+            return;
+        }
+        log.info("[Widget] Presenting " + widget.widgetId + " with the SDK UI artifact");
+        Window owner = root.getScene() == null ? null : root.getScene().getWindow();
+        CountlyWebView.presentFeedbackWidget(owner, widget,
+            () -> log.info("[Widget] SDK UI card for " + widget.widgetId + " was dismissed"));
+    }
+
     // ------------------- Inspect widget data -------------------
     private void inspectWidget(CountlyFeedbackWidget widget) {
         if (!SdkUtil.requireSdk(log)) return;
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/ui/InitPane.java b/app-javafx/src/main/java/ly/count/javafx/demo/ui/InitPane.java
index d46ecb6f8..2234a9487 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/ui/InitPane.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/ui/InitPane.java
@@ -21,6 +21,7 @@
 import ly.count.javafx.demo.AppContext;
 import ly.count.sdk.java.Config;
 import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.ui.CountlyWebView;
 
 public class InitPane {
 
@@ -49,6 +50,9 @@ public class InitPane {
     private final CheckBox disableUnhandledCrash = new CheckBox("Disable unhandled crash reporting");
     private final CheckBox disableAutoUserProps = new CheckBox("Disable auto-send user properties");
     private final CheckBox disableLocationBox = new CheckBox("Disable location tracking");
+    // Belongs on this screen because it is a one time setting: it is applied with init and ignored
+    // afterwards, so a checkbox anywhere else would be a switch that does nothing.
+    private final CheckBox widgetsWithinApp = new CheckBox("Show widgets and content within the app window");
 
     // Numeric / tuning fields
     private final TextField eventQueueSizeField = new TextField();
@@ -165,7 +169,8 @@ private VBox buildFeatures() {
     private VBox buildFlags() {
         HBox col1 = new HBox(20, new VBox(4, requiresConsent, backendMode, forcePost));
         VBox rcBox = new VBox(4, autoRcTriggers, rcCaching, rcAutoEnroll);
-        VBox disableBox = new VBox(4, disableUnhandledCrash, disableAutoUserProps, disableLocationBox);
+        VBox disableBox = new VBox(4, disableUnhandledCrash, disableAutoUserProps, disableLocationBox,
+            widgetsWithinApp);
         HBox row = new HBox(30, col1, rcBox, disableBox);
         row.setPadding(new Insets(2, 0, 0, 0));
         return new VBox(row);
@@ -209,6 +214,9 @@ private void initSdk() {
                 .setLoggingLevel(loggingLevelBox.getValue())
                 .setLogListener((msg, lvl) -> log.sdk("[" + lvl + "] " + msg));
 
+            config.content.setGlobalContentCallback((status, data) ->
+                log.info("[Content] callback: " + status + " " + data));
+
             Config.Feature[] selected = selectedFeatures();
             if (selected.length > 0) {
                 config.setFeatures(selected);
@@ -273,6 +281,10 @@ private void initSdk() {
             applyIntField(netRequestCooldownField, "network request cooldown", config::setNetworkRequestCooldown);
             applyIntField(netImportantCooldownField, "important request cooldown", config::setNetworkImportantRequestCooldown);
 
+            // A UI artifact setting rather than a Config one, and it only takes once, so it goes
+            // in with init.
+            CountlyWebView.setShowWidgetsWithinApp(widgetsWithinApp.isSelected());
+
             Countly.instance().init(config);
 
             // Cache credentials so the feedback pane can hit the server directly
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/ui/MainView.java b/app-javafx/src/main/java/ly/count/javafx/demo/ui/MainView.java
index f0f444df8..13922939f 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/ui/MainView.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/ui/MainView.java
@@ -32,7 +32,8 @@ public MainView() {
             tab("Crashes",        new CrashesPane(logPanel).getRoot()),
             tab("Device ID",      new DeviceIdPane(logPanel, statusLabel).getRoot()),
             tab("Remote Config",  new RemoteConfigPane(logPanel).getRoot()),
-            tab("Feedback Widgets", new FeedbackWidgetsPane(logPanel).getRoot())
+            tab("Feedback Widgets", new FeedbackWidgetsPane(logPanel).getRoot()),
+            tab("Content",        new ContentPane(logPanel).getRoot())
         );
 
         SplitPane split = new SplitPane();
diff --git a/app-javafx/src/main/java/ly/count/javafx/demo/ui/WidgetCard.java b/app-javafx/src/main/java/ly/count/javafx/demo/ui/WidgetCard.java
index aefa0bbff..f3bd899bc 100644
--- a/app-javafx/src/main/java/ly/count/javafx/demo/ui/WidgetCard.java
+++ b/app-javafx/src/main/java/ly/count/javafx/demo/ui/WidgetCard.java
@@ -16,7 +16,8 @@ public WidgetCard(CountlyFeedbackWidget widget,
                       String widgetVersion,
                       Consumer<CountlyFeedbackWidget> onOpen,
                       Consumer<CountlyFeedbackWidget> onInspect,
-                      Consumer<CountlyFeedbackWidget> onManualReport) {
+                      Consumer<CountlyFeedbackWidget> onManualReport,
+                      Consumer<CountlyFeedbackWidget> onPresentWithSdkUi) {
         getStyleClass().add("widget-card");
         setPadding(new Insets(10));
         setSpacing(4);
@@ -53,7 +54,10 @@ public WidgetCard(CountlyFeedbackWidget widget,
         javafx.scene.control.Button manual = new javafx.scene.control.Button("Report manually");
         manual.setOnAction(e -> onManualReport.accept(widget));
 
-        HBox actions = new HBox(6, open, inspect, manual);
+        javafx.scene.control.Button sdkUi = new javafx.scene.control.Button("Present (SDK UI)");
+        sdkUi.setOnAction(e -> onPresentWithSdkUi.accept(widget));
+
+        HBox actions = new HBox(6, open, sdkUi, inspect, manual);
         actions.setPadding(new Insets(6, 0, 0, 0));
 
         getChildren().addAll(badgeRow, nameLabel, idLabel, tagsLabel, actions);
diff --git a/build.gradle b/build.gradle
index e18483f6e..b8f1479b3 100644
--- a/build.gradle
+++ b/build.gradle
@@ -5,13 +5,31 @@ buildscript {
     google()
     mavenCentral()
   }
+  dependencies {
+    // The publish plugin is loaded here, once, and only when a publish task is requested. Loading it
+    // from each module's own buildscript gave every module its own copy of the plugin classes, and
+    // the plugin's shared Sonatype build service then failed with "cannot set property buildService
+    // ... loaded with a different classloader" as soon as two modules published in one build.
+    if (gradle.startParameter.taskNames.any { it.toLowerCase().contains("publish") }) {
+      // This requires minimum java 11 to work
+      classpath 'com.vanniktech:gradle-maven-publish-plugin:0.28.0'
+    }
+  }
 }
 
 allprojects {
-  ext.CLY_VERSION = "24.1.6"
+  ext.CLY_VERSION = "26.8.0"
   ext.POWERMOCK_VERSION = "1.7.4"
+  ext.JACOCO_VERSION = "0.8.13"
+
+  // Without this the compiler uses the platform default, which is windows-1252 on the Windows
+  // runner and fails on any non-ASCII character in a source file.
+  tasks.withType(JavaCompile) {
+    options.encoding = 'UTF-8'
+  }
 
   tasks.withType(Javadoc) {
+    options.encoding = 'UTF-8'
     options.addStringOption('Xdoclint:none', '-quiet')
   }
   repositories {
@@ -19,3 +37,133 @@ allprojects {
     mavenCentral()
   }
 }
+
+// ---------------------------------------------------------------------------
+// Coverage
+//
+// The library modules apply the jacoco plugin themselves (see their build.gradle).
+// "./gradlew coverage" runs their tests, writes HTML + XML reports and prints a
+// per-module summary, so the numbers do not have to be dug out of the reports.
+// ---------------------------------------------------------------------------
+
+// Only the published libraries are measured; the demo apps are not shipped.
+ext.COVERED_MODULES = [':sdk-java', ':sdk-java-ui']
+
+// Measuring coverage must not be blocked by a flaky test: the jacoco agent adds a large
+// wall-clock overhead, which is exactly what tips the SDK's few Thread.sleep based duration
+// assertions over their tolerance. So under "coverage" the test tasks are allowed to fail, the
+// report is still produced, and the summary reports how many tests failed. A plain
+// "./gradlew test" is untouched and still fails the build.
+gradle.taskGraph.whenReady { graph ->
+  if (!graph.allTasks.any { it.path == ':coverage' }) {
+    return
+  }
+  COVERED_MODULES.each { path ->
+    def module = findProject(path)
+    if (module != null) {
+      module.tasks.withType(Test).each { it.ignoreFailures = true }
+    }
+  }
+}
+
+tasks.register('coverage') {
+  group = 'verification'
+  description = 'Runs the tests of every published module and prints a line and branch coverage summary.'
+
+  // sdk-java-ui only exists on Java 11+, so resolve against the projects that are actually included.
+  def reportTasks = COVERED_MODULES
+    .findAll { findProject(it) != null }
+    .collect { "${it}:jacocoTestReport" }
+  dependsOn reportTasks
+
+  doLast {
+    println ''
+    println 'Coverage (jacoco)'
+    println '-'.multiply(64)
+    printf('%-16s %18s %18s%n', 'module', 'lines', 'branches')
+
+    COVERED_MODULES.each { path ->
+      def module = findProject(path)
+      if (module == null) {
+        printf('%-16s %18s %18s%n', path - ':', 'not included', '')
+        return
+      }
+
+      def report = new File(module.layout.buildDirectory.get().asFile, 'reports/jacoco/test/jacocoTestReport.xml')
+      if (!report.exists()) {
+        printf('%-16s %18s %18s%n', path - ':', 'no report', '')
+        return
+      }
+
+      def counters = readCounters(report)
+      printf('%-16s %18s %18s%n', path - ':', format(counters['LINE']), format(counters['BRANCH']))
+    }
+
+    println '-'.multiply(64)
+    COVERED_MODULES.findAll { findProject(it) != null }.each { path ->
+      def buildDir = findProject(path).layout.buildDirectory.get().asFile
+      println "HTML: ${buildDir}/reports/jacoco/test/html/index.html"
+    }
+
+    int failed = COVERED_MODULES
+      .findAll { findProject(it) != null }
+      .sum { countFailedTests(findProject(it)) } ?: 0
+    if (failed > 0) {
+      println ''
+      println "WARNING: ${failed} test(s) failed. The coverage numbers above still cover the whole run,"
+      println '         but read the test report before trusting them.'
+    }
+    println ''
+  }
+}
+
+/**
+ * Counts failures and errors across a module's JUnit XML results.
+ */
+ext.countFailedTests = { module ->
+  def resultsDir = new File(module.layout.buildDirectory.get().asFile, 'test-results/test')
+  if (!resultsDir.isDirectory()) {
+    return 0
+  }
+
+  int failed = 0
+  resultsDir.listFiles({ file -> file.name.endsWith('.xml') } as FileFilter)?.each { file ->
+    try {
+      def suite = new XmlParser(false, false).parse(file)
+      failed += (suite.@failures as int) + (suite.@errors as int)
+    } catch (Exception ignored) {
+      // An unreadable result file is not worth failing the summary over.
+    }
+  }
+  return failed
+}
+
+/**
+ * Reads the report level counters out of a jacoco XML report.
+ *
+ * The report declares a DOCTYPE pointing at a remote DTD; loading it would make the
+ * build depend on the network, so external entities are switched off.
+ */
+ext.readCounters = { File report ->
+  def parser = new XmlParser(false, false)
+  parser.setFeature('http://apache.org/xml/features/disallow-doctype-decl', false)
+  parser.setFeature('http://apache.org/xml/features/nonvalidating/load-external-dtd', false)
+
+  def root = parser.parse(report)
+  def counters = [:]
+  root.counter.each { counter ->
+    counters[counter.@type] = [missed: counter.@missed as int, covered: counter.@covered as int]
+  }
+  return counters
+}
+
+ext.format = { counter ->
+  if (counter == null) {
+    return 'n/a'
+  }
+  int total = counter.missed + counter.covered
+  if (total == 0) {
+    return 'n/a'
+  }
+  return String.format('%.1f%% (%d/%d)', counter.covered * 100.0d / total, counter.covered, total)
+}
diff --git a/gradle.properties b/gradle.properties
index 514bec16c..a5a8126c6 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -18,7 +18,7 @@
 # org.gradle.parallel=true
 
 # RELEASE FIELD SECTION
-VERSION_NAME=24.1.6
+VERSION_NAME=26.8.0
 GROUP=ly.count.sdk
 
 POM_URL=https://github.com/Countly/countly-sdk-java
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index e708b1c02..1b33c55ba 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index fae08049a..4f5eb9dcc 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index 4f906e0c8..23d15a936 100755
--- a/gradlew
+++ b/gradlew
@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh
 
 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,81 +15,115 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+CLASSPATH="\\\"\\\""
 
 
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -98,88 +132,120 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
 fi
 
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
 # For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
     # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
         fi
-        i=`expr $i + 1`
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
     done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
 fi
 
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
 
 exec "$JAVACMD" "$@"
diff --git a/gradlew.bat b/gradlew.bat
index ac1b06f93..5eed7ee84 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -13,8 +13,10 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 @rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
 
-@if "%DEBUG%" == "" @echo off
+@if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
 @rem  Gradle startup script for Windows
@@ -25,7 +27,8 @@
 if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,13 +43,13 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -56,32 +59,34 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
 :execute
 @rem Setup the command line
 
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+set CLASSPATH=
 
 
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal
diff --git a/sdk-java-ui/README.md b/sdk-java-ui/README.md
new file mode 100644
index 000000000..1d6b8897d
--- /dev/null
+++ b/sdk-java-ui/README.md
@@ -0,0 +1,136 @@
+# Countly Java SDK UI
+
+JavaFX user interface for the [Countly Java SDK](https://github.com/Countly/countly-sdk-java). It
+renders **Feedback Widgets** (Surveys, NPS, Ratings) and the **Content** feature on the desktop. It
+is a thin companion to the core `java` artifact: the core drives analytics, this artifact only
+displays.
+
+Published separately, so an application that does not show anything on screen, a backend service for
+example, never pulls JavaFX in.
+
+## Requirements
+
+- Java 17 or newer. The core SDK still runs on Java 8; JavaFX is what raises the floor here.
+- JavaFX 21 or newer, with the `javafx.controls` and `javafx.web` modules. JavaFX 20 is the first
+  release with a public API for a transparent web view background (`WebView.setPageFill`), which the
+  content overlay needs in order to float over your application rather than sit in an opaque box.
+- The `ly.count.sdk:java` core artifact, which comes in as a dependency of this one.
+
+## Installation
+
+Replace `LATEST_VERSION` with the version published on
+[Maven Central](https://central.sonatype.com/artifact/ly.count.sdk/java-ui).
+
+Gradle:
+
+```groovy
+dependencies {
+  implementation 'ly.count.sdk:java-ui:LATEST_VERSION'
+}
+```
+
+Maven:
+
+```xml
+<dependency>
+  <groupId>ly.count.sdk</groupId>
+  <artifactId>java-ui</artifactId>
+  <version>LATEST_VERSION</version>
+</dependency>
+```
+
+## Usage
+
+Initialize the core SDK as usual, then reach for `CountlyWebView`.
+
+### Feedback widgets
+
+The quick calls fetch the widget list, pick the widget you asked for and show it:
+
+```java
+CountlyWebView.presentNPS(stage);
+CountlyWebView.presentSurvey(stage, "onboarding");
+CountlyWebView.presentRating(stage, "", () -> System.out.println("dismissed"));
+```
+
+The second argument is a widget ID, a widget name or one of the widget's tags. Leave it out, or pass
+an empty string, to take the first available widget of that type. These are safe to call from any
+thread; the card is shown on the JavaFX application thread once the list arrives.
+
+To pick the widget yourself:
+
+```java
+Countly.instance().feedback().getAvailableFeedbackWidgets((widgets, error) -> {
+    if (error != null || widgets.isEmpty()) {
+        return;
+    }
+    // Must run on the JavaFX application thread.
+    Platform.runLater(() -> CountlyWebView.presentFeedbackWidget(stage, widgets.get(0), null));
+});
+```
+
+The card takes the size the widget asks for, and is anchored the way that widget type is anchored on
+the web: an NPS at the bottom centre, a survey at the bottom left or bottom right per its
+`appearance.position`, and a rating as a centred card.
+
+By default both widget cards and content blocks are laid out inside the application window, as a
+child window that follows it. To lay them out over the work area of the screen the application is on
+instead, set this once before showing anything:
+
+```java
+CountlyWebView.setShowWidgetsWithinApp(false);
+```
+
+Inside the window, a block that covers the whole window is clipped to rounded corners; match the
+radius to your window with `CountlyWebView.setOverlayCornerRadius(radius)`, or pass `0` for square
+windows.
+
+### Content
+
+```java
+Config config = new Config(serverUrl, appKey, storageDir)
+    .enableFeatures(Config.Feature.Content);
+config.content.setZoneTimerInterval(30);
+config.content.setGlobalContentCallback((status, data) -> System.out.println(status));
+
+Countly.instance().init(config);
+
+CountlyWebView.enableContentZone();
+// ...
+CountlyWebView.disableContentZone();
+```
+
+Content interactions, the events it records, external links, resizes and closes, are handled for
+you. Recorded events are pushed to the server straight away, so it can react to them.
+
+Content is placed on the screen your application window is on, and follows it if the window is
+dragged to another monitor. Pass a window explicitly when your application has more than one and you
+want content pinned to a particular one:
+
+```java
+CountlyWebView.enableContentZone(myWindow);
+```
+
+The content window is transparent, so the block appears as soon as its page draws. A page that fails
+to load, or does not load within 20 seconds, is abandoned and the zone resumes fetching. Only one
+widget or content block is shown at a time; a second one asked for meanwhile is reported closed at
+once.
+
+Content is an **experimental** feature and its API can change.
+
+### Your own display
+
+`CountlyWebView` is a convenience. To render content with a different toolkit, implement
+`ly.count.sdk.java.internal.ContentDisplay` and register it yourself:
+
+```java
+Countly.instance().content().setContentDisplay(myDisplay);
+Countly.instance().content().enterContentZone();
+```
+
+A display must call the `onClosed` callback it is handed exactly once, including when it fails to
+show anything, otherwise the content zone never resumes fetching.
+
+## License
+
+MIT, see the [LICENSE](https://github.com/Countly/countly-sdk-java/blob/master/LICENSE).
diff --git a/sdk-java-ui/build.gradle b/sdk-java-ui/build.gradle
new file mode 100644
index 000000000..5d0a2ad9e
--- /dev/null
+++ b/sdk-java-ui/build.gradle
@@ -0,0 +1,99 @@
+plugins {
+  id 'java-library'
+  id 'org.openjfx.javafxplugin' version '0.1.0'
+}
+
+//
+// No Monocle. The headless JavaFX platform cost four separate failures: Monocle 11 threw
+// AbstractMethodError against JavaFX 17, Monocle 17 crashed the JVM against JavaFX 21, Monocle 21 is
+// Java 21 bytecode so it needed a newer test JVM, and once that was solved JavaFX 21's WebKit
+// segfaulted on every platform the moment a real page was loaded (verified on macOS, Linux and
+// Windows). The tests now use the real toolkit, which is far better exercised; CI gives Linux a
+// display with xvfb.
+tasks.withType(Test) {
+  // A widget or content link would otherwise be handed to the real system browser while tests run.
+  systemProperty 'java.awt.headless', 'true'
+
+  // One JVM per test class. JavaFX cannot be restarted inside a process, so every class that needs
+  // the toolkit shares one, and WebKit does not survive that: each page loading class passes on its
+  // own, but running two in the same JVM segfaults libjfxwebkit. Forking per class is what makes
+  // them runnable at all.
+  forkEvery = 1
+
+
+  // Forwarded explicitly. "./gradlew -Dcountly.ui.pageLoadTests=true" sets the property on the
+  // Gradle daemon, NOT on the forked test JVM, so without this line the toolkit dependent tests
+  // silently skipped even in the CI job that passes the flag, and this module's reported coverage
+  // was about a third of what it should be.
+  systemProperty 'countly.ui.pageLoadTests', System.getProperty('countly.ui.pageLoadTests', 'false')
+  // The scenario driver: a real server and a desktop session, so never on by default. A -D on the
+  // gradle command line does not reach a forked test JVM by itself, hence the forwarding.
+  systemProperty 'countly.ui.scenarios', System.getProperty('countly.ui.scenarios', 'false')
+  systemProperty 'countly.ui.scenarioServer', System.getProperty('countly.ui.scenarioServer', 'https://master.count.ly')
+  systemProperty 'countly.ui.scenarioAppKey', System.getProperty('countly.ui.scenarioAppKey', 'dte_mobile_v2')
+  systemProperty 'countly.ui.scenarioOut', System.getProperty('countly.ui.scenarioOut', "$buildDir/scenarios")
+  systemProperty 'countly.ui.scenarioWithinApp', System.getProperty('countly.ui.scenarioWithinApp', 'false')
+}
+
+// The maven publish plugin is put on the classpath by the root build.gradle, so that every module
+// shares one copy of it.
+
+
+// Java 17, not 11. JavaFX only gained a public API for a transparent web view background
+// (WebView.setPageFill) in version 20, and JavaFX 20+ requires Java 17. Without it the only
+// lever is a com.sun.webkit internal reached by reflection, which needs --add-exports from
+// every integrator and renders the empty area opaque black rather than see-through.
+//
+// A toolchain rather than sourceCompatibility, so this module still builds when the Gradle
+// daemon itself is running on an older JDK. The core SDK stays on Java 8 regardless.
+java {
+  toolchain {
+    languageVersion = JavaLanguageVersion.of(17)
+  }
+}
+
+javafx {
+  version = '21.0.5'
+  modules = ['javafx.controls', 'javafx.web']
+}
+
+dependencies {
+  // 'api' so a consumer of this artifact also gets the core SDK, whose types
+  // appear in this package's public signatures.
+  api project(':sdk-java')
+
+  implementation 'org.json:json:20250517'
+
+  testImplementation 'junit:junit:4.13.1'
+  testImplementation 'org.mockito:mockito-core:4.11.0'
+}
+
+// Coverage. Reports land in build/reports/jacoco/test/ (HTML to read, XML for tooling).
+// "./gradlew coverage" from the repo root runs this and prints a summary.
+apply plugin: 'jacoco'
+
+jacoco {
+  toolVersion = JACOCO_VERSION
+}
+
+// Experiment hook: -PnoJacoco=true detaches the coverage agent from the test JVM, to tell a JVM
+// crash caused by the agent apart from one caused by the code under test.
+if (project.hasProperty('noJacoco')) {
+  tasks.withType(Test).configureEach {
+    jacoco.enabled = false
+  }
+}
+
+jacocoTestReport {
+  dependsOn test
+
+  reports {
+    html.required = true
+    xml.required = true
+    csv.required = false
+  }
+}
+
+if (gradle.startParameter.taskNames.any { it.toLowerCase().contains("publish") }) {
+  apply plugin: "com.vanniktech.maven.publish"
+}
diff --git a/sdk-java-ui/gradle.properties b/sdk-java-ui/gradle.properties
new file mode 100644
index 000000000..980570f36
--- /dev/null
+++ b/sdk-java-ui/gradle.properties
@@ -0,0 +1,6 @@
+#RELEASE FIELDS
+POM_ARTIFACT_ID=java-ui
+
+POM_NAME=Countly Java SDK UI
+POM_DESCRIPTION=JavaFX user interface for the Countly Java SDK, displaying feedback widgets and content
+POM_INCEPTION_YEAR=2026
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ContentJsBridge.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ContentJsBridge.java
new file mode 100644
index 000000000..5951cf9eb
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ContentJsBridge.java
@@ -0,0 +1,56 @@
+package ly.count.sdk.java.ui;
+
+import java.util.function.Consumer;
+import ly.count.sdk.java.internal.WidgetAction;
+
+/**
+ * Handed into a content page so a survey served through the content queue can reach Java.
+ * <p>
+ * A content block signals by navigating to the action URL, which the display intercepts. A survey
+ * or NPS template hosted by the content queue is a different page: it signals its size and its close
+ * the way every widget template does, with {@code window.parent.postMessage}, and never navigates.
+ * Without this, a survey inside a content block could not resize or close itself.
+ * <p>
+ * Must be public, with public methods, for the JavaFX web engine to call it - and it has to be kept
+ * in a field by whoever installs it, because the engine only holds it weakly.
+ */
+public class ContentJsBridge {
+
+    static final String MEMBER_NAME = "countlyContentBridge";
+
+    /** Forwards every {@code cly_widget_command} message the page receives. Guarded against reinstall. */
+    static final String INSTALL_SCRIPT =
+        "(function(){if(window.__clyContentBridgeInstalled){return 'already installed';}"
+            + "window.__clyContentBridgeInstalled=true;"
+            + "var bridge=window." + MEMBER_NAME + ";"
+            + "window.addEventListener('message',function(ev){try{"
+            + "var d=typeof ev.data==='string'?JSON.parse(ev.data):ev.data;"
+            + "if(d&&d.cly_widget_command){bridge.post(JSON.stringify(d));}"
+            + "}catch(e){}});"
+            + "return 'installed';})();";
+
+    private final Consumer<WidgetAction> onAction;
+
+    ContentJsBridge(Consumer<WidgetAction> onAction) {
+        this.onAction = onAction;
+    }
+
+    /**
+     * Called from JavaScript.
+     *
+     * @param json the payload the page posted
+     */
+    public void post(String json) {
+        if (onAction == null) {
+            return;
+        }
+        try {
+            WidgetAction action = WidgetMessageParser.parse(json);
+            if (action != null) {
+                onAction.accept(action);
+            }
+        } catch (Throwable t) {
+            UiLog.e("[ContentJsBridge] post, failed to handle a page message, [" + t + "]");
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/CountlyWebView.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/CountlyWebView.java
new file mode 100644
index 000000000..d31f6fa88
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/CountlyWebView.java
@@ -0,0 +1,460 @@
+package ly.count.sdk.java.ui;
+
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.application.Platform;
+import javafx.beans.value.ChangeListener;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.Window;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.FeedbackWidgetSelector;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import ly.count.sdk.java.internal.ModuleContent;
+import ly.count.sdk.java.internal.ModuleFeedback;
+
+/**
+ * Entry point for showing Countly feedback widgets and Countly content in a JavaFX application.
+ * <p>
+ * The core SDK stays headless: it fetches and reports, this package draws. Initialize the SDK as
+ * usual, then present a widget or turn the content zone on.
+ *
+ * <pre>
+ * // Feedback widgets, the quick way: fetch, pick and show in one call
+ * CountlyWebView.presentNPS(stage);
+ * CountlyWebView.presentSurvey(stage, "onboarding");
+ * CountlyWebView.presentRating(stage, "", () -&gt; System.out.println("dismissed"));
+ *
+ * // Feedback widgets, picking one yourself
+ * Countly.instance().feedback().getAvailableFeedbackWidgets((widgets, error) -&gt;
+ *     Platform.runLater(() -&gt; CountlyWebView.presentFeedbackWidget(stage, widgets.get(0), null)));
+ *
+ * // Configuration, set once up front: lay widgets and content out inside the application window
+ * CountlyWebView.setShowWidgetsWithinApp(true);
+ *
+ * // Content (experimental)
+ * CountlyWebView.enableContentZone();
+ * CountlyWebView.disableContentZone();
+ * </pre>
+ */
+public final class CountlyWebView {
+
+    /** Inside the application window, matching the other desktop SDKs. */
+    private static final boolean DEFAULT_WITHIN_APP = true;
+
+    private static volatile boolean displayAreaSet = false;
+    private static volatile JavaFxContentDisplay contentDisplay = null;
+    private static volatile Window contentDisplayOwner = null;
+
+    private CountlyWebView() {
+    }
+
+    /**
+     * Lay feedback widget cards and content blocks out inside the application window instead of over
+     * the work area of the screen the application is on. Applies to both.
+     * <p>
+     * Configuration, set once before the first widget or content block: a widget's own layout is
+     * built around one of the two, so moving the goalposts underneath a running application is not
+     * something it can be expected to cope with. Later calls are ignored.
+     * <p>
+     * Defaults to {@code true}, which is what the other desktop SDKs settled on: a card belongs to
+     * the application that asked for it. Pass {@code false} to lay cards and content out against the
+     * work area of the screen the application is on instead.
+     *
+     * @param withinApp {@code true} to keep cards and content inside the application window
+     */
+    public static void setShowWidgetsWithinApp(boolean withinApp) {
+        if (displayAreaSet) {
+            UiLog.w("[CountlyWebView] setShowWidgetsWithinApp, this is set once and it already is ["
+                + FxSurfaces.isDisplayWithinApp() + "], ignoring [" + withinApp + "]");
+            return;
+        }
+        displayAreaSet = true;
+        FxSurfaces.setDisplayWithinApp(withinApp);
+    }
+
+    /**
+     * @return whether cards and content are laid out inside the application window
+     */
+    public static boolean isShowingWidgetsWithinApp() {
+        return FxSurfaces.isDisplayWithinApp();
+    }
+
+    /**
+     * Forgets that the setting above was set, so a test can set it again. A one time setting is
+     * one time per process, and tests share one.
+     */
+    static void forgetDisplayAreaForTests() {
+        displayAreaSet = false;
+        FxSurfaces.setDisplayWithinApp(DEFAULT_WITHIN_APP);
+    }
+
+    /**
+     * The corner radius used for a widget or content block that fills the application window.
+     * <p>
+     * Only matters with {@link #setShowWidgetsWithinApp(boolean)}: an overlay is a rectangular window
+     * laid over the application's, so a block that covers it would otherwise paint square corners
+     * past the application's rounded ones. JavaFX cannot read the window's real radius, so the
+     * default is a sensible one; set it to match your window, or to {@code 0} for square windows.
+     *
+     * @param radius the radius in logical pixels
+     */
+    public static void setOverlayCornerRadius(double radius) {
+        FxSurfaces.setOverlayCornerRadius(radius);
+    }
+
+    /**
+     * Log what each page the SDK loads manages to fetch: the bundled WebKit version, images that
+     * failed, and the font loading status. Off by default, because it scripts the page. Switch it on
+     * when a widget or a content block does not look the way it should.
+     *
+     * @param enabled whether to log page diagnostics
+     */
+    public static void setWebViewDiagnosticsEnabled(boolean enabled) {
+        FxSurfaces.setDiagnosticsEnabled(enabled);
+    }
+
+    /**
+     * Show a feedback widget as a borderless card, sized and positioned where the widget asks. Must
+     * be called on the JavaFX application thread.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param widget the widget to show, obtained from
+     *     {@link ModuleFeedback.Feedback#getAvailableFeedbackWidgets}
+     * @param onClosed called once, when the card is gone, may be {@code null}
+     */
+    public static void presentFeedbackWidget(Window owner, CountlyFeedbackWidget widget, Runnable onClosed) {
+        if (!Platform.isFxApplicationThread()) {
+            Platform.runLater(() -> presentFeedbackWidget(owner, widget, onClosed));
+            return;
+        }
+
+        if (widget == null) {
+            UiLog.w("[CountlyWebView] presentFeedbackWidget, no widget was given, ignoring the call");
+            run(onClosed);
+            return;
+        }
+
+        ModuleFeedback.Feedback feedback = Countly.instance().feedback();
+        if (feedback == null) {
+            UiLog.w("[CountlyWebView] presentFeedbackWidget, the feedback interface is not available, ignoring the call");
+            run(onClosed);
+            return;
+        }
+
+        // One card at a time, shared with content: see PresentationLock.
+        String claim = "widget " + widget.widgetId;
+        if (!PresentationLock.tryAcquire(claim)) {
+            run(onClosed);
+            return;
+        }
+        // Whatever ends this presentation - the page closing itself, the window manager, an error
+        // below - frees the screen before the caller hears about it, so the caller may present again
+        // from inside its own callback.
+        Runnable onClosedAndReleased = () -> {
+            PresentationLock.release(claim);
+            run(onClosed);
+        };
+
+        try {
+            FxSurfaces.prewarm();
+            AtomicReference<FeedbackWidgetPresenter> presenterRef = new AtomicReference<>();
+            WidgetSurface surface = resolveSurface(owner);
+            WebView webView = new WebView();
+
+            // Starts as a 1x1 window at the surface origin so the page can load before the widget
+            // tells us how big its card has to be; the presenter shows it once it knows. Transparent
+            // and owned or always on top, as FxSurfaces explains.
+            Stage stage = FxSurfaces.newOverlayStage(owner, webView, 1, 1);
+            stage.setX(surface.x);
+            stage.setY(surface.y);
+
+            JavaFxWidgetHost host = new JavaFxWidgetHost(stage, webView, surface);
+            host.initialize();
+
+            FeedbackWidgetPresenter presenter = new FeedbackWidgetPresenter(host, feedback,
+                followWindow(owner, host, presenterRef, onClosedAndReleased));
+            presenterRef.set(presenter);
+            // A card hidden by anything other than the SDK - its owner window closing and taking it
+            // along, the integrator calling hide() - must still free the screen and tell the caller,
+            // or every later widget and block is refused as "already being shown". The presenter's
+            // own finish() runs first on the SDK's paths and makes this a no-op there.
+            stage.setOnHidden(event -> presenter.dismissedExternally());
+            presenter.start(widget);
+        } catch (Throwable t) {
+            UiLog.e("[CountlyWebView] presentFeedbackWidget, could not show the widget, [" + t + "]");
+            onClosedAndReleased.run();
+        }
+    }
+
+    /**
+     * Show the first available NPS widget.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     */
+    public static void presentNPS(Window owner) {
+        presentNPS(owner, null, null);
+    }
+
+    /**
+     * Show an NPS widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available NPS widget.
+     */
+    public static void presentNPS(Window owner, String nameIDorTag) {
+        presentNPS(owner, nameIDorTag, null);
+    }
+
+    /**
+     * Show an NPS widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available NPS widget.
+     * @param onClosed called once, when the card is gone, may be {@code null}
+     */
+    public static void presentNPS(Window owner, String nameIDorTag, Runnable onClosed) {
+        presentWidgetOfType(owner, FeedbackWidgetType.nps, nameIDorTag, onClosed);
+    }
+
+    /**
+     * Show the first available survey widget.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     */
+    public static void presentSurvey(Window owner) {
+        presentSurvey(owner, null, null);
+    }
+
+    /**
+     * Show a survey widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available survey widget.
+     */
+    public static void presentSurvey(Window owner, String nameIDorTag) {
+        presentSurvey(owner, nameIDorTag, null);
+    }
+
+    /**
+     * Show a survey widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available survey widget.
+     * @param onClosed called once, when the card is gone, may be {@code null}
+     */
+    public static void presentSurvey(Window owner, String nameIDorTag, Runnable onClosed) {
+        presentWidgetOfType(owner, FeedbackWidgetType.survey, nameIDorTag, onClosed);
+    }
+
+    /**
+     * Show the first available rating widget.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     */
+    public static void presentRating(Window owner) {
+        presentRating(owner, null, null);
+    }
+
+    /**
+     * Show a rating widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available rating widget.
+     */
+    public static void presentRating(Window owner, String nameIDorTag) {
+        presentRating(owner, nameIDorTag, null);
+    }
+
+    /**
+     * Show a rating widget picked by its ID, name or one of its tags.
+     *
+     * @param owner the application window the card belongs to, may be {@code null}
+     * @param nameIDorTag the widget ID, widget name or widget tag to look for. Leave it empty to take
+     *     the first available rating widget.
+     * @param onClosed called once, when the card is gone, may be {@code null}
+     */
+    public static void presentRating(Window owner, String nameIDorTag, Runnable onClosed) {
+        presentWidgetOfType(owner, FeedbackWidgetType.rating, nameIDorTag, onClosed);
+    }
+
+    /**
+     * Fetches the widget list, picks the one asked for, and shows it. The fetch is a network call, so
+     * this returns straight away and the card appears later.
+     */
+    private static void presentWidgetOfType(Window owner, FeedbackWidgetType type, String nameIDorTag, Runnable onClosed) {
+        ModuleFeedback.Feedback feedback = Countly.instance().feedback();
+        if (feedback == null) {
+            UiLog.w("[CountlyWebView] present" + type.name() + ", the feedback interface is not available, ignoring the call");
+            run(onClosed);
+            return;
+        }
+
+        feedback.getAvailableFeedbackWidgets((widgets, error) -> {
+            // This callback runs on the SDK's network thread. The happy path hands the callback back
+            // on the JavaFX thread, so these bail outs do the same and the caller only ever sees one.
+            if (error != null) {
+                UiLog.e("[CountlyWebView] present" + type.name() + ", could not retrieve the widget list, [" + error + "]");
+                runOnFxThread(onClosed);
+                return;
+            }
+
+            CountlyFeedbackWidget widget = FeedbackWidgetSelector.select(widgets, type, nameIDorTag);
+            if (widget == null) {
+                UiLog.w("[CountlyWebView] present" + type.name() + ", no widget of that type matches [" + nameIDorTag + "]");
+                runOnFxThread(onClosed);
+                return;
+            }
+
+            // The fetch completed off the JavaFX thread; presentFeedbackWidget hops back on its own.
+            presentFeedbackWidget(owner, widget, onClosed);
+        });
+    }
+
+    /**
+     * Register the JavaFX content display with the SDK and enter the content zone. Must be called on
+     * the JavaFX application thread, after the SDK was initialized with
+     * {@code Config.Feature.Content} enabled.
+     *
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public static void enableContentZone() {
+        enableContentZone(null);
+    }
+
+    /**
+     * Register the JavaFX content display with the SDK and enter the content zone, placing content on
+     * the screen the given window is on. Must be called on the JavaFX application thread, after the
+     * SDK was initialized with {@code Config.Feature.Content} enabled.
+     *
+     * @param owner the application window content should follow. Pass {@code null} to follow the
+     *     application's focused window, which is what most applications want.
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public static void enableContentZone(Window owner) {
+        if (!Platform.isFxApplicationThread()) {
+            Platform.runLater(() -> enableContentZone(owner));
+            return;
+        }
+
+        ModuleContent.Content content = Countly.instance().content();
+        if (content == null) {
+            UiLog.w("[CountlyWebView] enableContentZone, the content interface is not available, ignoring the call");
+            return;
+        }
+
+        Window window = owner != null ? owner : FxSurfaces.primaryApplicationWindow();
+
+        // The display listens to its window to follow it across monitors, so a different window
+        // needs a different display.
+        if (contentDisplay == null || contentDisplayOwner != window) {
+            contentDisplay = new JavaFxContentDisplay(window);
+            contentDisplayOwner = window;
+        }
+
+        content.setContentDisplay(contentDisplay);
+        content.enterContentZone();
+    }
+
+    /**
+     * Leave the content zone. A content block that is already on screen stays there, so the user
+     * can finish with it.
+     *
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public static void disableContentZone() {
+        ModuleContent.Content content = Countly.instance().content();
+        if (content == null) {
+            UiLog.w("[CountlyWebView] disableContentZone, the content interface is not available, ignoring the call");
+            return;
+        }
+        content.exitContentZone();
+    }
+
+    /**
+     * Keeps a card with the window it belongs to: a window that is moved, resized, or dragged to
+     * another monitor takes its card with it, rather than leaving it stranded where the window used
+     * to be. The listeners are removed when the card closes, so a long lived application window does
+     * not collect one set per widget it ever showed.
+     *
+     * @param owner the window to follow, may be {@code null}
+     * @param host the host whose surface to keep current
+     * @param presenterRef where the presenter will be, once it exists
+     * @param onClosed the caller's own callback, may be {@code null}
+     * @return the callback to hand the presenter
+     */
+    private static Runnable followWindow(Window owner, JavaFxWidgetHost host,
+        AtomicReference<FeedbackWidgetPresenter> presenterRef, Runnable onClosed) {
+        if (owner == null) {
+            return onClosed;
+        }
+
+        ChangeListener<Number> moved = (observable, was, now) -> {
+            host.setSurface(resolveSurface(owner));
+            FeedbackWidgetPresenter presenter = presenterRef.get();
+            if (presenter != null) {
+                presenter.refreshPlacement();
+            }
+        };
+        owner.xProperty().addListener(moved);
+        owner.yProperty().addListener(moved);
+        owner.widthProperty().addListener(moved);
+        owner.heightProperty().addListener(moved);
+
+        return () -> {
+            owner.xProperty().removeListener(moved);
+            owner.yProperty().removeListener(moved);
+            owner.widthProperty().removeListener(moved);
+            owner.heightProperty().removeListener(moved);
+            run(onClosed);
+        };
+    }
+
+    private static WidgetSurface resolveSurface(Window owner) {
+        Window window = owner != null ? owner : FxSurfaces.primaryApplicationWindow();
+        WidgetSurface surface = FxSurfaces.surfaceFor(window);
+
+        // Which monitor a card lands on is the application window's, so when a card is reported as
+        // not showing up, the first thing worth knowing is where the SDK thought that window was.
+        UiLog.d("[CountlyWebView] resolveSurface, withinApp=" + FxSurfaces.isDisplayWithinApp() + " " + surface
+            + ", owner " + describe(window));
+        return surface;
+    }
+
+    private static String describe(Window window) {
+        if (window == null) {
+            return "none, so the primary screen";
+        }
+        return (window.isShowing() ? "showing" : "not on screen") + " at " + (int) window.getX()
+            + "," + (int) window.getY() + " " + (int) window.getWidth() + "x" + (int) window.getHeight();
+    }
+
+    private static void runOnFxThread(Runnable runnable) {
+        if (runnable == null) {
+            return;
+        }
+        try {
+            Platform.runLater(() -> run(runnable));
+        } catch (Throwable t) {
+            // No toolkit running: better an off thread callback than none at all.
+            UiLog.w("[CountlyWebView] runOnFxThread, the JavaFX toolkit is not running, [" + t + "]");
+            run(runnable);
+        }
+    }
+
+    private static void run(Runnable runnable) {
+        if (runnable == null) {
+            return;
+        }
+        try {
+            runnable.run();
+        } catch (Throwable t) {
+            UiLog.e("[CountlyWebView] run, a callback threw, [" + t + "]");
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ExternalBrowser.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ExternalBrowser.java
new file mode 100644
index 000000000..d79bb29cd
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/ExternalBrowser.java
@@ -0,0 +1,360 @@
+package ly.count.sdk.java.ui;
+
+import java.awt.Desktop;
+import java.awt.GraphicsEnvironment;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import java.util.regex.Pattern;
+import ly.count.sdk.java.internal.ContentUrlHandler;
+import ly.count.sdk.java.internal.SDKCore;
+
+/**
+ * Opens a link the content or a widget asked for, outside the SDK's own web views.
+ * <p>
+ * Supports the system schemes a content block realistically uses ({@code https}, {@code mailto},
+ * {@code tel}, {@code sms}, {@code maps}) as well as an application's own custom scheme
+ * ({@code myapp://...}), because a content block's whole purpose can be to deep link back into the
+ * host application.
+ */
+class ExternalBrowser {
+
+    /**
+     * Schemes that are never opened, matching the Countly Android SDK's list exactly. A link comes
+     * from server-issued content, and content should not be able to make the desktop read a local
+     * file, evaluate a script, or unpack an archive. Kept identical across SDKs on purpose: a
+     * scheme that is unsafe on one platform should not be quietly allowed on another.
+     */
+    private static final Set<String> DANGEROUS_SCHEMES = new HashSet<>(
+        Arrays.asList("file", "content", "javascript", "jar", "zip", "intent", "data"));
+
+    /**
+     * Schemes that name no destination outside the web view, so there is nothing to hand over.
+     * <p>
+     * A web view reports {@code about:blank} as the location of a popup it is still setting up, and
+     * as the page a dismissed card is navigated away to. Handing that to the desktop is not a no-op:
+     * macOS puts up "The application can't be opened: -50" in the user's face.
+     */
+    private static final Set<String> NOT_A_DESTINATION = new HashSet<>(Arrays.asList("about", "blob"));
+
+    /**
+     * Which desktop action a link needs. A {@code mailto:} link opened through the browse action
+     * does not reliably reach a mail client: the mail handler is a separate action, and browsing a
+     * mailto URI is not specified to work at all.
+     */
+    enum Handler {
+        MAIL, BROWSE
+    }
+
+    private ExternalBrowser() {
+    }
+
+    /**
+     * @param url the link to inspect
+     * @return its lower-cased scheme, or {@code null} when it has none
+     */
+    static String schemeOf(String url) {
+        if (url == null) {
+            return null;
+        }
+        String trimmed = url.trim();
+        int colon = trimmed.indexOf(':');
+        if (colon <= 0) {
+            return null;
+        }
+        return trimmed.substring(0, colon).toLowerCase(Locale.ROOT);
+    }
+
+    /**
+     * @param url the link to check
+     * @return {@code true} when the SDK is willing to hand this link to the desktop
+     */
+    static boolean isAllowed(String url) {
+        String scheme = schemeOf(url);
+        // A link with no scheme is not something the desktop can open, and guessing one for it
+        // would be how a relative path becomes a local file read.
+        return scheme != null && !DANGEROUS_SCHEMES.contains(scheme) && !NOT_A_DESTINATION.contains(scheme);
+    }
+
+    /**
+     * @param url the link to open
+     * @return the desktop action that can open it
+     */
+    static Handler handlerFor(String url) {
+        return "mailto".equals(schemeOf(url)) ? Handler.MAIL : Handler.BROWSE;
+    }
+
+    /**
+     * The platform command that opens a URL when {@link Desktop} cannot.
+     * <p>
+     * {@code Desktop} is not guaranteed for anything but {@code http(s)}, and on Linux it is often
+     * reported unsupported entirely, so a custom scheme deep link would silently do nothing. These
+     * launchers hand the URL to the OS handler, which is what registered the scheme in the first
+     * place. Returned as an argument array and run without a shell, so nothing in the URL can be
+     * interpreted as a command.
+     *
+     * @param osName value of the {@code os.name} property
+     * @param url the link to open
+     * @return the command, or {@code null} for an unrecognised platform
+     */
+    static String[] launcherCommandFor(String osName, String url) {
+        String os = osName == null ? "" : osName.toLowerCase(Locale.ROOT);
+        if (os.contains("mac")) {
+            return new String[] { "open", url };
+        }
+        if (os.contains("win")) {
+            // Not "cmd /c start": that goes through the shell, which parses the URL.
+            return new String[] { "rundll32", "url.dll,FileProtocolHandler", url };
+        }
+        if (os.contains("nix") || os.contains("nux") || os.contains("aix")) {
+            return new String[] { "xdg-open", url };
+        }
+        return null;
+    }
+
+    /**
+     * Best effort: a headless JVM has no desktop to open anything on, and a link that cannot be
+     * opened must never take the host application down.
+     *
+     * @param url the link to open
+     * @return {@code true} when the link was handed to the desktop
+     */
+    static boolean open(String url) {
+        if (url == null || url.trim().isEmpty()) {
+            return false;
+        }
+
+        String trimmed = url.trim();
+
+        // The application gets first refusal, before any of the SDK's own policy. An app that
+        // registered a handler owns its deep links entirely, including deciding what is safe to act
+        // on; the scheme rules below govern only what the SDK itself is willing to open.
+        ContentUrlHandler handler = SDKCore.contentUrlHandler();
+        if (handler != null) {
+            try {
+                if (handler.onContentUrl(trimmed)) {
+                    UiLog.d("[ExternalBrowser] open, the application handled " + trimmed);
+                    return true;
+                }
+            } catch (Throwable t) {
+                UiLog.e("[ExternalBrowser] open, the application's URL handler threw, opening it"
+                    + " normally instead, [" + t + "]");
+            }
+        }
+
+        if (!isAllowed(trimmed)) {
+            UiLog.w("[ExternalBrowser] open, refusing to open a link with scheme ["
+                + schemeOf(trimmed) + "]: " + trimmed);
+            return false;
+        }
+
+        // Checked before anything else: in a headless JVM the launcher fallback below would still
+        // spawn a process, which is not something a headless application asked for.
+        if (GraphicsEnvironment.isHeadless()) {
+            UiLog.d("[ExternalBrowser] open, headless, cannot open " + trimmed);
+            return false;
+        }
+
+        // Linux never goes through java.awt.Desktop. Where it is supported at all, its browse is
+        // gnome_url_show underneath, which does not return when called on the JavaFX Application
+        // Thread (the GTK main loop) and holds the AWT lock while it waits: the click froze the
+        // application, no browser appeared and nothing was logged. The launchers below return in
+        // milliseconds from that same thread, so they are the only path there.
+        if (isLinux(System.getProperty("os.name"))) {
+            return openOnLinux(trimmed);
+        }
+
+        if (openWithDesktop(trimmed)) {
+            return true;
+        }
+        return openWithPlatformLauncher(trimmed);
+    }
+
+    private static boolean openWithDesktop(String url) {
+        try {
+            if (!Desktop.isDesktopSupported()) {
+                return false;
+            }
+            Desktop desktop = Desktop.getDesktop();
+            URI uri = new URI(url);
+
+            if (handlerFor(url) == Handler.MAIL && desktop.isSupported(Desktop.Action.MAIL)) {
+                desktop.mail(uri);
+                return true;
+            }
+            if (desktop.isSupported(Desktop.Action.BROWSE)) {
+                desktop.browse(uri);
+                return true;
+            }
+            return false;
+        } catch (Throwable t) {
+            // A custom scheme is the common case here: Desktop refuses it, the launcher takes it.
+            UiLog.d("[ExternalBrowser] openWithDesktop, could not open [" + url + "], [" + t + "]");
+            return false;
+        }
+    }
+
+    private static boolean openWithPlatformLauncher(String url) {
+        String[] command = launcherCommandFor(System.getProperty("os.name"), url);
+        if (command == null) {
+            UiLog.w("[ExternalBrowser] open, no way to open links on this platform: " + url);
+            return false;
+        }
+
+        try {
+            new ProcessBuilder(command).start();
+            return true;
+        } catch (Throwable t) {
+            UiLog.w("[ExternalBrowser] open, the platform launcher could not open [" + url + "], [" + t + "]");
+            return false;
+        }
+    }
+
+    /**
+     * How long a launcher gets to fail before it is taken to have succeeded. {@code xdg-open} and
+     * its relatives exit non-zero within a few tens of milliseconds when they have nothing to hand
+     * the URL to; a launcher that is still running after this has handed it over.
+     */
+    private static final long LAUNCHER_VERDICT_MS = 400;
+
+    /**
+     * Linux has no single way to open a URL. {@code java.awt.Desktop} is out (see {@link #open}: it
+     * hangs the JavaFX thread where it is supported, and is missing where it is not), and
+     * {@code xdg-open} is missing on minimal installs, has no default browser on a fresh desktop,
+     * and cannot reach a browser installed as a snap from some sandboxes. Starting it and calling
+     * that success, as this used to, logged an open that never happened. So the candidates are
+     * tried in turn, each given a moment to fail, and every failure is logged so the log says why a
+     * link did not open rather than that it did. {@code xdg-open} and {@code gio} take
+     * {@code mailto:} links as well, so mail needs no separate path here.
+     *
+     * @param url the link
+     * @return whether some launcher took it
+     */
+    private static boolean openOnLinux(String url) {
+        for (String[] command : linuxLaunchers(url, System.getenv("BROWSER"), defaultBrowserDesktopId())) {
+            try {
+                Process process = new ProcessBuilder(command).redirectErrorStream(true).start();
+                if (!process.waitFor(LAUNCHER_VERDICT_MS, TimeUnit.MILLISECONDS)) {
+                    UiLog.d("[ExternalBrowser] openOnLinux, [" + command[0] + "] took the link");
+                    return true;
+                }
+                if (process.exitValue() == 0) {
+                    UiLog.d("[ExternalBrowser] openOnLinux, [" + command[0] + "] opened the link");
+                    return true;
+                }
+                UiLog.w("[ExternalBrowser] openOnLinux, [" + command[0] + "] exited with ["
+                    + process.exitValue() + "], trying the next launcher");
+            } catch (Throwable t) {
+                // Typically "No such file or directory": this launcher is not installed.
+                UiLog.w("[ExternalBrowser] openOnLinux, [" + command[0] + "] is not available, [" + t + "]");
+            }
+        }
+        UiLog.w("[ExternalBrowser] openOnLinux, no launcher could open [" + url + "]. Set the BROWSER"
+            + " environment variable, or give the SDK a ContentUrlHandler to open links itself.");
+        return false;
+    }
+
+    static boolean isLinux(String osName) {
+        String os = osName == null ? "" : osName.toLowerCase(Locale.ROOT);
+        return os.contains("nix") || os.contains("nux") || os.contains("aix");
+    }
+
+    /**
+     * What a desktop file id looks like, as {@code xdg-settings} prints it: {@code firefox.desktop},
+     * {@code org.mozilla.firefox.desktop}. Anything else it prints is an error message, not an id.
+     */
+    private static final Pattern DESKTOP_ID = Pattern.compile("[A-Za-z0-9][A-Za-z0-9._+-]*\\.desktop");
+
+    /**
+     * The desktop file id of the default browser, asked of {@code xdg-settings}.
+     *
+     * @return the id, or {@code null} when there is no {@code xdg-settings}, no default, or the
+     *     answer took too long
+     */
+    private static String defaultBrowserDesktopId() {
+        try {
+            Process process = new ProcessBuilder("xdg-settings", "get", "default-web-browser").start();
+            if (!process.waitFor(LAUNCHER_VERDICT_MS, TimeUnit.MILLISECONDS)) {
+                process.destroyForcibly();
+                return null;
+            }
+            if (process.exitValue() != 0) {
+                return null;
+            }
+            return desktopIdOf(new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8));
+        } catch (Throwable t) {
+            // No xdg-settings here; the chain has plenty left.
+            return null;
+        }
+    }
+
+    /**
+     * @param output what {@code xdg-settings get default-web-browser} printed
+     * @return the desktop file id in it, or {@code null} when it printed something else
+     */
+    static String desktopIdOf(String output) {
+        if (output == null) {
+            return null;
+        }
+        String firstLine = output.trim().split("\\R", 2)[0].trim();
+        return DESKTOP_ID.matcher(firstLine).matches() ? firstLine : null;
+    }
+
+    /**
+     * The launchers to try on Linux, most specific first: the user's own {@code BROWSER}, then the
+     * desktop's openers, then the browsers themselves.
+     * <p>
+     * The desktop portal and {@code gtk-launch} come before {@code xdg-open}. All three open the
+     * link, but on Wayland a browser that is already running only comes to the front for a launcher
+     * that hands it an activation token, which those two do and {@code xdg-open} does not: through
+     * {@code xdg-open} the page opened in a background tab and, from inside the application,
+     * nothing visibly happened. The portal ({@code org.freedesktop.portal.OpenURI}, reached through
+     * {@code gdbus} from glib) covers GNOME, KDE and sandboxed applications and answers with an
+     * error when no portal is running; {@code gtk-launch} covers GTK desktops without one, and fails
+     * fast when the desktop id is unknown.
+     *
+     * @param url the link
+     * @param browserEnv the {@code BROWSER} environment variable, may be {@code null}; a {@code %s}
+     *     in it is replaced by the URL, as the convention has it
+     * @param defaultBrowserDesktopId the default browser's desktop file id, may be {@code null}
+     * @return commands, each ready for a ProcessBuilder
+     */
+    static List<String[]> linuxLaunchers(String url, String browserEnv, String defaultBrowserDesktopId) {
+        List<String[]> launchers = new ArrayList<>();
+        if (browserEnv != null && !browserEnv.trim().isEmpty()) {
+            // BROWSER may hold several, colon separated, each possibly with a %s placeholder.
+            for (String candidate : browserEnv.split(":")) {
+                String trimmed = candidate.trim();
+                if (trimmed.isEmpty()) {
+                    continue;
+                }
+                launchers.add(trimmed.contains("%s")
+                    ? new String[] { "/bin/sh", "-c", trimmed.replace("%s", "\"$0\""), url }
+                    : new String[] { trimmed, url });
+            }
+        }
+        launchers.add(new String[] { "gdbus", "call", "--session",
+            "--dest", "org.freedesktop.portal.Desktop",
+            "--object-path", "/org/freedesktop/portal/desktop",
+            "--method", "org.freedesktop.portal.OpenURI.OpenURI",
+            "", url, "{}" });
+        if (defaultBrowserDesktopId != null) {
+            launchers.add(new String[] { "gtk-launch", defaultBrowserDesktopId, url });
+        }
+        launchers.add(new String[] { "xdg-open", url });
+        launchers.add(new String[] { "gio", "open", url });
+        launchers.add(new String[] { "sensible-browser", url });
+        launchers.add(new String[] { "x-www-browser", url });
+        launchers.add(new String[] { "firefox", url });
+        launchers.add(new String[] { "google-chrome", url });
+        launchers.add(new String[] { "chromium", url });
+        launchers.add(new String[] { "chromium-browser", url });
+        return launchers;
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FeedbackWidgetPresenter.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FeedbackWidgetPresenter.java
new file mode 100644
index 000000000..6a3cd337b
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FeedbackWidgetPresenter.java
@@ -0,0 +1,326 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.ModuleFeedback;
+import ly.count.sdk.java.internal.SDKCore;
+import ly.count.sdk.java.internal.WidgetAction;
+import ly.count.sdk.java.internal.WidgetActionParser;
+
+/**
+ * Drives one feedback widget through a {@link WidgetWebHost}: loads the widget URL, tells the page
+ * how much room it has once it is up, places the card where the widget asks for it, and reports the
+ * result back to the SDK when the widget closes.
+ * <p>
+ * Free of any UI toolkit, so it can be tested against a fake host.
+ */
+public class FeedbackWidgetPresenter implements WidgetWebHost.Listener {
+
+    private final WidgetWebHost host;
+    private final ModuleFeedback.Feedback feedback;
+    private final Runnable onClosed;
+
+    private CountlyFeedbackWidget widget;
+    private ContentPlacement lastRequested;
+
+    /** The card as the page last drew it, which outranks a request that only differs by a border. */
+    private ContentPlacement lastDrawn;
+
+    /**
+     * How far a page's request may differ from the card it draws and still mean the same card. Wider
+     * than the host's fit tolerance on purpose: this is about a template's own arithmetic being off
+     * by a border or a shadow, not about a card that changed.
+     */
+    private static final int NEAR_ENOUGH = 24;
+
+    private boolean surfaceReported = false;
+    private boolean finished = false;
+
+    /**
+     * @param host the browser to drive
+     * @param feedback the SDK's feedback interface, used to build the URL and report the result
+     * @param onClosed called once, when the widget is gone, may be {@code null}
+     */
+    public FeedbackWidgetPresenter(WidgetWebHost host, ModuleFeedback.Feedback feedback, Runnable onClosed) {
+        this.host = host;
+        this.feedback = feedback;
+        this.onClosed = onClosed;
+        host.setListener(this);
+    }
+
+    /**
+     * Load the given widget.
+     *
+     * @param widgetToShow the widget to present
+     */
+    public void start(CountlyFeedbackWidget widgetToShow) {
+        widget = widgetToShow;
+
+        if (widgetToShow == null) {
+            UiLog.w("[FeedbackWidgetPresenter] start, no widget was given, nothing to present");
+            finish();
+            return;
+        }
+
+        if (feedback == null) {
+            // The SDK is not initialized, or feedback consent was not given.
+            UiLog.w("[FeedbackWidgetPresenter] start, the feedback interface is not available, nothing to present");
+            finish();
+            return;
+        }
+
+        // With the surface, so the page can lay its card out against the real area and report the
+        // rectangle it wants. Every template reads these two numbers out of the custom parameter.
+        WidgetSurface surface = host.getSurface();
+        String url = feedback.constructFeedbackWidgetUrl(widgetToShow,
+            surface == null ? 0 : surface.width, surface == null ? 0 : surface.height);
+        if (url == null || url.trim().isEmpty()) {
+            UiLog.w("[FeedbackWidgetPresenter] start, could not build a URL for widget [" + widgetToShow.widgetId + "]");
+            finish();
+            return;
+        }
+
+        UiLog.i("[FeedbackWidgetPresenter] start, presenting widget [" + widgetToShow.widgetId + "]");
+        host.navigate(url);
+    }
+
+    @Override
+    public void onPageLoaded() {
+        if (surfaceReported) {
+            return;
+        }
+        surfaceReported = true;
+
+        WidgetSurface surface = host.getSurface();
+        UiLog.d("[FeedbackWidgetPresenter] onPageLoaded, reporting surface " + surface);
+        // The widget can only work out its own card size once it knows the viewport, and it only
+        // listens for that after its own page has loaded.
+        host.reportSurfaceSize(surface.width, surface.height);
+    }
+
+    @Override
+    public void onLoadFailed() {
+        UiLog.w("[FeedbackWidgetPresenter] onLoadFailed, the widget page could not be loaded");
+        // Without this the caller would be left with an invisible card and no callback.
+        finish();
+    }
+
+    @Override
+    public void onNavigationStarting(String url) {
+        WidgetAction action = WidgetActionParser.parse(url, SDKCore.logger());
+        if (!action.isSdkSignal) {
+            return;
+        }
+
+        if (action.isExternalLink) {
+            UiLog.d("[FeedbackWidgetPresenter] onNavigationStarting, opening an external link");
+            ExternalBrowser.open(action.link);
+            return;
+        }
+
+        handle(action);
+    }
+
+    @Override
+    public void onWidgetMessage(String json) {
+        WidgetAction action = WidgetMessageParser.parse(json);
+        if (action == null) {
+            return;
+        }
+        handle(action);
+    }
+
+    @Override
+    public void onSizeNotReported(int paintedWidth, int paintedHeight) {
+        // What a widget page paints is not the card: a rating paints only its little sticky tab, and
+        // placing that measurement gave a 50px sliver of a window. For a type we know, the type's
+        // own card wins; the measurement is only worth anything when the type is not known at all.
+        boolean known = widget != null && widget.type != null;
+        place(!known && paintedWidth > 0 && paintedHeight > 0
+            ? new ContentPlacement(0, 0, paintedWidth, paintedHeight) : null);
+    }
+
+    private void handle(WidgetAction action) {
+        if (action.hasResize) {
+            UiLog.d("[FeedbackWidgetPresenter] handle, the page asked to be "
+                + action.resizeFor(host.getSurface().isLandscape()) + " on surface " + host.getSurface());
+            place(reconciledWithDrawn(WidgetPlacement.resolve(action, host.getSurface())));
+        }
+
+        if (action.link != null) {
+            ExternalBrowser.open(action.link);
+        }
+
+        if (action.close) {
+            UiLog.i("[FeedbackWidgetPresenter] handle, the widget asked to be closed");
+            finish();
+        }
+    }
+
+    @Override
+    public void onCardMeasured(int width, int height) {
+        if (widget != null && !WidgetLayout.usesReportedSize(widget.type)) {
+            // A rating's card is a fixed size, so re-placing it from a measurement lands on the same
+            // rectangle. Answering anyway just made the host measure again, three times over, and a
+            // card is not shown until the fitting settles.
+            return;
+        }
+
+        // What the page drew wins over what it asked for: the card is what the user sees, and a
+        // window taller than the card leaves it floating above the edge it is anchored to. The
+        // measurement has to be taken after the page's own step transition, though, or it describes
+        // a card mid fade rather than the step it is becoming - that timing lives in the host.
+        lastDrawn = new ContentPlacement(0, 0, width, height);
+        place(lastDrawn);
+    }
+
+    @Override
+    public void onCardFollowing(int width, int height) {
+        if (finished || widget == null || !WidgetLayout.usesReportedSize(widget.type)) {
+            return;
+        }
+
+        // The same anchor rule as a placement, without any of its machinery: this runs for every
+        // frame the page animates, so the card grows with the animation rather than after it.
+        ContentPlacement following = WidgetLayout.resolve(widget.type, widget.position,
+            host.getSurface(), new ContentPlacement(0, 0, width, height));
+        if (following == null) {
+            return;
+        }
+        lastRequested = new ContentPlacement(0, 0, width, height);
+        lastDrawn = lastRequested;
+        host.followGeometry(following);
+    }
+
+    @Override
+    public void onContentOverflow(int extraHeight) {
+        ContentPlacement current = lastRequested;
+        if (finished || extraHeight <= 0 || current == null) {
+            return;
+        }
+
+        // Taller by exactly what the content could not fit, keeping the width the page chose. The
+        // host bounds this by the surface before it asks.
+        UiLog.d("[FeedbackWidgetPresenter] onContentOverflow, growing the card by [" + extraHeight + "] px");
+        place(new ContentPlacement(current.x, current.y, current.width, current.height + extraHeight));
+    }
+
+    /**
+     * Puts the card back where it belongs after the window or screen it is anchored to moved or was
+     * resized. Nothing happens until the widget has asked to be placed at least once.
+     */
+    public void refreshPlacement() {
+        if (finished || (lastRequested == null && !surfaceReported)) {
+            return;
+        }
+
+        // The widget sizes its own card against the room it was told it has, so a resized window is
+        // news it has to act on: it answers with a fresh rect, which places the card again.
+        WidgetSurface surface = host.getSurface();
+        if (surfaceReported) {
+            host.reportSurfaceSize(surface.width, surface.height);
+        }
+        place(lastRequested);
+    }
+
+    /**
+     * Where a page's own number and the card it actually paints disagree by a few pixels, the paint
+     * wins, and this stops the two from correcting each other forever.
+     * <p>
+     * A survey template asked for 574 and drew 580 - a border its own height calculation does not
+     * count. Honouring the request left six pixels of card clipped, measuring the card then grew
+     * the window to 580, the page's next message asked for 574 again, and so on: a visible loop,
+     * restarted by every window resize. A request this close to the drawn card now resolves to the
+     * drawn card, which is what is already on screen, so nothing moves. A request that differs by
+     * more than {@link #NEAR_ENOUGH} is a genuinely new step and is honoured as asked.
+     *
+     * @param requested what the page asked for, surface absolute
+     * @return the same rectangle, or one carrying the drawn card's size when that is what it means
+     */
+    private ContentPlacement reconciledWithDrawn(ContentPlacement requested) {
+        ContentPlacement drawn = lastDrawn;
+        if (requested == null || drawn == null) {
+            return requested;
+        }
+        if (Math.abs(requested.width - drawn.width) > NEAR_ENOUGH
+            || Math.abs(requested.height - drawn.height) > NEAR_ENOUGH) {
+            return requested;
+        }
+        if (requested.width == drawn.width && requested.height == drawn.height) {
+            return requested;
+        }
+        UiLog.d("[FeedbackWidgetPresenter] reconciledWithDrawn, the page asked for " + requested.width
+            + "x" + requested.height + " but draws " + drawn.width + "x" + drawn.height + ", keeping the drawn size");
+        return new ContentPlacement(requested.x, requested.y, drawn.width, drawn.height);
+    }
+
+    /**
+     * Places the card the widget asked for. The size is the widget's own, since its page measured
+     * its content to get it; the anchor is the widget type's, since on the web that comes from the
+     * SDK's stylesheet and the page's numbers assume it was applied.
+     *
+     * @param requested the rect the widget asked for, {@code null} when it asked for nothing
+     */
+    private void place(ContentPlacement requested) {
+        UiLog.d("[FeedbackWidgetPresenter] place, requested " + requested);
+        lastRequested = requested;
+        WidgetSurface surface = host.getSurface();
+        ContentPlacement rect = WidgetLayout.resolve(
+            widget == null ? null : widget.type,
+            widget == null ? null : widget.position,
+            surface, requested);
+
+        UiLog.d("[FeedbackWidgetPresenter] place, putting the " + (widget == null ? "widget" : widget.type)
+            + " at " + rect + " (it asked for " + requested + ")");
+        host.placeAndShow(rect);
+    }
+
+    /**
+     * The card went away without the SDK closing it. Reported and torn down like any other dismissal,
+     * once; a no-op after finish() has already run.
+     */
+    void dismissedExternally() {
+        if (finished) {
+            return;
+        }
+        UiLog.i("[FeedbackWidgetPresenter] dismissedExternally, the card was hidden from outside the SDK");
+        finish();
+    }
+
+    /**
+     * Tears the presentation down exactly once: reports the dismissal to the SDK, closes the host
+     * and tells the caller.
+     */
+    private void finish() {
+        if (finished) {
+            return;
+        }
+        finished = true;
+
+        if (widget != null && feedback != null) {
+            try {
+                // The widget itself reports a completed result; this marks the dismissal.
+                feedback.reportFeedbackWidgetManually(widget, null, null);
+            } catch (Throwable t) {
+                // Reporting is the least important part of tearing down. If it throws, the card
+                // still has to close and the caller still has to be told, or the presentation
+                // wedges with a stuck window and no callback.
+                UiLog.e("[FeedbackWidgetPresenter] finish, reporting the dismissal failed, [" + t + "]");
+            }
+        }
+
+        try {
+            host.closeHost();
+        } catch (Throwable t) {
+            UiLog.e("[FeedbackWidgetPresenter] finish, the host failed to close, [" + t + "]");
+        }
+
+        if (onClosed != null) {
+            try {
+                onClosed.run();
+            } catch (Throwable t) {
+                UiLog.e("[FeedbackWidgetPresenter] finish, the close callback threw, [" + t + "]");
+            }
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FxSurfaces.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FxSurfaces.java
new file mode 100644
index 000000000..d660f3ac0
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/FxSurfaces.java
@@ -0,0 +1,864 @@
+package ly.count.sdk.java.ui;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.List;
+import java.util.Locale;
+import java.util.function.BooleanSupplier;
+import javafx.animation.PauseTransition;
+import javafx.geometry.Rectangle2D;
+import javafx.scene.Scene;
+import javafx.scene.paint.Color;
+import javafx.scene.shape.Rectangle;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Screen;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import javafx.stage.Window;
+import javafx.util.Duration;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.WidgetActionParser;
+
+/**
+ * Screen geometry and web view defaults shared by the widget and content displays.
+ */
+final class FxSurfaces {
+
+    /**
+     * A fallback font for the pages the SDK loads, plus emoji coverage.
+     * <p>
+     * Scoped to {@code html} and {@code body} only, and therefore <em>inherited</em>. That is the
+     * whole trick: an inherited declaration is weaker than any direct one, so an element the page
+     * styles itself keeps the page's font (the templates load Inter and Lato through @font-face and
+     * those do load here), while text the page leaves unstyled inherits this instead of falling all
+     * the way back to the engine's serif default. An earlier version forced this on every element,
+     * which replaced the templates' own typography with Helvetica.
+     * <p>
+     * {@code !important} is still needed, because losing to an inherited author rule on {@code body}
+     * is exactly the case that produced serif text.
+     * <p>
+     * The emoji families come <em>before</em> the generic {@code sans-serif}: a generic always
+     * matches, so anything after it is never consulted, which is why the templates' emoji rendered
+     * as nothing.
+     */
+    private static final String USER_CSS =
+        "html,body{"
+            + "font-family:\"Helvetica Neue\",Helvetica,\"Segoe UI\",Roboto,Arial,"
+            + "\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Noto Color Emoji\",sans-serif !important;"
+            + "-webkit-font-smoothing:antialiased;}";
+
+    private static final String USER_STYLESHEET =
+        "data:text/css;charset=utf-8;base64,"
+            + Base64.getEncoder().encodeToString(USER_CSS.getBytes(StandardCharsets.UTF_8));
+
+    /**
+     * How long after a page loads to look at what it actually managed to fetch. Images are still
+     * arriving when the document reports itself loaded, so an immediate probe would report false
+     * failures.
+     */
+    private static final Duration DIAGNOSTICS_DELAY = Duration.millis(1500);
+
+    /**
+     * Reports what the page could and could not fetch. Written defensively because the WebKit build
+     * JavaFX bundles is old: the CSS Font Loading API may be missing entirely, and a throwing probe
+     * must never take a content block down with it.
+     */
+    private static final String DIAGNOSTICS_SCRIPT =
+        "(function(){try{"
+            + "var out=[],imgs=document.getElementsByTagName('img'),failed=0,pending=0;"
+            + "for(var i=0;i<imgs.length;i++){var im=imgs[i],src=(im.currentSrc||im.src||'?');"
+            + "if(im.complete&&im.naturalWidth===0){failed++;out.push('IMAGE FAILED '+src);}"
+            + "else if(!im.complete){pending++;out.push('image still loading '+src);}}"
+            + "out.unshift('images total='+imgs.length+' failed='+failed+' pending='+pending);"
+            + "out.push('stylesheets='+(document.styleSheets?document.styleSheets.length:-1));"
+            + "if(document.fonts&&document.fonts.status){out.push('fonts status='+document.fonts.status+"
+            + "' loaded='+(document.fonts.size!==undefined?document.fonts.size:'?'));}"
+            + "else{out.push('fonts: CSS Font Loading API not available in this WebKit');}"
+            + "var b=document.body;if(b){var cs=window.getComputedStyle(b);"
+            + "out.push('body font='+cs.fontFamily+' size='+cs.fontSize);"
+            + "out.push('body background='+cs.backgroundColor);}"
+            + "var h=document.documentElement;if(h){out.push('html background='"
+            + "+window.getComputedStyle(h).backgroundColor);}"
+            + "try{var faces=[];for(var s=0;s<document.styleSheets.length;s++){var rs=document.styleSheets[s].cssRules;"
+            + "if(!rs){continue;}for(var r=0;r<rs.length;r++){if(rs[r].type===5){faces.push(rs[r].style.fontFamily+' <- '+rs[r].style.src);}}}"
+            + "out.push('@font-face: '+(faces.length?faces.join(' ;; '):'none'));}"
+            + "catch(e){out.push('@font-face: unreadable ('+e+')');}"
+            + "return out.join(' | ');"
+            + "}catch(e){return 'diagnostics failed: '+e;}})()";
+
+    /**
+     * Keeps the WebKit stack alive once it has been started. The very first WebView in a process
+     * pays for initialising all of WebKit, which is the bulk of the delay between the server saying
+     * "show this" and something appearing.
+     */
+    private static WebView warmView;
+
+    private static volatile boolean diagnosticsEnabled = false;
+    private static boolean signalFilterInstalled = false;
+
+    private FxSurfaces() {
+    }
+
+    /**
+     * @param enabled whether to log what each page managed to fetch
+     */
+    static void setDiagnosticsEnabled(boolean enabled) {
+        diagnosticsEnabled = enabled;
+    }
+
+    static boolean isDiagnosticsEnabled() {
+        return diagnosticsEnabled;
+    }
+
+    /**
+     * The containers every feedback widget and content template ships in its static HTML, so their
+     * presence is what tells a real widget page apart from whatever the browser substituted for one.
+     */
+    static final String WIDGET_MARKERS =
+        "#widget-body,.modal-content,[class*=\"survey-widget\"],[id^=\"nps-\"],"
+            + "[class*=\"countly-ratings\"],[class*=\"cly-\"],.smiley-container";
+
+    /**
+     * Whether the loaded document is a widget page at all.
+     * <p>
+     * JavaFX reports an HTTP level failure (a refused connection, a 404, a gateway error) as a
+     * SUCCEEDED load carrying an error document, so this is the only way to notice one. It asks
+     * whether the widget templates' own elements are in the document, not whether anything was
+     * painted: they are in the served HTML from the moment it parses, whereas painting waits on the
+     * widget's own fetches, and judging by paint killed slow widgets that were perfectly fine.
+     *
+     * @param engine the engine whose document to inspect
+     * @return {@code true} when this looks like a widget page, and when it cannot be determined
+     */
+    static boolean looksLikeWidgetPage(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{return !!(document.body&&document.querySelector('" + WIDGET_MARKERS + "'));}"
+                    + "catch(e){return true;}})()");
+            return !(result instanceof Boolean) || (Boolean) result;
+        } catch (Throwable t) {
+            // Undecidable, so it is not held against the page.
+            UiLog.w("[FxSurfaces] looksLikeWidgetPage, could not inspect the page, [" + t + "]");
+            return true;
+        }
+    }
+
+    /**
+     * Measures the rectangle the page actually painted, in CSS pixels.
+     * <p>
+     * Used to tell a real widget page from whatever the browser substituted when the real one could
+     * not be fetched: JavaFX reports an HTTP level failure as a SUCCEEDED load carrying an error
+     * document, and an error document paints no card.
+     *
+     * @param engine the engine to measure
+     * @return {@code left,top,width,height}, or {@code null} when the page has no card element at
+     *     all. Width and height may be zero when the window has not been sized yet.
+     */
+    static int[] measurePaintedContent(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{"
+                    + "if(!document.body){return '';}"
+                    // The widget templates' own containers, most specific first. Guessing from
+                    // style does not work: every one of these sits in a transparent wrapper, so a
+                    // "child of body with a background" test finds nothing on a perfectly good
+                    // page, and that used to be read as a failed load.
+                    + "var sel=['#widget-body','.modal-content','[class*=\"survey-widget\"]',"
+                    + "'[id^=\"nps-\"]','[class*=\"countly-ratings\"]','[class*=\"cly-\"]',"
+                    + "'.smiley-container'];"
+                    + "var e=null;"
+                    + "for(var i=0;i<sel.length&&!e;i++){var c=document.querySelectorAll(sel[i]);"
+                    + "for(var j=0;j<c.length;j++){var r=c[j].getBoundingClientRect();"
+                    + "if(r.width>0&&r.height>0){e=c[j];break;}}}"
+                    // Anything else the page painted, biggest first: enough to say "this rendered
+                    // something", which is all the caller needs.
+                    + "if(!e){var best=0;var kids=document.body.querySelectorAll('*');"
+                    + "for(var k=0;k<kids.length;k++){var b=kids[k].getBoundingClientRect();"
+                    + "var area=b.width*b.height;if(area>best){best=area;e=kids[k];}}}"
+                    + "if(!e){return '';}"
+                    // Zero sizes are reported rather than rejected: the window is still 1x1 before
+                    // it has been placed, so a real card measures zero here. The absence of any
+                    // element at all is what says the page rendered nothing.
+                    + "var b2=e.getBoundingClientRect();"
+                    + "return [Math.round(b2.left),Math.round(b2.top),Math.round(b2.width),Math.round(b2.height)].join(',');"
+                    + "}catch(err){return '';}})()");
+            if (!(result instanceof String) || ((String) result).isEmpty()) {
+                return null;
+            }
+            String[] parts = ((String) result).split(",");
+            if (parts.length != 4) {
+                return null;
+            }
+            return new int[] {
+                Integer.parseInt(parts[0]), Integer.parseInt(parts[1]),
+                Integer.parseInt(parts[2]), Integer.parseInt(parts[3])
+            };
+        } catch (Throwable t) {
+            UiLog.w("[FxSurfaces] measurePaintedContent, could not measure the page, [" + t + "]");
+            return null;
+        }
+    }
+
+    /**
+     * Makes the web view's own page backdrop fully transparent, so only what the page paints is
+     * visible and the application shows through everywhere else.
+     * <p>
+     * This is public JavaFX API as of version 20 ({@code WebView.setPageFill}). Before that the only
+     * lever was a {@code com.sun.webkit} internal reached by reflection, which needed
+     * {@code --add-exports} from every integrator and, on this pipeline, rendered the empty area
+     * opaque black instead of see-through. That is why this module requires JavaFX 21.
+     * <p>
+     * The page still wins: if the document sets its own background colour, that is what shows.
+     *
+     * @param webView the view whose backdrop to clear
+     */
+    static void makePageBackgroundTransparent(WebView webView) {
+        try {
+            webView.setPageFill(Color.TRANSPARENT);
+        } catch (Throwable t) {
+            // Cosmetic only: the overlay keeps an opaque backdrop.
+            UiLog.w("[FxSurfaces] makePageBackgroundTransparent, could not clear the backdrop, [" + t + "]");
+        }
+    }
+
+    /**
+     * The JavaFX property that chooses between the HTTP/2 loader and the older one.
+     * Read once, in {@code NetworkContext}'s static initialiser, so it has to be set before the
+     * first web view exists. Found by reading {@code NetworkContext}'s bytecode; it is not documented.
+     */
+    private static final String USE_HTTP2_LOADER = "com.sun.webkit.useHTTP2Loader";
+
+    /**
+     * Opts out of JavaFX's HTTP/2 loader before any page is loaded.
+     * <p>
+     * A widget or content block talks to the SDK by navigating to {@code https://countly_action_event/…},
+     * a host that deliberately does not resolve: the navigation is a message, not a destination. The
+     * HTTP/2 loader routes through {@code java.net.http}, whose request builder rejects that URI and
+     * throws {@code IllegalArgumentException} on the application thread, before the SDK's cancel can
+     * take effect. The older loader fails such a load quietly, which is what the protocol relies on
+     * and what JavaFX 17 did.
+     * <p>
+     * Only set when the integrator has not chosen for themselves. HTTP/1.1 versus HTTP/2 makes no
+     * practical difference for loading a single widget page.
+     */
+    private static void preferTolerantNetworkLoader() {
+        if (System.getProperty(USE_HTTP2_LOADER) != null) {
+            return;
+        }
+        try {
+            System.setProperty(USE_HTTP2_LOADER, "false");
+        } catch (Throwable t) {
+            // A restrictive security manager: the signalling URL will then log a stack trace.
+            UiLog.w("[FxSurfaces] preferTolerantNetworkLoader, could not set " + USE_HTTP2_LOADER
+                + ", signalling URLs may log a stack trace, [" + t + "]");
+        }
+    }
+
+    /**
+     * Stops JavaFX's network stack from reporting the SDK's own signalling URLs as fatal.
+     * <p>
+     * A widget or content block talks to the SDK by navigating to {@code https://countly_action_event/…}.
+     * That host does not resolve, which is the point: the navigation is a message, not a destination,
+     * and it is cancelled as soon as it is seen. JavaFX 21 routes loads through {@code java.net.http},
+     * whose builder rejects the URI outright and throws {@code IllegalArgumentException} on the
+     * application thread before the cancel can take effect. JavaFX 17's older loader simply failed
+     * the load quietly.
+     * <p>
+     * There is no navigation veto in the {@code WebEngine} API to prevent the dispatch, so the
+     * exception is filtered instead: only this exact case, only on the JavaFX thread, and any other
+     * uncaught exception is passed to the handler that was already installed.
+     */
+    static void installSignalUrlExceptionFilter() {
+        if (signalFilterInstalled) {
+            return;
+        }
+        signalFilterInstalled = true;
+
+        Thread fxThread = Thread.currentThread();
+        Thread.UncaughtExceptionHandler previous = fxThread.getUncaughtExceptionHandler();
+        fxThread.setUncaughtExceptionHandler((thread, thrown) -> {
+            if (isSignalUrlRejection(thrown)) {
+                UiLog.d("[FxSurfaces] the network stack refused a signalling URL, which is expected: "
+                    + thrown.getMessage());
+                return;
+            }
+            if (previous != null) {
+                previous.uncaughtException(thread, thrown);
+            }
+        });
+    }
+
+    private static boolean isSignalUrlRejection(Throwable thrown) {
+        return thrown instanceof IllegalArgumentException
+            && thrown.getMessage() != null
+            && thrown.getMessage().contains(WidgetActionParser.ACTION_HOST);
+    }
+
+    /**
+     * Starts WebKit ahead of time, so the first widget or content block does not pay for it. Cheap
+     * to call more than once. Must be called on the JavaFX application thread.
+     */
+    static void prewarm() {
+        if (warmView != null) {
+            return;
+        }
+        // Before the first WebView: NetworkContext reads the loader choice in its static initialiser.
+        preferTolerantNetworkLoader();
+        try {
+            long started = System.currentTimeMillis();
+            warmView = new WebView();
+            // The warm-up page is the fonts the last run's widget used, so the first widget of this
+            // run finds them in WebKit's memory cache instead of fetching them while on screen.
+            String warmupPage = WebFontPrefetch.warmupPage();
+            if (warmupPage == null) {
+                warmView.getEngine().load("about:blank");
+            } else {
+                warmView.getEngine().loadContent(warmupPage);
+            }
+            UiLog.d("[FxSurfaces] prewarm, started WebKit in [" + (System.currentTimeMillis() - started)
+                + "] ms, prefetching [" + WebFontPrefetch.rememberedCount() + "] fonts");
+        } catch (Throwable t) {
+            warmView = null;
+            UiLog.w("[FxSurfaces] prewarm, could not start WebKit ahead of time, [" + t + "]");
+        }
+    }
+
+    /**
+     * Tells the page how much room it has, which is what makes it recompute its own rectangle.
+     * <p>
+     * This is the half of the resize protocol the host owns. A content page cannot see the
+     * application window: its viewport is the card, and the surface only ever reached the server, in
+     * the fetch. Android posts the same message on every layout change
+     * ({@code ContentOverlayView.notifyWebViewOfResize}), the page answers with {@code resize_me},
+     * and the host adopts that rectangle. Without the message the page never asks for anything and
+     * the host is left guessing the geometry.
+     * <p>
+     * No density conversion: JavaFX lays a page out in logical pixels, which is the unit the message
+     * is defined in, so Android's divide-by-density has no counterpart here.
+     *
+     * @param engine the engine showing the page
+     * @param surface the room the page has
+     */
+    static void notifyPageOfSurface(WebEngine engine, WidgetSurface surface) {
+        if (engine == null || surface == null) {
+            return;
+        }
+        try {
+            engine.executeScript("window.postMessage({type: 'resize', width: " + surface.width
+                + ", height: " + surface.height + "}, '*');");
+            UiLog.d("[FxSurfaces] notifyPageOfSurface, told the page it has "
+                + surface.width + "x" + surface.height);
+        } catch (Throwable t) {
+            // A page that cannot be scripted keeps the geometry the host worked out for it.
+            UiLog.d("[FxSurfaces] notifyPageOfSurface, could not tell the page its size, [" + t + "]");
+        }
+    }
+
+    /**
+     * Fetches the given faces into the engine's memory cache now, using the hidden warm-up view.
+     * <p>
+     * The view belongs to the process rather than to any card, so what it starts finishes even when
+     * the card that prompted it is dismissed a second later. Call on the JavaFX application thread.
+     *
+     * @param warmupPage the page to load, or {@code null} to do nothing
+     */
+    static void warmFonts(String warmupPage) {
+        if (warmupPage == null) {
+            return;
+        }
+        prewarm();
+        if (warmView == null) {
+            return;
+        }
+        try {
+            warmView.getEngine().loadContent(warmupPage);
+            UiLog.d("[FxSurfaces] warmFonts, fetching this run's faces into the cache");
+        } catch (Throwable t) {
+            // The next card pays for the fonts again, which is what happened before this existed.
+            UiLog.d("[FxSurfaces] warmFonts, could not warm the faces, [" + t + "]");
+        }
+    }
+
+    /**
+     * Logs the user agent, which carries the bundled WebKit version, and what the page fetched.
+     * Only runs when diagnostics are switched on, so a customer's page is never scripted by default.
+     *
+     * @param engine the engine whose page to inspect
+     * @param label which display is asking
+     */
+    static void logPageDiagnostics(WebEngine engine, String label) {
+        logPageDiagnostics(engine, label, () -> true);
+    }
+
+    /**
+     * @param engine the engine whose page to inspect
+     * @param label which display is asking
+     * @param stillShowing whether the page is still the one that was loaded. The delayed sample is
+     *     skipped when it is not: a content block the user closed quickly has already been navigated
+     *     away to a blank page, and probing that reports an empty document rather than the content.
+     */
+    static void logPageDiagnostics(WebEngine engine, String label, BooleanSupplier stillShowing) {
+        if (!diagnosticsEnabled) {
+            return;
+        }
+
+        UiLog.d("[" + label + "] user agent: " + engine.getUserAgent());
+        // Sampled straight away, so a page that gets dismissed a moment later is still described.
+        // Images may legitimately still be arriving here; the probe reports those as pending.
+        sample(engine, label, "on load");
+
+        PauseTransition wait = new PauseTransition(DIAGNOSTICS_DELAY);
+        wait.setOnFinished(event -> {
+            if (!stillShowing.getAsBoolean()) {
+                UiLog.d("[" + label + "] page went away before the second diagnostics sample");
+                return;
+            }
+            sample(engine, label, "settled");
+        });
+        wait.play();
+    }
+
+    /**
+     * Makes the engine paint a CSS background image that arrives after its box was painted.
+     * <p>
+     * A content card shows its picture as a {@code background-image} rather than an {@code <img>}.
+     * This engine fetches and decodes that image, but does not repaint the box when it arrives: the
+     * card is left with an empty slot, and no amount of invalidating the scene fills it. Handing the
+     * same URL back to the style system does, so that is what this does, once per element, as soon
+     * as the image is known to be loaded.
+     * <p>
+     * Proven by driving the live server: every card whose slot measured a single flat colour
+     * measured hundreds of colours after this ran, including a 1.26MB photograph. Other platforms
+     * do not need it because their engines invalidate the box themselves.
+     * <p>
+     * The trigger is the image's own load event, taken from the engine's memory cache, so nothing is
+     * downloaded twice and nothing is polled. The observer catches the elements the page adds after
+     * the first sweep, and stops after {@code OBSERVER_LIFETIME_MS}: a card is settled long before
+     * then, and an observer nobody stops would outlive it.
+     */
+    private static final String BACKGROUND_IMAGE_REPAINT =
+        "(function(){if(window.__clyBackgroundFix){return 'already installed';}"
+            + "window.__clyBackgroundFix=true;var ATTEMPTS=4;"
+            + "function fix(el){if(!el.style){return;}"
+            + "var u=window.getComputedStyle(el).backgroundImage;"
+            + "if(!u||u.indexOf('url(')!==0){return;}"
+            // Already carrying the value this fix applies: nothing to do, and this is also what
+            // stops the observer from reacting to its own writes.
+            + "if((el.style.backgroundImage||'')===u){return;}"
+            + "var tries=el.__clyBackgroundTries||0;if(tries>=ATTEMPTS){return;}"
+            + "el.__clyBackgroundTries=tries+1;"
+            + "var url=u.slice(4,u.length-1).replace(/['\"]/g,'');"
+            + "var probe=new Image();"
+            + "probe.onload=function(){el.style.backgroundImage='none';"
+            + "void el.offsetHeight;el.style.backgroundImage=u;};"
+            + "probe.src=url;}"
+            + "function sweep(){var all=document.querySelectorAll('*');"
+            + "for(var i=0;i<all.length&&i<400;i++){fix(all[i]);}}"
+            + "sweep();"
+            + "if(window.MutationObserver){var obs=new MutationObserver(sweep);"
+            + "obs.observe(document.documentElement,{childList:true,subtree:true,"
+            + "attributes:true,attributeFilter:['style','class']});"
+            + "setTimeout(function(){obs.disconnect();},%1$d);}"
+            // The page rebuilds its card as fonts and images settle, and a rebuild drops the value
+            // this fix applied. The observer catches most of that; these sweeps catch a rebuild that
+            // changes nothing the observer is watching.
+            + "[400,1200,2500,5000,9000].forEach(function(ms){"
+            + "if(ms<=%1$d){setTimeout(sweep,ms);}});"
+            + "return 'installed';})()";
+
+    /** How long the page is watched for elements that gain a background image. */
+    private static final long OBSERVER_LIFETIME_MS = 15_000;
+
+    /**
+     * Installs the background image repaint on a page that has just loaded. Call on the JavaFX
+     * application thread, after the load succeeded.
+     *
+     * @param engine the engine showing the page
+     */
+    static void repaintBackgroundImagesWhenTheyArrive(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                // Locale.ROOT: a default locale with its own digits (Arabic-Indic, for one) would
+                // print them into the script and make it a syntax error.
+                String.format(Locale.ROOT, BACKGROUND_IMAGE_REPAINT, OBSERVER_LIFETIME_MS));
+            UiLog.d("[FxSurfaces] background image repaint " + result);
+        } catch (Throwable t) {
+            // The card still shows its text and buttons, only the picture may be missing.
+            UiLog.w("[FxSurfaces] could not install the background image repaint, [" + t + "]");
+        }
+    }
+
+    /**
+     * How much taller the page's content is than the room it has, in logical pixels.
+     * <p>
+     * A widget template caps its own card: the NPS definitions stop at 620 tall whatever the screen,
+     * so a step with a comment box reports 620 and then scrolls inside itself. On a phone that is the
+     * only option; on a desktop there is room, and a scrollbar in a card is a worse answer than a
+     * taller card. The card is grown by this much instead, still bounded by the surface.
+     *
+     * @param engine the engine showing the page
+     * @return the overflow, or 0 when the content fits or cannot be measured
+     */
+    static int measureOverflow(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{var d=document.documentElement;var b=document.body;"
+                    + "var need=Math.max(d.scrollHeight||0,b?b.scrollHeight||0:0);"
+                    + "var have=Math.max(d.clientHeight||0,window.innerHeight||0);"
+                    + "return Math.max(0,need-have);}catch(e){return 0;}})()");
+            if (result instanceof Number) {
+                return Math.max(0, ((Number) result).intValue());
+            }
+        } catch (Throwable t) {
+            UiLog.d("[FxSurfaces] measureOverflow, could not measure the page, [" + t + "]");
+        }
+        return 0;
+    }
+
+    /**
+     * The page's {@code <img>} elements: where each one sits and whether the engine actually decoded
+     * it. A card can be missing its picture for two very different reasons, and only this tells them
+     * apart: {@code natural=0x0} means the engine never got an image, while a real natural size on a
+     * box that is tiny, empty or off the card means the image is there and the layout is wrong.
+     *
+     * @param engine the engine whose document to inspect
+     * @return one entry per image, or a short reason why there are none
+     */
+    static String describeImages(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{var out=[];var imgs=document.images;"
+                    + "for(var i=0;i<imgs.length&&out.length<5;i++){var im=imgs[i];"
+                    + "var st=window.getComputedStyle(im);var r=im.getBoundingClientRect();"
+                    + "out.push((im.currentSrc||im.src||'no src').slice(0,90)"
+                    + "+' @ '+Math.round(r.left)+','+Math.round(r.top)"
+                    + "+' '+Math.round(r.width)+'x'+Math.round(r.height)"
+                    + "+' natural='+im.naturalWidth+'x'+im.naturalHeight"
+                    + "+' complete='+im.complete"
+                    + "+' vis='+st.visibility+' disp='+st.display+' op='+st.opacity);}"
+                    + "return out.length?out.join(' ;; '):'no img elements';}catch(e){return 'err '+e;}})()");
+            return String.valueOf(result);
+        } catch (Throwable t) {
+            return "unavailable";
+        }
+    }
+
+    /**
+     * @return the first few CSS background image URLs the page paints with, so an image that is not
+     *     an {@code <img>} element is still visible in the log
+     */
+    private static String backgroundImages(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{var out=[];var all=document.querySelectorAll('*');"
+                    + "for(var i=0;i<all.length&&out.length<5;i++){"
+                    + "var el=all[i];var st=window.getComputedStyle(el);"
+                    + "var u=st.backgroundImage;"
+                    + "if(!u||u.indexOf('url(')!==0){continue;}"
+                    // Where the box actually is and whether anything is being drawn: a background on
+                    // a box with no size, or one sitting outside the card, is invisible however well
+                    // the image itself loaded.
+                    + "var r=el.getBoundingClientRect();"
+                    + "out.push(u.slice(0,90)+' @ '+Math.round(r.left)+','+Math.round(r.top)"
+                    + "+' '+Math.round(r.width)+'x'+Math.round(r.height)"
+                    + "+' vis='+st.visibility+' disp='+st.display+' op='+st.opacity"
+                    + "+' size='+st.backgroundSize+' pos='+st.backgroundPosition);}"
+                    + "return out.join(' ;; ');}catch(e){return 'err '+e;}})()");
+            return String.valueOf(result);
+        } catch (Throwable t) {
+            return "unavailable";
+        }
+    }
+
+    /**
+     * @return each declared font face and whether it has actually been fetched, which is what tells
+     *     "the page has not asked for its fonts yet" apart from "the fonts are here"
+     */
+    private static String faceStates(WebEngine engine) {
+        try {
+            Object result = engine.executeScript(
+                "(function(){try{var f=document.fonts;if(!f||!f.forEach){return 'none';}"
+                    + "var out=[];f.forEach(function(face){out.push(face.family+':'+face.status);});"
+                    + "return out.join(', ');}catch(e){return 'err '+e;}})()");
+            return String.valueOf(result);
+        } catch (Throwable t) {
+            return "unavailable";
+        }
+    }
+
+    private static void sample(WebEngine engine, String label, String when) {
+        try {
+            Object result = engine.executeScript(DIAGNOSTICS_SCRIPT);
+            UiLog.d("[" + label + "] page resources (" + when + "): " + result
+                + " | images: " + describeImages(engine)
+                + " | css backgrounds: " + backgroundImages(engine)
+                + " | faces: " + faceStates(engine));
+        } catch (Throwable t) {
+            UiLog.w("[" + label + "] could not read the page diagnostics (" + when + "), [" + t + "]");
+        }
+    }
+
+    /**
+     * Applies the SDK's web view defaults. Called before navigating.
+     *
+     * @param engine the engine to configure
+     */
+    static void configure(WebEngine engine) {
+        preferTolerantNetworkLoader();
+        installSignalUrlExceptionFilter();
+        engine.setJavaScriptEnabled(true);
+        try {
+            engine.setUserStyleSheetLocation(USER_STYLESHEET);
+        } catch (Throwable t) {
+            // Cosmetic only: the page still renders with the engine's own defaults.
+            UiLog.w("[FxSurfaces] configure, could not apply the fallback font, [" + t + "]");
+        }
+
+        engine.getLoadWorker().exceptionProperty().addListener((observable, old, thrown) -> {
+            if (thrown != null) {
+                UiLog.w("[FxSurfaces] load failed, [" + thrown + "]");
+            }
+        });
+    }
+
+    /**
+     * The work area of the screen the given window currently sits on, which is where a widget or a
+     * content block belongs. Following the window matters on a multiple monitor desktop: the primary
+     * screen is not necessarily the one the application is on, and the application can be dragged to
+     * another monitor while a content zone is running.
+     *
+     * @param owner the application window to follow, may be {@code null} or not yet on screen
+     * @return the surface to place on, falling back to the primary screen's work area
+     */
+    static WidgetSurface screenOf(Window owner) {
+        Rectangle2D bounds = screenBoundsOf(owner);
+        return new WidgetSurface((int) bounds.getMinX(), (int) bounds.getMinY(), (int) bounds.getWidth(), (int) bounds.getHeight());
+    }
+
+    /**
+     * Whether widget cards and content blocks are laid out inside the application window instead of
+     * on the screen the application is on. Both displays read this, so one setting decides both.
+     * <p>
+     * Inside the window by default, which is what the other desktop SDKs settled on: a card belongs
+     * to the application that asked for it, and one placed against the whole screen appears over
+     * whatever else the user has open. An integrator who wants the screen says so.
+     */
+    private static volatile boolean displayWithinApp = true;
+
+    static void setDisplayWithinApp(boolean withinApp) {
+        displayWithinApp = withinApp;
+    }
+
+    static boolean isDisplayWithinApp() {
+        return displayWithinApp;
+    }
+
+    /**
+     * The area a card or a content block may occupy, per the current setting.
+     *
+     * @param owner the application window to measure against, {@code null} for the primary screen
+     * @return the application window's bounds, or the work area of the screen it is on
+     */
+    static WidgetSurface surfaceFor(Window owner) {
+        return displayWithinApp ? boundsOf(owner) : screenOf(owner);
+    }
+
+    /**
+     * @param owner the window to measure
+     * @return the window's own bounds, or the primary screen's work area when it is not on screen yet
+     */
+    static WidgetSurface boundsOf(Window owner) {
+        if (!isOnScreen(owner)) {
+            return screenOf(null);
+        }
+        // The window's own bounds. Insetting them to spare the resize border was worse on both
+        // counts: a block that fills the window left the application showing through as a stripe
+        // down every side, and a card anchored to an edge no longer touched it. A covering block is
+        // a modal, and there is nothing to resize while one is up.
+        return new WidgetSurface((int) owner.getX(), (int) owner.getY(),
+            (int) owner.getWidth(), (int) owner.getHeight());
+    }
+
+    /**
+     * The corner radius applied to a block that covers the whole application window.
+     * <p>
+     * An overlay is a rectangular window laid over one with rounded corners, so a block that fills
+     * it paints its own square corners past the application's - visible as four dark wedges. JavaFX
+     * cannot read the native window's radius, so this is a sensible default an integrator can
+     * correct, in the same spirit as the Swift SDK's {@code content.overlayCornerRadius}.
+     */
+    private static volatile double overlayCornerRadius = 10;
+
+    static void setOverlayCornerRadius(double radius) {
+        overlayCornerRadius = Math.max(0, radius);
+    }
+
+    static double getOverlayCornerRadius() {
+        return overlayCornerRadius;
+    }
+
+    /**
+     * Rounds off a block that covers its whole surface, and leaves any other block alone.
+     * <p>
+     * Only a covering block needs it: a card placed somewhere inside the window paints its own
+     * corners and everything around them is already transparent, so clipping it would cut into the
+     * card itself.
+     *
+     * @param webView the view showing the block
+     * @param rect where the block was placed, screen absolute
+     * @param surface the area it was placed on
+     */
+    static void applyOverlayCorners(WebView webView, ContentPlacement rect, WidgetSurface surface) {
+        if (webView == null || rect == null || surface == null) {
+            return;
+        }
+        boolean covers = rect.width >= surface.width && rect.height >= surface.height;
+        if (!covers || overlayCornerRadius <= 0) {
+            webView.setClip(null);
+            return;
+        }
+        Rectangle clip = new Rectangle(rect.width, rect.height);
+        clip.setArcWidth(overlayCornerRadius * 2);
+        clip.setArcHeight(overlayCornerRadius * 2);
+        webView.setClip(clip);
+    }
+
+    /**
+     * The borderless window a widget card or a content block is shown in, with its web view already
+     * in a transparent scene. Call on the JavaFX application thread.
+     * <p>
+     * Transparent, not merely undecorated: both a widget and a content block draw their own rounded
+     * card with its own background, so everything around that card has to show the application
+     * through it. An undecorated stage with a default scene fill puts an opaque white block there
+     * instead.
+     * <p>
+     * Who the window belongs to follows where it is being shown. Inside the application window it is
+     * a child of that window: ordered with it, above it, and carried along when it moves, which is
+     * what something laid out against that window should do. On the whole screen it belongs to
+     * nobody - a card placed against the screen is a system wide message for as long as the process
+     * runs, so it sits on the top layer and stays where it was put, instead of being dragged around
+     * by an application window it was never laid out against.
+     *
+     * @param owner the application window to belong to, may be {@code null}
+     * @param webView the view to show, which becomes the scene root
+     * @param sceneWidth the scene's initial width
+     * @param sceneHeight the scene's initial height
+     * @return the window, not yet placed and not yet shown
+     */
+    static Stage newOverlayStage(Window owner, WebView webView, int sceneWidth, int sceneHeight) {
+        Stage stage = new Stage(StageStyle.TRANSPARENT);
+        stage.setResizable(false);
+        if (isDisplayWithinApp() && owner != null && owner.isShowing()) {
+            stage.initOwner(owner);
+        } else {
+            stage.setAlwaysOnTop(true);
+        }
+        Scene scene = new Scene(webView, sceneWidth, sceneHeight);
+        scene.setFill(Color.TRANSPARENT);
+        stage.setScene(scene);
+        return stage;
+    }
+
+    /**
+     * Applies a rectangle to the window <i>and</i> to the page inside it.
+     * <p>
+     * Moving the window is not enough: a web view reports its own 800x600 preferred size, so the
+     * page's viewport stays whatever it was when the scene was built and the page never reflows or
+     * sees a resize. Something laid out for one width then keeps that width in a window of another.
+     * The view is resized outright rather than only asked to lay out, because a window that has not
+     * run a layout pass yet - one that has never been shown - would otherwise leave the page
+     * measuring the scene it started in, and any fit that follows would have nothing to work with.
+     *
+     * @param stage the window to move and size
+     * @param webView the view inside it, {@code null} when the scene holds something else
+     * @param rect where it belongs, screen absolute
+     * @param surface the area it was placed on, for the rounded corners of a covering block
+     */
+    static void applyGeometry(Stage stage, WebView webView, ContentPlacement rect, WidgetSurface surface) {
+        stage.setX(rect.x);
+        stage.setY(rect.y);
+        stage.setWidth(rect.width);
+        stage.setHeight(rect.height);
+
+        if (webView == null) {
+            return;
+        }
+        webView.setPrefSize(rect.width, rect.height);
+        webView.resize(rect.width, rect.height);
+        webView.requestLayout();
+        // Something covering the application window has to follow its rounded corners too.
+        applyOverlayCorners(webView, rect, surface);
+    }
+
+    /**
+     * The engine handed to a {@code target="_blank"} link, which sends it to the system browser
+     * instead of rendering it in the card.
+     *
+     * @return a throwaway engine that only reports where it was asked to go
+     */
+    static WebEngine newExternalLinkEngine() {
+        WebEngine popup = new WebEngine();
+        popup.locationProperty().addListener((observable, oldUrl, newUrl) -> {
+            if (newUrl != null && !newUrl.isEmpty()) {
+                ExternalBrowser.open(newUrl);
+            }
+        });
+        return popup;
+    }
+
+    private static Rectangle2D screenBoundsOf(Window owner) {
+        try {
+            if (isOnScreen(owner)) {
+                // Match on the window's centre rather than its origin, so a window straddling two
+                // monitors lands on the one it is mostly on.
+                double centreX = owner.getX() + owner.getWidth() / 2;
+                double centreY = owner.getY() + owner.getHeight() / 2;
+                List<Screen> screens = Screen.getScreensForRectangle(centreX, centreY, 1, 1);
+                if (!screens.isEmpty()) {
+                    return screens.get(0).getVisualBounds();
+                }
+            }
+            return Screen.getPrimary().getVisualBounds();
+        } catch (Throwable t) {
+            UiLog.w("[FxSurfaces] screenBoundsOf, could not measure the screen, [" + t + "]");
+            return new Rectangle2D(0, 0, 0, 0);
+        }
+    }
+
+    private static boolean isOnScreen(Window owner) {
+        if (owner == null || !owner.isShowing()) {
+            return false;
+        }
+        return !Double.isNaN(owner.getX()) && !Double.isNaN(owner.getY())
+            && owner.getWidth() > 0 && owner.getHeight() > 0;
+    }
+
+    /**
+     * The application window a display should follow when the integrator did not name one. Prefers
+     * the focused window, then any showing one. Must be called on the JavaFX application thread.
+     *
+     * @return the window to follow, or {@code null} when the application has none on screen
+     */
+    static Window primaryApplicationWindow() {
+        try {
+            Window focused = null;
+            Window showing = null;
+            for (Window window : Window.getWindows()) {
+                if (!window.isShowing()) {
+                    continue;
+                }
+                if (showing == null) {
+                    showing = window;
+                }
+                if (window.isFocused()) {
+                    focused = window;
+                }
+            }
+            return focused != null ? focused : showing;
+        } catch (Throwable t) {
+            UiLog.w("[FxSurfaces] primaryApplicationWindow, could not read the window list, [" + t + "]");
+            return null;
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxContentDisplay.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxContentDisplay.java
new file mode 100644
index 000000000..e3c05e69d
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxContentDisplay.java
@@ -0,0 +1,543 @@
+package ly.count.sdk.java.ui;
+
+import java.net.URI;
+import java.util.Collections;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+import javafx.animation.PauseTransition;
+import javafx.application.Platform;
+import javafx.concurrent.Worker;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.Window;
+import javafx.util.Duration;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.ContentCloseCallback;
+import ly.count.sdk.java.internal.ContentData;
+import ly.count.sdk.java.internal.ContentDisplay;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.ContentScreen;
+import ly.count.sdk.java.internal.ModuleContent;
+import ly.count.sdk.java.internal.SDKCore;
+import ly.count.sdk.java.internal.WidgetAction;
+import ly.count.sdk.java.internal.WidgetActionParser;
+import netscape.javascript.JSObject;
+
+/**
+ * Shows Countly content in a borderless, always on top JavaFX window placed where the server asked,
+ * leaving the rest of the application usable.
+ * <p>
+ * The placement follows the screen the application window is on, and keeps following it when the
+ * application is dragged to another monitor, so content never opens on a monitor the user is not
+ * looking at.
+ * <p>
+ * JavaFX lays a web page out in logical pixels, which is also the unit the server's coordinates come
+ * back in, so the reported surface and the applied rectangles need no density conversion.
+ */
+public class JavaFxContentDisplay implements ContentDisplay {
+
+    /**
+     * How long a content page gets to load before the attempt is abandoned. Without this a page that
+     * never finishes would leave the content zone believing something is on screen, and no further
+     * content would ever be fetched.
+     * <p>
+     * Shortened by tests, the same way {@link ly.count.sdk.java.internal.CountlyTimer} exposes its
+     * own delay, so the give-up path can be exercised without a twenty second test.
+     */
+    static Duration loadTimeout = Duration.seconds(20); // shortened for testing purposes
+
+    private final Window owner;
+    private volatile WidgetSurface surface;
+
+    /** The block on screen right now, so it can follow the window it was placed against. */
+    private Stage activeStage;
+    private ContentData activeContent;
+
+    /** The surface last reported to the server, which its coordinates are relative to. */
+    private volatile WidgetSurface reportedSurface;
+
+    /** The surface the block on screen was last placed against, so an unchanged one costs nothing. */
+    private volatile WidgetSurface appliedSurface;
+
+    /** Where the block was last put, so a window manager moving it can be undone. */
+    private volatile ContentPlacement appliedPlacement;
+
+    /** What this display holds the screen for, released when the block closes. */
+    private volatile String presentationClaim;
+
+    /**
+     * The rectangle the page asked for through {@code resize_me}, and the surface it asked against.
+     * Once the page has spoken it outranks the server's rectangle: it is the only party that knows
+     * how tall its own content turned out.
+     */
+    private volatile ContentPlacement pageRequested;
+    private volatile WidgetSurface pageRequestedFor;
+
+    /**
+     * The object the page posts to. A field, because the engine holds only a weak reference to it
+     * and a bridge nobody else references is collected after its first message.
+     */
+    private ContentJsBridge contentBridge;
+
+    /**
+     * Follows the primary application window. Construct on the JavaFX application thread.
+     */
+    public JavaFxContentDisplay() {
+        this(FxSurfaces.primaryApplicationWindow());
+    }
+
+    /**
+     * Follows the given window. Construct on the JavaFX application thread.
+     *
+     * @param owner the application window whose screen content is placed on, {@code null} to use the
+     *     primary screen
+     */
+    public JavaFxContentDisplay(Window owner) {
+        this.owner = owner;
+        this.surface = FxSurfaces.surfaceFor(owner);
+        watchOwner();
+        // Pay for starting WebKit now, while entering the zone, rather than when a content block
+        // finally arrives and the user is waiting to see it.
+        FxSurfaces.prewarm();
+    }
+
+    /**
+     * The fetch runs off the JavaFX thread and has to know the surface, so the cached value is kept
+     * current by listening to the window instead of measuring on demand.
+     */
+    private void watchOwner() {
+        if (owner == null) {
+            return;
+        }
+        Runnable refresh = () -> {
+            surface = FxSurfaces.surfaceFor(owner);
+            repositionActiveContent();
+        };
+        owner.xProperty().addListener((observable, old, current) -> refresh.run());
+        owner.yProperty().addListener((observable, old, current) -> refresh.run());
+        owner.widthProperty().addListener((observable, old, current) -> refresh.run());
+        owner.heightProperty().addListener((observable, old, current) -> refresh.run());
+    }
+
+    @Override
+    public ContentScreen getScreen() {
+        // Re-resolved, not the surface captured when this display was built. The server lays a block
+        // out inside the size reported here, and show() places it inside the surface as it is then:
+        // if those two disagree the coordinates are computed for one area and clamped into another,
+        // which pins the card to a corner. They disagree easily - the application window may not
+        // have been on screen when this display was constructed, in which case the surface was the
+        // screen, and it is the window by the time a block arrives.
+        surface = FxSurfaces.surfaceFor(owner);
+        WidgetSurface current = surface;
+        // Kept, because the server's coordinates are a proportion of this: following a resize means
+        // keeping those proportions, which needs the area they were computed against.
+        reportedSurface = current;
+        UiLog.d("[JavaFxContentDisplay] getScreen, reporting " + current
+            + " withinApp=" + FxSurfaces.isDisplayWithinApp());
+        return new ContentScreen(current.width, current.height);
+    }
+
+    @Override
+    public void present(ContentData content, ContentCloseCallback onClosed) {
+        // The guard lives out here, not inside the JavaFX call, so the SDK is told the content is
+        // gone even when the toolkit never runs our block. Without that the content zone would wait
+        // forever for a close that cannot come.
+        AtomicBoolean closed = new AtomicBoolean(false);
+
+        try {
+            Platform.runLater(() -> show(content, closed, onClosed));
+        } catch (Throwable t) {
+            UiLog.e("[JavaFxContentDisplay] present, the JavaFX toolkit is not running, [" + t + "]");
+            notifyClosed(closed, onClosed, Collections.emptyMap());
+        }
+    }
+
+    /**
+     * @return the window the block on screen is in, or {@code null} when nothing is showing. For the
+     *     scenario driver, which scripts the page inside it.
+     */
+    Stage activeStage() {
+        return activeStage;
+    }
+
+    /**
+     * Moves the block on screen to where the window it belongs to has gone. A content block is laid
+     * out by the server against a specific area, so a window that is moved, resized or dragged to
+     * another monitor has to take its content with it instead of leaving it behind.
+     */
+    private void repositionActiveContent() {
+        Stage stage = activeStage;
+        ContentData content = activeContent;
+        if (stage == null || content == null || !stage.isShowing()) {
+            return;
+        }
+
+        WidgetSurface current = surface;
+        // Dragging a window fires a stream of move events, and on the whole screen - the default -
+        // none of them change the area a block was placed against. Doing the work anyway re-placed
+        // the card and told the page its size on every frame of the drag, and the page answered with
+        // a rectangle of its own, so a block visibly resized while the window was merely moved.
+        WidgetSurface applied = appliedSurface;
+        if (current.sameAs(applied)) {
+            // The area is unchanged, so the block belongs exactly where it was put. It can still
+            // have been moved without asking: an owned stage is a child window, and a child window
+            // is dragged along with its parent, so a block placed against the whole screen follows
+            // the application around unless it is put back. Nothing is recomputed and the page is
+            // not told anything - this only undoes the drag.
+            ContentPlacement keep = appliedPlacement;
+            if (keep != null && ((int) stage.getX() != keep.x || (int) stage.getY() != keep.y)) {
+                UiLog.d("[JavaFxContentDisplay] repositionActiveContent, the window took the block"
+                    + " with it, putting it back at " + keep);
+                stage.setX(keep.x);
+                stage.setY(keep.y);
+            }
+            return;
+        }
+        appliedSurface = current;
+        boolean resized = !current.sameSizeAs(applied);
+
+        ContentPlacement fromPage = pageRequested;
+        // The page's own rectangle when it has asked for one, the server's otherwise, either way in
+        // this surface's proportions. An immediate answer: when the page reacts to the message below
+        // with a resize_me of its own, that replaces this.
+        ContentPlacement placement = WidgetPlacement.following(fromPage, pageRequestedFor,
+            content.placementFor(current.isLandscape()), reportedSurface, current);
+        if (placement == null) {
+            return;
+        }
+
+        UiLog.d("[JavaFxContentDisplay] repositionActiveContent, following the window to " + placement
+            + " (" + (fromPage != null ? "page" : "server") + " asked for it, "
+            + (resized ? "the area changed size" : "the area only moved") + ")");
+        applyGeometry(stage, placement, current);
+
+        // Only a change of size is worth telling the page about: it lays itself out against the
+        // width and height, and a block that merely moved with its window has nothing to recompute.
+        WebView webView = resized ? webViewOf(stage) : null;
+        if (webView != null) {
+            FxSurfaces.notifyPageOfSurface(webView.getEngine(), current);
+        }
+    }
+
+    /**
+     * Applies a rectangle to the window and the page inside it, remembering it so a window manager
+     * that moves the block afterwards can be undone.
+     *
+     * @param stage the window showing the block
+     * @param rect where the block belongs
+     * @param onSurface the area it is being placed on
+     */
+    private void applyGeometry(Stage stage, ContentPlacement rect, WidgetSurface onSurface) {
+        appliedPlacement = rect;
+        FxSurfaces.applyGeometry(stage, webViewOf(stage), rect, onSurface);
+    }
+
+    /**
+     * @param stage the window to look inside
+     * @return the view showing the block, or {@code null} when the scene holds something else
+     */
+    private static WebView webViewOf(Stage stage) {
+        if (stage.getScene() == null || !(stage.getScene().getRoot() instanceof WebView)) {
+            return null;
+        }
+        return (WebView) stage.getScene().getRoot();
+    }
+
+    private void show(ContentData content, AtomicBoolean closed, ContentCloseCallback onClosed) {
+        // One presentation at a time, shared with feedback widgets: see PresentationLock. Refused
+        // content is reported closed at once, so the zone carries on and fetches again later rather
+        // than waiting on a block that never appeared.
+        String claim = "content " + (content == null ? "?" : content.url);
+        if (!PresentationLock.tryAcquire(claim)) {
+            // Told at once, without touching the claim: this block never held the screen, and the
+            // one that does must keep its claim, or the next request would open on top of it.
+            notifyClosed(closed, onClosed, Collections.emptyMap(), null);
+            return;
+        }
+        presentationClaim = claim;
+
+        try {
+            surface = FxSurfaces.surfaceFor(owner);
+            WidgetSurface currentSurface = surface;
+            // Belongs to the block that asked for it, not to this one.
+            pageRequested = null;
+            pageRequestedFor = null;
+            appliedSurface = currentSurface;
+
+            ContentPlacement placement = WidgetPlacement.resolve(content.placementFor(currentSurface.isLandscape()), currentSurface);
+            UiLog.d("[JavaFxContentDisplay] show, placing into " + currentSurface
+                + " server asked for " + content.placementFor(currentSurface.isLandscape()));
+            if (placement == null) {
+                UiLog.w("[JavaFxContentDisplay] show, the content has no usable placement, dropping it");
+                notifyClosed(closed, onClosed, Collections.emptyMap());
+                return;
+            }
+
+            // Captured now, while consent is known to be good. Re-resolving it per navigation could
+            // hand back null after a consent change and silently drop the content's own events.
+            ModuleContent.Content contentInterface = Countly.instance().content();
+
+            WebView webView = new WebView();
+            WebEngine engine = webView.getEngine();
+            FxSurfaces.configure(engine);
+
+            // Public JavaFX API since version 20. Everything the page does not paint shows the
+            // application through it, which is how content behaves on the other platforms, and it
+            // means showing the window before the page has painted costs nothing visually.
+            FxSurfaces.makePageBackgroundTransparent(webView);
+
+            // Transparent and owned or always on top, as FxSurfaces explains: content is laid out by
+            // the server as a card with its own background inside the rectangle it asked for,
+            // exactly as on the other platforms, so anything the card does not paint has to show
+            // the application through it.
+            Stage stage = FxSurfaces.newOverlayStage(owner, webView, placement.width, placement.height);
+            applyGeometry(stage, placement, currentSurface);
+
+            engine.locationProperty().addListener((observable, oldUrl, newUrl) ->
+                onContentUrl(newUrl, engine, stage, currentSurface, contentInterface, closed, onClosed));
+            engine.setCreatePopupHandler(features -> FxSurfaces.newExternalLinkEngine());
+
+            activeStage = stage;
+            activeContent = content;
+
+            // A window the user closed by other means must still release the content zone.
+            stage.setOnHidden(event -> {
+                if (activeStage == stage) {
+                    activeStage = null;
+                    activeContent = null;
+                }
+                notifyClosed(closed, onClosed, Collections.emptyMap());
+            });
+
+            // The window is shown only once the page has painted. Showing it before the load, as an
+            // empty white rectangle that fills in a moment later, is what makes content look like it
+            // arrives late.
+            // Two separate facts, which must not share a flag: whether the page finished loading,
+            // and whether the window is on screen. Showing a transparent window early is an
+            // optimisation; giving up still has to depend only on the page never arriving.
+            AtomicBoolean pageLoaded = new AtomicBoolean(false);
+            long loadStarted = System.currentTimeMillis();
+
+            // The page's postMessage channel, for a survey the content queue hosts. Installed as
+            // soon as there is a document, so the page's first message is not lost, and again on
+            // load in case the document was replaced; the script guards against running twice.
+            contentBridge = new ContentJsBridge(action ->
+                handleContentAction(action, engine, stage, contentInterface, closed, onClosed));
+            engine.documentProperty().addListener((observable, oldDocument, document) -> {
+                if (document != null) {
+                    installContentBridge(engine);
+                }
+            });
+
+            engine.getLoadWorker().stateProperty().addListener((observable, oldState, newState) -> {
+                if (newState == Worker.State.SUCCEEDED) {
+                    installContentBridge(engine);
+                    // The blank page a dismissed block is navigated away to loads successfully too;
+                    // treating that as the content arriving logged a second paint and re-revealed a
+                    // window that was on its way out.
+                    if (pageLoaded.get() || closed.get()) {
+                        return;
+                    }
+                    pageLoaded.set(true);
+                    if (!stage.isShowing()) {
+                        stage.show();
+                    }
+                    // The picture and the fonts are asked for before the reveal, so the card is
+                    // seen once, complete, rather than appearing and then rearranging itself.
+                    FxSurfaces.repaintBackgroundImagesWhenTheyArrive(engine);
+                    WebFontPrefetch.remember(engine);
+
+                    // Shown as soon as the page is loaded, like the other platforms' SDKs do.
+                    // Holding the card back until the page's fonts settled was measured on the live
+                    // server and never paid off: document.fonts.ready did not resolve on any of the
+                    // nine content variants, so every card paid the full deadline and still showed
+                    // with fonts in flight. What removes the swap is having the faces in the cache
+                    // before the page asks, which is WebFontPrefetch's job.
+                    stage.setOpacity(1);
+                    UiLog.i("[JavaFxContentDisplay] show, content painted at " + placement
+                        + " after [" + (System.currentTimeMillis() - loadStarted) + "] ms");
+                    FxSurfaces.logPageDiagnostics(engine, "JavaFxContentDisplay", () -> !closed.get());
+                    // Straight away, not only on a later resize: the page's viewport is the card, so
+                    // this is the first and only chance it gets to learn the real surface and ask for
+                    // the rectangle it actually wants.
+                    FxSurfaces.notifyPageOfSurface(engine, surface);
+                } else if (newState == Worker.State.FAILED && !pageLoaded.get()) {
+                    UiLog.w("[JavaFxContentDisplay] show, the content page could not be loaded");
+                    notifyClosed(closed, onClosed, Collections.emptyMap());
+                    stage.close();
+                }
+            });
+
+            PauseTransition loadDeadline = new PauseTransition(loadTimeout);
+            loadDeadline.setOnFinished(event -> {
+                if (!pageLoaded.get()) {
+                    UiLog.w("[JavaFxContentDisplay] show, the content page did not load in time, giving up");
+                    notifyClosed(closed, onClosed, Collections.emptyMap());
+                    stage.close();
+                }
+            });
+            loadDeadline.play();
+
+            // Transparent all the way down, so showing before the page has painted costs nothing
+            // visually and the content is never late to appear. Fully invisible until the page and
+            // its fonts are both ready, so it is never seen half drawn.
+            stage.setOpacity(0);
+            stage.show();
+
+            engine.load(withOrigin(content.url));
+        } catch (Throwable t) {
+            UiLog.e("[JavaFxContentDisplay] show, could not show the content, [" + t + "]");
+            notifyClosed(closed, onClosed, Collections.emptyMap());
+        }
+    }
+
+    /**
+     * The content URL with an {@code origin} parameter added, so a survey the content queue hosts
+     * accepts this display's resize message.
+     * <p>
+     * The widget templates only act on the host's {@code {type:'resize'}} message when
+     * {@code event.origin} equals the URL's {@code origin} parameter, which the server's content URL
+     * does not carry. For a page posting to its own window that origin is the page's own, so it is
+     * taken from the URL itself. A content block ignores the parameter.
+     *
+     * @param url the URL the server handed out
+     * @return the same URL, carrying {@code origin} when it did not already
+     */
+    static String withOrigin(String url) {
+        if (url == null || url.contains("origin=")) {
+            return url;
+        }
+        try {
+            URI uri = new URI(url);
+            if (uri.getScheme() == null || uri.getHost() == null) {
+                return url;
+            }
+            String origin = uri.getScheme() + "://" + uri.getHost() + (uri.getPort() > 0 ? ":" + uri.getPort() : "");
+            return url + (url.contains("?") ? "&" : "?") + "origin=" + origin;
+        } catch (Throwable t) {
+            // An unparseable URL is the server's problem to report, not this parameter's.
+            return url;
+        }
+    }
+
+    private void installContentBridge(WebEngine engine) {
+        if (contentBridge == null) {
+            return;
+        }
+        try {
+            JSObject window = (JSObject) engine.executeScript("window");
+            window.setMember(ContentJsBridge.MEMBER_NAME, contentBridge);
+            Object result = engine.executeScript(ContentJsBridge.INSTALL_SCRIPT);
+            UiLog.d("[JavaFxContentDisplay] installContentBridge, " + result);
+        } catch (Throwable t) {
+            // A block that only navigates to signal still works; only a hosted survey loses its
+            // resize and close.
+            UiLog.w("[JavaFxContentDisplay] installContentBridge, could not install, [" + t + "]");
+        }
+    }
+
+    private void onContentUrl(String url, WebEngine engine, Stage stage, WidgetSurface currentSurface,
+        ModuleContent.Content contentInterface, AtomicBoolean closed, ContentCloseCallback onClosed) {
+
+        WidgetAction action = WidgetActionParser.parse(url, SDKCore.logger());
+        if (!action.isSdkSignal) {
+            return;
+        }
+
+        // A navigation, not a destination: stop it before it goes anywhere.
+        engine.getLoadWorker().cancel();
+        handleContentAction(action, engine, stage, contentInterface, closed, onClosed);
+    }
+
+    /**
+     * Acts on a signal from the page, whichever way it arrived: as a navigation to the action URL,
+     * which content blocks use, or as a posted message, which a survey served through the content
+     * queue uses. The two carry the same commands.
+     */
+    private void handleContentAction(WidgetAction action, WebEngine engine, Stage stage,
+        ModuleContent.Content contentInterface, AtomicBoolean closed, ContentCloseCallback onClosed) {
+
+        if (action.isExternalLink) {
+            UiLog.d("[JavaFxContentDisplay] onContentUrl, opening an external link");
+            ExternalBrowser.open(action.link);
+
+            // A "cly_x_int=1" link that also carries "close=1" closes the content, the same way an
+            // action event does. Returning here unconditionally, as this used to, meant a link that
+            // asked to be opened AND dismissed only got opened.
+            if (action.close) {
+                notifyClosed(closed, onClosed, action.queryParams);
+                engine.load("about:blank");
+                stage.close();
+            }
+            return;
+        }
+
+        // Events and links are processed first, the close comes last, as the content protocol asks.
+        if (action.eventPayload != null && contentInterface != null) {
+            try {
+                contentInterface.recordContentEvents(action.eventPayload);
+            } catch (Throwable t) {
+                UiLog.e("[JavaFxContentDisplay] onContentUrl, could not record the content events, [" + t + "]");
+            }
+        }
+
+        if (action.link != null) {
+            ExternalBrowser.open(action.link);
+        }
+
+        if (action.hasResize) {
+            // Against the area the window is on now, not the one it was shown on: a content block
+            // that resizes itself after the application window moved would otherwise jump back to
+            // where that window used to be.
+            WidgetSurface current = surface;
+            ContentPlacement asked = action.resizeFor(current.isLandscape());
+            ContentPlacement resized = WidgetPlacement.resolve(asked, current);
+            if (resized != null) {
+                // The page's own rectangle replaces the server's as the source of truth, the way
+                // Android replaces its stored config in resizeMeAction. Otherwise the next window
+                // move recomputes from the server's numbers and undoes what the page asked for.
+                pageRequested = asked;
+                pageRequestedFor = current;
+                UiLog.d("[JavaFxContentDisplay] onContentUrl, resizing the content to " + resized
+                    + " as the page asked");
+                applyGeometry(stage, resized, current);
+            }
+        }
+
+        if (action.close) {
+            UiLog.i("[JavaFxContentDisplay] onContentUrl, the content asked to be closed");
+            notifyClosed(closed, onClosed, action.queryParams);
+            engine.load("about:blank");
+            stage.close();
+        }
+    }
+
+    private void notifyClosed(AtomicBoolean closed, ContentCloseCallback onClosed, Map<String, Object> contentData) {
+        notifyClosed(closed, onClosed, contentData, presentationClaim);
+    }
+
+    /**
+     * @param claim the screen claim this close frees, {@code null} when the block never held one
+     */
+    private void notifyClosed(AtomicBoolean closed, ContentCloseCallback onClosed, Map<String, Object> contentData,
+        String claim) {
+        if (!closed.compareAndSet(false, true)) {
+            return;
+        }
+        // Freed before the SDK hears about the close, so the next thing it wants to show is not
+        // refused by the block that just went away.
+        if (claim != null && claim.equals(presentationClaim)) {
+            presentationClaim = null;
+        }
+        PresentationLock.release(claim);
+        if (onClosed == null) {
+            return;
+        }
+        try {
+            onClosed.onClosed(contentData);
+        } catch (Throwable t) {
+            UiLog.e("[JavaFxContentDisplay] notifyClosed, the close callback threw, [" + t + "]");
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxWidgetHost.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxWidgetHost.java
new file mode 100644
index 000000000..44f6760be
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/JavaFxWidgetHost.java
@@ -0,0 +1,575 @@
+package ly.count.sdk.java.ui;
+
+import javafx.animation.Animation;
+import javafx.animation.KeyFrame;
+import javafx.animation.PauseTransition;
+import javafx.animation.Timeline;
+import javafx.concurrent.Worker;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.Window;
+import javafx.util.Duration;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.SDKCore;
+import ly.count.sdk.java.internal.WidgetAction;
+import ly.count.sdk.java.internal.WidgetActionParser;
+import netscape.javascript.JSObject;
+
+/**
+ * Maps {@link WidgetWebHost} onto a JavaFX {@link WebView} inside a borderless card {@link Stage}.
+ * <p>
+ * JavaFX lays a web page out in logical pixels and handles high density displays itself, so the
+ * rectangles a widget asks for are applied to the stage as they are, with no density conversion.
+ * <p>
+ * Every method must be called on the JavaFX application thread.
+ */
+class JavaFxWidgetHost implements WidgetWebHost {
+
+    /**
+     * How long to wait for a widget to report its own size before falling back to measuring the
+     * rendered page. Widgets built from the rating template never report one.
+     */
+    private static final Duration PLACEMENT_FALLBACK_DELAY = Duration.millis(900);
+
+    /**
+     * How long to wait for the page itself. A load that never resolves reports neither success nor
+     * failure, so without a deadline the caller is left with no card and no callback at all.
+     */
+    static Duration loadTimeout = Duration.seconds(20);
+
+    /** Long enough for the page to lay itself out at a newly applied size. */
+    private static final Duration FIT_DELAY = Duration.millis(160);
+
+    /** How long a step transition is given to finish before the card is measured or checked. */
+    private static final Duration SETTLE_DELAY = Duration.millis(600);
+
+    /**
+     * How often the card is re-checked from this side. Only a backstop now that the page reports its
+     * own changes: it covers a page that cannot be scripted, where nothing else would notice.
+     */
+    private static final Duration WATCH_INTERVAL = Duration.millis(3000);
+
+    /**
+     * How many corrections the watcher may make for one page. A widget has a handful of steps, so
+     * this is generous; it exists so a page that changes size every time it is looked at cannot keep
+     * the card moving forever.
+     */
+    private static final int MAX_WATCH_CORRECTIONS = 12;
+
+    /** A page and a fit that disagreed forever would resize each other forever. */
+    private static final int MAX_FITS_PER_PAGE = 3;
+
+    /** Below this, a measurement is a wrapper caught mid layout rather than a card. */
+    private static final int MIN_CREDIBLE_CARD = 120;
+
+    /** A difference this small is not worth moving a visible window for. */
+    private static final int FIT_TOLERANCE = 4;
+
+    private final Stage stage;
+    private final WebView webView;
+    private final WebEngine engine;
+    private WidgetSurface surface;
+
+    private Listener listener;
+    private boolean pageLoaded = false;
+    private boolean placed = false;
+    private int fits = 0;
+    private int corrections = 0;
+    private int followedFrames = 0;
+    private Timeline watch;
+
+    /** Set by closeHost: nothing the dying page does afterwards may start anything. */
+    private boolean closed;
+
+    /** The object the page calls into. See installBridge for why it has to be a field. */
+    private WidgetJsBridge bridge;
+    private long placementRequests = 0;
+
+    JavaFxWidgetHost(Stage stage, WebView webView, WidgetSurface surface) {
+        this.stage = stage;
+        this.webView = webView;
+        this.engine = webView.getEngine();
+        this.surface = surface;
+    }
+
+    /**
+     * Wires up the engine. Call once, before navigating.
+     */
+    void initialize() {
+        FxSurfaces.configure(engine);
+        // Everything the widget's own card does not paint shows the application through it, rather
+        // than sitting in an opaque box.
+        FxSurfaces.makePageBackgroundTransparent(webView);
+        engine.locationProperty().addListener((observable, oldUrl, newUrl) -> onLocationChanged(newUrl));
+        engine.setCreatePopupHandler(features -> FxSurfaces.newExternalLinkEngine());
+        engine.getLoadWorker().stateProperty().addListener((observable, oldState, newState) -> onLoadStateChanged(newState));
+        // As soon as there is a document, rather than only once the load has succeeded.
+        //
+        // A widget template asks for its size while it is still initialising, which happens as the
+        // document parses. Installing the bridge on SUCCEEDED is later than that: on a fast machine
+        // the page's first resize_me was posted before anything was listening and was lost, and the
+        // card was left at a guessed height with the page never asked again. Installing here catches
+        // it. Both installs are guarded, so whichever runs first wins and the other does nothing.
+        engine.documentProperty().addListener((observable, oldDocument, document) -> {
+            if (document != null) {
+                installBridge();
+            }
+        });
+    }
+
+    @Override
+    public void setListener(Listener widgetListener) {
+        listener = widgetListener;
+    }
+
+    @Override
+    public WidgetSurface getSurface() {
+        return surface;
+    }
+
+    @Override
+    public void setSurface(WidgetSurface updated) {
+        if (updated == null) {
+            return;
+        }
+        surface = updated;
+        // A page that sizes itself against the surface has to be told when the surface changes, the
+        // same way the content display tells its page.
+        if (pageLoaded) {
+            FxSurfaces.notifyPageOfSurface(engine, updated);
+        }
+    }
+
+    @Override
+    public void navigate(String url) {
+        engine.load(url);
+        scheduleLoadDeadline();
+    }
+
+    @Override
+    public void reportSurfaceSize(int width, int height) {
+        try {
+            engine.executeScript("window.postMessage({type:'resize',width:" + width + ",height:" + height + "},'*');");
+        } catch (Throwable t) {
+            UiLog.w("[JavaFxWidgetHost] reportSurfaceSize, could not report the surface size, [" + t + "]");
+        }
+    }
+
+    /** @return how many placements were applied, for tests */
+    long placementRequestsForTests() {
+        return placementRequests;
+    }
+
+    @Override
+    public void followGeometry(ContentPlacement rect) {
+        if (!stage.isShowing()) {
+            return;
+        }
+        applyGeometry(rect);
+    }
+
+    @Override
+    public void placeAndShow(ContentPlacement rect) {
+        if (closed) {
+            // A fit or a measurement that was in flight when the card closed must not re-show it.
+            return;
+        }
+        if (placed && stage.isShowing() && rect.x == (int) stage.getX() && rect.y == (int) stage.getY()
+            && rect.width == (int) stage.getWidth() && rect.height == (int) stage.getHeight()) {
+            // Already exactly there. A page re-announcing the same size, or a window drag that
+            // changed nothing for this card, used to start a fresh round of fitting and timers each
+            // time - seven identical placements in a row in one log.
+            return;
+        }
+        placed = true;
+        placementRequests++;
+        UiLog.d("[JavaFxWidgetHost] placeAndShow, request [" + placementRequests + "] for " + rect
+            + ", the card is " + (int) stage.getWidth() + "x" + (int) stage.getHeight()
+            + (followedFrames > 0 ? ", after following [" + followedFrames + "] animation frames" : ""));
+        followedFrames = 0;
+        // A rectangle materially different from the one on screen is a new request from the page - a
+        // widget moving to its next step - and each of those gets its own fit budget. Without this a
+        // three step widget spends the whole budget on its first step and the rest are left at
+        // whatever height that one settled on.
+        if (Math.abs(rect.height - (int) stage.getHeight()) > FIT_TOLERANCE
+            || Math.abs(rect.width - (int) stage.getWidth()) > FIT_TOLERANCE) {
+            fits = 0;
+        }
+        applyGeometry(rect);
+
+        // The size a widget asks for is not the size it always draws, and a card drawn shorter than
+        // its window floats above whatever edge it is anchored to, so the card is fitted to what the
+        // page actually draws before anyone sees it. That needs a real layout pass, which a window
+        // that has never been shown does not get: the page would still be measuring itself against
+        // the 1x1 scene it started in. So the window is shown fully transparent, laid out, fitted,
+        // and only then revealed. Showing it first and correcting afterwards is a card that jumps.
+        if (!stage.isShowing()) {
+            stage.setOpacity(0);
+            stage.show();
+            // Always on top settles the card against other applications, not against the owner's own
+            // stacking.
+            stage.toFront();
+        }
+
+        // The first placement is fitted quickly, because the card is invisible until it is: the
+        // widget must not be held back. Every later one is a step the page moved to, and the page
+        // fades that in over a few hundred milliseconds - measuring during the fade describes the
+        // step it is leaving, which is what left later steps at the wrong height.
+        long request = placementRequests;
+        PauseTransition fit = new PauseTransition(request <= 1 ? FIT_DELAY : SETTLE_DELAY);
+        fit.setOnFinished(event -> fitThenReveal(rect, request));
+        fit.play();
+    }
+
+    private void applyGeometry(ContentPlacement rect) {
+        FxSurfaces.applyGeometry(stage, webView, rect, surface);
+    }
+
+    /**
+     * Fits the card to what the page drew, then reveals it, unless the fit asked for a different
+     * rectangle: the placement that follows reveals it instead, so the card is only ever seen at the
+     * size it keeps.
+     *
+     * @param rect the rectangle this round was asked for
+     */
+    private void fitThenReveal(ContentPlacement rect, long requestWhenScheduled) {
+        if (placementRequests != requestWhenScheduled) {
+            // A newer placement was applied while this fit waited, so it describes a card that no
+            // longer exists. Reporting that as a window manager surprise was crying wolf, which is
+            // what filled the log with warnings about rectangles nobody had asked for any more.
+            return;
+        }
+
+        long requestsBefore = placementRequests;
+        reportMeasuredCard(FxSurfaces.measurePaintedContent(engine));
+
+        if (placementRequests != requestsBefore) {
+            // The fit re-placed the card, and that round owns revealing it.
+            return;
+        }
+
+        stage.setOpacity(1);
+
+        // Asking is not landing: the window manager can move a card, size it differently, or refuse
+        // to show it at all, which is what an owner window on another desktop or minimized does to
+        // its children. Reported so a card the user never saw can be told apart from a card that was
+        // never placed.
+        if (!stage.isShowing() || (int) stage.getX() != rect.x || (int) stage.getY() != rect.y) {
+            UiLog.w("[JavaFxWidgetHost] fitThenReveal, the card was placed at " + rect + " but the"
+                + " window manager put it at " + describeStage() + ", owner=" + describeOwner());
+            return;
+        }
+
+        UiLog.d("[JavaFxWidgetHost] fitThenReveal, the card is at " + describeStage()
+            + ", web view " + (int) webView.getWidth() + "x" + (int) webView.getHeight()
+            + ", owner " + describeOwner());
+    }
+
+    /**
+     * Hands the size of the card the page actually drew to the listener.
+     * <p>
+     * The size a widget asks for is not always the size it draws: a page lays its card out at the
+     * top of the viewport, so a window even slightly taller leaves transparent space below the card,
+     * and a card that is supposed to sit on the bottom edge visibly floats above it.
+     *
+     * @param painted what the page drew, {@code null} when it could not be measured
+     */
+    private void reportMeasuredCard(int[] painted) {
+        if (listener == null || painted == null || fits >= MAX_FITS_PER_PAGE) {
+            return;
+        }
+
+        int width = painted[2];
+        int height = painted[3];
+        // A measurement is only worth acting on when it looks like a card: mid layout the wrapper
+        // measures as a sliver, and the page's own numbers are the better guess in that case.
+        if (width < MIN_CREDIBLE_CARD || height < MIN_CREDIBLE_CARD
+            || (Math.abs(width - (int) stage.getWidth()) <= FIT_TOLERANCE
+            && Math.abs(height - (int) stage.getHeight()) <= FIT_TOLERANCE)) {
+            UiLog.d("[JavaFxWidgetHost] reportMeasuredCard, declining " + width + "x" + height
+                + " against a " + (int) stage.getWidth() + "x" + (int) stage.getHeight() + " card");
+            return;
+        }
+
+        fits++;
+        UiLog.d("[JavaFxWidgetHost] reportMeasuredCard, the page drew " + width + "x" + height
+            + " in a " + (int) stage.getWidth() + "x" + (int) stage.getHeight() + " card, fitting it");
+        listener.onCardMeasured(width, height);
+    }
+
+    private String describeStage() {
+        return (int) stage.getX() + "," + (int) stage.getY() + " "
+            + (int) stage.getWidth() + "x" + (int) stage.getHeight()
+            + ", showing=" + stage.isShowing() + ", focused=" + stage.isFocused();
+    }
+
+    private String describeOwner() {
+        Window owner = stage.getOwner();
+        if (owner == null) {
+            return "none";
+        }
+        String state = owner.isShowing() ? "showing" : "not on screen";
+        if (owner instanceof Stage && ((Stage) owner).isIconified()) {
+            // A child stage of a minimized owner is not drawn, however well it was placed.
+            state = "minimized";
+        }
+        return state + " at " + (int) owner.getX() + "," + (int) owner.getY();
+    }
+
+    @Override
+    public void closeHost() {
+        closed = true;
+        if (followedFrames > 0) {
+            UiLog.d("[JavaFxWidgetHost] closeHost, followed [" + followedFrames
+                + "] animation frames since the last placement");
+        }
+        try {
+            if (watch != null) {
+                // Before the page goes: a tick against a document being torn down measures nothing
+                // useful and would keep a timer alive after the card is gone.
+                watch.stop();
+                watch = null;
+            }
+            engine.load("about:blank");
+            stage.close();
+        } catch (Throwable t) {
+            UiLog.e("[JavaFxWidgetHost] closeHost, could not close the widget card, [" + t + "]");
+        }
+    }
+
+    private void onLocationChanged(String url) {
+        WidgetAction action = WidgetActionParser.parse(url, SDKCore.logger());
+        if (!action.isSdkSignal) {
+            return;
+        }
+
+        // Signalling URLs are not real destinations: navigating to them would replace the widget
+        // with a browser error page.
+        engine.getLoadWorker().cancel();
+
+        if (listener != null) {
+            listener.onNavigationStarting(url);
+        }
+    }
+
+    private void onLoadStateChanged(Worker.State state) {
+        if (closed) {
+            // The blank page a closed card is navigated away to loads successfully too. Treating that
+            // as a page arriving re-installed the bridge, re-told the page its surface and, worst,
+            // started a fresh INDEFINITE watch timer that nothing would ever stop: one leaked engine
+            // and one immortal 3s poll per widget ever shown.
+            return;
+        }
+        if (state == Worker.State.SUCCEEDED) {
+            pageLoaded = true;
+            fits = 0;
+            installBridge();
+            // The widget's own half of the resize protocol. An NPS page keeps its parent dimensions
+            // null until this message arrives and computes every size from them, so without it
+            // getDeviceSize throws on null and the page reports no size at all: every step is then
+            // drawn at the host's fallback height, which is a scrollbar on the comment step and dead
+            // space on the thanks step. A survey does not need it, because it seeds the same
+            // dimensions from the 'custom' URL parameter itself. The page only accepts the message
+            // when its 'origin' parameter matches, which WidgetUrlBuilder sends.
+            FxSurfaces.notifyPageOfSurface(engine, surface);
+            startWatchingThePage();
+            FxSurfaces.logPageDiagnostics(engine, "JavaFxWidgetHost");
+            WebFontPrefetch.remember(engine);
+            FxSurfaces.repaintBackgroundImagesWhenTheyArrive(engine);
+            if (listener != null) {
+                listener.onPageLoaded();
+            }
+            schedulePlacementFallback();
+        } else if (state == Worker.State.FAILED && !pageLoaded) {
+            // Only the very first load matters here: later failures are the cancelled signalling
+            // navigations, which are expected.
+            if (listener != null) {
+                listener.onLoadFailed();
+            }
+        }
+    }
+
+    /**
+     * The page's own report about its card: it changed size, or its content stopped fitting.
+     * <p>
+     * This is the fast path and the only one that needs to be. It arrives as the page lays the step
+     * out, rather than a fifth of a second to a second later, which is what a timer on this side
+     * could manage.
+     *
+     * @param width the card the page has drawn
+     * @param height its height
+     * @param overflow how much taller its content is than the room it has
+     */
+    private void onObservedCard(int width, int height, int overflow) {
+        if (closed || !pageLoaded || !placed || listener == null) {
+            return;
+        }
+        if (width < MIN_CREDIBLE_CARD || height < MIN_CREDIBLE_CARD) {
+            return;
+        }
+
+        // Overflow means the page has capped its own card and the content does not fit, so the card
+        // has to be told to grow beyond what the page drew. Budgeted, because growing changes what
+        // the page then reports and could otherwise chase itself.
+        if (overflow > FIT_TOLERANCE && (int) stage.getHeight() < surface.height) {
+            if (corrections >= MAX_WATCH_CORRECTIONS) {
+                return;
+            }
+            corrections++;
+            UiLog.d("[JavaFxWidgetHost] onObservedCard, the content needs [" + overflow
+                + "] more pixels than its " + (int) stage.getHeight() + " tall card");
+            listener.onContentOverflow(overflow);
+            return;
+        }
+
+        if (width == (int) stage.getWidth() && height == (int) stage.getHeight()) {
+            return;
+        }
+
+        // Every other report is a frame of the page's own animation, and following it is the whole
+        // point: no per-frame logging, no budget, no fitting. A pixel of difference is worth
+        // following, which is why this does not use FIT_TOLERANCE. Counted, so a log can show the
+        // animation was followed at all, in one line rather than one per frame.
+        followedFrames++;
+        listener.onCardFollowing(width, height);
+    }
+
+    /**
+     * Follows the page while the widget is on screen, correcting the card when it stops matching.
+     * <p>
+     * Everything else here reacts to something: a load finishing, or the page asking for a size
+     * through {@code resize_me}. Both proved unreliable for a widget that moves between steps - the
+     * page announces some steps and not others, and a step that is not announced produces no
+     * placement, so nothing was scheduled to notice that the card no longer fits. Driving the live
+     * server, an NPS comment step sat 55 pixels short with a scrollbar for exactly that reason.
+     * <p>
+     * So the card is also checked on a timer, which needs nothing from the page. A check that finds
+     * the card already correct does nothing and says nothing.
+     */
+    private void startWatchingThePage() {
+        if (watch != null || closed) {
+            return;
+        }
+        watch = new Timeline(new KeyFrame(WATCH_INTERVAL, event -> {
+            if (!pageLoaded || !placed || listener == null || corrections >= MAX_WATCH_CORRECTIONS) {
+                return;
+            }
+
+            int[] painted = FxSurfaces.measurePaintedContent(engine);
+            int overflow = FxSurfaces.measureOverflow(engine);
+            int cardHeight = (int) stage.getHeight();
+            int cardWidth = (int) stage.getWidth();
+
+            if (overflow > FIT_TOLERANCE && cardHeight < surface.height) {
+                corrections++;
+                UiLog.d("[JavaFxWidgetHost] watch, the content needs [" + overflow
+                    + "] more pixels than its " + cardHeight + " tall card");
+                listener.onContentOverflow(overflow);
+                return;
+            }
+
+            // The other direction: a step shorter than the one before it leaves the card too tall,
+            // and a card taller than what it draws floats above the edge it is anchored to.
+            if (painted == null || painted[2] < MIN_CREDIBLE_CARD || painted[3] < MIN_CREDIBLE_CARD) {
+                return;
+            }
+            if (Math.abs(painted[2] - cardWidth) <= FIT_TOLERANCE
+                && Math.abs(painted[3] - cardHeight) <= FIT_TOLERANCE) {
+                return;
+            }
+
+            corrections++;
+            UiLog.d("[JavaFxWidgetHost] watch, the page now draws " + painted[2] + "x" + painted[3]
+                + " in a " + cardWidth + "x" + cardHeight + " card, fitting it");
+            listener.onCardMeasured(painted[2], painted[3]);
+        }));
+        watch.setCycleCount(Animation.INDEFINITE);
+        watch.play();
+    }
+
+    private void installBridge() {
+        try {
+            JSObject window = (JSObject) engine.executeScript("window");
+            // Held in a field on purpose. The engine keeps only a weak reference to an object handed
+            // to setMember, so a bridge created inline is garbage collected the first time the
+            // collector runs, and from then on every call the page makes into it is dropped without
+            // a trace. That is exactly how it failed on a customer's machine: the page's first
+            // message arrived, and nothing after it ever did. A test JVM rarely collects in time,
+            // which is why the tests kept passing.
+            if (bridge == null) {
+                bridge = new WidgetJsBridge(listener, this::onObservedCard);
+            }
+            window.setMember(WidgetJsBridge.MEMBER_NAME, bridge);
+            Object result = engine.executeScript(WidgetJsBridge.INSTALL_SCRIPT);
+            UiLog.d("[JavaFxWidgetHost] installBridge, " + result);
+        } catch (Throwable t) {
+            // Without the bridge a widget can still close itself through a signalling URL, it just
+            // cannot report its own card size, so the fallback placement takes over.
+            UiLog.w("[JavaFxWidgetHost] installBridge, could not install the JavaScript bridge, [" + t + "]");
+        }
+    }
+
+    private void scheduleLoadDeadline() {
+        PauseTransition deadline = new PauseTransition(loadTimeout);
+        deadline.setOnFinished(event -> {
+            if (pageLoaded) {
+                return;
+            }
+            UiLog.w("[JavaFxWidgetHost] the widget page did not load within " + loadTimeout.toSeconds()
+                + "s, giving up on it");
+            if (listener != null) {
+                listener.onLoadFailed();
+            }
+        });
+        deadline.play();
+    }
+
+    private void schedulePlacementFallback() {
+        PauseTransition wait = new PauseTransition(PLACEMENT_FALLBACK_DELAY);
+        wait.setOnFinished(event -> {
+            if (!placed) {
+                reportMissingSize();
+            }
+        });
+        wait.play();
+    }
+
+    /**
+     * Reports a widget that never told us how big its card is, along with the size of whatever it
+     * did paint. Only the listener knows the widget type, and the type is what decides the card, so
+     * the decision belongs there: a rating never reports a size and paints only its sticky tab, so
+     * placing the measurement gave a sliver of a window.
+     * <p>
+     * A widget page that could not be measured is still shown. Being unmeasurable used to be read as
+     * "not a widget page" and the card was closed, which cost exactly what it was meant to prevent:
+     * these templates wrap their card in a transparent wrapper, so a perfectly good page measured as
+     * nothing, and any widget whose own size message arrived later than this deadline was killed
+     * before it appeared. What the server actually served is asked separately, by looking for the
+     * templates' own elements.
+     */
+    private void reportMissingSize() {
+        if (listener == null) {
+            return;
+        }
+
+        if (!FxSurfaces.looksLikeWidgetPage(engine)) {
+            UiLog.w("[JavaFxWidgetHost] reportMissingSize, the document is not a widget page, so the"
+                + " server served something else: treating it as a failed load");
+            listener.onLoadFailed();
+            return;
+        }
+
+        int[] card = FxSurfaces.measurePaintedContent(engine);
+        UiLog.d("[JavaFxWidgetHost] reportMissingSize, the widget has reported no size; it painted "
+            + (card == null ? "nothing measurable" : card[2] + "x" + card[3]));
+        listener.onSizeNotReported(card == null ? 0 : card[2], card == null ? 0 : card[3]);
+    }
+
+    /**
+     * @return the web view this host drives, so a caller can put it in a scene
+     */
+    WebView getWebView() {
+        return webView;
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/PresentationLock.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/PresentationLock.java
new file mode 100644
index 000000000..1f298042d
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/PresentationLock.java
@@ -0,0 +1,72 @@
+package ly.count.sdk.java.ui;
+
+import javafx.application.Platform;
+
+/**
+ * One presentation at a time, across feedback widgets and content blocks alike.
+ * <p>
+ * Every other SDK enforces this: Android's {@code showContentOverlay} refuses when
+ * {@code ContentOverlayView.isOtherOverlayPresented} says a content or feedback overlay is already
+ * up, and skips the content. Two cards on screen at once would fight for the same edge of the
+ * window, and a survey opening over a content block would leave the block's close event unrecorded
+ * when the survey took the click meant for it.
+ * <p>
+ * The refused caller is told straight away, through the same callback a dismissal uses, so nothing
+ * waits on a card that will never show. For content that means the zone carries on and fetches
+ * again after its interval, exactly as Android's {@code shouldFetchContents = true} does.
+ * <p>
+ * Only ever touched on the JavaFX application thread, so a plain field is enough.
+ */
+final class PresentationLock {
+
+    private static String showing;
+
+    private PresentationLock() {
+    }
+
+    /**
+     * @param what a description of what wants to show, for the log
+     * @return {@code true} when it may show; {@code false} when something else is already on screen
+     */
+    static boolean tryAcquire(String what) {
+        if (showing != null) {
+            UiLog.w("[PresentationLock] " + what + " cannot be shown: " + showing
+                + " is already being shown, skipping");
+            return false;
+        }
+        showing = what;
+        return true;
+    }
+
+    /**
+     * Frees the screen for the next presentation. Safe to call more than once, and from any thread:
+     * a close can arrive from the page, the window manager or the SDK, and each path releases.
+     */
+    static void release(String what) {
+        if (what == null) {
+            return;
+        }
+        if (!Platform.isFxApplicationThread()) {
+            try {
+                Platform.runLater(() -> release(what));
+                return;
+            } catch (IllegalStateException toolkitNotRunning) {
+                // No application thread to hop to, and nothing else can be touching the field
+                // either: clear it here rather than let a close go unreported.
+            }
+        }
+        if (what.equals(showing)) {
+            showing = null;
+        }
+    }
+
+    /** @return what is on screen, or {@code null} when nothing is */
+    static String showing() {
+        return showing;
+    }
+
+    /** Test seam. */
+    static void resetForTests() {
+        showing = null;
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/UiLog.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/UiLog.java
new file mode 100644
index 000000000..a6d259a1c
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/UiLog.java
@@ -0,0 +1,49 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.Log;
+import ly.count.sdk.java.internal.SDKCore;
+
+/**
+ * Logs through the SDK's own logger, so everything this package prints honours the logging level
+ * and the log listener the integrator configured. Silent while the SDK is not initialized.
+ */
+final class UiLog {
+
+    private UiLog() {
+    }
+
+    static void v(String message) {
+        Log logger = SDKCore.logger();
+        if (logger != null) {
+            logger.v(message);
+        }
+    }
+
+    static void d(String message) {
+        Log logger = SDKCore.logger();
+        if (logger != null) {
+            logger.d(message);
+        }
+    }
+
+    static void i(String message) {
+        Log logger = SDKCore.logger();
+        if (logger != null) {
+            logger.i(message);
+        }
+    }
+
+    static void w(String message) {
+        Log logger = SDKCore.logger();
+        if (logger != null) {
+            logger.w(message);
+        }
+    }
+
+    static void e(String message) {
+        Log logger = SDKCore.logger();
+        if (logger != null) {
+            logger.e(message);
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WebFontPrefetch.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WebFontPrefetch.java
new file mode 100644
index 000000000..89be4edd7
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WebFontPrefetch.java
@@ -0,0 +1,307 @@
+package ly.count.sdk.java.ui;
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import javafx.animation.PauseTransition;
+import javafx.scene.web.WebEngine;
+import javafx.util.Duration;
+import ly.count.sdk.java.internal.SDKCore;
+
+/**
+ * Puts the web fonts a widget page uses into WebKit's memory cache before the first widget is shown.
+ * <p>
+ * A Countly widget or content block styles its text with web fonts fetched from the server, and it
+ * paints before they arrive: the text appears in a fallback face and swaps a second later. Every
+ * other platform's SDK avoids this without trying, because the engine it embeds has a persistent
+ * HTTP cache. JavaFX's WebKit has none (JDK-8014501) and its loader calls
+ * {@code setUseCaches(false)}, so {@link java.net.ResponseCache} is never consulted either: the same
+ * faces are fetched again on every run.
+ * <p>
+ * What is left is the engine's in-process memory cache, which is shared by every web view. So the
+ * first page a process loads is made to be a hidden one that asks for nothing but those fonts,
+ * during {@link FxSurfaces#prewarm()}, which happens at initialization rather than when a widget is
+ * due. By the time a widget page needs a face, the fetch has already happened.
+ * <p>
+ * Which faces those are is only known once a widget page has been seen, so the list is harvested
+ * from the first one ({@link #remember(WebEngine)}) and kept in the SDK's storage directory for the
+ * next run. The first run in a fresh installation therefore gains nothing; every run after it does.
+ * <p>
+ * Faces this engine cannot decode are left out. WebKit here fetches a {@code woff2} and then fails
+ * to decode it, so a page whose {@code @font-face} lists {@code woff2} before {@code woff} pays for
+ * two downloads and uses the second: only the formats that can actually be used are prefetched.
+ */
+final class WebFontPrefetch {
+
+    /** Where the harvested list lives, inside the SDK's own storage directory. */
+    private static final String FILE_NAME = "countly_display_fonts.txt";
+
+    /** A page needs a handful of faces. A cap keeps a hostile or broken page from queueing hundreds. */
+    private static final int MAX_URLS = 8;
+
+    private static final int MAX_URL_LENGTH = 512;
+
+    /** The formats this engine can decode, in the order they are preferred. */
+    private static final List<String> USABLE_EXTENSIONS = Arrays.asList(".woff", ".ttf", ".otf");
+
+    /**
+     * How long after the page loads the faces are read.
+     * <p>
+     * Not a guess: at load every face still reads {@code unloaded}, so harvesting then cannot tell
+     * the family the card uses from the four it merely declares. A moment later the used ones report
+     * {@code loading} or {@code loaded}, which is the signal this waits for.
+     */
+    static Duration settle = Duration.millis(2500); // shortened for testing purposes
+
+    /**
+     * Collects the {@code @font-face} sources of the loaded document, one URL per line.
+     * <p>
+     * Only the families the page actually used. A dashboard page declares every font it offers -
+     * Inter, Lato, Oswald, Roboto-Mono, Ubuntu - and uses one of them, so remembering them in
+     * stylesheet order spends the budget on faces no card will ever request. When nothing reports as
+     * used, every declared face is kept rather than none: a wrong guess about which font is wanted
+     * is better than an empty cache.
+     */
+    private static final String HARVEST_SCRIPT =
+        "(function(){var out=[];try{"
+            + "var used={};var anyUsed=false;"
+            + "if(document.fonts&&document.fonts.forEach){document.fonts.forEach(function(f){"
+            + "if(f.status!=='unloaded'){used[(f.family||'').replace(/['\"]/g,'')]=true;anyUsed=true;}});}"
+            + "var sheets=document.styleSheets;"
+            + "for(var i=0;i<sheets.length;i++){var rules;try{rules=sheets[i].cssRules;}catch(e){continue;}"
+            + "if(!rules){continue;}"
+            + "for(var j=0;j<rules.length;j++){var r=rules[j];"
+            + "if(!r||!r.style||r.type!==5){continue;}"
+            + "var family=(r.style.getPropertyValue('font-family')||'').replace(/['\"]/g,'');"
+            + "if(anyUsed&&!used[family]){continue;}"
+            + "var src=r.style.getPropertyValue('src')||'';"
+            + "var m=src.match(/url\\((['\"]?)([^'\")]+)\\1\\)/g)||[];"
+            + "for(var k=0;k<m.length;k++){var u=m[k].replace(/^url\\((['\"]?)/,'').replace(/(['\"]?)\\)$/,'');"
+            + "try{u=new URL(u,document.baseURI).href;}catch(e2){}"
+            + "out.push(u);}}}}catch(e3){}"
+            + "return out.join('\\n');})()";
+
+    private WebFontPrefetch() {
+    }
+
+    /**
+     * Remembers the fonts of a widget page that has just loaded, for the next run. Cheap: reads the
+     * page's own stylesheets and writes a few lines, and only when the list has changed. Call on the
+     * JavaFX application thread.
+     *
+     * @param engine the engine whose loaded document to harvest
+     */
+    static void remember(WebEngine engine) {
+        // Read after the page has settled, not on load: see the field's own note.
+        PauseTransition wait = new PauseTransition(settle);
+        wait.setOnFinished(event -> harvest(engine));
+        wait.play();
+    }
+
+    private static void harvest(WebEngine engine) {
+        List<String> urls;
+        try {
+            urls = usableUrls(String.valueOf(engine.executeScript(HARVEST_SCRIPT)));
+        } catch (Throwable t) {
+            // A page that refuses to be scripted costs the next run its head start, nothing more.
+            UiLog.d("[WebFontPrefetch] remember, could not read the page's fonts, [" + t + "]");
+            return;
+        }
+        if (urls.isEmpty()) {
+            return;
+        }
+
+        File file = listFile();
+        if (file == null) {
+            return;
+        }
+        // Off the application thread: the widget is on screen and must not wait for a disk write.
+        Thread writer = new Thread(() -> write(file, urls), "cly-font-list");
+        writer.setDaemon(true);
+        writer.start();
+
+        // And warm them now, in this run. The card that taught us these URLs may be closed before it
+        // finishes fetching them - closing its window cancels the download - which left the next card
+        // in the same run fetching from scratch. The warm-up view outlives every card, so a fetch
+        // started there cannot be cancelled by one closing.
+        FxSurfaces.warmFonts(warmupPageFor(urls));
+    }
+
+    /**
+     * The page to load into the hidden warm-up view: it declares the remembered faces and asks for
+     * each one, which is what makes the engine fetch it.
+     *
+     * @return the page, or {@code null} when nothing has been remembered yet
+     */
+    static String warmupPage() {
+        return warmupPageFor(read());
+    }
+
+    /**
+     * @param urls the faces to fetch
+     * @return a page that asks for each of them, or {@code null} when there are none
+     */
+    static String warmupPageFor(List<String> urls) {
+        if (urls.isEmpty()) {
+            return null;
+        }
+
+        StringBuilder faces = new StringBuilder();
+        StringBuilder families = new StringBuilder();
+        for (int i = 0; i < urls.size(); i++) {
+            String family = "cly-prefetch-" + i;
+            faces.append("@font-face{font-family:'").append(family).append("';src:url('")
+                .append(urls.get(i)).append("') format('").append(formatOf(urls.get(i))).append("');}");
+            if (i > 0) {
+                families.append(',');
+            }
+            families.append('\'').append(family).append('\'');
+        }
+
+        // document.fonts.load, not layout: the view has no scene, so nothing would use the faces and
+        // a declared but unused face is never fetched.
+        return "<html><head><style>" + faces + "</style></head><body><script>"
+            + "if(document.fonts&&document.fonts.load){[" + families + "].forEach(function(f){"
+            + "try{document.fonts.load('16px '+f);}catch(e){}});}"
+            + "</script></body></html>";
+    }
+
+    /** @return how many faces are remembered, for logging and tests */
+    static int rememberedCount() {
+        return read().size();
+    }
+
+    /** Forgets the remembered list. Test seam, and the way an integrator's storage stays tidy. */
+    static void forget() {
+        File file = listFile();
+        if (file != null && file.exists() && !file.delete()) {
+            UiLog.d("[WebFontPrefetch] forget, could not delete [" + file + "]");
+        }
+    }
+
+    /**
+     * Keeps only what is worth fetching: absolute http(s) URLs in a format this engine can decode,
+     * free of the characters that would let a URL break out of the page built around it, deduplicated
+     * and capped.
+     */
+    private static List<String> usableUrls(String harvested) {
+        if (harvested == null || harvested.isEmpty() || "null".equals(harvested)) {
+            return new ArrayList<>();
+        }
+
+        Set<String> unique = new LinkedHashSet<>();
+        // One format per face. A page lists the same face as woff2, woff and ttf, and this engine
+        // uses the first of those it can decode: warming the others would spend the budget on bytes
+        // no page will ask for. USABLE_EXTENSIONS is in the engine's own order of preference, and
+        // the harvested lines keep the stylesheet's order, so the first usable line for a face wins.
+        Set<String> faces = new LinkedHashSet<>();
+        for (String line : harvested.split("\n")) {
+            String url = line.trim();
+            if (!isUsable(url) || !faces.add(withoutExtension(url))) {
+                continue;
+            }
+            unique.add(url);
+            if (unique.size() == MAX_URLS) {
+                break;
+            }
+        }
+        return new ArrayList<>(unique);
+    }
+
+    private static boolean isUsable(String url) {
+        if (url.isEmpty() || url.length() > MAX_URL_LENGTH) {
+            return false;
+        }
+        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+            return false;
+        }
+        for (int i = 0; i < url.length(); i++) {
+            char c = url.charAt(i);
+            boolean safe = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9')
+                || ":/._?&=%~+-#".indexOf(c) >= 0;
+            if (!safe) {
+                return false;
+            }
+        }
+        return extensionOf(url) != null;
+    }
+
+    /** @return the usable extension the URL's path ends in, ignoring a query or fragment, or null */
+    private static String extensionOf(String url) {
+        String path = url;
+        int cut = path.indexOf('?');
+        if (cut < 0) {
+            cut = path.indexOf('#');
+        }
+        if (cut >= 0) {
+            path = path.substring(0, cut);
+        }
+        String lower = path.toLowerCase();
+        for (String extension : USABLE_EXTENSIONS) {
+            if (lower.endsWith(extension)) {
+                return extension;
+            }
+        }
+        return null;
+    }
+
+    /** @return the URL without the font extension, which is what identifies one face */
+    private static String withoutExtension(String url) {
+        String extension = extensionOf(url);
+        return extension == null ? url : url.substring(0, url.length() - extension.length());
+    }
+
+    private static String formatOf(String url) {
+        String extension = extensionOf(url);
+        if (".woff".equals(extension)) {
+            return "woff";
+        }
+        if (".otf".equals(extension)) {
+            return "opentype";
+        }
+        return "truetype";
+    }
+
+    private static File listFile() {
+        File directory = SDKCore.sdkStorageDirectory();
+        if (directory == null) {
+            // Before initialization, or after the SDK was stopped: no place to keep it.
+            return null;
+        }
+        return new File(directory, FILE_NAME);
+    }
+
+    private static synchronized void write(File file, List<String> urls) {
+        try {
+            String contents = String.join("\n", urls);
+            Path path = file.toPath();
+            if (file.exists() && contents.equals(new String(Files.readAllBytes(path), StandardCharsets.UTF_8))) {
+                return;
+            }
+            Files.write(path, contents.getBytes(StandardCharsets.UTF_8));
+            UiLog.d("[WebFontPrefetch] remembered [" + urls.size() + "] font URLs for the next run");
+        } catch (Throwable t) {
+            // The next run just pays for the fonts again.
+            UiLog.d("[WebFontPrefetch] could not remember the page's fonts, [" + t + "]");
+        }
+    }
+
+    private static synchronized List<String> read() {
+        File file = listFile();
+        if (file == null || !file.exists()) {
+            return new ArrayList<>();
+        }
+        try {
+            return usableUrls(new String(Files.readAllBytes(file.toPath()), StandardCharsets.UTF_8));
+        } catch (Throwable t) {
+            UiLog.d("[WebFontPrefetch] could not read the remembered fonts, [" + t + "]");
+            return new ArrayList<>();
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetJsBridge.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetJsBridge.java
new file mode 100644
index 000000000..a9ca05788
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetJsBridge.java
@@ -0,0 +1,134 @@
+package ly.count.sdk.java.ui;
+
+/**
+ * Handed into the page as a JavaScript member so a widget can reach Java. Must be public, and its
+ * methods must be public, for the JavaFX web engine to call them.
+ */
+public class WidgetJsBridge {
+
+    /**
+     * The JavaScript member name the page posts to.
+     */
+    static final String MEMBER_NAME = "countlyJavaBridge";
+
+    /**
+     * What the page reports about its card, whenever it changes.
+     */
+    interface CardObserver {
+
+        /**
+         * @param width the width of the card the page has drawn
+         * @param height its height
+         * @param overflow how much taller the content is than the room it has, 0 when it fits
+         */
+        void onObservedCard(int width, int height, int overflow);
+    }
+
+    /**
+     * Installs both halves of the page's side of the conversation.
+     * <p>
+     * The first is the {@code cly_widget_command} messages a widget posts - {@code resize_me},
+     * {@code close}, a link - forwarded as they arrive.
+     * <p>
+     * The second watches the card. A widget page announces its size for some steps and not others,
+     * and waiting on those announcements meant a step that was never announced kept the previous
+     * step's card: an NPS comment step sat 55 pixels short, with a scrollbar, until something else
+     * happened to disturb it. Watching from Java instead meant polling on a timer, which was both
+     * slow to react and wasteful. So the page is asked to report its own card, which it knows
+     * immediately: a {@code ResizeObserver} where there is one, a {@code MutationObserver} for the
+     * step swaps that replace elements, and a cheap interval as a backstop. All three funnel through
+     * one function that crosses into Java only when the numbers actually changed.
+     */
+    static final String INSTALL_SCRIPT =
+        "(function(){if(window.__clyBridgeInstalled){return 'already installed';}"
+            + "window.__clyBridgeInstalled=true;"
+            + "var bridge=window." + MEMBER_NAME + ";"
+            + "window.addEventListener('message',function(ev){try{"
+            + "var d=typeof ev.data==='string'?JSON.parse(ev.data):ev.data;"
+            + "if(d&&d.cly_widget_command){bridge.post(JSON.stringify(d));}"
+            + "}catch(e){}});"
+            + "var last='';var watched=null;var ro=null;"
+            + "function measure(){try{"
+            + "var el=document.querySelector('" + FxSurfaces.WIDGET_MARKERS + "');"
+            + "if(!el){return;}"
+            // The card element does not exist when this is installed - the bridge goes in as soon as
+            // there is a document, which is the only way to catch the page's first message - so the
+            // observer is attached the first time the card is actually found.
+            + "if(ro&&watched!==el){try{if(watched){ro.unobserve(watched);}ro.observe(el);watched=el;}catch(e){}}"
+            + "var r=el.getBoundingClientRect();"
+            + "var w=Math.round(r.width);var h=Math.round(r.height);"
+            + "if(w<40||h<40){return;}"
+            + "var d=document.documentElement;var b=document.body;"
+            + "var need=Math.max(d.scrollHeight||0,b?b.scrollHeight||0:0);"
+            + "var have=Math.max(d.clientHeight||0,window.innerHeight||0);"
+            + "var over=Math.max(0,need-have);"
+            + "var key=w+'x'+h+':'+over;if(key===last){return;}last=key;"
+            + "bridge.cardChanged(w+','+h+','+over);"
+            + "}catch(e){}}"
+            // Reported per frame, deliberately. A step swap animates its height and this engine's
+            // ResizeObserver fires on every frame of that animation, so the card's window follows
+            // the content as it grows: the animation and the window move together, which is what
+            // reads as smooth. Coalescing these into one resize at the end was measurably worse -
+            // the content animates inside a stale window and then the window snaps.
+            + "if(window.ResizeObserver){try{ro=new ResizeObserver(measure);"
+            + "ro.observe(document.documentElement);}catch(e){ro=null;}}"
+            + "if(window.MutationObserver){try{new MutationObserver(measure).observe("
+            + "document.documentElement,{childList:true,subtree:true,attributes:true,"
+            + "attributeFilter:['style','class']});}catch(e){}}"
+            // The end of an animation, so a card that settled on a size a frame after the last
+            // observer callback is not left a few pixels out.
+            + "document.addEventListener('transitionend',measure,true);"
+            + "document.addEventListener('animationend',measure,true);"
+            // A backstop for a step that changes without animating, mutating or resizing anything
+            // these observers are watching.
+            + "setInterval(measure,500);measure();"
+            + "return 'installed';})();";
+
+    private final WidgetWebHost.Listener listener;
+    private final CardObserver observer;
+
+    WidgetJsBridge(WidgetWebHost.Listener listener, CardObserver observer) {
+        this.listener = listener;
+        this.observer = observer;
+    }
+
+    /**
+     * Called from JavaScript.
+     *
+     * @param json the payload the widget posted
+     */
+    public void post(String json) {
+        if (listener == null) {
+            return;
+        }
+        try {
+            listener.onWidgetMessage(json);
+        } catch (Throwable t) {
+            UiLog.e("[WidgetJsBridge] post, failed to handle a widget message, [" + t + "]");
+        }
+    }
+
+    /**
+     * Called from JavaScript, whenever the card the page draws changes size or stops fitting.
+     *
+     * @param report the card as {@code "width,height,overflow"}
+     */
+    public void cardChanged(String report) {
+        if (observer == null || report == null) {
+            return;
+        }
+        try {
+            // "width,height,overflow". A String rather than three numbers: this engine binds a
+            // String parameter reliably, which post proves, while a three-argument numeric method
+            // silently failed to resolve on a customer's machine and the page's report went nowhere.
+            String[] parts = report.split(",");
+            if (parts.length != 3) {
+                return;
+            }
+            observer.onObservedCard(Integer.parseInt(parts[0].trim()),
+                Integer.parseInt(parts[1].trim()), Integer.parseInt(parts[2].trim()));
+        } catch (Throwable t) {
+            UiLog.w("[WidgetJsBridge] cardChanged, could not read [" + report + "], [" + t + "]");
+        }
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetLayout.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetLayout.java
new file mode 100644
index 000000000..9333204f5
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetLayout.java
@@ -0,0 +1,114 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+
+/**
+ * Where a feedback widget card belongs on screen, per widget type.
+ * <p>
+ * A widget page works out its own card size and posts it as a {@code resize_me} rect, and that size
+ * is authoritative: it comes from the page measuring its own content against its own maximums. What
+ * the rect does not carry is the anchor, because on the web the SDK's stylesheet supplies it, and
+ * the page's numbers assume those rules are applied:
+ * <ul>
+ *     <li>NPS reports {@code x = parentWidth / 2} and relies on
+ *     {@code transform:translateX(-50%)} to pull the card back by half its width. Applied to a
+ *     window as it stands, that puts the card half a card right of centre.</li>
+ *     <li>A survey reports {@code x = 0} and carries its {@code appearance.position} as a class
+ *     instead: {@code .bLeft} sits {@code 50px} from the left, {@code .bRight} {@code 50px} from the
+ *     right. Both are {@code bottom:0}, which the reported {@code y} already accounts for.</li>
+ *     <li>A rating reports no rect at all. Its page only paints the little sticky tab; on the web the
+ *     popup lives in a {@code 400x800} iframe centred by a flex wrapper
+ *     ({@code star-rating/stylesheets/countly-feedback-web.css}). Measuring what the page painted
+ *     gives the tab, which is a sliver.</li>
+ * </ul>
+ * Toolkit free, so all of this is testable without a JavaFX toolkit.
+ */
+final class WidgetLayout {
+
+    /** The fixed size of the web SDK's {@code #countly-ratings-iframe}. */
+    static final int RATING_WIDTH = 400;
+    static final int RATING_HEIGHT = 800;
+
+    /** The 50px gap .bLeft and .bRight put between a survey card and the screen edge. */
+    static final int SIDE_MARGIN = 50;
+
+    /**
+     * Used only when a widget reported no size of its own and painted nothing worth measuring:
+     * {@code max-width:480px} from the surveys stylesheet, and its per type max height.
+     */
+    static final int DEFAULT_WIDTH = 480;
+    static final int NPS_DEFAULT_HEIGHT = 450;
+    static final int SURVEY_DEFAULT_HEIGHT = 650;
+
+    private WidgetLayout() {
+    }
+
+    /**
+     * Whether a widget of this type is laid out from the size it reports.
+     *
+     * @param type the widget type, may be {@code null}
+     * @return {@code false} for a rating, whose card is a fixed size, so measuring the page and
+     *     re-placing it can only ever produce the same rectangle
+     */
+    static boolean usesReportedSize(FeedbackWidgetType type) {
+        return type != FeedbackWidgetType.rating;
+    }
+
+    /**
+     * @param type the widget being shown, may be {@code null} when it is not known
+     * @param position the widget's {@code appearance.position} ("bLeft"/"bRight"), may be
+     *     {@code null} when the server did not send one
+     * @param surface the area the card may occupy, screen absolute
+     * @param requested the rect the widget asked for, or {@code null} when it asked for nothing
+     * @return where to put the card
+     */
+    static ContentPlacement resolve(FeedbackWidgetType type, String position, WidgetSurface surface, ContentPlacement requested) {
+        if (type == FeedbackWidgetType.rating) {
+            // Deliberately ignores anything the page reported: the tab it paints is not the card.
+            return centred(surface, RATING_WIDTH, RATING_HEIGHT);
+        }
+
+        int width = clamp(requested == null || requested.width <= 0 ? DEFAULT_WIDTH : requested.width, surface.width);
+        int defaultHeight = type == FeedbackWidgetType.nps ? NPS_DEFAULT_HEIGHT : SURVEY_DEFAULT_HEIGHT;
+        int height = clamp(requested == null || requested.height <= 0 ? defaultHeight : requested.height, surface.height);
+
+        if (type == null) {
+            // An unknown type has no anchor to apply, so it goes in the middle.
+            return centred(surface, width, height);
+        }
+
+        // bottom:0 for both NPS and surveys, which is also what the reported y works out to.
+        int y = surface.y + Math.max(0, surface.height - height);
+        return new ContentPlacement(surface.x + horizontalOffset(type, position, surface, width), y, width, height);
+    }
+
+    private static int horizontalOffset(FeedbackWidgetType type, String position, WidgetSurface surface, int width) {
+        if (type == FeedbackWidgetType.nps) {
+            // left:50% plus translateX(-50%) is the centre, whatever the reported x looks like. The
+            // page itself already subtracts half the width below 1025px wide, so both branches of
+            // its own breakpoint end up here.
+            return Math.max(0, (surface.width - width) / 2);
+        }
+
+        if (position != null && position.trim().equalsIgnoreCase("bRight")) {
+            return Math.max(0, surface.width - width - SIDE_MARGIN);
+        }
+        // bLeft is the default: the web SDK always adds a position class for surveys, and every
+        // template ships one of the two.
+        return Math.min(SIDE_MARGIN, Math.max(0, surface.width - width));
+    }
+
+    private static ContentPlacement centred(WidgetSurface surface, int requestedWidth, int requestedHeight) {
+        int width = clamp(requestedWidth, surface.width);
+        int height = clamp(requestedHeight, surface.height);
+        return new ContentPlacement(
+            surface.x + Math.max(0, (surface.width - width) / 2),
+            surface.y + Math.max(0, (surface.height - height) / 2),
+            width, height);
+    }
+
+    private static int clamp(int value, int available) {
+        return Math.max(1, Math.min(value, available));
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetMessageParser.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetMessageParser.java
new file mode 100644
index 000000000..ae731457d
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetMessageParser.java
@@ -0,0 +1,79 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.WidgetAction;
+import org.json.JSONObject;
+
+/**
+ * Parses the {@code postMessage} payloads a feedback widget sends, the
+ * {@code {cly_widget_command, action:'resize_me', resize_me:{p,l}, close}} shape. This is a
+ * different channel from the URL based signals that
+ * {@link ly.count.sdk.java.internal.WidgetActionParser} handles: a widget rendered with the web
+ * model reports its own card size this way rather than by navigating.
+ */
+public class WidgetMessageParser {
+
+    private WidgetMessageParser() {
+    }
+
+    /**
+     * @param json the bridged payload
+     * @return the parsed signal, or {@code null} when the payload is not a widget command
+     */
+    public static WidgetAction parse(String json) {
+        if (json == null || json.trim().isEmpty()) {
+            return null;
+        }
+
+        JSONObject root;
+        try {
+            root = new JSONObject(json);
+        } catch (Throwable t) {
+            return null;
+        }
+
+        if (!root.has("cly_widget_command")) {
+            return null;
+        }
+
+        WidgetAction action = new WidgetAction();
+        action.isSdkSignal = true;
+        action.isWidgetCommand = true;
+        action.close = isTruthy(root.opt("close"));
+
+        JSONObject resize = root.optJSONObject("resize_me");
+        if (resize != null) {
+            action.portrait = toPlacement(resize.optJSONObject("p"));
+            action.landscape = toPlacement(resize.optJSONObject("l"));
+            action.hasResize = action.portrait != null || action.landscape != null;
+        }
+
+        return action;
+    }
+
+    private static ContentPlacement toPlacement(JSONObject rect) {
+        if (rect == null) {
+            return null;
+        }
+        int width = rect.optInt("w", 0);
+        int height = rect.optInt("h", 0);
+        if (width <= 0 || height <= 0) {
+            return null;
+        }
+        return new ContentPlacement(rect.optInt("x", 0), rect.optInt("y", 0), width, height);
+    }
+
+    private static boolean isTruthy(Object value) {
+        if (value == null) {
+            return false;
+        }
+        if (value instanceof Boolean) {
+            return (Boolean) value;
+        }
+        if (value instanceof Number) {
+            return ((Number) value).doubleValue() != 0;
+        }
+        String asString = value.toString();
+        return "1".equals(asString) || "true".equalsIgnoreCase(asString);
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetPlacement.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetPlacement.java
new file mode 100644
index 000000000..5860599e9
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetPlacement.java
@@ -0,0 +1,155 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.WidgetAction;
+
+/**
+ * Maps a rectangle a widget or a content block asked for, which is relative to the surface the SDK
+ * reported, onto a screen absolute rectangle that stays inside that surface.
+ */
+public class WidgetPlacement {
+
+    private WidgetPlacement() {
+    }
+
+    /**
+     * @param rect the requested rectangle, relative to the surface
+     * @param surface the surface the rectangle has to fit into
+     * @return a screen absolute rectangle, or {@code null} when there is nothing to place
+     */
+    public static ContentPlacement resolve(ContentPlacement rect, WidgetSurface surface) {
+        if (rect == null || surface == null) {
+            return null;
+        }
+
+        int width = Math.min(rect.width, surface.width);
+        int height = Math.min(rect.height, surface.height);
+        int x = surface.x + clamp(rect.x, 0, Math.max(0, surface.width - width));
+        int y = surface.y + clamp(rect.y, 0, Math.max(0, surface.height - height));
+
+        return new ContentPlacement(x, y, width, height);
+    }
+
+    /**
+     * @param action the signal carrying the requested rectangle
+     * @param surface the surface the rectangle has to fit into
+     * @return a screen absolute rectangle, or {@code null} when the action carries none
+     */
+    public static ContentPlacement resolve(WidgetAction action, WidgetSurface surface) {
+        if (action == null || surface == null) {
+            return null;
+        }
+        return resolve(action.resizeFor(surface.isLandscape()), surface);
+    }
+
+    /**
+     * The rectangle a block on screen should occupy now, given both parties that have an opinion.
+     * <p>
+     * The page outranks the server once it has spoken: only the page knows how tall its own content
+     * turned out, which is what {@code resize_me} is for, and Android likewise replaces its stored
+     * config when that arrives. Whichever rectangle is used is re-stated in the current surface's
+     * proportions, because it was computed against the surface in force at the time.
+     *
+     * @param pageRect what the page last asked for, or {@code null} if it never did
+     * @param pageSurface the surface the page asked against
+     * @param serverRect what the server computed at fetch
+     * @param serverSurface the surface reported to the server
+     * @param current the surface the block sits on now
+     * @return a screen absolute rectangle, or {@code null} when there is nothing to place
+     */
+    public static ContentPlacement following(ContentPlacement pageRect, WidgetSurface pageSurface,
+        ContentPlacement serverRect, WidgetSurface serverSurface, WidgetSurface current) {
+        if (pageRect != null) {
+            // A page that asked for its own rectangle sized itself - a survey hosted by the content
+            // queue asks for its 500 wide card whatever the window is. That size is not a proportion
+            // of anything, so scaling it with the window is wrong: shrinking the application window
+            // squeezed a hosted survey to a sliver, its title one letter per line, while the same
+            // survey shown as a widget kept its width and was merely clamped. Keep the size, put it
+            // against the edges it was against, clamp it onto the current surface; the page re-anchors
+            // itself too once it is told the new room. The server's rectangle is what scales, because
+            // it is a proportion of the area.
+            return resolve(reanchor(pageRect, pageSurface, current), current);
+        }
+        return resolve(rescale(serverRect, serverSurface, current), current);
+    }
+
+    /**
+     * Moves a page-sized rectangle to a new surface by keeping it against the edges it was against.
+     * <p>
+     * A page computes its position for the area it was told about: a bottom-left survey puts itself
+     * at {@code y = height - h}. When the window then grows taller, that number is stale, and keeping
+     * it left the card floating mid-window until the page happened to recompute. The edge a card
+     * hugs is recoverable from its margins - the smaller margin on each axis is the one it was placed
+     * by - so the card is put the same distance from the same edge of the new surface. Equal margins
+     * mean centred, and stay centred.
+     *
+     * @param rect the page's rectangle, surface relative
+     * @param from the surface it was computed against, {@code null} if unknown
+     * @param to the surface it is being placed on now
+     * @return the rectangle re-anchored on {@code to}, surface relative
+     */
+    static ContentPlacement reanchor(ContentPlacement rect, WidgetSurface from, WidgetSurface to) {
+        if (rect == null || from == null || to == null || from.width <= 0 || from.height <= 0) {
+            return rect;
+        }
+        if (from.width == to.width && from.height == to.height) {
+            return rect;
+        }
+        return new ContentPlacement(
+            along(rect.x, rect.width, from.width, to.width),
+            along(rect.y, rect.height, from.height, to.height),
+            rect.width, rect.height);
+    }
+
+    /** One axis of {@link #reanchor}: the offset that keeps the smaller margin, or the centre. */
+    private static int along(int start, int size, int fromExtent, int toExtent) {
+        int leading = start;
+        int trailing = fromExtent - (start + size);
+        if (Math.abs(leading - trailing) <= 2) {
+            return Math.max(0, (toExtent - size) / 2);
+        }
+        if (leading <= trailing) {
+            return leading;
+        }
+        return toExtent - trailing - size;
+    }
+
+    /**
+     * Re-states a rectangle the server computed for one surface against another.
+     * <p>
+     * The server lays a block out as a proportion of the area it was told about - a large sticky
+     * centre block is 60% of the width, a corner one 45%, each with a cap - so the only faithful way
+     * to follow a window that changed size is to keep those proportions. Carrying the absolute
+     * rectangle over and clamping it into the new area instead squeezes the card: a 768 wide block
+     * became 487 wide as the window narrowed, rather than staying the same share of it.
+     *
+     * @param rect what the server asked for
+     * @param from the surface the server was told about, {@code null} if unknown
+     * @param to the surface the block is being placed on now
+     * @return the rectangle in {@code to}'s proportions, surface relative like the server's own
+     */
+    public static ContentPlacement rescale(ContentPlacement rect, WidgetSurface from, WidgetSurface to) {
+        if (rect == null || from == null || to == null || from.width <= 0 || from.height <= 0) {
+            return rect;
+        }
+        if (from.width == to.width && from.height == to.height) {
+            return rect;
+        }
+
+        double horizontal = (double) to.width / from.width;
+        double vertical = (double) to.height / from.height;
+
+        return new ContentPlacement(
+            (int) Math.round(rect.x * horizontal),
+            (int) Math.round(rect.y * vertical),
+            (int) Math.round(rect.width * horizontal),
+            (int) Math.round(rect.height * vertical));
+    }
+
+    private static int clamp(int value, int low, int high) {
+        if (value < low) {
+            return low;
+        }
+        return Math.min(value, high);
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetSurface.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetSurface.java
new file mode 100644
index 000000000..cc6db3be1
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetSurface.java
@@ -0,0 +1,49 @@
+package ly.count.sdk.java.ui;
+
+/**
+ * The area a feedback widget or a content block may be placed on, in screen absolute JavaFX
+ * coordinates. JavaFX already works in logical pixels, so these are the same units a web page lays
+ * itself out in and no density conversion is needed.
+ */
+public class WidgetSurface {
+
+    public final int x;
+    public final int y;
+    public final int width;
+    public final int height;
+
+    public WidgetSurface(int x, int y, int width, int height) {
+        this.x = x;
+        this.y = y;
+        this.width = width;
+        this.height = height;
+    }
+
+    /**
+     * @return {@code true} when the surface is wider than it is tall
+     */
+    public boolean isLandscape() {
+        return width >= height;
+    }
+
+    /**
+     * @param other the surface to compare against, may be {@code null}
+     * @return whether the two describe the same area
+     */
+    public boolean sameAs(WidgetSurface other) {
+        return other != null && x == other.x && y == other.y && width == other.width && height == other.height;
+    }
+
+    /**
+     * @param other the surface to compare against, may be {@code null}
+     * @return whether the two are the same size, wherever they sit
+     */
+    public boolean sameSizeAs(WidgetSurface other) {
+        return other != null && width == other.width && height == other.height;
+    }
+
+    @Override
+    public String toString() {
+        return "WidgetSurface{x=" + x + ", y=" + y + ", width=" + width + ", height=" + height + '}';
+    }
+}
diff --git a/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetWebHost.java b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetWebHost.java
new file mode 100644
index 000000000..a9cef20e3
--- /dev/null
+++ b/sdk-java-ui/src/main/java/ly/count/sdk/java/ui/WidgetWebHost.java
@@ -0,0 +1,133 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+
+/**
+ * What {@link FeedbackWidgetPresenter} needs from an embedded browser. Keeping the presentation
+ * logic behind this interface is what makes it testable without starting a JavaFX toolkit.
+ */
+public interface WidgetWebHost {
+
+    /**
+     * Events a host reports back to whoever drives it.
+     */
+    interface Listener {
+
+        /**
+         * @param url the URL the host is about to navigate to, including the SDK's own signalling URLs
+         */
+        void onNavigationStarting(String url);
+
+        /**
+         * A postMessage payload the widget sent, bridged out of the page as raw JSON.
+         *
+         * @param json the payload
+         */
+        void onWidgetMessage(String json);
+
+        /**
+         * The widget page finished loading, so it is safe to tell it how much room it has.
+         */
+        void onPageLoaded();
+
+        /**
+         * The widget page could not be loaded at all.
+         */
+        void onLoadFailed();
+
+        /**
+         * The page loaded but never reported a card size, so the placement has to be decided from
+         * the widget type instead. Rating widgets never report one.
+         *
+         * @param paintedWidth the width of the card the page painted, {@code 0} when it painted none
+         * @param paintedHeight the height of the card the page painted, {@code 0} when it painted none
+         */
+        void onSizeNotReported(int paintedWidth, int paintedHeight);
+
+        /**
+         * The size of the card the page actually drew, once it has settled and when it differs from
+         * the size the host was given. A page draws its card at the top of the viewport, so a window
+         * any taller than the card shows transparent space underneath it, and a card meant to sit on
+         * the bottom edge floats above it instead.
+         *
+         * @param width the drawn card's width
+         * @param height the drawn card's height
+         */
+        void onCardMeasured(int width, int height);
+
+        /**
+         * Called when the page's content does not fit the card it was given.
+         * <p>
+         * Kept apart from {@link #onCardMeasured(int, int)} because the two mean different things: a
+         * measurement is a guess at what the page drew and must never override a size the page asked
+         * for outright, while an overflow is a fact about that very size - the template capped its
+         * own height and the content did not fit. The card can be grown without contradicting the
+         * page.
+         *
+         * @param extraHeight how many more pixels the content needs
+         */
+        void onContentOverflow(int extraHeight);
+
+        /**
+         * Called for every size the page reports while it is animating a step.
+         * <p>
+         * Separate from {@link #onCardMeasured(int, int)} because it happens at frame rate: the card
+         * follows the animation instead of jumping to its end state, and that means no fitting, no
+         * revealing and no budget - just geometry, as cheaply as possible.
+         *
+         * @param width the card's width at this frame
+         * @param height its height at this frame
+         */
+        void onCardFollowing(int width, int height);
+    }
+
+    /**
+     * @param listener who to report events to
+     */
+    void setListener(Listener listener);
+
+    /**
+     * @return the area the widget may place itself on
+     */
+    WidgetSurface getSurface();
+
+    /**
+     * The area moved, because the window or the screen the card belongs to did.
+     *
+     * @param surface the new area, {@code null} is ignored
+     */
+    void setSurface(WidgetSurface surface);
+
+    /**
+     * @param url the URL to load
+     */
+    void navigate(String url);
+
+    /**
+     * Moves and resizes the card, and nothing else: no fitting, no reveal, no bookkeeping. For
+     * following a page that is animating.
+     *
+     * @param rect where the card belongs now
+     */
+    void followGeometry(ContentPlacement rect);
+
+    /**
+     * Tell the page how much room it has, by posting a {@code {type:'resize',width,height}} message.
+     *
+     * @param width available width
+     * @param height available height
+     */
+    void reportSurfaceSize(int width, int height);
+
+    /**
+     * Move and size the host to the given screen absolute rectangle, and show it.
+     *
+     * @param rect where to put the host
+     */
+    void placeAndShow(ContentPlacement rect);
+
+    /**
+     * Dismiss the host.
+     */
+    void closeHost();
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/BridgeLifetimeTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/BridgeLifetimeTests.java
new file mode 100644
index 000000000..f317823cc
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/BridgeLifetimeTests.java
@@ -0,0 +1,94 @@
+package ly.count.sdk.java.ui;
+
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.concurrent.Worker;
+import javafx.scene.web.WebView;
+import netscape.javascript.JSObject;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The engine keeps only a weak reference to a Java object handed to a page, so the object has to be
+ * kept alive on the Java side or the page ends up calling into nothing. This drives the collector
+ * hard between the install and the call, which is what a long running application does by itself.
+ */
+@RunWith(JUnit4.class)
+public class BridgeLifetimeTests {
+
+    @BeforeClass
+    public static void toolkit() {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+    }
+
+    @Test
+    public void aBridgeHeldByJavaSurvivesGarbageCollection() {
+        List<String> received = new CopyOnWriteArrayList<>();
+        WidgetWebHost.Listener listener = new RecordingListener(received);
+
+        // Kept in a local for the whole test: this is the strong reference the host now holds too.
+        WidgetJsBridge held = new WidgetJsBridge(listener, (w, h, o) -> received.add("card " + w + "x" + h));
+
+        AtomicReference<WebView> viewRef = new AtomicReference<>();
+        AtomicReference<Boolean> loaded = new AtomicReference<>(false);
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            viewRef.set(webView);
+            webView.getEngine().getLoadWorker().stateProperty().addListener((o, old, state) -> {
+                if (state == Worker.State.SUCCEEDED) {
+                    JSObject window = (JSObject) webView.getEngine().executeScript("window");
+                    window.setMember(WidgetJsBridge.MEMBER_NAME, held);
+                    loaded.set(true);
+                }
+            });
+            webView.getEngine().loadContent("<html><body>x</body></html>");
+        });
+        for (int i = 0; i < 60 && !loaded.get(); i++) {
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue(loaded.get());
+
+        // The collector, several times over, with garbage to chew on.
+        for (int round = 0; round < 5; round++) {
+            byte[][] pressure = new byte[64][];
+            for (int i = 0; i < pressure.length; i++) {
+                pressure[i] = new byte[1 << 20];
+            }
+            System.gc();
+            ScenarioDriver.pause(50);
+        }
+
+        FxTestToolkit.onFx(() -> viewRef.get().getEngine().executeScript(
+            "window." + WidgetJsBridge.MEMBER_NAME + ".post('{\"cly_widget_command\":1,\"close\":1}');"
+                + "window." + WidgetJsBridge.MEMBER_NAME + ".cardChanged('480,469,0');"));
+
+        Assert.assertTrue("the page's message must still reach Java after collection: " + received,
+            received.contains("{\"cly_widget_command\":1,\"close\":1}"));
+        Assert.assertTrue("the page's card report must still reach Java after collection: " + received,
+            received.contains("card 480x469"));
+        // Still referenced here, so the collector could not have taken it before the calls above.
+        Assert.assertNotNull(held);
+    }
+
+    private static final class RecordingListener implements WidgetWebHost.Listener {
+        private final List<String> received;
+
+        RecordingListener(List<String> received) {
+            this.received = received;
+        }
+
+        @Override public void onNavigationStarting(String url) { }
+        @Override public void onWidgetMessage(String json) { received.add(json); }
+        @Override public void onPageLoaded() { }
+        @Override public void onLoadFailed() { }
+        @Override public void onSizeNotReported(int paintedWidth, int paintedHeight) { }
+        @Override public void onCardMeasured(int width, int height) { }
+        @Override public void onContentOverflow(int extraHeight) { }
+        @Override public void onCardFollowing(int width, int height) { }
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentJsBridgeTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentJsBridgeTests.java
new file mode 100644
index 000000000..6f727b186
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentJsBridgeTests.java
@@ -0,0 +1,51 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.List;
+import ly.count.sdk.java.internal.WidgetAction;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The object a content page posts to when it hosts a survey. Called here the way the engine calls
+ * it, so no toolkit is needed.
+ */
+@RunWith(JUnit4.class)
+public class ContentJsBridgeTests {
+
+    @Test
+    public void post_forwardsResizeAndCloseAndIgnoresEverythingElse() {
+        List<WidgetAction> actions = new ArrayList<>();
+        ContentJsBridge bridge = new ContentJsBridge(actions::add);
+
+        // A hosted survey's resize, as the template posts it (an object, stringified by the script).
+        bridge.post("{\"cly_widget_command\":1,\"action\":\"resize_me\",\"resize_me\":"
+            + "{\"p\":{\"x\":0,\"y\":200,\"w\":500,\"h\":620},\"l\":{\"x\":0,\"y\":200,\"w\":500,\"h\":620}}}");
+        Assert.assertEquals(1, actions.size());
+        Assert.assertTrue(actions.get(0).hasResize);
+        Assert.assertEquals(620, actions.get(0).resizeFor(true).height);
+        Assert.assertFalse(actions.get(0).close);
+
+        bridge.post("{\"cly_widget_command\":1,\"close\":1}");
+        Assert.assertEquals(2, actions.size());
+        Assert.assertTrue(actions.get(1).close);
+
+        // Not a widget command, not JSON, nothing at all: none of it reaches the display.
+        bridge.post("{\"type\":\"resize\",\"width\":1280,\"height\":820}");
+        bridge.post("not json");
+        bridge.post(null);
+        new ContentJsBridge(null).post("{\"cly_widget_command\":1,\"close\":1}");
+        Assert.assertEquals(2, actions.size());
+    }
+
+    @Test
+    public void post_survivesAThrowingHandler() {
+        ContentJsBridge bridge = new ContentJsBridge(action -> {
+            throw new IllegalStateException("boom");
+        });
+        // Must not propagate: a page must never see a Java exception surface back into it.
+        bridge.post("{\"cly_widget_command\":1,\"close\":1}");
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentScenarioTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentScenarioTests.java
new file mode 100644
index 000000000..17ae77afa
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentScenarioTests.java
@@ -0,0 +1,569 @@
+package ly.count.sdk.java.ui;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.HashSet;
+import java.util.Set;
+import javafx.scene.image.PixelReader;
+import javafx.scene.image.WritableImage;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.ContentUrlHandler;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Drives the content zone through the variants the Android SDK's {@code content_test_runner.py}
+ * drives: one run per content type the server routes by device ID prefix, each entering the zone,
+ * waiting for the block, then exercising what the harness exercises — the window moving underneath
+ * it (the desktop's answer to a rotation), the links inside it, and closing it.
+ * <p>
+ * Findings are recorded rather than asserted, because what a live server serves is itself the
+ * finding. Enable with {@code -Dcountly.ui.scenarios=true}.
+ */
+@RunWith(JUnit4.class)
+public class ContentScenarioTests {
+
+    /**
+     * The device ID prefix the server routes each placement by, and the placement it should produce.
+     * <p>
+     * The prefixes are the app's own convention rather than the placement names: the two oldest,
+     * {@code sticky_top} and {@code sticky_bottom}, were re-pointed at the right hand placements when
+     * the centre and left ones were added, so the mapping cannot be inferred from the prefix.
+     */
+    private static final String[][] VARIANTS = {
+        { "sticky_tll", "sticky top left" },
+        { "sticky_tcl", "sticky top centre" },
+        { "sticky_top", "sticky top right" },
+        { "sticky_bll", "sticky bottom left" },
+        { "sticky_bcl", "sticky bottom centre" },
+        { "sticky_bottom", "sticky bottom right" },
+        { "modal", "modal centre" },
+        { "half_modal_top", "half modal centre" },
+        { "fullscreen", "fullscreen" },
+    };
+
+    /** No area outside the block, so no passthrough probe: modals and fullscreen cover everything. */
+    private static final List<String> FULLSCREEN = java.util.Arrays.asList(
+        "fullscreen", "modal", "half_modal_top");
+
+    private static final long ZONE_TIMEOUT_MS = 50_000;
+
+    private static Stage owner;
+    private ScenarioDriver.LogBuffer log;
+    private JavaFxContentDisplay display;
+
+    /** Run again with {@code -Dcountly.ui.scenarioWithinApp=true} to lay content out in the window. */
+    private static final boolean WITHIN_APP = Boolean.getBoolean("countly.ui.scenarioWithinApp");
+
+    @BeforeClass
+    public static void enable() {
+        ScenarioDriver.assumeEnabled();
+        CountlyWebView.setShowWidgetsWithinApp(WITHIN_APP);
+        // The point of a driven run is the evidence: this is what logs each page's images, fonts and
+        // painted boxes into the report.
+        CountlyWebView.setWebViewDiagnosticsEnabled(true);
+        owner = ScenarioDriver.newApplicationWindow(100, 80, 1000, 700);
+    }
+
+    @AfterClass
+    public static void report() {
+        ScenarioDriver.writeReport("content-scenarios" + (WITHIN_APP ? "-within-app" : ""));
+        if (owner != null) {
+            FxTestToolkit.onFx(owner::close);
+        }
+    }
+
+    @After
+    public void stopSdk() {
+        if (display != null) {
+            FxTestToolkit.onFx(() -> {
+                Stage stage = display.activeStage();
+                if (stage != null && stage.isShowing()) {
+                    stage.close();
+                }
+            });
+        }
+        FxTestToolkit.onFx(PresentationLock::resetForTests);
+        try {
+            Countly.instance().content().exitContentZone();
+        } catch (Throwable ignored) {
+            // Halting is what matters.
+        }
+        Countly.instance().halt();
+    }
+
+    @Test
+    public void allVariants() {
+        for (String[] variant : VARIANTS) {
+            drive(variant[0], variant[1]);
+        }
+    }
+
+    private void drive(String variant, String placement) {
+        log = new ScenarioDriver.LogBuffer();
+        List<String> handledUrls = Collections.synchronizedList(new ArrayList<>());
+        // A journey serves each device once, so a re-run needs a device it has not served yet.
+        String deviceId = variant + "_javafx_" + ScenarioDriver.RUN_ID;
+
+        // Instead of letting a link reach a real browser, as the Android harness does when it waits
+        // for Chrome, it is captured here: the SDK's own handler is the same code path.
+        Config config = ScenarioDriver.liveConfig(deviceId, log);
+        config.content.setContentUrlHandler(new ContentUrlHandler() {
+            @Override
+            public boolean onContentUrl(String url) {
+                handledUrls.add(url);
+                return true;
+            }
+        });
+        config.content.setGlobalContentCallback((status, data) ->
+            ScenarioDriver.record(variant, "content callback", ScenarioDriver.Verdict.PASS,
+                status + " " + data));
+
+        Countly.instance().init(config);
+
+        // A device that never began a session has not entered any journey, so the server has no
+        // content to give it. Without this the whole content half reads as "nothing configured".
+        Countly.session().begin();
+        boolean sessionSent = log.waitFor("begin_session", 15_000);
+        ScenarioDriver.record(variant, "expected placement", ScenarioDriver.Verdict.PASS, placement);
+        ScenarioDriver.record(variant, "the SDK started and began a session",
+            sessionSent ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            "device id [" + deviceId + "], begin_session sent: " + sessionSent);
+        // Let the journey pick the device up before asking for content.
+        ScenarioDriver.pause(3000);
+
+        long enteredAt = System.currentTimeMillis();
+        FxTestToolkit.onFx(() -> {
+            display = new JavaFxContentDisplay(owner);
+            Countly.instance().content().setContentDisplay(display);
+            Countly.instance().content().enterContentZone();
+        });
+
+        boolean fetched = log.waitFor("\\[ModuleContent\\].*(No content|content block|fetchContents)", 15_000);
+        ScenarioDriver.record(variant, "the zone fetched", fetched
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            String.valueOf(log.find("\\[ModuleContent\\].*(No content|content block|fetchContents)")));
+
+        boolean painted = log.waitFor("\\[JavaFxContentDisplay\\] show, content painted", ZONE_TIMEOUT_MS);
+        if (!painted) {
+            ScenarioDriver.record(variant, "a content block arrived", ScenarioDriver.Verdict.SKIP,
+                "nothing served for this device ID in " + (ZONE_TIMEOUT_MS / 1000) + "s; last content log ["
+                    + log.find("\\[ModuleContent\\]") + "]");
+            teardown();
+            return;
+        }
+        long appearedIn = System.currentTimeMillis() - enteredAt;
+        ScenarioDriver.record(variant, "a content block arrived", ScenarioDriver.Verdict.PASS,
+            String.valueOf(log.find("\\[JavaFxContentDisplay\\] show, content painted")));
+        // What the user actually waits: the call, the zone's first fetch, and the page.
+        ScenarioDriver.record(variant, "how long from entering the zone to seeing it",
+            appearedIn < 3000 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            appearedIn + " ms");
+
+        AtomicReference<WebEngine> engineRef = new AtomicReference<>();
+        AtomicReference<String> geometry = new AtomicReference<>("no window");
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            if (stage == null) {
+                return;
+            }
+            engineRef.set(((WebView) stage.getScene().getRoot()).getEngine());
+            geometry.set((int) stage.getX() + "," + (int) stage.getY() + " "
+                + (int) stage.getWidth() + "x" + (int) stage.getHeight());
+        });
+        // The server's own rectangle beside the one that was applied, so checking a campaign's
+        // placement is a comparison rather than a guess.
+        String served = log.find("onContentFetched, showing content");
+        ScenarioDriver.record(variant, "the block is on screen",
+            engineRef.get() == null ? ScenarioDriver.Verdict.FAIL : ScenarioDriver.Verdict.PASS,
+            "server " + (served == null ? "?" : served.substring(served.indexOf("portrait=")))
+                + " -> window " + geometry.get());
+        if (engineRef.get() == null) {
+            teardown();
+            return;
+        }
+        WebEngine engine = engineRef.get();
+
+        // A card's picture can be missing two ways round: the engine never got the image, or it got
+        // it and the box it sits in is empty. Only the natural size next to the box tells them apart,
+        // and the answer decides which side of the stack has the bug. The wait is for the image
+        // itself: the assets these blocks carry are megabytes, and decoding one is not instant.
+        ScenarioDriver.pause(2500);
+        AtomicReference<String> images = new AtomicReference<>("not read");
+        FxTestToolkit.onFx(() -> images.set(FxSurfaces.describeImages(engine)));
+        String described = images.get() + " ;; backgrounds: " + probeCardPictures(engine);
+        boolean decoded = described.contains("complete=true") && !described.contains("natural=0x0");
+        // Does the card change after it is on screen? A page that fetches its fonts after first
+        // paint repaints its text a second later, which is the swap that makes a card look broken.
+        // Sampled outside the picture's box, since the picture legitimately arrives late.
+        int[] first = snapshotArgb();
+        ScenarioDriver.pause(2500);
+        int[] second = snapshotArgb();
+        ScenarioDriver.record(variant, "the card stopped changing once it was shown",
+            ScenarioDriver.Verdict.PASS, compare(first, second, engine));
+
+        // Pixels, because everything up to here is the page's own account of itself. This is the
+        // only step that can tell a painted picture from one the DOM merely claims is visible.
+        ScenarioDriver.record(variant, "the picture's pixels", ScenarioDriver.Verdict.PASS,
+            capturePicture(variant, engine));
+
+        ScenarioDriver.record(variant, "the block's images decoded and have a box",
+            described.contains("no img elements") ? ScenarioDriver.Verdict.SKIP
+                : decoded ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.FAIL,
+            described);
+
+        ScenarioDriver.record(variant, "the page rendered something", ScenarioDriver.Verdict.PASS,
+            "text [" + trim(ScenarioDriver.visibleText(engine)) + "], links "
+                + ScenarioDriver.count(engine, "a") + ", buttons " + ScenarioDriver.count(engine, "button"));
+
+        // The desktop equivalent of the harness's rotate/back/rotate: the window the block is
+        // anchored to moves and changes shape underneath it.
+        String before = geometry.get();
+        FxTestToolkit.onFx(() -> {
+            owner.setX(owner.getX() + 120);
+            owner.setWidth(owner.getWidth() - 160);
+        });
+        ScenarioDriver.pause(700);
+        AtomicReference<String> after = new AtomicReference<>("no window");
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            if (stage != null) {
+                after.set((int) stage.getX() + "," + (int) stage.getY() + " "
+                    + (int) stage.getWidth() + "x" + (int) stage.getHeight());
+            }
+        });
+        ScenarioDriver.record(variant, "the block followed the window",
+            ScenarioDriver.Verdict.PASS, before + " -> " + after.get());
+        FxTestToolkit.onFx(() -> {
+            owner.setX(owner.getX() - 120);
+            owner.setWidth(owner.getWidth() + 160);
+        });
+
+        // Events recorded while a block is up, which is what the harness's "pokes" check.
+        Countly.instance().events().recordEvent("scenario_poke_" + variant);
+        ScenarioDriver.record(variant, "an app event recorded while content is up",
+            log.waitFor("recordEventInternal.*scenario_poke", 5000)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.FAIL,
+            String.valueOf(log.find("recordEventInternal.*scenario_poke")));
+
+        // The link out of the block. These blocks put it on a button rather than an anchor, so it
+        // is found by its text the way the Android harness finds its "Go": looking for a[href] alone
+        // reported every variant as having no link at all.
+        String go = ScenarioDriver.clickByText(engine, "Go to checkout", "Go", "Open", "Visit", "Click here");
+        if (go == null && ScenarioDriver.count(engine, "a[href]") > 0) {
+            go = ScenarioDriver.click(engine, "a[href]") ? "a[href]" : null;
+        }
+        if (go == null) {
+            ScenarioDriver.record(variant, "the link out of the block was handled",
+                ScenarioDriver.Verdict.SKIP, "the block has no link control");
+        } else {
+            ScenarioDriver.pause(1500);
+            ScenarioDriver.check(variant, "the link out of the block was handled",
+                !handledUrls.isEmpty(), "clicked [" + go + "], handler got " + handledUrls);
+        }
+
+        if (!FULLSCREEN.contains(variant)) {
+            ScenarioDriver.record(variant, "there is an area outside the block",
+                ScenarioDriver.Verdict.PASS, "the window is " + after.get()
+                    + "; anything outside it belongs to the application");
+        }
+
+        // Closing: the block's own close control, by its text rather than by position in the
+        // markup, which is what the Android harness's WEBVIEW_HINTS do. A link carrying close=1 has
+        // already taken the block down, so this only applies while it is still up.
+        AtomicReference<Boolean> upStill = new AtomicReference<>(false);
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            upStill.set(stage != null && stage.isShowing());
+        });
+        if (!upStill.get()) {
+            ScenarioDriver.record(variant, "clicked the block's close control",
+                ScenarioDriver.Verdict.SKIP, "the link already closed it");
+        } else {
+            String clicked = ScenarioDriver.clickByText(engine, "Close", "X", "\u00d7", "\u2715", "Dismiss");
+            ScenarioDriver.record(variant, "clicked the block's close control",
+                clicked != null ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP,
+                clicked == null ? "no close control found" : "clicked [" + clicked + "]");
+            ScenarioDriver.pause(2000);
+        }
+
+        AtomicReference<Boolean> stillShowing = new AtomicReference<>(false);
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            stillShowing.set(stage != null && stage.isShowing());
+        });
+        ScenarioDriver.record(variant, "the block closed", !stillShowing.get()
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            "still showing: " + stillShowing.get());
+
+        ScenarioDriver.record(variant, "no SDK errors during the variant",
+            log.countOf("^ERROR ") == 0 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            log.countOf("^ERROR ") + " error lines, first [" + log.find("^ERROR ") + "]");
+
+        teardown();
+    }
+
+    private void teardown() {
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display == null ? null : display.activeStage();
+            if (stage != null && stage.isShowing()) {
+                stage.close();
+            }
+        });
+        try {
+            Countly.instance().content().exitContentZone();
+        } catch (Throwable ignored) {
+            // Nothing to release.
+        }
+        Countly.instance().halt();
+        ScenarioDriver.pause(300);
+    }
+
+    private static String trim(String text) {
+        String single = text == null ? "" : text.replace('\n', ' ').trim();
+        return single.length() > 120 ? single.substring(0, 120) + "..." : single;
+    }
+
+    /**
+     * The card's picture, which these templates paint as a CSS background rather than an
+     * {@code <img>}: where the box is, and whether the engine can actually decode what is in it.
+     * <p>
+     * The decode is proved by asking for the same URL again through {@code new Image()}. That is not
+     * a second download: the engine's memory cache serves it, so a URL that painted answers straight
+     * away with its natural size, and one that never loaded answers with an error.
+     *
+     * @param engine the engine showing the block
+     * @return one entry per background image, or why there are none
+     */
+    private static String probeCardPictures(WebEngine engine) {
+        AtomicReference<String> started = new AtomicReference<>("0");
+        FxTestToolkit.onFx(() -> {
+            try {
+                started.set(String.valueOf(engine.executeScript(
+                    "(function(){window.__clyPics=[];var all=document.querySelectorAll('*');"
+                        + "for(var i=0;i<all.length&&window.__clyPics.length<5;i++){"
+                        + "var st=window.getComputedStyle(all[i]);var u=st.backgroundImage;"
+                        + "if(!u||u.indexOf('url(')!==0){continue;}"
+                        + "var url=u.slice(4,u.length-1).replace(/[\'\"]/g,'');"
+                        + "var r=all[i].getBoundingClientRect();"
+                        + "var rec={url:url,box:Math.round(r.width)+'x'+Math.round(r.height)"
+                        + "+'@'+Math.round(r.left)+','+Math.round(r.top)"
+                        + ",vis:st.visibility+'/'+st.display+'/'+st.opacity+'/'+st.backgroundSize"
+                        + ",state:'pending',natural:'0x0'};"
+                        + "window.__clyPics.push(rec);"
+                        + "(function(rec){var im=new Image();"
+                        + "im.onload=function(){rec.state='decoded';rec.natural=im.naturalWidth+'x'+im.naturalHeight;};"
+                        + "im.onerror=function(){rec.state='FAILED';};im.src=rec.url;})(rec);}"
+                        + "return window.__clyPics.length;})()")));
+            } catch (Throwable t) {
+                started.set("probe threw " + t);
+            }
+        });
+        if ("0".equals(started.get())) {
+            return "no background images";
+        }
+
+        String read = "pending";
+        for (int i = 0; i < 40; i++) {
+            AtomicReference<String> current = new AtomicReference<>("pending");
+            FxTestToolkit.onFx(() -> {
+                try {
+                    current.set(String.valueOf(engine.executeScript(
+                        "JSON.stringify(window.__clyPics.map(function(p){"
+                            + "return p.state+' natural='+p.natural+' box '+p.box+' '+p.vis+' '"
+                            + "+p.url.slice(0,80);}))")));
+                } catch (Throwable t) {
+                    current.set("read threw " + t);
+                }
+            });
+            read = current.get();
+            if (!read.contains("pending")) {
+                break;
+            }
+            ScenarioDriver.pause(250);
+        }
+        return read;
+    }
+
+
+    /**
+     * Snapshots the card and reports what is actually drawn inside the picture's box, and writes the
+     * card next to the report so it can be looked at.
+     *
+     * @param variant which run this is, used for the file name
+     * @param engine the engine showing the block
+     * @return what the pixels in the picture's box are
+     */
+    private String capturePicture(String variant, WebEngine engine) {
+        AtomicReference<String> rect = new AtomicReference<>("");
+        AtomicReference<String> result = new AtomicReference<>("no snapshot");
+
+        FxTestToolkit.onFx(() -> {
+            try {
+                rect.set(String.valueOf(engine.executeScript(
+                    "(function(){var all=document.querySelectorAll('*');"
+                        + "for(var i=0;i<all.length;i++){var st=window.getComputedStyle(all[i]);"
+                        + "if((st.backgroundImage||'').indexOf('url(')!==0){continue;}"
+                        + "var r=all[i].getBoundingClientRect();"
+                        + "return Math.round(r.left)+','+Math.round(r.top)+','"
+                        + "+Math.round(r.width)+','+Math.round(r.height);}return '';})()")));
+            } catch (Throwable t) {
+                rect.set("");
+            }
+
+            Stage stage = display.activeStage();
+            if (stage == null) {
+                return;
+            }
+            WebView webView = (WebView) stage.getScene().getRoot();
+            WritableImage shot = webView.snapshot(null, null);
+            PixelReader pixels = shot.getPixelReader();
+            int width = (int) shot.getWidth();
+            int height = (int) shot.getHeight();
+
+            // The whole card, as a plain PPM: no javafx.swing on this classpath, and a PPM is a
+            // header plus RGB bytes.
+            try {
+                File dir = new File(System.getProperty("countly.ui.scenarioOut",
+                    System.getProperty("java.io.tmpdir")));
+                if (dir.exists() || dir.mkdirs()) {
+                    ByteArrayOutputStream body = new ByteArrayOutputStream();
+                    body.write(("P6\n" + width + " " + height + "\n255\n").getBytes(StandardCharsets.US_ASCII));
+                    for (int y = 0; y < height; y++) {
+                        for (int x = 0; x < width; x++) {
+                            int argb = pixels.getArgb(x, y);
+                            body.write((argb >> 16) & 0xFF);
+                            body.write((argb >> 8) & 0xFF);
+                            body.write(argb & 0xFF);
+                        }
+                    }
+                    Files.write(new File(dir, "card-" + variant + ".ppm").toPath(), body.toByteArray());
+                }
+            } catch (Throwable t) {
+                // The counts below are the evidence; the file is a convenience.
+            }
+
+            String[] parts = rect.get().split(",");
+            if (parts.length != 4) {
+                result.set("card " + width + "x" + height + ", but the picture has no box to sample");
+                return;
+            }
+            int left = Integer.parseInt(parts[0]);
+            int top = Integer.parseInt(parts[1]);
+            int boxWidth = Integer.parseInt(parts[2]);
+            int boxHeight = Integer.parseInt(parts[3]);
+
+            Set<Integer> distinct = new HashSet<>();
+            int opaque = 0;
+            int sampled = 0;
+            for (int y = top; y < top + boxHeight && y < height; y++) {
+                for (int x = left; x < left + boxWidth && x < width; x++) {
+                    if (x < 0 || y < 0) {
+                        continue;
+                    }
+                    int argb = pixels.getArgb(x, y);
+                    distinct.add(argb);
+                    sampled++;
+                    if (((argb >> 24) & 0xFF) > 8) {
+                        opaque++;
+                    }
+                }
+            }
+            // A photograph scaled into a box is many colours; a slot that never painted is one.
+            result.set("card " + width + "x" + height + ", box " + boxWidth + "x" + boxHeight
+                + "@" + left + "," + top + ", sampled " + sampled + " px, distinct colours "
+                + distinct.size() + ", not transparent " + opaque
+                + ", written to card-" + variant + ".ppm");
+        });
+        return result.get();
+    }
+
+
+    /** @return the card's pixels, row major, or an empty array when there is no window */
+    private int[] snapshotArgb() {
+        AtomicReference<int[]> pixels = new AtomicReference<>(new int[0]);
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            if (stage == null) {
+                return;
+            }
+            WritableImage shot = ((WebView) stage.getScene().getRoot()).snapshot(null, null);
+            int width = (int) shot.getWidth();
+            int height = (int) shot.getHeight();
+            int[] read = new int[width * height + 2];
+            read[0] = width;
+            read[1] = height;
+            for (int y = 0; y < height; y++) {
+                for (int x = 0; x < width; x++) {
+                    read[2 + y * width + x] = shot.getPixelReader().getArgb(x, y);
+                }
+            }
+            pixels.set(read);
+        });
+        return pixels.get();
+    }
+
+    /**
+     * @return how much of the card changed between the two snapshots, ignoring the picture's box
+     */
+    private String compare(int[] before, int[] after, WebEngine engine) {
+        if (before.length < 3 || before.length != after.length) {
+            return "could not compare, " + before.length + " against " + after.length + " pixels";
+        }
+        int width = before[0];
+        int height = before[1];
+
+        AtomicReference<String> box = new AtomicReference<>("");
+        FxTestToolkit.onFx(() -> {
+            try {
+                box.set(String.valueOf(engine.executeScript(
+                    "(function(){var all=document.querySelectorAll('*');"
+                        + "for(var i=0;i<all.length;i++){"
+                        + "if((window.getComputedStyle(all[i]).backgroundImage||'').indexOf('url(')!==0){continue;}"
+                        + "var r=all[i].getBoundingClientRect();"
+                        + "return Math.round(r.left)+','+Math.round(r.top)+','"
+                        + "+Math.round(r.right)+','+Math.round(r.bottom);}return '';})()")));
+            } catch (Throwable t) {
+                box.set("");
+            }
+        });
+        int[] picture = { -1, -1, -1, -1 };
+        String[] parts = box.get().split(",");
+        if (parts.length == 4) {
+            for (int i = 0; i < 4; i++) {
+                picture[i] = Integer.parseInt(parts[i]);
+            }
+        }
+
+        int changed = 0;
+        int sampled = 0;
+        for (int y = 0; y < height; y++) {
+            for (int x = 0; x < width; x++) {
+                if (x >= picture[0] && x < picture[2] && y >= picture[1] && y < picture[3]) {
+                    continue;
+                }
+                sampled++;
+                if (before[2 + y * width + x] != after[2 + y * width + x]) {
+                    changed++;
+                }
+            }
+        }
+        int percent = sampled == 0 ? 0 : (changed * 100) / sampled;
+        return changed + " of " + sampled + " px changed outside the picture (" + percent + "%)";
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentVariantScenarioTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentVariantScenarioTests.java
new file mode 100644
index 000000000..a4c8f8b18
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ContentVariantScenarioTests.java
@@ -0,0 +1,326 @@
+package ly.count.sdk.java.ui;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.ContentUrlHandler;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The six content variants the Android SDK's harness drives, against a stub server.
+ * <p>
+ * On a live server a variant is nothing but the geometry the campaign was authored with, routed by
+ * device ID; with no campaigns bound to an app key there is nothing to drive at all
+ * ({@link ContentScenarioTests} records that). Serving the same payloads locally exercises every
+ * step that is actually the SDK's: the queue response, the placement, the page, the links, the
+ * events recorded while a block is up, and the close.
+ */
+@RunWith(JUnit4.class)
+public class ContentVariantScenarioTests {
+
+    /** Screen relative geometry per variant, in the shape the server sends. */
+    private static final String[][] VARIANTS = {
+        // name, x, y, w, h (as a fraction of the surface, resolved below)
+        { "sticky_top", "0", "0", "1", "0.18" },
+        { "sticky_bottom", "0", "0.82", "1", "0.18" },
+        { "modal", "0.2", "0.25", "0.6", "0.5" },
+        { "half_modal_top", "0", "0", "1", "0.5" },
+        { "half_modal_bottom", "0", "0.5", "1", "0.5" },
+        { "fullscreen", "0", "0", "1", "1" },
+    };
+
+    private static final long PAINT_TIMEOUT_MS = 25_000;
+
+    private static HttpServer server;
+    private static int port;
+    private static Stage owner;
+
+    /** The variant the stub is currently serving, and whether it has been taken. */
+    private static volatile String servingVariant;
+    private static volatile boolean served;
+    private static volatile int surfaceWidth = 1470;
+    private static volatile int surfaceHeight = 923;
+
+    private ScenarioDriver.LogBuffer log;
+    private JavaFxContentDisplay display;
+
+    /**
+     * Run again with {@code -Dcountly.ui.scenarioWithinApp=true} to drive the same variants laid out
+     * inside the application window. The two modes cannot share a run: the setting is applied once
+     * per process on purpose.
+     */
+    private static final boolean WITHIN_APP = Boolean.getBoolean("countly.ui.scenarioWithinApp");
+
+    @BeforeClass
+    public static void startEverything() throws IOException {
+        ScenarioDriver.assumeEnabled();
+        CountlyWebView.setShowWidgetsWithinApp(WITHIN_APP);
+        owner = ScenarioDriver.newApplicationWindow(100, 80, 1000, 700);
+
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        port = server.getAddress().getPort();
+
+        // The content queue: one block per variant, then nothing, so the zone does not loop.
+        server.createContext("/o/sdk/content", exchange -> {
+            String body;
+            if (served || servingVariant == null) {
+                body = "{\"result\":\"No content block found!\"}";
+            } else {
+                served = true;
+                body = queueResponse(servingVariant);
+            }
+            respond(exchange, body);
+        });
+
+        // The block itself: a page with a link and a close button, like a real content block.
+        server.createContext("/content-page", exchange -> respond(exchange,
+            "<html><head><title>content</title></head><body style='margin:0'>"
+                + "<div id='widget-body' style='background:#fff;height:100%'>"
+                + "<h3>Scenario content</h3>"
+                + "<a id='go' href='https://countly_action_event/?cly_x_action_event=1&action=link"
+                + "&link=https%3A%2F%2Fexample.test%2Fgo&close=0'>Go</a>"
+                + "<a id='x' href='https://countly_action_event/?cly_x_action_event=1&close=1'>X</a>"
+                + "</div></body></html>"));
+
+        server.createContext("/", exchange -> respond(exchange, "{\"result\":\"Success\"}"));
+        server.setExecutor(null);
+        server.start();
+    }
+
+    @AfterClass
+    public static void stopEverything() {
+        ScenarioDriver.writeReport("content-variant-scenarios" + (WITHIN_APP ? "-within-app" : ""));
+        if (server != null) {
+            server.stop(0);
+        }
+        if (owner != null) {
+            FxTestToolkit.onFx(owner::close);
+        }
+    }
+
+    @After
+    public void stopSdk() {
+        Countly.instance().halt();
+    }
+
+    @Test
+    public void allVariants() {
+        for (String[] variant : VARIANTS) {
+            drive(variant);
+        }
+    }
+
+    private void drive(String[] spec) {
+        String variant = spec[0];
+        log = new ScenarioDriver.LogBuffer();
+        List<String> handledUrls = Collections.synchronizedList(new ArrayList<>());
+        servingVariant = variant;
+        served = false;
+
+        Config config = ScenarioDriver.liveConfig(variant + "_stub", log, "http://127.0.0.1:" + port);
+        config.content.setContentUrlHandler(url -> {
+            handledUrls.add(url);
+            return true;
+        });
+        Countly.instance().init(config);
+
+        FxTestToolkit.onFx(() -> {
+            display = new JavaFxContentDisplay(owner);
+            WidgetSurface surface = FxSurfaces.surfaceFor(owner);
+            surfaceWidth = surface.width;
+            surfaceHeight = surface.height;
+            Countly.instance().content().setContentDisplay(display);
+            Countly.instance().content().enterContentZone();
+        });
+
+        boolean painted = log.waitFor("\\[JavaFxContentDisplay\\] show, content painted", PAINT_TIMEOUT_MS);
+        if (!painted) {
+            ScenarioDriver.record(variant, "the block was shown", ScenarioDriver.Verdict.FAIL,
+                "no paint in " + (PAINT_TIMEOUT_MS / 1000) + "s, content logs "
+                    + log.countOf("\\[ModuleContent\\]") + ", display logs "
+                    + log.countOf("\\[JavaFxContentDisplay\\]"));
+            teardown();
+            return;
+        }
+
+        AtomicReference<WebEngine> engineRef = new AtomicReference<>();
+        AtomicReference<int[]> rect = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            if (stage == null) {
+                return;
+            }
+            engineRef.set(((WebView) stage.getScene().getRoot()).getEngine());
+            rect.set(new int[] { (int) stage.getX(), (int) stage.getY(),
+                (int) stage.getWidth(), (int) stage.getHeight() });
+        });
+
+        int[] expected = expectedRect(spec);
+        int[] actual = rect.get();
+        ScenarioDriver.check(variant, "the block is where the server asked",
+            actual != null && Math.abs(actual[0] - expected[0]) <= 2 && Math.abs(actual[1] - expected[1]) <= 2
+                && Math.abs(actual[2] - expected[2]) <= 2 && Math.abs(actual[3] - expected[3]) <= 2,
+            "asked " + describe(expected) + ", got " + (actual == null ? "no window" : describe(actual)));
+
+        if (engineRef.get() == null) {
+            teardown();
+            return;
+        }
+        WebEngine engine = engineRef.get();
+        ScenarioDriver.check(variant, "the page rendered",
+            ScenarioDriver.visibleText(engine).contains("Scenario content"),
+            "text [" + ScenarioDriver.visibleText(engine).replace('\n', ' ').trim() + "]");
+
+        // The desktop's answer to the harness's rotate: the window underneath it changes shape.
+        FxTestToolkit.onFx(() -> {
+            owner.setX(owner.getX() + 120);
+            owner.setWidth(owner.getWidth() - 200);
+        });
+        ScenarioDriver.pause(600);
+        AtomicReference<int[]> afterMove = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display.activeStage();
+            if (stage != null) {
+                afterMove.set(new int[] { (int) stage.getX(), (int) stage.getY(),
+                    (int) stage.getWidth(), (int) stage.getHeight() });
+            }
+        });
+        boolean moved = afterMove.get() != null && actual != null
+            && (afterMove.get()[0] != actual[0] || afterMove.get()[2] != actual[2]);
+        if (WITHIN_APP) {
+            // The window is the surface, so the block has to have moved with it.
+            ScenarioDriver.check(variant, "the block followed the window", moved,
+                describe(actual) + " -> " + (afterMove.get() == null ? "gone" : describe(afterMove.get())));
+        } else {
+            // The screen is the surface, and it did not move, so the block must not either.
+            ScenarioDriver.check(variant, "the block stayed put on the screen",
+                afterMove.get() != null && !moved,
+                describe(actual) + " -> " + (afterMove.get() == null ? "gone" : describe(afterMove.get())));
+        }
+        FxTestToolkit.onFx(() -> {
+            owner.setX(owner.getX() - 120);
+            owner.setWidth(owner.getWidth() + 200);
+        });
+
+        Countly.instance().events().recordEvent("scenario_poke_" + variant);
+        ScenarioDriver.check(variant, "an app event recorded while the block is up",
+            log.waitFor("recordEventInternal.*scenario_poke", 5000),
+            String.valueOf(log.find("recordEventInternal.*scenario_poke")));
+
+        // The link, which is what the harness checks by waiting for Chrome.
+        ScenarioDriver.check(variant, "the Go link reached the SDK's URL handling",
+            ScenarioDriver.click(engine, "#go") && waitUntilNotEmpty(handledUrls),
+            handledUrls.toString());
+
+        // The close signal, which has to release the zone as well as the window.
+        ScenarioDriver.check(variant, "the X closed the block",
+            ScenarioDriver.click(engine, "#x") && waitClosed(),
+            "content status logs: " + log.countOf("\\[ModuleContent\\].*(closed|contentShown)"));
+
+        ScenarioDriver.check(variant, "the zone is free to fetch again",
+            log.waitFor("\\[ModuleContent\\]", 2000), "content module still logging");
+
+        teardown();
+    }
+
+    // ----------------------------------------------------------------- helpers
+
+    private boolean waitUntilNotEmpty(List<String> urls) {
+        long until = System.currentTimeMillis() + 4000;
+        while (System.currentTimeMillis() < until) {
+            if (!urls.isEmpty()) {
+                return true;
+            }
+            ScenarioDriver.pause(100);
+        }
+        return false;
+    }
+
+    private boolean waitClosed() {
+        long until = System.currentTimeMillis() + 5000;
+        while (System.currentTimeMillis() < until) {
+            AtomicReference<Boolean> showing = new AtomicReference<>(false);
+            FxTestToolkit.onFx(() -> {
+                Stage stage = display.activeStage();
+                showing.set(stage != null && stage.isShowing());
+            });
+            if (!showing.get()) {
+                return true;
+            }
+            ScenarioDriver.pause(150);
+        }
+        return false;
+    }
+
+    private void teardown() {
+        try {
+            Countly.instance().content().exitContentZone();
+        } catch (Throwable ignored) {
+            // Nothing to release.
+        }
+        FxTestToolkit.onFx(() -> {
+            Stage stage = display == null ? null : display.activeStage();
+            if (stage != null && stage.isShowing()) {
+                stage.close();
+            }
+        });
+        Countly.instance().halt();
+        ScenarioDriver.pause(200);
+    }
+
+    private static int[] expectedRect(String[] spec) {
+        int x = (int) (Double.parseDouble(spec[1]) * surfaceWidth);
+        int y = (int) (Double.parseDouble(spec[2]) * surfaceHeight);
+        int w = (int) (Double.parseDouble(spec[3]) * surfaceWidth);
+        int h = (int) (Double.parseDouble(spec[4]) * surfaceHeight);
+        AtomicReference<WidgetSurface> surface = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> surface.set(FxSurfaces.surfaceFor(owner)));
+        return new int[] { surface.get().x + x, surface.get().y + y, w, h };
+    }
+
+    private static String describe(int[] rect) {
+        return rect[0] + "," + rect[1] + " " + rect[2] + "x" + rect[3];
+    }
+
+    private static String queueResponse(String variant) {
+        for (String[] spec : VARIANTS) {
+            if (!spec[0].equals(variant)) {
+                continue;
+            }
+            int x = (int) (Double.parseDouble(spec[1]) * surfaceWidth);
+            int y = (int) (Double.parseDouble(spec[2]) * surfaceHeight);
+            int w = (int) (Double.parseDouble(spec[3]) * surfaceWidth);
+            int h = (int) (Double.parseDouble(spec[4]) * surfaceHeight);
+            String rect = "{\"x\":" + x + ",\"y\":" + y + ",\"w\":" + w + ",\"h\":" + h + "}";
+            return "{\"html\":\"http://127.0.0.1:" + port + "/content-page\","
+                + "\"geo\":{\"p\":" + rect + ",\"l\":" + rect + "}}";
+        }
+        return "{\"result\":\"No content block found!\"}";
+    }
+
+    private static void respond(com.sun.net.httpserver.HttpExchange exchange, String body) throws IOException {
+        byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
+        exchange.getResponseHeaders().add("Content-Type",
+            body.startsWith("<") ? "text/html; charset=utf-8" : "application/json");
+        exchange.sendResponseHeaders(200, bytes.length);
+        try (OutputStream out = exchange.getResponseBody()) {
+            out.write(bytes);
+        }
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/CountlyWebViewTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/CountlyWebViewTests.java
new file mode 100644
index 000000000..4a1b3cf46
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/CountlyWebViewTests.java
@@ -0,0 +1,372 @@
+package ly.count.sdk.java.ui;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.Scene;
+import javafx.scene.layout.Pane;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The public facade, driven on the headless toolkit against a dead local port.
+ * <p>
+ * Every path that cannot show anything has to end in the caller's callback being run exactly once,
+ * because an integrator waiting on a callback that never comes is the worst failure this class can
+ * have.
+ */
+@RunWith(JUnit4.class)
+public class CountlyWebViewTests {
+
+    private final AtomicInteger closed = new AtomicInteger(0);
+
+    private static HttpServer widgetServer;
+    private static int widgetPort;
+
+    @BeforeClass
+    public static void startToolkit() throws IOException {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+
+        // A real widget page over real HTTP, so the whole chain runs: the SDK builds the URL, the
+        // page loads, and the page closes itself the way a widget does. The JDK's own server keeps
+        // this dependency free.
+        widgetServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        widgetPort = widgetServer.getAddress().getPort();
+        widgetServer.createContext("/", exchange -> {
+            boolean askingForTheList = exchange.getRequestURI().getPath().startsWith("/o/sdk");
+            String query = String.valueOf(exchange.getRequestURI().getQuery());
+            String payload = askingForTheList ? WIDGET_LIST
+                : query.contains("never-closes") ? OPEN_ENDED_WIDGET_PAGE : WIDGET_PAGE;
+            byte[] body = payload.getBytes(StandardCharsets.UTF_8);
+            exchange.getResponseHeaders().add("Content-Type",
+                askingForTheList ? "application/json; charset=utf-8" : "text/html; charset=utf-8");
+            exchange.sendResponseHeaders(200, body.length);
+            try (OutputStream out = exchange.getResponseBody()) {
+                out.write(body);
+            }
+        });
+        widgetServer.start();
+    }
+
+    @AfterClass
+    public static void stopServer() {
+        if (widgetServer != null) {
+            widgetServer.stop(0);
+        }
+    }
+
+    /** What the server answers to "/o/sdk?method=feedback": one widget of each type. */
+    private static final String WIDGET_LIST =
+        "{\"result\":["
+            + "{\"_id\":\"nps_1\",\"type\":\"nps\",\"name\":\"served nps\",\"tg\":[\"by-tag\"]},"
+            + "{\"_id\":\"survey_1\",\"type\":\"survey\",\"name\":\"served survey\",\"tg\":[]},"
+            + "{\"_id\":\"rating_1\",\"type\":\"rating\",\"name\":\"served rating\",\"tg\":[]}"
+            + "]}";
+
+    /** A widget page that never closes itself, for the tests that end the presentation another way. */
+    private static final String OPEN_ENDED_WIDGET_PAGE =
+        "<html><head><title>widget</title></head><body><div id='widget-body'>survey</div></body></html>";
+
+    private static final String WIDGET_PAGE =
+        "<html><head><title>widget</title></head><body><div id='widget-body'>survey</div><script>"
+            + "setTimeout(function(){window.location="
+            + "'https://countly_action_event/?cly_widget_command=1&close=1';},80);"
+            + "</script></body></html>";
+
+    @After
+    public void stopSdk() {
+        CountlyWebView.forgetDisplayAreaForTests();
+        CountlyWebView.setWebViewDiagnosticsEnabled(false);
+        FxTestToolkit.onFx(PresentationLock::resetForTests);
+        Countly.instance().halt();
+    }
+
+    /**
+     * With no SDK initialized there is no feedback interface and no content interface, so every
+     * entry point has to decline quietly and still run the caller's callback.
+     */
+    @Test
+    public void withoutAnInitializedSdk_everyEntryPointDeclinesAndCallsBack() {
+        Countly.instance().halt();
+
+        CountlyWebView.presentFeedbackWidget(null, widget(), closed::incrementAndGet);
+        CountlyWebView.presentNPS(null, "", closed::incrementAndGet);
+        CountlyWebView.presentSurvey(null, "", closed::incrementAndGet);
+        CountlyWebView.presentRating(null, "", closed::incrementAndGet);
+
+        FxTestToolkit.waitUntil("all four callbacks", () -> closed.get() == 4);
+
+        // Content needs no callback, it just must not throw.
+        CountlyWebView.enableContentZone();
+        CountlyWebView.disableContentZone();
+        FxTestToolkit.sleep(200);
+    }
+
+    /**
+     * A caller whose own callback throws must not take the SDK down with it, and must not stop the
+     * rest of a presentation from tearing down.
+     */
+    @Test
+    public void aThrowingCallerCallback_isContained() {
+        Countly.instance().init(UiTestConfigs.refusedServer());
+
+        CountlyWebView.presentFeedbackWidget(null, null, () -> {
+            closed.incrementAndGet();
+            throw new IllegalStateException("this integrator's callback is broken");
+        });
+
+        FxTestToolkit.waitUntil("the callback to run", () -> closed.get() == 1);
+        FxTestToolkit.sleep(200);
+
+        // The SDK is still usable afterwards.
+        CountlyWebView.presentFeedbackWidget(null, null, closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the second callback", () -> closed.get() == 2);
+    }
+
+    /**
+     * A null widget is nothing to show, and the caller is told immediately.
+     */
+    @Test
+    public void aNullWidget_isDeclinedImmediately() {
+        Countly.instance().init(UiTestConfigs.refusedServer());
+
+        CountlyWebView.presentFeedbackWidget(null, null, closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the callback", () -> closed.get() == 1);
+        Assert.assertEquals(1, closed.get());
+    }
+
+    /**
+     * One presentation end to end against a real page: the SDK builds the widget URL, the page loads
+     * and closes itself, the dismissal is reported to the SDK, and the caller is told exactly once
+     * even though the page keeps signalling afterwards.
+     */
+    @Test
+    public void aWidgetThatClosesItself_reportsTheDismissalExactlyOnce() {
+        Countly.instance().init(UiTestConfigs.configFor("http://127.0.0.1:" + widgetPort));
+        CountlyWebView.setWebViewDiagnosticsEnabled(true);
+
+        CountlyWebView.presentFeedbackWidget(null, widget(), closed::incrementAndGet);
+
+        FxTestToolkit.waitUntil("the dismissal", () -> closed.get() >= 1);
+        FxTestToolkit.sleep(800);
+        Assert.assertEquals("a dismissal must be reported once, not once per signal", 1, closed.get());
+    }
+
+    /**
+     * Presenting with an owner window and {@code showWidgetsWithinApp} set, which is the path that
+     * measures the application window instead of the screen's work area.
+     * <p>
+     * What is asserted is that the path runs and leaves the SDK healthy. The geometry itself is
+     * asserted where it can be done deterministically: {@code FxSurfacesTests} pins that the owner's
+     * bounds are what gets measured, and {@code WidgetPlacementTests} pins the clamping. An earlier
+     * version hunted the card stage through the JavaFX window list and failed every run, which
+     * bought fragility rather than confidence, so do not restore it.
+     */
+    @Test
+    public void presentingInsideTheApplicationWindow_runsAndLeavesTheSdkHealthy() {
+        Countly.instance().init(UiTestConfigs.configFor("http://127.0.0.1:" + widgetPort));
+        CountlyWebView.setShowWidgetsWithinApp(true);
+
+        FxTestToolkit.onFx(() -> {
+            Stage owner = new Stage(StageStyle.UNDECORATED);
+            owner.setScene(new Scene(new Pane(), 500, 400));
+            owner.setX(60);
+            owner.setY(50);
+            owner.show();
+            CountlyWebView.presentFeedbackWidget(owner, widget(), closed::incrementAndGet);
+        });
+
+        FxTestToolkit.sleep(2500);
+
+        // Still usable afterwards: a presentation with nothing to show reports back as ever.
+        CountlyWebView.presentFeedbackWidget(null, null, closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the SDK to still respond", () -> closed.get() >= 1);
+    }
+
+    /**
+     * A widget whose page cannot be fetched is dismissed and reported, rather than leaving a card
+     * around a browser error page with no callback.
+     * <p>
+     * JavaFX reports an HTTP level failure as a SUCCEEDED load carrying an error document, so the
+     * load failure listener never fires. The host notices it instead by measuring what the page
+     * painted: an error page paints no card.
+     */
+    @Test
+    public void aWidgetWhosePageCannotBeFetched_isDismissedAndReported() {
+        Countly.instance().init(UiTestConfigs.refusedServer());
+
+        CountlyWebView.presentFeedbackWidget(null, widget(), closed::incrementAndGet);
+
+        FxTestToolkit.waitUntil("the dismissal", () -> closed.get() >= 1);
+        FxTestToolkit.sleep(600);
+        Assert.assertEquals("must be reported exactly once", 1, closed.get());
+    }
+
+    /**
+     * The quick calls end to end against a served widget list: the list is fetched, the widget of
+     * the asked-for type is selected, its page loads and closes itself, and the caller is told. A
+     * selector matching nothing is declined rather than falling back to a different widget.
+     */
+    @Test
+    public void quickCalls_fetchSelectAndPresentAServedWidget() {
+        Countly.instance().init(UiTestConfigs.configFor("http://127.0.0.1:" + widgetPort));
+
+        CountlyWebView.presentNPS(null, "", closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the NPS widget to close", () -> closed.get() >= 1);
+
+        CountlyWebView.presentSurvey(null, "served survey", closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the survey widget to close", () -> closed.get() >= 2);
+
+        CountlyWebView.presentRating(null, "", closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the rating widget to close", () -> closed.get() >= 3);
+
+        CountlyWebView.presentNPS(null, "no-such-widget", closed::incrementAndGet);
+        FxTestToolkit.waitUntil("the declined call to report back", () -> closed.get() >= 4);
+
+        // The overloads without a callback have to work too.
+        CountlyWebView.presentNPS(null);
+        CountlyWebView.presentSurvey(null, "served survey");
+        CountlyWebView.presentRating(null);
+        FxTestToolkit.sleep(1200);
+    }
+
+    /**
+     * When the widget list cannot be fetched at all, the quick calls still report back rather than
+     * leaving the caller waiting on a callback that never comes.
+     */
+    @Test
+    public void quickCalls_reportBackWhenTheWidgetListCannotBeFetched() {
+        Countly.instance().init(UiTestConfigs.refusedServer());
+
+        CountlyWebView.presentNPS(null, "", closed::incrementAndGet);
+        CountlyWebView.presentSurvey(null, "", closed::incrementAndGet);
+        CountlyWebView.presentRating(null, "", closed::incrementAndGet);
+
+        FxTestToolkit.waitUntil("the three callbacks", () -> closed.get() == 3);
+        Assert.assertEquals(3, closed.get());
+    }
+
+    /**
+     * Entering and leaving the content zone, with and without a named window, and entering twice so
+     * the display is reused rather than rebuilt.
+     */
+    @Test
+    public void contentZone_canBeEnteredAndLeft() {
+        Countly.instance().init(UiTestConfigs.refusedServer());
+
+        CountlyWebView.enableContentZone();
+        CountlyWebView.enableContentZone();
+
+        FxTestToolkit.onFx(() -> {
+            Stage owner = new Stage(StageStyle.UNDECORATED);
+            owner.setScene(new Scene(new Pane(), 400, 300));
+            owner.show();
+            try {
+                // A different window needs a different display, since a display follows its window.
+                CountlyWebView.enableContentZone(owner);
+            } finally {
+                CountlyWebView.disableContentZone();
+                owner.close();
+            }
+        });
+
+        CountlyWebView.disableContentZone();
+        FxTestToolkit.sleep(200);
+    }
+
+    private static CountlyFeedbackWidget widget() {
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = "widget_1";
+        widget.type = FeedbackWidgetType.nps;
+        widget.name = "test widget";
+        widget.tags = new String[] { "by-tag" };
+        return widget;
+    }
+
+    /**
+     * One card at a time. A second widget asked for while the first is on screen is refused and its
+     * caller told at once; once the first has closed itself the screen is free again.
+     */
+    @Test
+    public void aSecondWidgetWhileOneIsShowing_isRefusedUntilTheFirstCloses() {
+        Countly.instance().init(UiTestConfigs.configFor("http://127.0.0.1:" + widgetPort));
+
+        AtomicInteger first = new AtomicInteger();
+        AtomicInteger second = new AtomicInteger();
+        AtomicInteger third = new AtomicInteger();
+
+        // Both asked for on the same pulse: the second arrives before the first's page has even
+        // loaded, and is refused on the spot.
+        FxTestToolkit.onFx(() -> {
+            CountlyWebView.presentFeedbackWidget(null, widget(), first::incrementAndGet);
+            CountlyWebView.presentFeedbackWidget(null, widget(), second::incrementAndGet);
+        });
+        FxTestToolkit.waitUntil("the refused caller to be told", () -> second.get() == 1);
+        Assert.assertEquals("the first is still on its way", 0, first.get());
+        FxTestToolkit.onFx(() -> Assert.assertNotNull("the first holds the screen", PresentationLock.showing()));
+
+        // The first's page closes itself, which frees the screen for the next one.
+        FxTestToolkit.waitUntil("the first to close", () -> first.get() == 1);
+        FxTestToolkit.waitUntil("the screen to be free", () -> PresentationLock.showing() == null);
+
+        CountlyWebView.presentFeedbackWidget(null, widget(), third::incrementAndGet);
+        FxTestToolkit.waitUntil("the third to show and close", () -> third.get() == 1);
+
+        FxTestToolkit.sleep(300);
+        Assert.assertEquals(1, first.get());
+        Assert.assertEquals(1, second.get());
+        Assert.assertEquals(1, third.get());
+    }
+
+
+    /**
+     * A card hidden by something other than the SDK still tells the caller and frees the screen;
+     * otherwise every later widget and block is refused as "already being shown".
+     */
+    @Test
+    public void aCardHiddenFromOutside_stillReportsAndFreesTheScreen() {
+        Countly.instance().init(UiTestConfigs.configFor("http://127.0.0.1:" + widgetPort));
+
+        // A page that never closes itself, so only the outside hide can end the presentation.
+        CountlyFeedbackWidget widget = widget();
+        widget.widgetId = "never-closes";
+        AtomicInteger told = new AtomicInteger();
+        CountlyWebView.presentFeedbackWidget(null, widget, told::incrementAndGet);
+
+        AtomicReference<Stage> card = new AtomicReference<>();
+        FxTestToolkit.waitUntil("the card to be up", () -> {
+            FxTestToolkit.onFx(() -> {
+                for (javafx.stage.Window window : javafx.stage.Window.getWindows()) {
+                    if (window instanceof Stage && window.isShowing() && window.getScene() != null
+                        && window.getScene().getRoot() instanceof javafx.scene.web.WebView) {
+                        card.set((Stage) window);
+                    }
+                }
+            });
+            return card.get() != null && PresentationLock.showing() != null;
+        });
+
+        FxTestToolkit.onFx(() -> card.get().hide());
+
+        FxTestToolkit.waitUntil("the caller to be told", () -> told.get() == 1);
+        FxTestToolkit.waitUntil("the screen to be free", () -> PresentationLock.showing() == null);
+        FxTestToolkit.sleep(300);
+        Assert.assertEquals("told exactly once", 1, told.get());
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ExternalBrowserTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ExternalBrowserTests.java
new file mode 100644
index 000000000..f07e714a4
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ExternalBrowserTests.java
@@ -0,0 +1,215 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Handing a link to the system browser. The {@code :sdk-java-ui} test task runs with
+ * {@code java.awt.headless=true} (see build.gradle) specifically so {@link java.awt.Desktop} is
+ * never supported here, meaning {@link ExternalBrowser#open} always falls into its "browsing not
+ * supported" branch and no test in this class can ever actually launch a browser.
+ */
+@RunWith(JUnit4.class)
+public class ExternalBrowserTests {
+
+    @After
+    public void stopSdk() {
+        Countly.instance().halt();
+    }
+
+
+    /**
+     * Which desktop action each scheme needs. A "mailto:" link opened through the browse action does
+     * not reliably reach a mail client, and that failure is silent, so the routing is asserted.
+     */
+    @Test
+    public void handlerFor_routesMailLinksToTheMailClient() {
+        Assert.assertEquals(ExternalBrowser.Handler.MAIL, ExternalBrowser.handlerFor("mailto:someone@count.ly"));
+        Assert.assertEquals(ExternalBrowser.Handler.MAIL, ExternalBrowser.handlerFor("MAILTO:someone@count.ly?subject=Hi"));
+        Assert.assertEquals(ExternalBrowser.Handler.MAIL, ExternalBrowser.handlerFor("  mailto:someone@count.ly  "));
+
+        for (String browsed : new String[] { "https://count.ly", "http://count.ly", "tel:+15551234",
+            "sms:+15551234", "maps://?q=here", "myapp://deep/link", null }) {
+            Assert.assertEquals("should browse: " + browsed,
+                ExternalBrowser.Handler.BROWSE, ExternalBrowser.handlerFor(browsed));
+        }
+    }
+
+    /**
+     * System schemes and an application's own custom scheme are allowed; anything that could make
+     * the desktop read a local file, evaluate a script or unpack an archive is not. The blocked list
+     * is kept identical to the Countly Android SDK's.
+     */
+    @Test
+    public void isAllowed_permitsSystemAndCustomSchemesAndBlocksDangerousOnes() {
+        for (String allowed : new String[] { "https://count.ly", "http://count.ly",
+            "mailto:support@count.ly", "tel:+15551234", "sms:+15551234", "maps://?q=here",
+            "geo:0,0", "myapp://open/thing", "MYAPP://OPEN" }) {
+            Assert.assertTrue("should be allowed: " + allowed, ExternalBrowser.isAllowed(allowed));
+        }
+
+        for (String blocked : new String[] { "file:///etc/passwd", "content://media/x",
+            "javascript:alert(1)", "jar:file:///x!/y", "zip:/x", "intent://scan", "data:text/html,x",
+            "FILE:///etc/passwd", "JavaScript:alert(1)" }) {
+            Assert.assertFalse("should be blocked: " + blocked, ExternalBrowser.isAllowed(blocked));
+        }
+
+        // A web view's own placeholder locations name nothing to open. macOS answers a handover of
+        // one with a "can't be opened: -50" dialog, which the user sees.
+        for (String placeholder : new String[] { "about:blank", "ABOUT:BLANK", "about:", "blob:https://count.ly/x" }) {
+            Assert.assertFalse("should be blocked: " + placeholder, ExternalBrowser.isAllowed(placeholder));
+        }
+
+        // No scheme is not openable, and guessing one is how a relative path becomes a file read.
+        for (String noScheme : new String[] { null, "", "   ", "count.ly", "/etc/passwd", ":nohost" }) {
+            Assert.assertFalse("should be blocked: " + noScheme, ExternalBrowser.isAllowed(noScheme));
+        }
+    }
+
+    /**
+     * The per-platform launcher used when {@link java.awt.Desktop} cannot open a link, which is the
+     * usual case for a custom scheme. The URL has to stay one argument: run through a shell it would
+     * be parsed, and it comes from server-issued content.
+     */
+    @Test
+    public void launcherCommandFor_handsTheUrlToTheOsAsOneArgument() {
+        String url = "myapp://open/thing?a=1&b=2";
+
+        Assert.assertArrayEquals(new String[] { "open", url },
+            ExternalBrowser.launcherCommandFor("Mac OS X", url));
+        Assert.assertArrayEquals(new String[] { "rundll32", "url.dll,FileProtocolHandler", url },
+            ExternalBrowser.launcherCommandFor("Windows 11", url));
+        Assert.assertArrayEquals(new String[] { "xdg-open", url },
+            ExternalBrowser.launcherCommandFor("Linux", url));
+
+        Assert.assertNull(ExternalBrowser.launcherCommandFor("Plan 9", url));
+        Assert.assertNull(ExternalBrowser.launcherCommandFor(null, url));
+    }
+
+    /**
+     * An application that registers a URL handler owns its links: it is offered every link first,
+     * gets the scheme the content actually sent, and a handler that throws must not stop the SDK
+     * from carrying on.
+     */
+    @Test
+    public void applicationUrlHandler_isOfferedEveryLinkFirst() {
+        List<String> seen = new ArrayList<>();
+        Countly.instance().init(UiTestConfigs.refusedServer()
+            .content.setContentUrlHandler(url -> {
+                seen.add(url);
+                return url.startsWith("myapp://");
+            }));
+
+        // Claimed by the application: reported as opened without the SDK touching the desktop.
+        Assert.assertTrue(ExternalBrowser.open("myapp://open/thing"));
+
+        // Declined: falls through to the SDK, which is headless here so it cannot open it.
+        Assert.assertFalse(ExternalBrowser.open("https://count.ly"));
+
+        // Offered even for a scheme the SDK would refuse itself: the application decides.
+        Assert.assertFalse(ExternalBrowser.open("file:///etc/passwd"));
+
+        Assert.assertEquals(Arrays.asList("myapp://open/thing", "https://count.ly", "file:///etc/passwd"), seen);
+    }
+
+    /**
+     * A handler that throws is contained: the SDK logs it and opens the link as if no handler was
+     * registered.
+     */
+    @Test
+    public void applicationUrlHandler_thatThrows_isContained() {
+        Countly.instance().init(UiTestConfigs.refusedServer()
+            .content.setContentUrlHandler(url -> {
+                throw new IllegalStateException("this handler is broken");
+            }));
+
+        Assert.assertFalse(ExternalBrowser.open("https://count.ly"));
+    }
+
+    /**
+     * A null or blank URL is rejected before anything else is attempted, and a well-formed URL runs
+     * into the headless "no desktop support" branch, so both paths report "not opened" without ever
+     * touching a real browser.
+     */
+    @Test
+    public void open_guardsBlankUrlsAndReportsUnsupportedWhenHeadless() {
+        for (String blank : new String[] { null, "", "   " }) {
+            Assert.assertFalse("blank URL [" + blank + "] must be rejected", ExternalBrowser.open(blank));
+        }
+
+        Assert.assertFalse("a headless JVM never supports Desktop.browse",
+            ExternalBrowser.open("https://count.ly"));
+    }
+
+    /**
+     * Linux gets a chain of launchers, the user's own BROWSER first, rather than one fire-and-forget
+     * xdg-open whose failure used to be logged as an open.
+     */
+    @Test
+    public void linuxLaunchers_tryTheUsersBrowserFirstThenTheDesktopsThenTheBrowsers() {
+        java.util.List<String[]> plain = ExternalBrowser.linuxLaunchers("https://x.y/z", null, null);
+        Assert.assertEquals("gdbus", plain.get(0)[0]);
+        Assert.assertArrayEquals(new String[] { "xdg-open", "https://x.y/z" }, plain.get(1));
+        Assert.assertArrayEquals(new String[] { "gio", "open", "https://x.y/z" }, plain.get(2));
+        Assert.assertEquals("firefox", plain.get(5)[0]);
+
+        java.util.List<String[]> own = ExternalBrowser.linuxLaunchers("https://x.y/z", "brave-browser", null);
+        Assert.assertArrayEquals(new String[] { "brave-browser", "https://x.y/z" }, own.get(0));
+        Assert.assertEquals("gdbus", own.get(1)[0]);
+        Assert.assertEquals("xdg-open", own.get(2)[0]);
+
+        // The %s convention, and several colon separated entries.
+        java.util.List<String[]> templated = ExternalBrowser.linuxLaunchers("https://x.y/z", "myopen --url=%s:firefox", null);
+        Assert.assertEquals("/bin/sh", templated.get(0)[0]);
+        Assert.assertEquals("myopen --url=\"$0\"", templated.get(0)[2]);
+        Assert.assertEquals("https://x.y/z", templated.get(0)[3]);
+        Assert.assertArrayEquals(new String[] { "firefox", "https://x.y/z" }, templated.get(1));
+        Assert.assertEquals("gdbus", templated.get(2)[0]);
+
+        Assert.assertTrue(ExternalBrowser.isLinux("Linux"));
+        Assert.assertFalse(ExternalBrowser.isLinux("Mac OS X"));
+        Assert.assertFalse(ExternalBrowser.isLinux("Windows 11"));
+    }
+
+    /**
+     * The browser is raised through the desktop portal and gtk-launch ahead of xdg-open, so that on
+     * Wayland the tab comes to the front instead of opening in the background; the user's own BROWSER
+     * still wins, the URL is always its own argument, and what xdg-settings printed is trusted only
+     * when it is a desktop file id.
+     */
+    @Test
+    public void linuxLaunchers_raiseTheBrowserAheadOfXdgOpen() {
+        java.util.List<String[]> withDefault = ExternalBrowser.linuxLaunchers("https://x.y/z", null, "org.mozilla.firefox.desktop");
+        String[] portal = withDefault.get(0);
+        Assert.assertEquals("gdbus", portal[0]);
+        Assert.assertEquals("org.freedesktop.portal.OpenURI.OpenURI", portal[8]);
+        Assert.assertEquals("", portal[9]);
+        Assert.assertEquals("https://x.y/z", portal[10]);
+        Assert.assertEquals("{}", portal[11]);
+        Assert.assertEquals(12, portal.length);
+        Assert.assertArrayEquals(new String[] { "gtk-launch", "org.mozilla.firefox.desktop", "https://x.y/z" }, withDefault.get(1));
+        Assert.assertArrayEquals(new String[] { "xdg-open", "https://x.y/z" }, withDefault.get(2));
+
+        java.util.List<String[]> own = ExternalBrowser.linuxLaunchers("https://x.y/z", "brave-browser", "org.mozilla.firefox.desktop");
+        Assert.assertEquals("brave-browser", own.get(0)[0]);
+        Assert.assertEquals("gdbus", own.get(1)[0]);
+        Assert.assertEquals("gtk-launch", own.get(2)[0]);
+        Assert.assertEquals("xdg-open", own.get(3)[0]);
+
+        Assert.assertEquals("org.mozilla.firefox.desktop", ExternalBrowser.desktopIdOf("org.mozilla.firefox.desktop\n"));
+        Assert.assertEquals("firefox.desktop", ExternalBrowser.desktopIdOf("  firefox.desktop  \nsecond line"));
+        Assert.assertNull(ExternalBrowser.desktopIdOf(null));
+        Assert.assertNull(ExternalBrowser.desktopIdOf(""));
+        Assert.assertNull(ExternalBrowser.desktopIdOf("xdg-settings: unknown property default-web-browser"));
+        Assert.assertNull(ExternalBrowser.desktopIdOf("../evil.desktop"));
+        Assert.assertNull(ExternalBrowser.desktopIdOf("firefox"));
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackScenarioTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackScenarioTests.java
new file mode 100644
index 000000000..26a125d40
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackScenarioTests.java
@@ -0,0 +1,533 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.stage.Window;
+import javafx.scene.web.WebView;
+import javafx.scene.web.WebEngine;
+import javafx.stage.Stage;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.FeedbackWidgetSelector;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Drives each feedback widget through the flow the Android SDK's {@code content_test_runner.py}
+ * drives, with the selectors from its {@code content_test_config.py}: open, confirm the right
+ * template rendered, fill it in, submit, and check what the SDK made of it.
+ * <p>
+ * Findings are recorded rather than asserted. A scenario driver's job is to say what a real server
+ * and a real page do, and a missing fixture on the server is a finding, not a broken test.
+ */
+@RunWith(JUnit4.class)
+public class FeedbackScenarioTests {
+
+    // From content_test_config.py, verbatim.
+    private static final String SURVEY_V2_CLOSE_SELECTOR = ".close-button";
+    private static final String SURVEY_V2_TERMS_LINK = "a[href*='termsandconditions' i]";
+    private static final String SURVEY_V2_PRIVACY_LINK = "a[href*='privacypolicy' i]";
+    private static final String SURVEY_SUBMIT_BUTTON = "[data-test-id='survey-drawer-survey-page-next-button']";
+    private static final String SURVEY_CONSENT_CHECKBOX =
+        "[data-test-id='survey-survey-sub-page-agree-to-terms-conditions-checkbox']";
+    private static final String SURVEY_RADIO_OPTION = ".radio-item";
+    private static final String NPS_NEXT_BUTTON = "[data-test-id='nps-drawer-survey-page-next-button']";
+    private static final String NPS_SUBMIT_BUTTON = "[data-test-id='nps-survey-sub-page-submit-button']";
+    private static final String NPS_CONSENT_CHECKBOX =
+        "[data-test-id='nps-survey-sub-page-agree-to-terms-conditions-checkbox']";
+    private static final String NPS_RATING_BUTTON_FMT = ".rating-button[data-rating='%d']";
+    private static final String NPS_COMMENT_TEXTAREA = "[data-test-id='nps-popup-comment-textarea']";
+    private static final String RATING_CLOSE_SELECTOR = "#close-btn";
+    private static final String RATING_EMOJI_FMT = ".rating-emotion[data-score='%d']";
+    private static final String RATING_ADD_COMMENT_CHECKBOX = "#countly-feedback-show-comment";
+    private static final String RATING_COMMENT_TEXTAREA = "#countly-feedback-comment-textarea";
+    private static final String RATING_EMAIL_CHECKBOX = "#countly-feedback-show-email";
+    private static final String RATING_EMAIL_INPUT = "#countly-feedback-contact-me-email";
+    private static final String RATING_SUBMIT_BUTTON = "#cf-submit-button";
+    private static final String LOREM = "Lorem ipsum dolor sit amet, consectetur adipiscing elit";
+    private static final String LOREM_EMAIL = "automation+lorem@example.test";
+
+    private static final long PAGE_TIMEOUT_MS = 30_000;
+    private static final WidgetSurface SURFACE = new WidgetSurface(0, 0, 1600, 1000);
+
+    private static Stage owner;
+    private ScenarioDriver.LogBuffer log;
+    private List<CountlyFeedbackWidget> widgets;
+
+    @BeforeClass
+    public static void enable() {
+        ScenarioDriver.assumeEnabled();
+        owner = ScenarioDriver.newApplicationWindow(80, 60, 900, 600);
+    }
+
+    @AfterClass
+    public static void report() {
+        ScenarioDriver.writeReport("feedback-scenarios");
+        if (owner != null) {
+            FxTestToolkit.onFx(owner::close);
+        }
+    }
+
+    @Before
+    public void startSdk() {
+        log = new ScenarioDriver.LogBuffer();
+        Countly.instance().init(ScenarioDriver.liveConfig("scenario-java-fx", log));
+
+        AtomicReference<List<CountlyFeedbackWidget>> fetched = new AtomicReference<>();
+        AtomicReference<String> error = new AtomicReference<>();
+        Countly.instance().feedback().getAvailableFeedbackWidgets((list, problem) -> {
+            error.set(problem);
+            fetched.set(list);
+        });
+
+        long until = System.currentTimeMillis() + PAGE_TIMEOUT_MS;
+        while (fetched.get() == null && error.get() == null && System.currentTimeMillis() < until) {
+            ScenarioDriver.pause(100);
+        }
+        widgets = fetched.get() == null ? new ArrayList<>() : fetched.get();
+        ScenarioDriver.record("setup", "fetch the widget list",
+            widgets.isEmpty() ? ScenarioDriver.Verdict.FAIL : ScenarioDriver.Verdict.PASS,
+            widgets.size() + " widgets, error [" + error.get() + "]");
+    }
+
+    @After
+    public void stopSdk() {
+        if (log != null) {
+            log.dump("feedback-scenarios");
+        }
+        FxTestToolkit.onFx(PresentationLock::resetForTests);
+        Countly.instance().halt();
+    }
+
+    /**
+     * NPS: the two page flow. Pick a score, go to the comment page, write a comment, agree to the
+     * terms, submit, and check the SDK recorded the answer.
+     */
+    @Test
+    public void nps() {
+        Card card = present(FeedbackWidgetType.nps, "nps");
+        if (card == null) {
+            return;
+        }
+        WebEngine engine = card.driven.engine();
+
+        ScenarioDriver.check("nps", "the survey-v2 template rendered",
+            ScenarioDriver.count(engine, ".rating-button") == 11,
+            ScenarioDriver.count(engine, ".rating-button") + " rating buttons, expected 11");
+        ScenarioDriver.check("nps", "a close button is present",
+            ScenarioDriver.exists(engine, SURVEY_V2_CLOSE_SELECTOR), SURVEY_V2_CLOSE_SELECTOR);
+        reportLinks(engine, "nps", SURVEY_V2_TERMS_LINK, SURVEY_V2_PRIVACY_LINK);
+        measureStep(card, "nps", "rating step");
+
+        ScenarioDriver.check("nps", "pick a score",
+            ScenarioDriver.click(engine, String.format(NPS_RATING_BUTTON_FMT, 9)), "score 9");
+
+        boolean next = ScenarioDriver.click(engine, NPS_NEXT_BUTTON);
+        ScenarioDriver.check("nps", "go to the comment page", next, NPS_NEXT_BUTTON);
+
+        if (next) {
+            ScenarioDriver.pause(600);
+            ScenarioDriver.record("nps", "the comment page opened",
+                ScenarioDriver.exists(engine, NPS_COMMENT_TEXTAREA)
+                    ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+                "textarea present: " + ScenarioDriver.exists(engine, NPS_COMMENT_TEXTAREA));
+            measureStep(card, "nps", "comment step");
+            ScenarioDriver.check("nps", "write a comment",
+                ScenarioDriver.type(engine, NPS_COMMENT_TEXTAREA, LOREM), "lorem text");
+            // The links live on this page, not the first one: checking them on the rating screen is
+            // what made them look absent.
+            reportLinks(engine, "nps (comment page)", SURVEY_V2_TERMS_LINK, SURVEY_V2_PRIVACY_LINK);
+            ScenarioDriver.record("nps", "agree to the terms",
+                ScenarioDriver.tick(engine, NPS_CONSENT_CHECKBOX)
+                    ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP,
+                "checkbox: " + ScenarioDriver.exists(engine, NPS_CONSENT_CHECKBOX));
+            ScenarioDriver.check("nps", "submit", ScenarioDriver.click(engine, NPS_SUBMIT_BUTTON),
+                NPS_SUBMIT_BUTTON);
+            measureStep(card, "nps", "thanks step");
+        }
+
+        finish(card, "nps", "\\[CLY\\]_nps");
+    }
+
+    /**
+     * Survey: one page. Answer a question, agree to the terms, submit.
+     */
+    @Test
+    public void survey() {
+        Card card = present(FeedbackWidgetType.survey, "survey");
+        if (card == null) {
+            return;
+        }
+        WebEngine engine = card.driven.engine();
+
+        int options = ScenarioDriver.count(engine, SURVEY_RADIO_OPTION);
+        ScenarioDriver.record("survey", "the survey-v2 template rendered",
+            options > 0 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            options + " radio options");
+        ScenarioDriver.check("survey", "a close button is present",
+            ScenarioDriver.exists(engine, SURVEY_V2_CLOSE_SELECTOR), SURVEY_V2_CLOSE_SELECTOR);
+        reportLinks(engine, "survey", SURVEY_V2_TERMS_LINK, SURVEY_V2_PRIVACY_LINK);
+
+        if (options > 0) {
+            ScenarioDriver.check("survey", "answer a question",
+                ScenarioDriver.click(engine, SURVEY_RADIO_OPTION), "first radio option");
+        }
+        ScenarioDriver.record("survey", "agree to the terms",
+            ScenarioDriver.tick(engine, SURVEY_CONSENT_CHECKBOX)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP,
+            "checkbox: " + ScenarioDriver.exists(engine, SURVEY_CONSENT_CHECKBOX));
+        reportLinks(engine, "survey (consent shown)", SURVEY_V2_TERMS_LINK, SURVEY_V2_PRIVACY_LINK);
+        ScenarioDriver.check("survey", "submit",
+            ScenarioDriver.click(engine, SURVEY_SUBMIT_BUTTON), SURVEY_SUBMIT_BUTTON);
+
+        finish(card, "survey", "\\[CLY\\]_survey");
+    }
+
+    /**
+     * Rating: the older framework. Pick a face, add a comment and an email, submit.
+     */
+    @Test
+    public void rating() {
+        Card card = present(FeedbackWidgetType.rating, "rating");
+        if (card == null) {
+            return;
+        }
+        WebEngine engine = card.driven.engine();
+
+        int faces = ScenarioDriver.count(engine, ".rating-emotion");
+        ScenarioDriver.record("rating", "the ratings-popup template rendered",
+            faces > 0 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            faces + " rating faces, close button: " + ScenarioDriver.exists(engine, RATING_CLOSE_SELECTOR));
+
+        // The rating page opens as a sticky tab; the popup is behind it.
+        ScenarioDriver.record("rating", "the sticky tab is the entry point",
+            ScenarioDriver.Verdict.PASS,
+            "body text [" + ScenarioDriver.visibleText(engine).replace('\n', ' ').trim() + "]");
+
+        ScenarioDriver.check("rating", "pick a face",
+            ScenarioDriver.click(engine, String.format(RATING_EMOJI_FMT, 5)), "score 5");
+        ScenarioDriver.record("rating", "ask for the comment field",
+            ScenarioDriver.tick(engine, RATING_ADD_COMMENT_CHECKBOX)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP, RATING_ADD_COMMENT_CHECKBOX);
+        ScenarioDriver.record("rating", "write a comment",
+            ScenarioDriver.type(engine, RATING_COMMENT_TEXTAREA, LOREM)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP, RATING_COMMENT_TEXTAREA);
+        ScenarioDriver.record("rating", "ask for the email field",
+            ScenarioDriver.tick(engine, RATING_EMAIL_CHECKBOX)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP, RATING_EMAIL_CHECKBOX);
+        ScenarioDriver.record("rating", "fill the email in",
+            ScenarioDriver.type(engine, RATING_EMAIL_INPUT, LOREM_EMAIL)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP, RATING_EMAIL_INPUT);
+        ScenarioDriver.record("rating", "submit",
+            ScenarioDriver.click(engine, RATING_SUBMIT_BUTTON)
+                ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP, RATING_SUBMIT_BUTTON);
+
+        finish(card, "rating", "\\[CLY\\]_star_rating|\\[CLY\\]_rating");
+    }
+
+    /**
+     * The close button, on its own: a widget dismissed without answering still has to reach the
+     * SDK and still has to run the caller's callback.
+     */
+    @Test
+    public void closingWithoutAnswering() {
+        Card card = present(FeedbackWidgetType.nps, "close");
+        if (card == null) {
+            return;
+        }
+
+        boolean closed = ScenarioDriver.click(card.driven.engine(), SURVEY_V2_CLOSE_SELECTOR);
+        ScenarioDriver.check("close", "click the close button", closed, SURVEY_V2_CLOSE_SELECTOR);
+
+        boolean gone = false;
+        long until = System.currentTimeMillis() + 5000;
+        while (System.currentTimeMillis() < until && !gone) {
+            gone = card.callbacks.get() > 0;
+            ScenarioDriver.pause(100);
+        }
+        ScenarioDriver.check("close", "the caller's callback ran", gone,
+            "callbacks: " + card.callbacks.get());
+        ScenarioDriver.check("close", "the dismissal was reported",
+            log.has("reportFeedbackWidgetManually"), log.find("reportFeedbackWidgetManually"));
+
+        AtomicReference<Boolean> showing = new AtomicReference<>(true);
+        FxTestToolkit.onFx(() -> showing.set(card.driven.stage.isShowing()));
+        ScenarioDriver.check("close", "the card is off screen", !showing.get(), null);
+    }
+
+    // ------------------------------------------------------------------ helpers
+
+    private static final class Card {
+        final ScenarioDriver.Card driven;
+        final AtomicInteger callbacks = new AtomicInteger();
+
+        Card(ScenarioDriver.Card driven) {
+            this.driven = driven;
+        }
+    }
+
+    /**
+     * Presents the first widget of a type and waits for its page.
+     *
+     * @return the card, or {@code null} when the server has no such widget, which is recorded
+     */
+    private Card present(FeedbackWidgetType type, String scenario) {
+        CountlyFeedbackWidget widget = FeedbackWidgetSelector.select(widgets, type, null);
+        if (widget == null) {
+            ScenarioDriver.record(scenario, "a " + type + " widget is available",
+                ScenarioDriver.Verdict.SKIP, "the server returned none for this app key");
+            return null;
+        }
+        ScenarioDriver.record(scenario, "a " + type + " widget is available", ScenarioDriver.Verdict.PASS,
+            "id [" + widget.widgetId + "] name [" + widget.name + "] position [" + widget.position + "]");
+
+        List<ContentPlacement> fits = new ArrayList<>();
+        AtomicInteger loads = new AtomicInteger();
+        AtomicInteger failures = new AtomicInteger();
+
+        ScenarioDriver.Card driven = ScenarioDriver.newCard(SURFACE, null);
+        Card card = new Card(driven);
+
+        FeedbackWidgetPresenter presenter = new FeedbackWidgetPresenter(driven.host,
+            Countly.instance().feedback(), card.callbacks::incrementAndGet);
+        driven.presenter = presenter;
+
+        // Wrapped so the scenario can see the page's own milestones as well as the SDK's.
+        WidgetWebHost.Listener spy = new WidgetWebHost.Listener() {
+            @Override public void onNavigationStarting(String url) {
+                presenter.onNavigationStarting(url);
+            }
+            @Override public void onWidgetMessage(String json) {
+                presenter.onWidgetMessage(json);
+            }
+            @Override public void onCardFollowing(int width, int height) {
+                presenter.onCardFollowing(width, height);
+            }
+            @Override public void onContentOverflow(int extraHeight) {
+                ScenarioDriver.record(scenario, "the page's content did not fit its card",
+                    ScenarioDriver.Verdict.WARN, extraHeight + " px short, growing the card");
+                presenter.onContentOverflow(extraHeight);
+            }
+            @Override public void onPageLoaded() {
+                loads.incrementAndGet();
+                presenter.onPageLoaded();
+            }
+            @Override public void onLoadFailed() {
+                failures.incrementAndGet();
+                presenter.onLoadFailed();
+            }
+            @Override public void onSizeNotReported(int paintedWidth, int paintedHeight) {
+                presenter.onSizeNotReported(paintedWidth, paintedHeight);
+            }
+            @Override public void onCardMeasured(int width, int height) {
+                fits.add(new ContentPlacement(0, 0, width, height));
+                presenter.onCardMeasured(width, height);
+            }
+        };
+        FxTestToolkit.onFx(() -> driven.host.setListener(spy));
+        FxTestToolkit.onFx(() -> presenter.start(widget));
+
+        long until = System.currentTimeMillis() + PAGE_TIMEOUT_MS;
+        while (loads.get() == 0 && failures.get() == 0 && System.currentTimeMillis() < until) {
+            ScenarioDriver.pause(100);
+        }
+        ScenarioDriver.check(scenario, "the widget page loaded", loads.get() > 0,
+            "loads " + loads.get() + ", failures " + failures.get());
+        if (loads.get() == 0) {
+            return null;
+        }
+
+        // The page needs a moment to fetch its own definition and build its DOM.
+        ScenarioDriver.pause(2500);
+
+        AtomicReference<String> geometry = new AtomicReference<>("");
+        FxTestToolkit.onFx(() -> geometry.set((int) driven.stage.getX() + "," + (int) driven.stage.getY()
+            + " " + (int) driven.stage.getWidth() + "x" + (int) driven.stage.getHeight()
+            + " showing=" + driven.stage.isShowing() + " opacity=" + driven.stage.getOpacity()));
+        ScenarioDriver.record(scenario, "the card is on screen", ScenarioDriver.Verdict.PASS,
+            geometry.get() + ", fitted " + fits.size() + " time(s)");
+        return card;
+    }
+
+    /** Records whether the terms and privacy links the fixtures carry are in the page. */
+    private void reportLinks(WebEngine engine, String scenario, String terms, String privacy) {
+        ScenarioDriver.record(scenario, "the terms link is present",
+            ScenarioDriver.exists(engine, terms) ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP,
+            "count " + ScenarioDriver.count(engine, terms));
+        ScenarioDriver.record(scenario, "the privacy link is present",
+            ScenarioDriver.exists(engine, privacy) ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.SKIP,
+            "count " + ScenarioDriver.count(engine, privacy));
+    }
+
+    /**
+     * Waits out the widget's own closing, then reports what the SDK made of the session.
+     */
+    private void finish(Card card, String scenario, String eventRegex) {
+        long until = System.currentTimeMillis() + 8000;
+        while (card.callbacks.get() == 0 && System.currentTimeMillis() < until) {
+            ScenarioDriver.pause(200);
+        }
+
+        ScenarioDriver.record(scenario, "the SDK recorded a widget event",
+            log.has(eventRegex) ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            String.valueOf(log.find(eventRegex)));
+        ScenarioDriver.record(scenario, "the widget closed itself",
+            card.callbacks.get() > 0 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.WARN,
+            "callbacks " + card.callbacks.get());
+        ScenarioDriver.record(scenario, "no SDK errors during the scenario",
+            log.countOf("^ERROR ") == 0 ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.FAIL,
+            log.countOf("^ERROR ") + " error lines, first [" + log.find("^ERROR ") + "]");
+
+        FxTestToolkit.onFx(() -> {
+            if (card.driven.stage.isShowing()) {
+                card.driven.host.closeHost();
+            }
+        });
+    }
+
+    /**
+     * The card against its own content, at whichever step it is on: a window smaller than the page
+     * needs is a scrollbar the user has to fight, and a bottom anchored card that stopped short of
+     * the edge floats.
+     *
+     * @param card the card on screen
+     * @param scenario which run this is
+     * @param step what the widget is showing
+     */
+    private void measureStep(Card card, String scenario, String step) {
+        // Long enough for the page to have asked for its new size and for the fit to have run.
+        ScenarioDriver.pause(1200);
+
+        AtomicReference<String> detail = new AtomicReference<>("not measured");
+        FxTestToolkit.onFx(() -> {
+            Stage stage = card.driven.stage;
+            WidgetSurface surface = card.driven.host.getSurface();
+            int overflow = FxSurfaces.measureOverflow(card.driven.engine());
+            int bottomGap = (surface.y + surface.height) - ((int) stage.getY() + (int) stage.getHeight());
+            detail.set("card " + (int) stage.getWidth() + "x" + (int) stage.getHeight()
+                + " @" + (int) stage.getX() + "," + (int) stage.getY()
+                + " | needs " + overflow + " more px"
+                + " | " + bottomGap + " px above the surface bottom"
+                + " | surface " + surface);
+        });
+
+        boolean fits = detail.get().contains("needs 0 more px");
+        ScenarioDriver.record(scenario, "the card fits its content on the " + step,
+            fits ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.FAIL, detail.get());
+
+        // What the host did to get there, in order: the size the page asked for, what was measured
+        // off the drawn card, and any growth. Without this a wrong height is a mystery.
+        List<String> trail = log.findAll(
+            "resizing the content|reportMeasuredCard|growPastAScrollbar|onContentOverflow|placeAndShow", 6);
+        ScenarioDriver.record(scenario, "how the card got its size on the " + step,
+            ScenarioDriver.Verdict.PASS, trail.isEmpty() ? "nothing logged"
+                : String.join(" ;; ", trail).replace("DEBUG ", ""));
+    }
+
+
+    /**
+     * NPS the way an integrator shows it: through {@link CountlyWebView#presentNPS}, not through a
+     * card this test built itself.
+     * <p>
+     * The other NPS scenario drives a stage and a host the driver assembles, which is a different
+     * code path from the one a demo application takes: the public facade resolves the surface,
+     * creates the stage, wires the presenter and installs the bridge itself. A widget that resizes
+     * per step in one and not the other is a fault in that wiring, so this drives the facade and
+     * measures the same three steps.
+     */
+    @Test
+    public void npsThroughThePublicApi() {
+        // The screen, as the demo is configured when the fault is seen.
+        CountlyWebView.forgetDisplayAreaForTests();
+        CountlyWebView.setShowWidgetsWithinApp(false);
+        CountlyWebView.setWebViewDiagnosticsEnabled(true);
+
+        AtomicInteger closed = new AtomicInteger();
+        FxTestToolkit.onFx(() -> CountlyWebView.presentNPS(owner, null, closed::incrementAndGet));
+
+        // The facade keeps its stage to itself, so it is found the way a user sees it: the
+        // transparent window that appeared, showing a web view on the widget's own URL.
+        AtomicReference<Stage> found = new AtomicReference<>();
+        for (int i = 0; i < 80 && found.get() == null; i++) {
+            ScenarioDriver.pause(250);
+            FxTestToolkit.onFx(() -> {
+                for (Window window : Window.getWindows()) {
+                    if (!(window instanceof Stage) || !window.isShowing()) {
+                        continue;
+                    }
+                    Stage stage = (Stage) window;
+                    if (stage == owner || stage.getScene() == null
+                        || !(stage.getScene().getRoot() instanceof WebView)) {
+                        continue;
+                    }
+                    String location = ((WebView) stage.getScene().getRoot()).getEngine().getLocation();
+                    if (location != null && location.contains("/feedback/")) {
+                        found.set(stage);
+                        return;
+                    }
+                }
+            });
+        }
+
+        if (found.get() == null) {
+            ScenarioDriver.record("nps (public api)", "the facade presented a widget",
+                ScenarioDriver.Verdict.SKIP, "no widget window appeared, closed callbacks: " + closed.get());
+            return;
+        }
+
+        Stage stage = found.get();
+        AtomicReference<WebEngine> engineRef = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> engineRef.set(((WebView) stage.getScene().getRoot()).getEngine()));
+        WebEngine engine = engineRef.get();
+
+        ScenarioDriver.record("nps (public api)", "the facade presented a widget",
+            ScenarioDriver.Verdict.PASS, "window at " + (int) stage.getX() + "," + (int) stage.getY()
+                + " " + (int) stage.getWidth() + "x" + (int) stage.getHeight());
+
+        measureFacadeStep("nps (public api)", "rating step", stage, engine);
+        ScenarioDriver.click(engine, String.format(NPS_RATING_BUTTON_FMT, 9));
+        ScenarioDriver.click(engine, NPS_NEXT_BUTTON);
+        measureFacadeStep("nps (public api)", "comment step", stage, engine);
+        ScenarioDriver.type(engine, NPS_COMMENT_TEXTAREA, LOREM);
+        ScenarioDriver.tick(engine, NPS_CONSENT_CHECKBOX);
+        ScenarioDriver.click(engine, NPS_SUBMIT_BUTTON);
+        measureFacadeStep("nps (public api)", "thanks step", stage, engine);
+
+        FxTestToolkit.onFx(() -> {
+            if (stage.isShowing()) {
+                stage.close();
+            }
+        });
+    }
+
+    /**
+     * The same measurement as the other scenario, against a stage the facade owns.
+     */
+    private void measureFacadeStep(String scenario, String step, Stage stage, WebEngine engine) {
+        ScenarioDriver.pause(2600);
+
+        AtomicReference<String> detail = new AtomicReference<>("not measured");
+        FxTestToolkit.onFx(() -> detail.set("card " + (int) stage.getWidth() + "x" + (int) stage.getHeight()
+            + " @" + (int) stage.getX() + "," + (int) stage.getY()
+            + " | needs " + FxSurfaces.measureOverflow(engine) + " more px"));
+
+        ScenarioDriver.record(scenario, "the card fits its content on the " + step,
+            detail.get().contains("needs 0 more px") ? ScenarioDriver.Verdict.PASS : ScenarioDriver.Verdict.FAIL,
+            detail.get());
+        List<String> trail = log.findAll(
+            "asked to be|putting the|reportMeasuredCard|growPastAScrollbar|notifyPageOfSurface", 6);
+        ScenarioDriver.record(scenario, "how the card got its size on the " + step,
+            ScenarioDriver.Verdict.PASS, trail.isEmpty() ? "nothing logged"
+                : String.join(" ;; ", trail).replace("DEBUG ", ""));
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterErrorTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterErrorTests.java
new file mode 100644
index 000000000..ec47dc895
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterErrorTests.java
@@ -0,0 +1,148 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import ly.count.sdk.java.internal.ModuleFeedback;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+/**
+ * Error and edge paths of {@link FeedbackWidgetPresenter} that {@link FeedbackWidgetPresenterTests}
+ * does not reach: external links, a plain in-page "link" signal outside of a resize, and a teardown
+ * whose host or callback misbehaves. A NEW file, kept separate so the existing tests stay untouched.
+ */
+@RunWith(JUnit4.class)
+public class FeedbackWidgetPresenterErrorTests {
+
+    private static final String WIDGET_URL = "https://test.server.com/feedback/nps?widget_id=w1";
+
+    /**
+     * An external link signal (the whole URL is the destination) is handed to the system browser and
+     * never reaches the resize/close handling in {@code handle}; a plain "link" carried on an
+     * in-page action-event URL, with no resize and no close alongside it, is opened the same way
+     * from inside {@code handle} instead; and a bridged postMessage payload that is not a widget
+     * command at all is dropped before either channel is reached.
+     */
+    @Test
+    public void navigation_opensExternalAndInPageLinksWithoutClosingOrPlacing() {
+        FakeHost host = new FakeHost();
+        ModuleFeedback.Feedback feedback = mock(ModuleFeedback.Feedback.class);
+        when(feedback.constructFeedbackWidgetUrl(any(), anyInt(), anyInt())).thenReturn(WIDGET_URL);
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = "w1";
+        widget.type = FeedbackWidgetType.nps;
+
+        FeedbackWidgetPresenter presenter = new FeedbackWidgetPresenter(host, feedback, null);
+        presenter.start(widget);
+
+        host.listener.onNavigationStarting("https://example.com/offer?cly_x_int=1");
+        Assert.assertTrue("an external link must not be read as a resize/close command", host.placements.isEmpty());
+        Assert.assertEquals(0, host.closeCount);
+
+        host.listener.onNavigationStarting("https://countly_action_event/?cly_x_action_event=1"
+            + "&link=https%3A%2F%2Fexample.com%2Fpage");
+        Assert.assertTrue("a link with no resize payload places nothing", host.placements.isEmpty());
+        Assert.assertEquals("a link with no close flag must not close the widget", 0, host.closeCount);
+
+        // Not a {cly_widget_command} payload at all: WidgetMessageParser.parse returns null and
+        // onWidgetMessage must drop it before it ever reaches handle().
+        host.listener.onWidgetMessage("{\"type\":\"something_else\"}");
+        Assert.assertTrue(host.placements.isEmpty());
+        Assert.assertEquals(0, host.closeCount);
+    }
+
+    /**
+     * Teardown must isolate its two side effects from each other: a host whose {@code closeHost}
+     * throws still lets the {@code onClosed} callback run, and an {@code onClosed} that itself
+     * throws must not escape {@code finish()} (and so {@code start()}) either.
+     */
+    @Test
+    public void finish_isolatesAThrowingHostFromAThrowingCallback() {
+        ModuleFeedback.Feedback feedback = mock(ModuleFeedback.Feedback.class);
+        when(feedback.constructFeedbackWidgetUrl(any(), anyInt(), anyInt())).thenReturn(WIDGET_URL);
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = "w1";
+        widget.type = FeedbackWidgetType.nps;
+
+        FakeHost throwingHost = new FakeHost();
+        throwingHost.throwOnClose = true;
+        AtomicInteger closedCallbacks = new AtomicInteger(0);
+        new FeedbackWidgetPresenter(throwingHost, feedback, closedCallbacks::incrementAndGet).start(widget);
+
+        throwingHost.listener.onLoadFailed();
+        // The host blew up while closing itself, but the caller must still be told it is gone.
+        Assert.assertEquals(1, throwingHost.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+
+        FakeHost plainHost = new FakeHost();
+        Runnable throwingCallback = () -> {
+            throw new RuntimeException("caller callback misbehaved");
+        };
+        new FeedbackWidgetPresenter(plainHost, feedback, throwingCallback).start(widget);
+        // Must not throw out of start()/onLoadFailed(): the callback's own exception is swallowed.
+        plainHost.listener.onLoadFailed();
+        Assert.assertEquals(1, plainHost.closeCount);
+    }
+
+    private static class FakeHost implements WidgetWebHost {
+
+        Listener listener;
+        WidgetSurface surface = new WidgetSurface(0, 0, 1600, 900);
+        final List<ContentPlacement> placements = new ArrayList<>();
+        final List<ContentPlacement> followed = new ArrayList<>();
+        boolean throwOnClose = false;
+        int closeCount = 0;
+
+        @Override
+        public void setListener(Listener widgetListener) {
+            listener = widgetListener;
+        }
+
+        @Override
+        public WidgetSurface getSurface() {
+            return surface;
+        }
+
+        @Override
+        public void setSurface(WidgetSurface updated) {
+            surface = updated;
+        }
+
+        @Override
+        public void navigate(String url) {
+        }
+
+        @Override
+        public void reportSurfaceSize(int width, int height) {
+        }
+
+        @Override
+        public void placeAndShow(ContentPlacement rect) {
+            placements.add(rect);
+        }
+
+        @Override
+        public void closeHost() {
+            closeCount++;
+            if (throwOnClose) {
+                throw new RuntimeException("host failed to close");
+            }
+        }
+
+        @Override
+        public void followGeometry(ContentPlacement rect) {
+            followed.add(rect);
+        }
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterTests.java
new file mode 100644
index 000000000..81b097898
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FeedbackWidgetPresenterTests.java
@@ -0,0 +1,389 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.CountlyFeedbackWidget;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import ly.count.sdk.java.internal.ModuleFeedback;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/**
+ * The feedback widget presentation flow, driven against a fake browser host so no JavaFX toolkit is
+ * needed.
+ */
+@RunWith(JUnit4.class)
+public class FeedbackWidgetPresenterTests {
+
+    private static final String WIDGET_URL = "https://test.server.com/feedback/nps?widget_id=w1";
+    private static final String CLOSE_URL = "https://countly_action_event/?cly_widget_command=1&close=1";
+
+    private FakeHost host;
+    private ModuleFeedback.Feedback feedback;
+    private CountlyFeedbackWidget widget;
+    private AtomicInteger closedCallbacks;
+
+    @Before
+    public void beforeTest() {
+        host = new FakeHost();
+        feedback = mock(ModuleFeedback.Feedback.class);
+        closedCallbacks = new AtomicInteger(0);
+
+        widget = new CountlyFeedbackWidget();
+        widget.widgetId = "w1";
+        widget.type = FeedbackWidgetType.nps;
+
+        when(feedback.constructFeedbackWidgetUrl(any(), anyInt(), anyInt())).thenReturn(WIDGET_URL);
+    }
+
+    /**
+     * The whole happy path of one widget: load, report the viewport once the page is up, place the
+     * card where the widget asks for it, then report the dismissal exactly once when it closes.
+     */
+    @Test
+    public void present_loadsPlacesAndReportsTheDismissalOnce() {
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+
+        Assert.assertEquals(1, host.navigations.size());
+        Assert.assertEquals(WIDGET_URL, host.navigations.get(0));
+        Assert.assertTrue(host.reportedSizes.isEmpty());
+
+        host.listener.onPageLoaded();
+        Assert.assertEquals(1, host.reportedSizes.size());
+        Assert.assertArrayEquals(new int[] { 1600, 900 }, host.reportedSizes.get(0));
+
+        // A second load of the same page must not report the viewport again.
+        host.listener.onPageLoaded();
+        Assert.assertEquals(1, host.reportedSizes.size());
+
+        host.listener.onWidgetMessage("{\"cly_widget_command\":1,\"action\":\"resize_me\","
+            + "\"resize_me\":{\"p\":{\"x\":10,\"y\":10,\"w\":300,\"h\":400},\"l\":{\"x\":1200,\"y\":40,\"w\":360,\"h\":500}}}");
+
+        Assert.assertEquals(1, host.placements.size());
+        ContentPlacement placed = host.placements.get(0);
+        // The widget's own rect supplies the size (360x500 for this landscape surface); the anchor
+        // comes from the widget type, the way the web SDK's stylesheet applies it. This one is an
+        // NPS, so: bottom, centred.
+        Assert.assertEquals((1600 - 360) / 2, placed.x);
+        Assert.assertEquals(900 - 500, placed.y);
+        Assert.assertEquals(360, placed.width);
+        Assert.assertEquals(500, placed.height);
+
+        host.listener.onNavigationStarting(CLOSE_URL);
+
+        verify(feedback, times(1)).reportFeedbackWidgetManually(eq(widget), isNull(), isNull());
+        Assert.assertEquals(1, host.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+
+        // A widget that signals close more than once must not report or close twice.
+        host.listener.onNavigationStarting(CLOSE_URL);
+        host.listener.onLoadFailed();
+        verify(feedback, times(1)).reportFeedbackWidgetManually(eq(widget), isNull(), isNull());
+        Assert.assertEquals(1, host.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+    }
+
+    /**
+     * Nothing to present: no widget, no feedback interface, or no URL. Each one has to tear down
+     * cleanly instead of leaving an invisible card and a caller waiting for a callback.
+     */
+    @Test
+    public void present_withNothingToShow_tearsDownCleanly() {
+        newPresenter().start(null);
+        Assert.assertTrue(host.navigations.isEmpty());
+        Assert.assertEquals(1, host.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+
+        beforeTest();
+        new FeedbackWidgetPresenter(host, null, closedCallbacks::incrementAndGet).start(widget);
+        Assert.assertTrue(host.navigations.isEmpty());
+        Assert.assertEquals(1, closedCallbacks.get());
+        verify(feedback, never()).reportFeedbackWidgetManually(any(), any(), any());
+
+        beforeTest();
+        when(feedback.constructFeedbackWidgetUrl(any(), anyInt(), anyInt())).thenReturn(null);
+        newPresenter().start(widget);
+        Assert.assertTrue(host.navigations.isEmpty());
+        Assert.assertEquals(1, host.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+
+        beforeTest();
+        when(feedback.constructFeedbackWidgetUrl(any(), anyInt(), anyInt())).thenReturn("   ");
+        newPresenter().start(widget);
+        Assert.assertTrue(host.navigations.isEmpty());
+        Assert.assertEquals(1, closedCallbacks.get());
+    }
+
+    /**
+     * A widget page that never loads has to dismiss its own card and report the dismissal, so the
+     * caller is not left hanging.
+     */
+    @Test
+    public void loadFailure_dismissesTheCard() {
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+
+        host.listener.onLoadFailed();
+
+        Assert.assertEquals(1, host.closeCount);
+        Assert.assertEquals(1, closedCallbacks.get());
+        verify(feedback, times(1)).reportFeedbackWidgetManually(eq(widget), isNull(), isNull());
+    }
+
+    /**
+     * Signals arriving as navigations rather than messages, on a portrait surface, plus the plain
+     * page navigations that have to be left alone.
+     */
+    @Test
+    public void urlSignals_arePlacedAndFilteredCorrectly() {
+        host.surface = new WidgetSurface(100, 50, 600, 1000);
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+
+        // The initial widget URL is a real navigation, not a signal.
+        host.listener.onNavigationStarting(WIDGET_URL);
+        Assert.assertTrue(host.placements.isEmpty());
+        Assert.assertEquals(0, host.closeCount);
+
+        host.listener.onNavigationStarting("https://countly_action_event/?cly_x_action_event=1"
+            + "&resize_me=%7B%22p%22%3A%7B%22x%22%3A20%2C%22y%22%3A30%2C%22w%22%3A900%2C%22h%22%3A2000%7D%7D&close=0");
+
+        Assert.assertEquals(1, host.placements.size());
+        ContentPlacement placed = host.placements.get(0);
+        // A request bigger than the surface is clamped to it, then anchored bottom centre, origin
+        // included.
+        Assert.assertEquals(100, placed.x);
+        Assert.assertEquals(50, placed.y);
+        Assert.assertEquals(600, placed.width);
+        Assert.assertEquals(1000, placed.height);
+        Assert.assertEquals(0, host.closeCount);
+    }
+
+    /**
+     * A rating's card is a fixed size, so a measurement of its page is not worth re-placing for:
+     * the rectangle would not change, and every answer costs the host another measuring round
+     * before the card is allowed to appear.
+     */
+    @Test
+    public void aRating_isNotRefittedFromItsPage() {
+        widget.type = FeedbackWidgetType.rating;
+
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+        host.listener.onPageLoaded();
+        host.listener.onSizeNotReported(50, 669);
+        Assert.assertEquals(1, host.placements.size());
+
+        host.listener.onCardMeasured(50, 669);
+        Assert.assertEquals("nothing to re-place", 1, host.placements.size());
+    }
+
+    /**
+     * A widget that never reports a size still gets a card, and it is the card its type calls for
+     * rather than the sliver its page painted. This is every rating widget: they report nothing and
+     * paint only a sticky tab, which came out as a 50px wide window.
+     */
+    @Test
+    public void aWidgetThatReportsNoSize_isPlacedByItsType() {
+        widget.type = FeedbackWidgetType.rating;
+
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+        host.listener.onPageLoaded();
+        host.listener.onSizeNotReported(50, 669);
+
+        Assert.assertEquals(1, host.placements.size());
+        ContentPlacement placed = host.placements.get(0);
+        Assert.assertEquals(WidgetLayout.RATING_WIDTH, placed.width);
+        Assert.assertEquals(WidgetLayout.RATING_HEIGHT, placed.height);
+        Assert.assertEquals((1600 - WidgetLayout.RATING_WIDTH) / 2, placed.x);
+    }
+
+    /**
+     * With no type to go by, the size the page painted is the only thing left to place, and a page
+     * that painted nothing at all still has to end up somewhere sane.
+     */
+    @Test
+    public void aWidgetOfUnknownType_isPlacedByWhatItPainted() {
+        widget.type = null;
+
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+        host.listener.onSizeNotReported(320, 240);
+
+        ContentPlacement painted = host.placements.get(0);
+        Assert.assertEquals(320, painted.width);
+        Assert.assertEquals(240, painted.height);
+
+        host.listener.onSizeNotReported(0, 0);
+
+        ContentPlacement fallback = host.placements.get(1);
+        Assert.assertEquals(WidgetLayout.DEFAULT_WIDTH, fallback.width);
+        Assert.assertEquals(WidgetLayout.SURVEY_DEFAULT_HEIGHT, fallback.height);
+    }
+
+    /**
+     * The card is fitted to what the page actually drew.
+     * <p>
+     * A page lays its card out at the top of the viewport, so a window taller than the card leaves
+     * transparent space below it, and an NPS anchored to the bottom edge visibly floats above it.
+     */
+    @Test
+    public void theCardIsFittedToWhatThePageDrew() {
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+        host.listener.onPageLoaded();
+
+        host.listener.onWidgetMessage("{\"cly_widget_command\":1,\"action\":\"resize_me\","
+            + "\"resize_me\":{\"l\":{\"x\":800,\"y\":0,\"w\":480,\"h\":563}}}");
+        Assert.assertEquals(563, host.placements.get(0).height);
+
+        host.listener.onCardMeasured(480, 414);
+
+        ContentPlacement fitted = host.placements.get(1);
+        Assert.assertEquals("the drawn card's height wins", 414, fitted.height);
+        Assert.assertEquals(480, fitted.width);
+        Assert.assertEquals("still flush with the bottom", 900 - 414, fitted.y);
+        Assert.assertEquals((1600 - 480) / 2, fitted.x);
+    }
+
+    /**
+     * A card follows the window it was placed against, so moving or resizing the application window
+     * does not leave the card stranded where the window used to be.
+     */
+    @Test
+    public void aMovedSurface_takesTheCardWithIt() {
+        FeedbackWidgetPresenter presenter = newPresenter();
+
+        // Nothing to re-place before the widget has asked for anything.
+        presenter.refreshPlacement();
+        Assert.assertTrue(host.placements.isEmpty());
+
+        presenter.start(widget);
+        host.listener.onPageLoaded();
+        host.listener.onWidgetMessage("{\"cly_widget_command\":1,\"action\":\"resize_me\","
+            + "\"resize_me\":{\"l\":{\"x\":800,\"y\":0,\"w\":480,\"h\":400}}}");
+
+        host.setSurface(new WidgetSurface(-1000, -200, 1200, 800));
+        presenter.refreshPlacement();
+
+        ContentPlacement moved = host.placements.get(host.placements.size() - 1);
+        Assert.assertEquals("centred on the new surface", -1000 + (1200 - 480) / 2, moved.x);
+        Assert.assertEquals("bottom of the new surface", -200 + 800 - 400, moved.y);
+        Assert.assertEquals("the widget's own size is kept", 400, moved.height);
+
+        // A dismissed card has nothing left to follow with.
+        host.listener.onNavigationStarting(CLOSE_URL);
+        int placementsAtClose = host.placements.size();
+        presenter.refreshPlacement();
+        Assert.assertEquals(placementsAtClose, host.placements.size());
+    }
+
+    private FeedbackWidgetPresenter newPresenter() {
+        return new FeedbackWidgetPresenter(host, feedback, closedCallbacks::incrementAndGet);
+    }
+
+    private static class FakeHost implements WidgetWebHost {
+
+        Listener listener;
+        WidgetSurface surface = new WidgetSurface(0, 0, 1600, 900);
+        final List<String> navigations = new ArrayList<>();
+        final List<int[]> reportedSizes = new ArrayList<>();
+        final List<ContentPlacement> placements = new ArrayList<>();
+        final List<ContentPlacement> followed = new ArrayList<>();
+        int closeCount = 0;
+
+        @Override
+        public void setListener(Listener widgetListener) {
+            listener = widgetListener;
+        }
+
+        @Override
+        public WidgetSurface getSurface() {
+            return surface;
+        }
+
+        @Override
+        public void setSurface(WidgetSurface updated) {
+            surface = updated;
+        }
+
+        @Override
+        public void navigate(String url) {
+            navigations.add(url);
+        }
+
+        @Override
+        public void followGeometry(ContentPlacement rect) {
+            followed.add(rect);
+        }
+
+        @Override
+        public void reportSurfaceSize(int width, int height) {
+            reportedSizes.add(new int[] { width, height });
+        }
+
+        @Override
+        public void placeAndShow(ContentPlacement rect) {
+            placements.add(rect);
+        }
+
+        @Override
+        public void closeHost() {
+            closeCount++;
+        }
+    }
+
+    /**
+     * A survey asked for 574 and drew 580 - a border its own arithmetic leaves out. Honouring the
+     * request, measuring the card, honouring the next request and so on made the card flicker
+     * forever. A request within a border's width of what the page draws now resolves to the drawn
+     * size, so nothing moves; a request further away is a real step and is honoured.
+     */
+    @Test
+    public void aRequestWithinABorderOfTheDrawnCard_keepsTheDrawnCard() {
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = "survey_1";
+        widget.type = FeedbackWidgetType.survey;
+        widget.position = "bLeft";
+        host.surface = new WidgetSurface(0, 0, 1600, 900);
+        FeedbackWidgetPresenter presenter = newPresenter();
+        presenter.start(widget);
+
+        // The page drew 580.
+        presenter.onCardMeasured(500, 580);
+        ContentPlacement drawn = host.placements.get(host.placements.size() - 1);
+        Assert.assertEquals(580, drawn.height);
+
+        // It then asks for 574: six pixels off, the same card. Nothing changes.
+        int before = host.placements.size();
+        presenter.onWidgetMessage("{\"cly_widget_command\":1,\"resize_me\":"
+            + "{\"p\":{\"x\":0,\"y\":326,\"w\":500,\"h\":574},\"l\":{\"x\":0,\"y\":326,\"w\":500,\"h\":574}}}");
+        ContentPlacement after = host.placements.get(host.placements.size() - 1);
+        Assert.assertEquals("the drawn height is kept", 580, after.height);
+        Assert.assertEquals("and the anchor with it", drawn.y, after.y);
+
+        // A genuinely new step is honoured as asked.
+        presenter.onWidgetMessage("{\"cly_widget_command\":1,\"resize_me\":"
+            + "{\"p\":{\"x\":0,\"y\":100,\"w\":500,\"h\":800},\"l\":{\"x\":0,\"y\":100,\"w\":500,\"h\":800}}}");
+        Assert.assertEquals(800, host.placements.get(host.placements.size() - 1).height);
+        Assert.assertTrue(host.placements.size() > before);
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxSurfacesTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxSurfacesTests.java
new file mode 100644
index 000000000..b9619bb86
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxSurfacesTests.java
@@ -0,0 +1,285 @@
+package ly.count.sdk.java.ui;
+
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.Scene;
+import javafx.scene.layout.Pane;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import ly.count.sdk.java.internal.ContentPlacement;
+import javafx.stage.Window;
+import javafx.util.Duration;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Screen geometry and web view defaults, exercised against the headless toolkit.
+ */
+@RunWith(JUnit4.class)
+public class FxSurfacesTests {
+
+    @BeforeClass
+    public static void startToolkit() {
+        FxTestToolkit.assumeToolkitAvailable();
+    }
+
+    @AfterClass
+    public static void resetDiagnostics() {
+        FxSurfaces.setDiagnosticsEnabled(false);
+    }
+
+    /**
+     * With no window to follow, and with a window that is not on screen yet, the primary screen's
+     * work area is the answer. A window that IS on screen selects the screen it sits on, and reports
+     * its own bounds separately.
+     */
+    @Test
+    public void surfaces_fallBackToThePrimaryScreenUntilAWindowIsOnScreen() {
+        WidgetSurface primary = FxSurfaces.screenOf(null);
+        Assert.assertTrue("the primary screen should have a size", primary.width > 0 && primary.height > 0);
+
+        // Not shown yet, so there is nothing to follow.
+        FxTestToolkit.onFx(() -> {
+            Stage hidden = new Stage(StageStyle.UNDECORATED);
+            Assert.assertEquals(primary.width, FxSurfaces.screenOf(hidden).width);
+            Assert.assertEquals(primary.width, FxSurfaces.boundsOf(hidden).width);
+        });
+
+        FxTestToolkit.onFx(() -> {
+            Stage shown = new Stage(StageStyle.UNDECORATED);
+            shown.setScene(new Scene(new Pane(), 300, 200));
+            shown.setX(40);
+            shown.setY(30);
+            shown.setWidth(300);
+            shown.setHeight(200);
+            shown.show();
+            try {
+                // Not compared against the primary screen: on a multiple monitor machine the window
+                // may legitimately sit on another one, which is the whole point of screenOf.
+                WidgetSurface screen = FxSurfaces.screenOf(shown);
+                Assert.assertTrue(screen.width > 0 && screen.height > 0);
+
+                // Compared against what the stage reports, not against the numbers we asked for: a
+                // window manager is free to move or resize a window it is given, and on a real
+                // desktop it does.
+                WidgetSurface own = FxSurfaces.boundsOf(shown);
+                Assert.assertEquals((int) shown.getX(), own.x);
+                Assert.assertEquals((int) shown.getY(), own.y);
+                Assert.assertEquals((int) shown.getWidth(), own.width);
+                Assert.assertEquals((int) shown.getHeight(), own.height);
+                Assert.assertTrue(own.toString().contains("width=" + own.width));
+            } finally {
+                shown.close();
+            }
+        });
+    }
+
+    /**
+     * The window a display follows when the integrator names none: a showing window, preferring the
+     * focused one, and nothing at all when the application has no window up.
+     */
+    @Test
+    public void primaryApplicationWindow_prefersAShowingWindow() {
+        FxTestToolkit.onFx(() -> {
+            Stage stage = new Stage(StageStyle.UNDECORATED);
+            stage.setScene(new Scene(new Pane(), 200, 100));
+            stage.show();
+            try {
+                Window found = FxSurfaces.primaryApplicationWindow();
+                Assert.assertNotNull(found);
+                Assert.assertTrue(found.isShowing());
+            } finally {
+                stage.close();
+            }
+        });
+    }
+
+    /**
+     * Configuring an engine installs the default typography and a load-failure listener, and must
+     * survive being handed an engine twice. Diagnostics stay off unless asked for, and asking for
+     * them makes the probe run without throwing.
+     */
+    @Test
+    public void configure_andDiagnostics_areSafeToApply() {
+        Assert.assertFalse(FxSurfaces.isDiagnosticsEnabled());
+
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            FxSurfaces.configure(webView.getEngine());
+            FxSurfaces.configure(webView.getEngine());
+            Assert.assertTrue(webView.getEngine().isJavaScriptEnabled());
+            // A fallback font IS installed, as a user stylesheet so the page still wins when it
+            // states a font. Without it, a page with no usable font declaration renders in serif.
+            Assert.assertNotNull(webView.getEngine().getUserStyleSheetLocation());
+
+            // Off by default, so a customer's page is never scripted.
+            FxSurfaces.logPageDiagnostics(webView.getEngine(), "test");
+
+            FxSurfaces.setDiagnosticsEnabled(true);
+            Assert.assertTrue(FxSurfaces.isDiagnosticsEnabled());
+            FxSurfaces.logPageDiagnostics(webView.getEngine(), "test");
+            FxSurfaces.setDiagnosticsEnabled(false);
+        });
+    }
+
+    /**
+     * Clearing the web view's page backdrop, which is what lets the application show through
+     * everywhere the page does not paint. Public JavaFX API since version 20; this module requires
+     * JavaFX 21 precisely so it does not have to reach an internal reflectively.
+     */
+    @Test
+    public void makePageBackgroundTransparent_clearsTheBackdrop() {
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            FxSurfaces.makePageBackgroundTransparent(webView);
+            Assert.assertEquals(javafx.scene.paint.Color.TRANSPARENT, webView.getPageFill());
+
+            // Applying it twice is harmless.
+            FxSurfaces.makePageBackgroundTransparent(webView);
+            Assert.assertEquals(javafx.scene.paint.Color.TRANSPARENT, webView.getPageFill());
+        });
+    }
+
+    /**
+     * The display area setting decides what {@code surfaceFor} measures, and one setting has to
+     * cover both the widget cards and the content blocks.
+     */
+    @Test
+    public void surfaceFor_followsTheOneTimeSetting() {
+        Assert.assertTrue("the application window is the default", FxSurfaces.isDisplayWithinApp());
+
+        FxTestToolkit.onFx(() -> {
+            Stage owner = new Stage(StageStyle.UNDECORATED);
+            owner.setScene(new Scene(new Pane(), 500, 400));
+            owner.setX(120);
+            owner.setY(90);
+            owner.show();
+
+            try {
+                WidgetSurface window = FxSurfaces.surfaceFor(owner);
+                Assert.assertEquals(FxSurfaces.boundsOf(owner).toString(), window.toString());
+                Assert.assertTrue(CountlyWebView.isShowingWidgetsWithinApp());
+
+                FxSurfaces.setDisplayWithinApp(false);
+                Assert.assertFalse(FxSurfaces.isDisplayWithinApp());
+                WidgetSurface screen = FxSurfaces.surfaceFor(owner);
+                Assert.assertEquals(FxSurfaces.screenOf(owner).toString(), screen.toString());
+
+                // A window sits inside its own screen, so this is the whole point of the setting.
+                Assert.assertTrue(window.width <= screen.width);
+                Assert.assertTrue(window.height <= screen.height);
+
+                // Set through the public API, which is configuration: the first call decides and
+                // later ones are ignored, so a widget's layout cannot change under a running app.
+                CountlyWebView.forgetDisplayAreaForTests();
+                Assert.assertTrue("the default is restored", CountlyWebView.isShowingWidgetsWithinApp());
+                CountlyWebView.setShowWidgetsWithinApp(false);
+                Assert.assertFalse(CountlyWebView.isShowingWidgetsWithinApp());
+                CountlyWebView.setShowWidgetsWithinApp(true);
+                Assert.assertFalse("a second call must not change it", CountlyWebView.isShowingWidgetsWithinApp());
+            } finally {
+                CountlyWebView.forgetDisplayAreaForTests();
+                owner.close();
+            }
+        });
+    }
+
+    /**
+     * Starting WebKit early is idempotent and does not throw.
+     */
+    @Test
+    public void prewarm_isIdempotent() {
+        FxTestToolkit.onFx(() -> {
+            FxSurfaces.prewarm();
+            FxSurfaces.prewarm();
+        });
+    }
+
+    /**
+     * The host's half of the resize protocol: the page cannot see the application window, so it is
+     * told, in the shape Android uses, and answers with a resize_me of its own.
+     */
+    @Test
+    public void notifyPageOfSurface_reachesThePage() {
+        java.util.concurrent.atomic.AtomicReference<javafx.scene.web.WebView> viewRef =
+            new java.util.concurrent.atomic.AtomicReference<>();
+        java.util.concurrent.atomic.AtomicReference<Boolean> loaded =
+            new java.util.concurrent.atomic.AtomicReference<>(false);
+
+        FxTestToolkit.onFx(() -> {
+            javafx.scene.web.WebView webView = new javafx.scene.web.WebView();
+            viewRef.set(webView);
+            webView.getEngine().getLoadWorker().stateProperty().addListener((o, old, state) -> {
+                if (state == javafx.concurrent.Worker.State.SUCCEEDED) {
+                    loaded.set(true);
+                }
+            });
+            webView.getEngine().loadContent("<html><body><script>window.seen='none';"
+                + "window.addEventListener('message',function(e){"
+                + "window.seen=e.data.type+' '+e.data.width+'x'+e.data.height;});</script></body></html>");
+        });
+
+        for (int i = 0; i < 60 && !loaded.get(); i++) {
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue("the probe page never loaded", loaded.get());
+
+        FxTestToolkit.onFx(() -> FxSurfaces.notifyPageOfSurface(viewRef.get().getEngine(),
+            new WidgetSurface(-2560, -519, 1280, 820)));
+
+        String seen = "none";
+        for (int i = 0; i < 40; i++) {
+            java.util.concurrent.atomic.AtomicReference<String> read =
+                new java.util.concurrent.atomic.AtomicReference<>("none");
+            FxTestToolkit.onFx(() -> {
+                try {
+                    read.set(String.valueOf(viewRef.get().getEngine().executeScript("window.seen")));
+                } catch (Throwable t) {
+                    read.set("none");
+                }
+            });
+            seen = read.get();
+            if (!"none".equals(seen)) {
+                break;
+            }
+            ScenarioDriver.pause(100);
+        }
+        // The surface, not the card: the width and height of the room, not of the block.
+        Assert.assertEquals("resize 1280x820", seen);
+    }
+
+
+    /**
+     * The rounded corners are for a block that covers the window; a card sitting inside it paints
+     * its own and must not be cut into.
+     */
+    @Test
+    public void applyOverlayCorners_onlyClipsACoveringBlock() {
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            WidgetSurface surface = new WidgetSurface(0, 0, 1280, 820);
+
+            FxSurfaces.applyOverlayCorners(webView, new ContentPlacement(16, 16, 435, 144), surface);
+            Assert.assertNull("a card inside the window is not clipped", webView.getClip());
+
+            FxSurfaces.applyOverlayCorners(webView, new ContentPlacement(0, 0, 1280, 820), surface);
+            Assert.assertNotNull("a block filling the window is", webView.getClip());
+
+            // Square windows exist, and an integrator can say so.
+            double was = FxSurfaces.getOverlayCornerRadius();
+            try {
+                FxSurfaces.setOverlayCornerRadius(0);
+                FxSurfaces.applyOverlayCorners(webView, new ContentPlacement(0, 0, 1280, 820), surface);
+                Assert.assertNull("a zero radius means no clip at all", webView.getClip());
+            } finally {
+                FxSurfaces.setOverlayCornerRadius(was);
+            }
+        });
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxTestToolkit.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxTestToolkit.java
new file mode 100644
index 000000000..45ca43adb
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/FxTestToolkit.java
@@ -0,0 +1,187 @@
+package ly.count.sdk.java.ui;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.BooleanSupplier;
+import javafx.application.Platform;
+import org.junit.Assert;
+import org.junit.Assume;
+
+/**
+ * Runs the JavaFX display classes headlessly.
+ * <p>
+ * The build points JavaFX at Monocle's headless platform, so a stage can be shown and a web view can
+ * load a page with no display attached. That is what makes {@link CountlyWebView} and the two
+ * display classes testable at all.
+ * <p>
+ * The toolkit starts once per JVM and is never shut down, because JavaFX cannot be restarted in the
+ * same process.
+ */
+final class FxTestToolkit {
+
+    private static final long TIMEOUT_SECONDS = 30;
+
+    private static boolean started = false;
+
+    private FxTestToolkit() {
+    }
+
+    /**
+     * Skips a test class when this machine cannot start a JavaFX toolkit at all.
+     * <p>
+     * Most of the toolkit dependent classes are fine: with one JVM per class (see the build file)
+     * they load real pages and pass. Only {@code JavaFxContentDisplayTests} cannot run, and it has
+     * its own stricter gate.
+     */
+    static void assumeToolkitAvailable() {
+        try {
+            start();
+        } catch (Throwable t) {
+            Assume.assumeNoException("skipped: no JavaFX toolkit on this machine", t);
+        }
+    }
+
+    /**
+     * Skips a class that shows a TRANSPARENT stage with a web view in it.
+     * <p>
+     * Narrowed down by elimination: with one JVM per test class, every other toolkit dependent class
+     * loads real pages and passes. This one segfaults {@code libjfxwebkit} even run entirely alone,
+     * and it is the only class that combines {@code StageStyle.TRANSPARENT} with
+     * {@code WebView.setPageFill(TRANSPARENT)} — the transparency the content overlay needs. The
+     * same code is stable in a real application; it dies in a forked test JVM that creates and tears
+     * down transparent stages back to back.
+     * <p>
+     * Ruled out along the way: the jacoco agent (crashes identically without it), the URL scheme
+     * (file: and http: both fine elsewhere), headless Monocle, and xvfb on Linux.
+     * <p>
+     * Opt in with {@code -Dcountly.ui.pageLoadTests=true} if a future JavaFX fixes it.
+     */
+    static void assumeTransparentStagesAreSafe() {
+        Assume.assumeTrue(
+            "skipped: needs a live JavaFX toolkit. CI runs these on Linux under xvfb; enable"
+                + " locally with -Dcountly.ui.pageLoadTests=true and a desktop session.",
+            Boolean.getBoolean("countly.ui.pageLoadTests"));
+        try {
+            start();
+        } catch (Throwable t) {
+            Assume.assumeNoException("skipped: the JavaFX toolkit would not start", t);
+        }
+    }
+
+    static synchronized void start() {
+        if (started) {
+            return;
+        }
+
+        CountDownLatch ready = new CountDownLatch(1);
+        try {
+            Platform.startup(ready::countDown);
+            await(ready, "the JavaFX toolkit to start");
+        } catch (IllegalStateException alreadyRunning) {
+            // Another test class in this JVM got there first.
+        }
+
+        // Closing the last stage would otherwise shut the toolkit down for every later test.
+        Platform.setImplicitExit(false);
+        started = true;
+    }
+
+    /**
+     * Runs the block on the JavaFX thread and waits for it, so a test reads top to bottom.
+     *
+     * @param work what to run
+     */
+    static void onFx(Runnable work) {
+        start();
+
+        if (Platform.isFxApplicationThread()) {
+            work.run();
+            return;
+        }
+
+        CountDownLatch done = new CountDownLatch(1);
+        AtomicReference<Throwable> thrown = new AtomicReference<>();
+        Platform.runLater(() -> {
+            try {
+                work.run();
+            } catch (Throwable t) {
+                thrown.set(t);
+            } finally {
+                done.countDown();
+            }
+        });
+
+        await(done, "the JavaFX thread to run the block");
+        if (thrown.get() != null) {
+            throw new AssertionError("the block threw on the JavaFX thread", thrown.get());
+        }
+    }
+
+    /**
+     * Waits for something the JavaFX thread will eventually do.
+     *
+     * @param what described in the failure message
+     * @param condition polled until true
+     */
+    static void waitUntil(String what, BooleanSupplier condition) {
+        long deadline = System.currentTimeMillis() + TIMEOUT_SECONDS * 1000;
+        while (System.currentTimeMillis() < deadline) {
+            if (condition.getAsBoolean()) {
+                return;
+            }
+            sleep(25);
+        }
+        Assert.fail("timed out waiting for " + what);
+    }
+
+    static void await(CountDownLatch latch, String what) {
+        try {
+            Assert.assertTrue("timed out waiting for " + what, latch.await(TIMEOUT_SECONDS, TimeUnit.SECONDS));
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new AssertionError("interrupted waiting for " + what, e);
+        }
+    }
+
+    static void sleep(long millis) {
+        try {
+            Thread.sleep(millis);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    /**
+     * A page served from disk. The engine's own {@code load} path is used, rather than
+     * {@code loadContent}, so the tests exercise the same code a real widget URL goes through, and
+     * a "data:" URL is not an option: the engine never finishes loading one.
+     *
+     * @param html the page body
+     * @return a "file:" URL for it
+     */
+    static String pageUrl(String html) {
+        try {
+            File file = File.createTempFile("cly-ui-test", ".html");
+            file.deleteOnExit();
+            Files.write(file.toPath(), html.getBytes(StandardCharsets.UTF_8));
+            return file.toURI().toString();
+        } catch (IOException e) {
+            throw new AssertionError("could not write the test page", e);
+        }
+    }
+
+    /**
+     * @param signalUrl where the page should navigate once it has loaded
+     * @return a page that sends the SDK one signal
+     */
+    static String pageThatSignals(String signalUrl) {
+        return "<html><head><title>test</title></head><body><p id='widget-body'>content</p>"
+            + "<script>setTimeout(function(){window.location='" + signalUrl + "';},50);</script>"
+            + "</body></html>";
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxContentDisplayTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxContentDisplayTests.java
new file mode 100644
index 000000000..4c5692e8a
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxContentDisplayTests.java
@@ -0,0 +1,306 @@
+package ly.count.sdk.java.ui;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+import javafx.scene.Scene;
+import javafx.scene.layout.Pane;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import javafx.util.Duration;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.internal.ContentData;
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.ContentScreen;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The JavaFX content overlay, driven against real pages on the headless toolkit.
+ * <p>
+ * The SDK is initialized against a dead local port: nothing here needs a server, and a refused
+ * connection fails immediately rather than holding a test up.
+ */
+@RunWith(JUnit4.class)
+public class JavaFxContentDisplayTests {
+
+    private static final String ACTION = "https://countly_action_event/?cly_x_action_event=1";
+
+    private final List<Map<String, Object>> closes = Collections.synchronizedList(new ArrayList<>());
+    private final AtomicInteger closeCount = new AtomicInteger(0);
+
+    private static HttpServer hangingServer;
+    private static int hangingPort;
+
+    @BeforeClass
+    public static void startToolkit() throws IOException {
+        // See the javadoc: loading real pages headlessly crashes JavaFX 21's WebKit on macOS.
+        // This class alone segfaults the JVM; see the javadoc on the gate.
+        FxTestToolkit.assumeTransparentStagesAreSafe();
+        FxTestToolkit.start();
+
+        // An endpoint that accepts the request and then does not answer for far longer than the
+        // shortened load deadline, which is what that deadline exists for. Kept to a few seconds
+        // rather than a long block: the handler holds a server thread until it returns, and a long
+        // one both stalls this class's teardown and starves the shared JVM the other test classes
+        // are timing against.
+        hangingServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        hangingPort = hangingServer.getAddress().getPort();
+        hangingServer.createContext("/", exchange -> FxTestToolkit.sleep(3000));
+        hangingServer.start();
+    }
+
+    @AfterClass
+    public static void stopServer() {
+        if (hangingServer != null) {
+            hangingServer.stop(0);
+        }
+    }
+
+    @Before
+    public void initSdk() {
+        closes.clear();
+        closeCount.set(0);
+        Countly.instance().init(UiTestConfigs.refusedServer());
+    }
+
+    @After
+    public void stopSdk() {
+        Countly.instance().halt();
+    }
+
+    /**
+     * The surface reported to the server: the primary screen when no window is followed, and the
+     * screen of the window when one is.
+     */
+    @Test
+    public void getScreen_reportsTheSurfaceItWillPlaceOn() {
+        ContentScreen unowned = new JavaFxContentDisplay(null).getScreen();
+        Assert.assertTrue(unowned.width > 0 && unowned.height > 0);
+        Assert.assertTrue(unowned.toString().contains("width="));
+
+        FxTestToolkit.onFx(() -> {
+            Stage owner = new Stage(StageStyle.UNDECORATED);
+            owner.setScene(new Scene(new Pane(), 400, 300));
+            owner.setX(20);
+            owner.setY(20);
+            owner.show();
+            try {
+                JavaFxContentDisplay display = new JavaFxContentDisplay(owner);
+                ContentScreen screen = display.getScreen();
+                Assert.assertEquals(unowned.width, screen.width);
+
+                // Moving the window keeps the reported surface current.
+                owner.setX(60);
+                Assert.assertEquals(unowned.width, display.getScreen().width);
+            } finally {
+                owner.close();
+            }
+        });
+    }
+
+    /**
+     * The whole content lifecycle through the page's own signals: an event is recorded through the
+     * SDK, a resize moves the window, an external link is handled without leaving, and the close
+     * hands the query parameters back exactly once.
+     */
+    @Test
+    public void present_recordsEventsResizesAndClosesOnce() {
+        String page = "<html><head><title>c</title></head><body><p>content</p><script>"
+            + "setTimeout(function(){window.location='" + ACTION
+            + "&action=event&event='+encodeURIComponent('[{\"key\":\"[CLY]_content_shown\",\"sg\":{\"a\":\"1\"}}]');},60);"
+            + "setTimeout(function(){window.location='" + ACTION
+            + "&action=resize_me&resize_me='+encodeURIComponent('{\"p\":{\"x\":5,\"y\":6,\"w\":260,\"h\":200},\"l\":{\"x\":7,\"y\":8,\"w\":300,\"h\":240}}');},220);"
+            + "setTimeout(function(){window.location='" + ACTION + "&close=1&reason=done';},420);"
+            + "</script></body></html>";
+
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content(FxTestToolkit.pageUrl(page)), this::recordClose);
+
+        FxTestToolkit.waitUntil("the content to close", () -> closeCount.get() > 0);
+        FxTestToolkit.sleep(300);
+
+        Assert.assertEquals("close must be reported exactly once", 1, closeCount.get());
+        Map<String, Object> data = closes.get(0);
+        Assert.assertEquals("1", data.get("close"));
+        Assert.assertEquals("done", data.get("reason"));
+        Assert.assertEquals("1", data.get("cly_x_action_event"));
+    }
+
+    /**
+     * Content the server placed nowhere usable is dropped, and the zone is released straight away
+     * rather than being left believing something is on screen.
+     */
+    @Test
+    public void present_withNoUsablePlacement_releasesTheZone() {
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(new ContentData(FxTestToolkit.pageUrl("<html><body>x</body></html>"), null, null), this::recordClose);
+
+        FxTestToolkit.waitUntil("the zone to be released", () -> closeCount.get() > 0);
+        Assert.assertEquals(1, closeCount.get());
+        Assert.assertTrue(closes.get(0).isEmpty());
+    }
+
+    /**
+     * A content page that cannot load must release the zone too, or no further content would ever
+     * be fetched.
+     */
+    @Test
+    public void present_withAPageThatCannotLoad_releasesTheZone() {
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content("file:///countly-does-not-exist/none.html"), this::recordClose);
+
+        FxTestToolkit.waitUntil("the zone to be released", () -> closeCount.get() > 0);
+        Assert.assertEquals(1, closeCount.get());
+    }
+
+    /**
+     * An external link is opened outside the overlay and the content stays up, then the user closing
+     * the window still releases the zone.
+     */
+    @Test
+    public void externalLink_leavesTheContentUp_andHidingItStillReleasesTheZone() {
+        String page = "<html><head><title>c</title></head><body><p>content</p><script>"
+            + "setTimeout(function(){window.location='https://count.ly/pricing?cly_x_int=1';},60);"
+            + "</script></body></html>";
+
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content(FxTestToolkit.pageUrl(page)), this::recordClose);
+
+        // The external link is not a close, so nothing is reported for it.
+        FxTestToolkit.sleep(1200);
+        Assert.assertEquals(0, closeCount.get());
+    }
+
+    /**
+     * Content already on screen when the SDK is stopped: the page can still signal, and the display
+     * has to handle having no content interface left to relay its events through, then still close
+     * cleanly. Without this the overlay would throw on the JavaFX thread and never release the zone.
+     */
+    @Test
+    public void aPageSignallingAfterTheSdkIsStopped_stillClosesCleanly() {
+        Countly.instance().halt();
+
+        String page = "<html><head><title>c</title></head><body><p>content</p><script>"
+            + "setTimeout(function(){window.location='" + ACTION
+            + "&action=event&event='+encodeURIComponent('[{\"key\":\"orphan\",\"sg\":{}}]');},60);"
+            + "setTimeout(function(){window.location='" + ACTION + "&close=1';},260);"
+            + "</script></body></html>";
+
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content(FxTestToolkit.pageUrl(page)), this::recordClose);
+
+        FxTestToolkit.waitUntil("the content to close", () -> closeCount.get() > 0);
+        Assert.assertEquals(1, closeCount.get());
+    }
+
+    /**
+     * A content page that accepts the connection and then never answers must not hold the zone
+     * hostage: the deadline gives up, the window is dropped and the zone is released so the next
+     * fetch can happen. This is the guarantee that keeps a hung page from silently ending content
+     * for the rest of the session.
+     */
+    @Test
+    public void aPageThatNeverAnswers_isAbandonedAndReleasesTheZone() {
+        Duration realTimeout = JavaFxContentDisplay.loadTimeout;
+        JavaFxContentDisplay.loadTimeout = Duration.millis(600);
+        try {
+            JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+            display.present(content("http://127.0.0.1:" + hangingPort + "/hangs-forever"), this::recordClose);
+
+            FxTestToolkit.waitUntil("the deadline to give up", () -> closeCount.get() > 0);
+            Assert.assertEquals(1, closeCount.get());
+            Assert.assertTrue(closes.get(0).isEmpty());
+        } finally {
+            JavaFxContentDisplay.loadTimeout = realTimeout;
+        }
+    }
+
+    /**
+     * A missing close callback must not stop the overlay from working.
+     */
+    @Test
+    public void present_withoutACloseCallback_stillWorks() {
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content(FxTestToolkit.pageUrl(FxTestToolkit.pageThatSignals(ACTION + "&close=1"))), null);
+        FxTestToolkit.sleep(1200);
+    }
+
+    /**
+     * One block at a time, and a refused block must not free the one on screen. A second block asked
+     * for while the first is up is reported closed at once and the first keeps its claim. When the
+     * refusal released that claim instead, the next request opened on top of the first, which is how
+     * two blocks ended up alive together.
+     */
+    @Test
+    public void aSecondBlockWhileOneIsShowing_isRefusedAndTheFirstKeepsTheScreen() {
+        // A page that never closes itself, so only the test decides when the first block ends.
+        String openEnded = "<html><head><title>c</title></head><body><p>content</p></body></html>";
+        JavaFxContentDisplay display = new JavaFxContentDisplay(null);
+        display.present(content(FxTestToolkit.pageUrl(openEnded)), this::recordClose);
+        FxTestToolkit.waitUntil("the first block to hold the screen", () -> PresentationLock.showing() != null);
+        String firstClaim = PresentationLock.showing();
+
+        AtomicInteger refused = new AtomicInteger();
+        display.present(content(FxTestToolkit.pageUrl(openEnded + "<!-- 2 -->")), data -> refused.incrementAndGet());
+        FxTestToolkit.waitUntil("the second block to be refused", () -> refused.get() == 1);
+        FxTestToolkit.sleep(200);
+        Assert.assertEquals("the first block still holds the screen", firstClaim, PresentationLock.showing());
+        Assert.assertEquals("the first block was not reported closed", 0, closeCount.get());
+
+        // A third request while the first is still up is refused just the same, and does not open.
+        display.present(content(FxTestToolkit.pageUrl(openEnded + "<!-- 3 -->")), data -> refused.incrementAndGet());
+        FxTestToolkit.waitUntil("the third block to be refused", () -> refused.get() == 2);
+        Assert.assertEquals(firstClaim, PresentationLock.showing());
+        Assert.assertEquals("only the first block has a window", 1, contentWindows());
+
+        // Hiding the first from outside ends it and frees the screen.
+        FxTestToolkit.onFx(() -> {
+            for (javafx.stage.Window window : javafx.stage.Window.getWindows()) {
+                if (isContentWindow(window)) {
+                    ((Stage) window).hide();
+                }
+            }
+        });
+        FxTestToolkit.waitUntil("the first block to be reported closed", () -> closeCount.get() == 1);
+        FxTestToolkit.waitUntil("the screen to be free", () -> PresentationLock.showing() == null);
+    }
+
+    private static int contentWindows() {
+        AtomicInteger count = new AtomicInteger();
+        FxTestToolkit.onFx(() -> {
+            for (javafx.stage.Window window : javafx.stage.Window.getWindows()) {
+                if (isContentWindow(window)) {
+                    count.incrementAndGet();
+                }
+            }
+        });
+        return count.get();
+    }
+
+    private static boolean isContentWindow(javafx.stage.Window window) {
+        return window instanceof Stage && window.isShowing() && window.getScene() != null
+            && window.getScene().getRoot() instanceof javafx.scene.web.WebView;
+    }
+
+    private void recordClose(Map<String, Object> data) {
+        closes.add(data);
+        closeCount.incrementAndGet();
+    }
+
+    private static ContentData content(String url) {
+        return new ContentData(url, new ContentPlacement(10, 20, 300, 240), new ContentPlacement(30, 40, 320, 260));
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxWidgetHostTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxWidgetHostTests.java
new file mode 100644
index 000000000..fd7ee01c0
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/JavaFxWidgetHostTests.java
@@ -0,0 +1,424 @@
+package ly.count.sdk.java.ui;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.Scene;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import javafx.util.Duration;
+import ly.count.sdk.java.internal.ContentPlacement;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The JavaFX browser adapter, driven against real pages loaded from disk on the headless toolkit.
+ */
+@RunWith(JUnit4.class)
+public class JavaFxWidgetHostTests {
+
+    private static final String CLOSE_SIGNAL = "https://countly_action_event/?cly_widget_command=1&close=1";
+
+    @BeforeClass
+    public static void startToolkit() {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+    }
+
+    /**
+     * A page loads, the host reports it, and the signal the page navigates to afterwards is handed
+     * to the listener rather than being followed as a navigation.
+     */
+    @Test
+    public void load_reportsThePageThenTheSignalItNavigatesTo() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+            Assert.assertEquals(900, host.getSurface().width);
+            Assert.assertNotNull(host.getWebView());
+            host.navigate(FxTestToolkit.pageUrl(FxTestToolkit.pageThatSignals(CLOSE_SIGNAL)));
+        });
+
+        FxTestToolkit.waitUntil("the page to load", () -> listener.pageLoads > 0);
+        FxTestToolkit.waitUntil("the close signal", () -> !listener.navigations.isEmpty());
+
+        Assert.assertEquals(1, listener.pageLoads);
+        Assert.assertEquals(0, listener.loadFailures);
+        Assert.assertTrue(listener.navigations.get(0).contains("cly_widget_command=1"));
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * Reporting the surface, placing the card and dismissing it: the stage really moves, really
+     * shows, and really closes.
+     */
+    @Test
+    public void placeAndShow_movesAndShowsTheStage_andCloseHostDismissesIt() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+        AtomicReference<JavaFxWidgetHost> hostRef = new AtomicReference<>();
+
+        FxTestToolkit.onFx(() -> {
+            hostRef.set(newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef));
+            // Reporting a size before any page has loaded must not throw, it simply has nowhere to post.
+            hostRef.get().reportSurfaceSize(900, 700);
+            hostRef.get().placeAndShow(new ContentPlacement(120, 90, 340, 260));
+        });
+
+        FxTestToolkit.waitUntil("the stage to show", () -> showing(stageRef));
+
+        FxTestToolkit.onFx(() -> {
+            Stage stage = stageRef.get();
+            Assert.assertEquals(120.0, stage.getX(), 0.5);
+            Assert.assertEquals(90.0, stage.getY(), 0.5);
+            Assert.assertEquals(340.0, stage.getWidth(), 0.5);
+            Assert.assertEquals(260.0, stage.getHeight(), 0.5);
+
+            // Showing again is a no-op rather than a second window.
+            hostRef.get().placeAndShow(new ContentPlacement(10, 10, 200, 200));
+            Assert.assertTrue(stage.isShowing());
+
+            hostRef.get().closeHost();
+        });
+
+        FxTestToolkit.waitUntil("the stage to close", () -> !showing(stageRef));
+    }
+
+    /**
+     * A widget reporting its own card size through the page's message channel reaches the listener,
+     * which is what the JavaScript bridge exists for.
+     */
+    @Test
+    public void widgetMessages_reachTheListenerThroughTheJavaScriptBridge() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        String page = "<html><head><title>test</title></head><body><p id='widget-body'>x</p><script>"
+            + "setTimeout(function(){window.postMessage(JSON.stringify({cly_widget_command:1,"
+            + "action:'resize_me',resize_me:{p:{x:1,y:2,w:100,h:120},l:{x:3,y:4,w:200,h:150}}}),'*');},120);"
+            + "</script></body></html>";
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+            host.navigate(FxTestToolkit.pageUrl(page));
+        });
+
+        FxTestToolkit.waitUntil("the widget message", () -> !listener.messages.isEmpty());
+
+        String message = listener.messages.get(0);
+        Assert.assertTrue(message, message.contains("cly_widget_command"));
+        Assert.assertTrue(message, message.contains("resize_me"));
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * The card is fitted to what the page drew before it is ever visible, so it appears once at the
+     * size it keeps rather than at the size the widget guessed and then jumping to the right one.
+     */
+    @Test
+    public void aCardIsFittedBeforeItIsVisible() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+        AtomicReference<JavaFxWidgetHost> hostRef = new AtomicReference<>();
+        // Every rectangle the window was ever visible at, which is the whole point of the test.
+        List<String> seen = Collections.synchronizedList(new ArrayList<>());
+
+        // A 300px card in a page it will be asked to fill 500px of.
+        String page = "<html><head><title>test</title></head><body style='margin:0'>"
+            + "<div id='widget-body' style='height:300px;background:#fff'>card</div></body></html>";
+
+        // Re-places the way the presenter does, keeping the bottom edge.
+        listener.onMeasured = (width, height) -> hostRef.get().placeAndShow(
+            new ContentPlacement(0, 200 + 500 - height, width, height));
+
+        FxTestToolkit.onFx(() -> {
+            hostRef.set(newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef));
+            Stage stage = stageRef.get();
+            stage.opacityProperty().addListener((observable, was, now) -> {
+                if (now.doubleValue() > 0) {
+                    seen.add((int) stage.getWidth() + "x" + (int) stage.getHeight() + " at " + (int) stage.getY());
+                }
+            });
+            hostRef.get().navigate(FxTestToolkit.pageUrl(page));
+        });
+
+        FxTestToolkit.waitUntil("the page to load", () -> listener.pageLoads > 0);
+        FxTestToolkit.onFx(() -> hostRef.get().placeAndShow(new ContentPlacement(0, 200, 480, 500)));
+
+        FxTestToolkit.waitUntil("the card to be measured", () -> !listener.measuredCards.isEmpty());
+        Assert.assertEquals("300 tall, not the 500 it was placed at", "480x300", listener.measuredCards.get(0));
+
+        FxTestToolkit.waitUntil("the card to be revealed", () -> !seen.isEmpty());
+        Assert.assertEquals("only ever visible at the fitted size", "480x300 at 400", seen.get(0));
+
+        FxTestToolkit.onFx(() -> {
+            Assert.assertTrue(showing(stageRef));
+            stageRef.get().close();
+        });
+    }
+
+    /**
+     * A widget that never reports its own size is reported along with the size of what it did paint,
+     * rather than being placed here: only the presenter knows the widget type, and the type is what
+     * decides the card. A rating reports no size and paints only its sticky tab, so placing the
+     * measurement gave a 50px sliver of a window.
+     */
+    @Test
+    public void aPageThatNeverReportsASize_isReportedWithWhatItPainted() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        String page = "<html><head><title>test</title></head><body>"
+            + "<div id='widget-body' style='height:240px'>quiet</div></body></html>";
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+            host.navigate(FxTestToolkit.pageUrl(page));
+        });
+
+        FxTestToolkit.waitUntil("the missing size report", () -> !listener.missingSizes.isEmpty());
+
+        Assert.assertEquals(0, listener.loadFailures);
+        Assert.assertFalse("the host must not place it itself", showing(stageRef));
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * A load that never resolves is reported as a failure once the deadline passes.
+     * <p>
+     * WebKit reports neither success nor failure for a connection that is accepted and then goes
+     * quiet, which left the caller with no card and no callback at all: a click that did nothing.
+     */
+    @Test
+    public void aLoadThatNeverResolves_isReportedAsAFailure() throws Exception {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        // Accepts the connection and then says nothing, which is what stalls a load.
+        ServerSocket silent = new ServerSocket(0);
+        Thread accepting = new Thread(() -> {
+            try {
+                while (!silent.isClosed()) {
+                    silent.accept();
+                }
+            } catch (IOException expected) {
+                // The socket was closed by the test.
+            }
+        });
+        accepting.setDaemon(true);
+        accepting.start();
+
+        Duration original = JavaFxWidgetHost.loadTimeout;
+        JavaFxWidgetHost.loadTimeout = Duration.millis(400);
+        try {
+            FxTestToolkit.onFx(() -> {
+                JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+                host.navigate("http://127.0.0.1:" + silent.getLocalPort() + "/stalls");
+            });
+
+            FxTestToolkit.waitUntil("the deadline to pass", () -> listener.loadFailures > 0);
+            Assert.assertEquals(0, listener.pageLoads);
+        } finally {
+            JavaFxWidgetHost.loadTimeout = original;
+            silent.close();
+        }
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * A page that cannot be loaded is reported as a failure, so the presenter can dismiss an
+     * otherwise invisible card instead of leaving the caller waiting.
+     */
+    @Test
+    public void aPageThatCannotLoad_isReportedAsAFailure() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+            host.navigate("file:///countly-does-not-exist/nothing-here.html");
+        });
+
+        FxTestToolkit.waitUntil("the load failure", () -> listener.loadFailures > 0);
+        Assert.assertEquals(0, listener.pageLoads);
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * A host with no listener attached must not blow up when a page loads and signals.
+     */
+    @Test
+    public void aHostWithNoListener_doesNotThrow() {
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), null, stageRef);
+            host.navigate(FxTestToolkit.pageUrl(FxTestToolkit.pageThatSignals(CLOSE_SIGNAL)));
+        });
+
+        FxTestToolkit.sleep(1500);
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * A widget opening a link in a new window has it handed to the system browser instead of being
+     * rendered over the card, which is what the popup handler exists for.
+     */
+    @Test
+    public void aPopupLink_isHandedToTheSystemBrowser() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+
+        String page = "<html><head><title>test</title></head><body><div id='widget-body'>x</div><script>"
+            + "setTimeout(function(){window.open('https://count.ly/pricing','_blank');},80);"
+            + "</script></body></html>";
+
+        FxTestToolkit.onFx(() -> {
+            JavaFxWidgetHost host = newHost(new WidgetSurface(0, 0, 900, 700), listener, stageRef);
+            host.navigate(FxTestToolkit.pageUrl(page));
+        });
+
+        FxTestToolkit.waitUntil("the page to load", () -> listener.pageLoads > 0);
+        // The popup is handled off the card: nothing closes and the listener sees no signal for it.
+        FxTestToolkit.sleep(1200);
+        Assert.assertTrue(listener.navigations.isEmpty());
+
+        FxTestToolkit.onFx(() -> stageRef.get().close());
+    }
+
+    /**
+     * A stage's showing state read on the JavaFX thread, which is the only place it is reliably
+     * observable. Polling it from the test thread only ever appeared to work under Monocle.
+     *
+     * @param stageRef holds the stage
+     * @return whether it is on screen
+     */
+    private static boolean showing(AtomicReference<Stage> stageRef) {
+        AtomicReference<Boolean> shown = new AtomicReference<>(false);
+        FxTestToolkit.onFx(() -> shown.set(stageRef.get() != null && stageRef.get().isShowing()));
+        return shown.get();
+    }
+
+    private static JavaFxWidgetHost newHost(WidgetSurface surface, WidgetWebHost.Listener listener, AtomicReference<Stage> stageRef) {
+        WebView webView = new WebView();
+        Stage stage = new Stage(StageStyle.UNDECORATED);
+        stage.setScene(new Scene(webView, 1, 1));
+        stageRef.set(stage);
+
+        JavaFxWidgetHost host = new JavaFxWidgetHost(stage, webView, surface);
+        host.initialize();
+        if (listener != null) {
+            host.setListener(listener);
+        }
+        return host;
+    }
+
+    private static class RecordingListener implements WidgetWebHost.Listener {
+
+        final List<String> navigations = Collections.synchronizedList(new ArrayList<>());
+        final List<String> messages = Collections.synchronizedList(new ArrayList<>());
+        final List<String> missingSizes = Collections.synchronizedList(new ArrayList<>());
+        final List<String> measuredCards = Collections.synchronizedList(new ArrayList<>());
+        final List<Integer> overflows = Collections.synchronizedList(new ArrayList<>());
+        final List<String> followedSizes = Collections.synchronizedList(new ArrayList<>());
+        volatile int pageLoads = 0;
+        volatile int loadFailures = 0;
+
+        @Override
+        public void onNavigationStarting(String url) {
+            navigations.add(url);
+        }
+
+        @Override
+        public void onContentOverflow(int extraHeight) {
+            overflows.add(extraHeight);
+        }
+
+        @Override
+        public void onCardFollowing(int width, int height) {
+            followedSizes.add(width + "x" + height);
+        }
+
+        @Override
+        public void onWidgetMessage(String json) {
+            messages.add(json);
+        }
+
+        @Override
+        public void onPageLoaded() {
+            pageLoads++;
+        }
+
+        @Override
+        public void onLoadFailed() {
+            loadFailures++;
+        }
+
+        @Override
+        public void onSizeNotReported(int paintedWidth, int paintedHeight) {
+            missingSizes.add(paintedWidth + "x" + paintedHeight);
+        }
+
+        /** What to do about a measurement, when a test wants to react like the presenter does. */
+        volatile java.util.function.BiConsumer<Integer, Integer> onMeasured;
+
+        @Override
+        public void onCardMeasured(int width, int height) {
+            measuredCards.add(width + "x" + height);
+            if (onMeasured != null) {
+                onMeasured.accept(width, height);
+            }
+        }
+    }
+
+    /**
+     * Placing a card exactly where it already is must not start another round of fitting: a page
+     * re-announcing its size, or a window drag that changed nothing for the card, produced seven
+     * identical placements in a row, each rescheduling timers.
+     */
+    @Test
+    public void anIdenticalPlacementIsANoOp() {
+        RecordingListener listener = new RecordingListener();
+        AtomicReference<Stage> stageRef = new AtomicReference<>();
+        AtomicReference<JavaFxWidgetHost> hostRef = new AtomicReference<>();
+        // A stage and a web view can only be made on the application thread, like every other test
+        // here does.
+        FxTestToolkit.onFx(() -> hostRef.set(newHost(new WidgetSurface(0, 0, 1600, 900), listener, stageRef)));
+        JavaFxWidgetHost host = hostRef.get();
+        ContentPlacement rect = new ContentPlacement(100, 100, 480, 414);
+
+        FxTestToolkit.onFx(() -> host.placeAndShow(rect));
+        ScenarioDriver.pause(300);
+        AtomicReference<String> first = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> first.set(geometryOf(stageRef.get())));
+
+        // Same rectangle again: the stage is untouched and no new placement is counted.
+        FxTestToolkit.onFx(() -> host.placeAndShow(new ContentPlacement(100, 100, 480, 414)));
+        ScenarioDriver.pause(300);
+        AtomicReference<String> second = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> second.set(geometryOf(stageRef.get())));
+
+        Assert.assertEquals(first.get(), second.get());
+        Assert.assertEquals("one placement, not two", 1, host.placementRequestsForTests());
+    }
+
+    private static String geometryOf(Stage stage) {
+        return (int) stage.getX() + "," + (int) stage.getY() + " "
+            + (int) stage.getWidth() + "x" + (int) stage.getHeight();
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/LateBackgroundImageTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/LateBackgroundImageTests.java
new file mode 100644
index 000000000..090f6c53a
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/LateBackgroundImageTests.java
@@ -0,0 +1,146 @@
+package ly.count.sdk.java.ui;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.util.Base64;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.concurrent.Worker;
+import javafx.scene.web.WebView;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * A content card paints its picture as a CSS background, and this engine does not repaint the box
+ * when the image arrives after it. The SDK closes that gap, and this is the page that proves it: the
+ * image is deliberately served late, which is the case that leaves a card with an empty slot.
+ */
+@RunWith(JUnit4.class)
+public class LateBackgroundImageTests {
+
+    /** A 1x1 red PNG, so the served bytes are a real image the engine will decode. */
+    private static final byte[] PNG = Base64.getDecoder().decode(
+        "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==");
+
+    private static final long SERVER_DELAY_MS = 900;
+
+    private static HttpServer server;
+    private static String base;
+
+    @BeforeClass
+    public static void startToolkitAndServer() throws IOException {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        base = "http://127.0.0.1:" + server.getAddress().getPort();
+        server.createContext("/late.png", exchange -> {
+            try {
+                Thread.sleep(SERVER_DELAY_MS);
+            } catch (InterruptedException ignored) {
+                Thread.currentThread().interrupt();
+            }
+            exchange.getResponseHeaders().add("Content-Type", "image/png");
+            exchange.sendResponseHeaders(200, PNG.length);
+            try (OutputStream out = exchange.getResponseBody()) {
+                out.write(PNG);
+            }
+        });
+        server.start();
+    }
+
+    @AfterClass
+    public static void stopServer() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    public void aBackgroundImageThatArrivesLateIsGivenBackToTheStyleSystem() {
+        AtomicReference<WebView> viewRef = new AtomicReference<>();
+        AtomicReference<Boolean> loaded = new AtomicReference<>(false);
+
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            viewRef.set(webView);
+            FxSurfaces.configure(webView.getEngine());
+            webView.getEngine().getLoadWorker().stateProperty().addListener((o, old, state) -> {
+                if (state == Worker.State.SUCCEEDED) {
+                    loaded.set(true);
+                    FxSurfaces.repaintBackgroundImagesWhenTheyArrive(webView.getEngine());
+                }
+            });
+            // The slot a card's picture sits in: a sized box whose only content is the background.
+            webView.getEngine().loadContent("<html><head><style>"
+                + "#slot{width:58px;height:58px;background-image:url('" + base + "/late.png');"
+                + "background-size:contain;}</style></head><body><div id='slot'></div></body></html>");
+        });
+
+        for (int i = 0; i < 60 && !loaded.get(); i++) {
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue("the page never loaded", loaded.get());
+
+        // The fix re-applies the URL through the element's own style once the image has loaded, so
+        // that inline value appearing is the engine having been told to paint the box again.
+        String inline = "";
+        for (int i = 0; i < 60; i++) {
+            AtomicReference<String> read = new AtomicReference<>("");
+            FxTestToolkit.onFx(() -> {
+                try {
+                    read.set(String.valueOf(viewRef.get().getEngine().executeScript(
+                        "document.getElementById('slot').style.backgroundImage")));
+                } catch (Throwable t) {
+                    read.set("");
+                }
+            });
+            inline = read.get();
+            if (inline.contains("late.png")) {
+                break;
+            }
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue("the late image was never given back to the style system, was [" + inline + "]",
+            inline.contains("late.png"));
+    }
+
+    @Test
+    public void installingItTwiceOnOnePageDoesNothingTheSecondTime() {
+        AtomicReference<String> first = new AtomicReference<>("");
+        AtomicReference<String> second = new AtomicReference<>("");
+
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            FxSurfaces.configure(webView.getEngine());
+            webView.getEngine().loadContent("<html><body>x</body></html>");
+        });
+        ScenarioDriver.pause(500);
+
+        AtomicReference<WebView> viewRef = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            viewRef.set(webView);
+            FxSurfaces.configure(webView.getEngine());
+            webView.getEngine().loadContent("<html><body><div id='slot'></div></body></html>");
+        });
+        ScenarioDriver.pause(800);
+
+        FxTestToolkit.onFx(() -> {
+            first.set(String.valueOf(viewRef.get().getEngine().executeScript(
+                "window.__clyBackgroundFix ? 'was installed' : 'not installed'")));
+            FxSurfaces.repaintBackgroundImagesWhenTheyArrive(viewRef.get().getEngine());
+            FxSurfaces.repaintBackgroundImagesWhenTheyArrive(viewRef.get().getEngine());
+            second.set(String.valueOf(viewRef.get().getEngine().executeScript(
+                "window.__clyBackgroundFix ? 'was installed' : 'not installed'")));
+        });
+
+        Assert.assertEquals("not installed", first.get());
+        Assert.assertEquals("was installed", second.get());
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PrefetchAcrossRunsTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PrefetchAcrossRunsTests.java
new file mode 100644
index 000000000..ddf69cda0
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PrefetchAcrossRunsTests.java
@@ -0,0 +1,49 @@
+package ly.count.sdk.java.ui;
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The second run: a list left behind by a previous process has to be found at initialization, which
+ * is the whole point of keeping it on disk.
+ */
+@RunWith(JUnit4.class)
+public class PrefetchAcrossRunsTests {
+
+    private static final String LIST =
+        "https://master.count.ly/content/dist/assets/inter-v7-vietnamese_latin-ext_latin-regular.26.01.5.woff\n"
+            + "https://master.count.ly/content/dist/assets/Inter-SemiBold.26.01.5.woff";
+
+    @After
+    public void stopSdk() {
+        Countly.instance().halt();
+    }
+
+    @Test
+    public void aListLeftByThePreviousRunIsFound() throws Exception {
+        File storage = new File(System.getProperty("java.io.tmpdir"), "countly-across-runs");
+        if (!storage.exists()) {
+            Assert.assertTrue(storage.mkdirs());
+        }
+        File list = new File(storage, "countly_display_fonts.txt");
+        Files.write(list.toPath(), LIST.getBytes(StandardCharsets.UTF_8));
+
+        Countly.instance().init(new Config("http://localhost:1", "UI_TEST_APP_KEY", storage)
+            .enableFeatures(Config.Feature.Content)
+            .setLoggingLevel(Config.LoggingLevel.DEBUG)
+            .setCustomDeviceId("across-runs"));
+
+        Assert.assertEquals("the previous run's list must be readable at startup",
+            2, WebFontPrefetch.rememberedCount());
+        Assert.assertNotNull(WebFontPrefetch.warmupPage());
+        Assert.assertTrue(list.delete());
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PresentationLockTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PresentationLockTests.java
new file mode 100644
index 000000000..2c7146517
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/PresentationLockTests.java
@@ -0,0 +1,61 @@
+package ly.count.sdk.java.ui;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * One presentation at a time: the second claimant is refused while the first holds the screen, and
+ * only the holder's release frees it.
+ */
+@RunWith(JUnit4.class)
+public class PresentationLockTests {
+
+    @BeforeClass
+    public static void toolkit() {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+    }
+
+    @After
+    public void reset() {
+        FxTestToolkit.onFx(PresentationLock::resetForTests);
+    }
+
+    @Test
+    public void theSecondClaimantIsRefusedUntilTheFirstReleases() {
+        FxTestToolkit.onFx(() -> {
+            Assert.assertNull(PresentationLock.showing());
+            Assert.assertTrue(PresentationLock.tryAcquire("widget nps_1"));
+            Assert.assertEquals("widget nps_1", PresentationLock.showing());
+
+            Assert.assertFalse("content must wait for the widget", PresentationLock.tryAcquire("content block_2"));
+            Assert.assertFalse("and so must another widget", PresentationLock.tryAcquire("widget survey_1"));
+            Assert.assertEquals("a refusal changes nothing", "widget nps_1", PresentationLock.showing());
+
+            // A release by something that does not hold the screen is ignored.
+            PresentationLock.release("content block_2");
+            Assert.assertEquals("widget nps_1", PresentationLock.showing());
+
+            PresentationLock.release("widget nps_1");
+            Assert.assertNull(PresentationLock.showing());
+            Assert.assertTrue("free again", PresentationLock.tryAcquire("content block_2"));
+        });
+    }
+
+    @Test
+    public void releaseIsSafeFromAnyThreadAndMoreThanOnce() {
+        FxTestToolkit.onFx(() -> Assert.assertTrue(PresentationLock.tryAcquire("widget nps_1")));
+
+        // Off the application thread: a close reported by the SDK's own worker, for instance.
+        PresentationLock.release("widget nps_1");
+        PresentationLock.release("widget nps_1");
+        PresentationLock.release(null);
+
+        FxTestToolkit.waitUntil("the release to land on the application thread",
+            () -> PresentationLock.showing() == null);
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ScenarioDriver.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ScenarioDriver.java
new file mode 100644
index 000000000..ffde51c08
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/ScenarioDriver.java
@@ -0,0 +1,426 @@
+package ly.count.sdk.java.ui;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.regex.Pattern;
+import javafx.scene.Scene;
+import javafx.scene.layout.Pane;
+import javafx.scene.web.WebEngine;
+import javafx.scene.web.WebView;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import ly.count.sdk.java.Config;
+import org.junit.Assume;
+
+/**
+ * Drives the real widget and content UI against a real Countly server, the way the Android SDK's
+ * {@code content_test_runner.py} drives its demo app.
+ * <p>
+ * The Android harness has to reach into the app from outside, through adb and accessibility nodes,
+ * because the WebView belongs to another process. Here the page is in this process, so the same
+ * scenarios are driven by scripting the DOM directly with the selectors that harness uses, and the
+ * SDK's own log is captured in memory instead of being scraped out of logcat.
+ * <p>
+ * Off by default: it needs a desktop session and a reachable server. Enable with
+ * {@code -Dcountly.ui.scenarios=true}, and point it somewhere else with
+ * {@code -Dcountly.ui.scenarioServer} / {@code -Dcountly.ui.scenarioAppKey}.
+ */
+final class ScenarioDriver {
+
+    static final String SERVER = System.getProperty("countly.ui.scenarioServer", "https://master.count.ly");
+    static final String APP_KEY = System.getProperty("countly.ui.scenarioAppKey", "dte_mobile_v2");
+
+    /**
+     * Distinguishes one run's device IDs from the last one's.
+     * <p>
+     * A journey serves a device its content once: re-running with the same IDs gets nothing, which
+     * looks exactly like a server with no campaigns on it. Every run gets fresh devices instead.
+     */
+    static final String RUN_ID = Long.toString(System.currentTimeMillis(), 36);
+
+    /** Where the findings of a run are collected, one line per checked step. */
+    private static final List<String> FINDINGS = Collections.synchronizedList(new ArrayList<>());
+
+    private ScenarioDriver() {
+    }
+
+    static void assumeEnabled() {
+        Assume.assumeTrue("skipped: needs a desktop session and a live server, enable with"
+            + " -Dcountly.ui.scenarios=true", Boolean.getBoolean("countly.ui.scenarios"));
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+    }
+
+    /**
+     * @param deviceId the device ID to run as, which is how the server picks which fixtures to serve
+     * @param log where to send the SDK's own log
+     * @return a config against the live server
+     */
+    static Config liveConfig(String deviceId, LogBuffer log) {
+        return liveConfig(deviceId, log, SERVER);
+    }
+
+    /**
+     * @param deviceId the device ID to run as
+     * @param log where to send the SDK's own log
+     * @param serverUrl the server to talk to, which a stub driven scenario points at itself
+     * @return a config against that server
+     */
+    static Config liveConfig(String deviceId, LogBuffer log, String serverUrl) {
+        File storage = new File(System.getProperty("java.io.tmpdir"), "countly-scenarios");
+        if (!storage.exists() && !storage.mkdirs()) {
+            throw new IllegalStateException("could not create " + storage);
+        }
+
+        Config config = new Config(serverUrl, APP_KEY, storage)
+            // Sessions included on purpose: a device that never began one has not entered any
+            // journey, so the server has no content for it, and session().begin() is a no-op while
+            // the feature is off. Leaving it out made every content variant look unconfigured.
+            .enableFeatures(Config.Feature.Content, Config.Feature.Events, Config.Feature.Feedback,
+                Config.Feature.Sessions)
+            .setLoggingLevel(Config.LoggingLevel.DEBUG)
+            .setLogListener(log)
+            .setApplicationVersion("1.0.0")
+            // As the demo application configures it. Left at the SDK's default - the operating
+            // system name - a widget page behaved differently from the one a real integrator sees,
+            // which is exactly the kind of difference a driven run exists to remove.
+            .setSdkPlatform("desktop")
+            .setCustomDeviceId(deviceId);
+        // A short zone timer, so a content fetch does not cost half a minute per scenario.
+        config.content.setZoneTimerInterval(30);
+        return config;
+    }
+
+    // ---------------------------------------------------------------- findings
+
+    enum Verdict {
+        PASS, FAIL, SKIP, WARN
+    }
+
+    static void record(String scenario, String step, Verdict verdict, String detail) {
+        FINDINGS.add(verdict + "\t" + scenario + "\t" + step + "\t" + (detail == null ? "" : detail));
+        System.out.println("[scenario] " + verdict + " | " + scenario + " | " + step
+            + (detail == null || detail.isEmpty() ? "" : " | " + detail));
+    }
+
+    static void check(String scenario, String step, boolean ok, String detail) {
+        record(scenario, step, ok ? Verdict.PASS : Verdict.FAIL, detail);
+    }
+
+    /**
+     * Writes everything recorded so far as a markdown table, so a run leaves the same kind of
+     * artifact the Android harness's {@code summary.md} does.
+     */
+    static void writeReport(String name) {
+        StringBuilder out = new StringBuilder("# " + name + "\n\n");
+        out.append("Server `").append(SERVER).append("`, app key `").append(APP_KEY).append("`\n\n");
+        out.append("| Verdict | Scenario | Step | Detail |\n|---|---|---|---|\n");
+        for (String finding : new ArrayList<>(FINDINGS)) {
+            String[] parts = finding.split("\t", 4);
+            out.append("| ").append(parts[0]).append(" | ").append(parts[1]).append(" | ")
+                .append(parts[2]).append(" | ").append(parts[3].replace("|", "\\|")).append(" |\n");
+        }
+
+        try {
+            File dir = new File(System.getProperty("countly.ui.scenarioOut",
+                System.getProperty("java.io.tmpdir")));
+            // A clean build has no such directory, and losing a five minute live run to that is a
+            // waste of the run.
+            if (!dir.exists() && !dir.mkdirs()) {
+                System.out.println("[scenario] could not create " + dir + ", falling back to the temp directory");
+                dir = new File(System.getProperty("java.io.tmpdir"));
+            }
+            Files.write(Paths.get(new File(dir, name + ".md").toURI()),
+                out.toString().getBytes(StandardCharsets.UTF_8));
+            System.out.println("[scenario] report written to " + new File(dir, name + ".md"));
+        } catch (IOException t) {
+            System.out.println("[scenario] could not write the report: " + t);
+        }
+    }
+
+    // ------------------------------------------------------------------ pages
+
+    /**
+     * A page element, addressed by the same CSS selectors the Android harness uses. Every call hops
+     * onto the JavaFX thread itself, so a scenario reads as a sequence of steps.
+     */
+    static boolean exists(WebEngine engine, String selector) {
+        return count(engine, selector) > 0;
+    }
+
+    static int count(WebEngine engine, String selector) {
+        Object result = script(engine, "(function(){try{return ''+document.querySelectorAll(\""
+            + selector + "\").length;}catch(e){return '0';}})()");
+        try {
+            return Integer.parseInt(String.valueOf(result));
+        } catch (NumberFormatException t) {
+            return 0;
+        }
+    }
+
+    /**
+     * @return {@code true} when the element was there to be clicked
+     */
+    static boolean click(WebEngine engine, String selector) {
+        Object result = script(engine, "(function(){try{"
+            + "var e=document.querySelector(\"" + selector + "\");"
+            + "if(!e){return 'no';}"
+            // A real click, not just the handler: these widgets bind through jQuery delegation on
+            // body, so dispatching on the element is what actually reaches them.
+            + "e.scrollIntoView();e.click();return 'yes';}catch(err){return 'err '+err;}})()");
+        return "yes".equals(String.valueOf(result));
+    }
+
+    /**
+     * Types into a field the way a person would, then fires the events a framework listens for.
+     */
+    static boolean type(WebEngine engine, String selector, String text) {
+        Object result = script(engine, "(function(){try{"
+            + "var e=document.querySelector(\"" + selector + "\");if(!e){return 'no';}"
+            + "e.focus();e.value=" + quote(text) + ";"
+            + "e.dispatchEvent(new Event('input',{bubbles:true}));"
+            + "e.dispatchEvent(new Event('change',{bubbles:true}));"
+            + "e.dispatchEvent(new Event('keyup',{bubbles:true}));"
+            + "return 'yes';}catch(err){return 'err '+err;}})()");
+        return "yes".equals(String.valueOf(result));
+    }
+
+    /** Ticks a checkbox and tells whether it ended up ticked. */
+    static boolean tick(WebEngine engine, String selector) {
+        Object result = script(engine, "(function(){try{"
+            + "var e=document.querySelector(\"" + selector + "\");if(!e){return 'no';}"
+            + "if(e.tagName!=='INPUT'){e.click();var i=e.querySelector('input');"
+            + "return i?(i.checked?'yes':'no'):'yes';}"
+            + "if(!e.checked){e.click();}"
+            + "return e.checked?'yes':'no';}catch(err){return 'err '+err;}})()");
+        return "yes".equals(String.valueOf(result));
+    }
+
+    /**
+     * Clicks the first element whose own text is one of the given hints, which is how the Android
+     * harness finds a widget's Close or Go control ({@code WEBVIEW_HINTS}). A CSS selector cannot
+     * express "the button that says Close", and picking the first button instead clicks whatever
+     * happens to come first in the markup.
+     *
+     * @param engine the page to click in
+     * @param hints the texts to look for, case insensitively
+     * @return the text that was clicked, or {@code null} when none of them was there
+     */
+    static String clickByText(WebEngine engine, String... hints) {
+        StringBuilder list = new StringBuilder();
+        for (String hint : hints) {
+            list.append(list.length() == 0 ? "" : ",").append(quote(hint));
+        }
+
+        Object result = script(engine, "(function(){try{"
+            + "var hints=[" + list + "].map(function(h){return h.toLowerCase();});"
+            + "var nodes=document.querySelectorAll('button,a,[role=button],[onclick],span,div');"
+            + "for(var i=0;i<nodes.length;i++){"
+            + "var n=nodes[i];"
+            // Own text only: a wrapper contains every hint its children do.
+            + "var t=(n.innerText||n.textContent||'').trim();"
+            + "if(!t||t.length>24||n.children.length>0){continue;}"
+            + "if(hints.indexOf(t.toLowerCase())>=0){n.scrollIntoView();n.click();return t;}}"
+            + "return '';}catch(err){return 'err '+err;}})()");
+        String clicked = String.valueOf(result);
+        return clicked.isEmpty() || clicked.startsWith("err ") ? null : clicked;
+    }
+
+    static String visibleText(WebEngine engine) {
+        Object result = script(engine, "(function(){try{return document.body?document.body.innerText:'';}"
+            + "catch(e){return '';}})()");
+        return String.valueOf(result);
+    }
+
+    static Object script(WebEngine engine, String js) {
+        AtomicReference<Object> out = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            try {
+                out.set(engine.executeScript(js));
+            } catch (Throwable t) {
+                out.set("threw " + t);
+            }
+        });
+        return out.get();
+    }
+
+    private static String quote(String text) {
+        return "\"" + text.replace("\\", "\\\\").replace("\"", "\\\"") + "\"";
+    }
+
+    // ------------------------------------------------------------------ hosts
+
+    /**
+     * A widget card built the way {@link CountlyWebView#presentFeedbackWidget} builds one, kept open
+     * so a scenario can script the page inside it.
+     */
+    static final class Card {
+
+        final Stage stage;
+        final WebView webView;
+        final JavaFxWidgetHost host;
+        FeedbackWidgetPresenter presenter;
+
+        Card(Stage stage, WebView webView, JavaFxWidgetHost host) {
+            this.stage = stage;
+            this.webView = webView;
+            this.host = host;
+        }
+
+        WebEngine engine() {
+            return webView.getEngine();
+        }
+    }
+
+    static Card newCard(WidgetSurface surface, WidgetWebHost.Listener listener) {
+        AtomicReference<Card> out = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            Stage stage = new Stage(StageStyle.UNDECORATED);
+            stage.setAlwaysOnTop(true);
+            Scene scene = new Scene(webView, 1, 1);
+            stage.setScene(scene);
+
+            JavaFxWidgetHost host = new JavaFxWidgetHost(stage, webView, surface);
+            host.initialize();
+            if (listener != null) {
+                host.setListener(listener);
+            }
+            out.set(new Card(stage, webView, host));
+        });
+        return out.get();
+    }
+
+    /**
+     * @return an application window to anchor cards and content to, as a real integration would
+     */
+    static Stage newApplicationWindow(double x, double y, double width, double height) {
+        AtomicReference<Stage> out = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            Stage owner = new Stage(StageStyle.DECORATED);
+            owner.setTitle("scenario host");
+            owner.setScene(new Scene(new Pane(), width, height));
+            owner.setX(x);
+            owner.setY(y);
+            owner.show();
+            out.set(owner);
+        });
+        return out.get();
+    }
+
+    // -------------------------------------------------------------------- log
+
+    /**
+     * The SDK's own log, in memory. Stands in for the {@code LOG_PATTERNS} logcat matching the
+     * Android harness does.
+     */
+    static final class LogBuffer implements ly.count.sdk.java.internal.LogCallback {
+
+        private final List<String> lines = Collections.synchronizedList(new ArrayList<>());
+
+        @Override
+        public void LogHappened(String logMessage, Config.LoggingLevel logLevel) {
+            lines.add(logLevel + " " + logMessage);
+        }
+
+        boolean has(String regex) {
+            return find(regex) != null;
+        }
+
+        /**
+         * @param regex the pattern to look for
+         * @return the first matching line, or {@code null}
+         */
+        String find(String regex) {
+            Pattern pattern = Pattern.compile(regex);
+            for (String line : new ArrayList<>(lines)) {
+                if (pattern.matcher(line).find()) {
+                    return line;
+                }
+            }
+            return null;
+        }
+
+        /**
+         * @param regex what to look for
+         * @param limit how many to return, most recent last
+         * @return every matching line, in order, so a sequence can be read rather than a single hit
+         */
+        List<String> findAll(String regex, int limit) {
+            Pattern pattern = Pattern.compile(regex);
+            List<String> found = new ArrayList<>();
+            for (String line : new ArrayList<>(lines)) {
+                if (pattern.matcher(line).find()) {
+                    found.add(line);
+                }
+            }
+            return found.size() <= limit ? found : found.subList(found.size() - limit, found.size());
+        }
+
+        /**
+         * Writes every line to a file beside the report, so a run can be read in full. A recorded
+         * row shows what was checked; this shows what happened.
+         *
+         * @param name what to call the file
+         */
+        void dump(String name) {
+            try {
+                File dir = new File(System.getProperty("countly.ui.scenarioOut",
+                    System.getProperty("java.io.tmpdir")));
+                if (!dir.exists() && !dir.mkdirs()) {
+                    return;
+                }
+                Files.write(new File(dir, name + ".log").toPath(),
+                    String.join("\n", new ArrayList<>(lines)).getBytes(StandardCharsets.UTF_8));
+                System.out.println("[scenario] log written to " + new File(dir, name + ".log"));
+            } catch (Throwable t) {
+                System.out.println("[scenario] could not write the log: " + t);
+            }
+        }
+
+        int countOf(String regex) {
+            Pattern pattern = Pattern.compile(regex);
+            int found = 0;
+            for (String line : new ArrayList<>(lines)) {
+                if (pattern.matcher(line).find()) {
+                    found++;
+                }
+            }
+            return found;
+        }
+
+        boolean waitFor(String regex, long timeoutMs) {
+            long until = System.currentTimeMillis() + timeoutMs;
+            while (System.currentTimeMillis() < until) {
+                if (has(regex)) {
+                    return true;
+                }
+                pause(100);
+            }
+            return false;
+        }
+
+        void clear() {
+            lines.clear();
+        }
+
+        List<String> snapshot() {
+            return new ArrayList<>(lines);
+        }
+    }
+
+    static void pause(long millis) {
+        try {
+            Thread.sleep(millis);
+        } catch (InterruptedException ignored) {
+            Thread.currentThread().interrupt();
+        }
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiLogTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiLogTests.java
new file mode 100644
index 000000000..ee8bb3f83
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiLogTests.java
@@ -0,0 +1,77 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.Log;
+import ly.count.sdk.java.internal.SDKCore;
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+
+/**
+ * The module's logging shim, which is silent until the core SDK installs a logger and then simply
+ * forwards to it. Driven against {@link SDKCore#logger()} directly, with no JavaFX toolkit needed.
+ */
+@RunWith(JUnit4.class)
+public class UiLogTests {
+
+    @After
+    public void afterTest() {
+        // SDKCore.instance is a process-wide static; never leak an installed logger into another
+        // test class running later in the same JVM.
+        TestSdkCoreAccessor.clear();
+    }
+
+    /**
+     * Before the SDK is initialized every level is a silent no-op (nothing to log through and
+     * nothing must throw); once a logger is installed, every level forwards its message to it
+     * unchanged.
+     */
+    @Test
+    public void logging_isSilentWithoutALoggerAndForwardsOnceOneIsInstalled() {
+        // No SDKCore instance at all yet: SDKCore.logger() returns null, so every level below must
+        // simply do nothing rather than throw.
+        UiLog.v("verbose before init");
+        UiLog.d("debug before init");
+        UiLog.i("info before init");
+        UiLog.w("warn before init");
+        UiLog.e("error before init");
+
+        Log logger = mock(Log.class);
+        TestSdkCoreAccessor.install(logger);
+
+        UiLog.v("verbose message");
+        UiLog.d("debug message");
+        UiLog.i("info message");
+        UiLog.w("warn message");
+        UiLog.e("error message");
+
+        verify(logger).v("verbose message");
+        verify(logger).d("debug message");
+        verify(logger).i("info message");
+        verify(logger).w("warn message");
+        verify(logger).e("error message");
+        verifyNoMoreInteractions(logger);
+    }
+
+    /**
+     * Test-only accessor that installs (or clears) the SDK's static logger the same way a real
+     * {@code Countly.init(...)} would, but without running any of the rest of SDK startup, so
+     * {@link UiLog} can be exercised against both states.
+     */
+    private static final class TestSdkCoreAccessor extends SDKCore {
+
+        static void install(Log logger) {
+            // The SDKCore() constructor sets the protected static SDKCore.instance to this new
+            // object; setting L on it is then exactly what SDKCore.logger() reads back.
+            new TestSdkCoreAccessor().L = logger;
+        }
+
+        static void clear() {
+            instance = null;
+        }
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiTestConfigs.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiTestConfigs.java
new file mode 100644
index 000000000..c4bc18cd4
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/UiTestConfigs.java
@@ -0,0 +1,40 @@
+package ly.count.sdk.java.ui;
+
+import java.io.File;
+import ly.count.sdk.java.Config;
+import org.junit.Assert;
+
+/**
+ * Shared SDK configurations for the UI tests. One home for these, so a change to how the tests
+ * reach a server does not have to be made in three places.
+ */
+final class UiTestConfigs {
+
+    private UiTestConfigs() {
+    }
+
+    /**
+     * @return a config pointing at a port that refuses instantly, so no test ever waits on a
+     *     network timeout
+     */
+    static Config refusedServer() {
+        return configFor("http://localhost:1");
+    }
+
+    /**
+     * @param serverUrl the server the SDK should talk to
+     * @return a config pointing at it
+     */
+    static Config configFor(String serverUrl) {
+        File storage = new File(System.getProperty("java.io.tmpdir"), "countly-ui-tests");
+        if (!storage.exists()) {
+            Assert.assertTrue(storage.mkdirs());
+        }
+        // No application version on purpose: it is unset in plenty of real integrations, and that is
+        // what used to make reportFeedbackWidgetManually throw.
+        return new Config(serverUrl, "UI_TEST_APP_KEY", storage)
+            .enableFeatures(Config.Feature.Content, Config.Feature.Events, Config.Feature.Feedback)
+            .setLoggingLevel(Config.LoggingLevel.DEBUG)
+            .setCustomDeviceId("ui-test-device");
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WebFontPrefetchTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WebFontPrefetchTests.java
new file mode 100644
index 000000000..166dc8662
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WebFontPrefetchTests.java
@@ -0,0 +1,223 @@
+package ly.count.sdk.java.ui;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicReference;
+import javafx.scene.web.WebView;
+import javafx.util.Duration;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The web font head start: what a widget page's fonts are worth remembering, and that the warm-up
+ * page actually fetches them.
+ */
+@RunWith(JUnit4.class)
+public class WebFontPrefetchTests {
+
+    private static HttpServer fontServer;
+    private static String base;
+
+    /** Every path the served page's fonts were asked for, in order. */
+    private static final List<String> requested = new CopyOnWriteArrayList<>();
+
+    @BeforeClass
+    public static void startToolkitAndServer() throws IOException {
+        FxTestToolkit.assumeToolkitAvailable();
+        FxTestToolkit.start();
+
+        fontServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        base = "http://127.0.0.1:" + fontServer.getAddress().getPort();
+        fontServer.createContext("/", exchange -> {
+            requested.add(exchange.getRequestURI().getPath());
+            // Not a real font: the engine only has to try to fetch it for the point to be made.
+            byte[] body = new byte[64];
+            exchange.getResponseHeaders().add("Content-Type", "font/woff");
+            exchange.sendResponseHeaders(200, body.length);
+            try (OutputStream out = exchange.getResponseBody()) {
+                out.write(body);
+            }
+        });
+        fontServer.start();
+    }
+
+    @AfterClass
+    public static void stopServer() {
+        if (fontServer != null) {
+            fontServer.stop(0);
+        }
+    }
+
+    @Before
+    public void startSdk() {
+        // The harvest waits for the page to settle before reading which faces were used; a short
+        // wait here keeps each test's write inside its own test.
+        WebFontPrefetch.settle = Duration.millis(150);
+        Countly.instance().init(UiTestConfigs.refusedServer());
+        WebFontPrefetch.forget();
+        requested.clear();
+    }
+
+    @After
+    public void stopSdk() {
+        // Let a harvest already in flight land, so it cannot write into the next test.
+        ScenarioDriver.pause(400);
+        WebFontPrefetch.forget();
+        Countly.instance().halt();
+    }
+
+    @Test
+    public void aPagesFontsAreRememberedForTheNextRun() {
+        rememberFontsOf("@font-face{font-family:'Inter';src:url('" + base + "/inter.woff2') format('woff2'),"
+            + "url('" + base + "/inter.woff') format('woff'),"
+            + "url('" + base + "/inter.ttf') format('truetype');}");
+
+        String page = awaitWarmupPage();
+        Assert.assertTrue(page, page.contains(base + "/inter.woff"));
+        // The one this engine fetches and then fails to decode is not worth fetching, and neither is
+        // the ttf twin of a face already covered by its woff.
+        Assert.assertFalse(page, page.contains("inter.woff2"));
+        Assert.assertFalse(page, page.contains("inter.ttf"));
+        Assert.assertEquals(1, WebFontPrefetch.rememberedCount());
+    }
+
+    @Test
+    public void theWarmupPageFetchesWhatWasRemembered() {
+        rememberFontsOf("@font-face{font-family:'Inter';src:url('" + base + "/wanted.woff') format('woff');}");
+        String page = awaitWarmupPage();
+        requested.clear();
+
+        AtomicReference<WebView> viewRef = new AtomicReference<>();
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            viewRef.set(webView);
+            FxSurfaces.configure(webView.getEngine());
+            webView.getEngine().loadContent(page);
+        });
+
+        for (int i = 0; i < 40 && !requested.contains("/wanted.woff"); i++) {
+            ScenarioDriver.pause(100);
+        }
+        // A view with no scene lays nothing out, so this only passes because the page asks for each
+        // face itself. That is the whole mechanism.
+        Assert.assertTrue("fetched " + requested, requested.contains("/wanted.woff"));
+    }
+
+    @Test
+    public void harvestingAlsoWarmsTheFacesInThisRun() {
+        // Nothing on this page uses the face, so the page itself never asks for it. A request
+        // arriving anyway is the warm-up view fetching it, which is what makes the second card of a
+        // run fast even when the first was closed mid-download.
+        rememberFontsOf("@font-face{font-family:'Inter';src:url('" + base + "/thisrun.woff') format('woff');}");
+
+        for (int i = 0; i < 60 && !requested.contains("/thisrun.woff"); i++) {
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue("fetched " + requested, requested.contains("/thisrun.woff"));
+    }
+
+    @Test
+    public void onlyAbsoluteHttpFontUrlsAreRemembered() {
+        rememberFontsOf("@font-face{font-family:'A';src:url('data:font/woff;base64,AAAA') format('woff');}"
+            + "@font-face{font-family:'B';src:url('/relative/only.woff') format('woff');}"
+            + "@font-face{font-family:'C';src:url('" + base + "/styles.css') format('woff');}"
+            + "@font-face{font-family:'D';src:url('" + base + "/kept.woff') format('woff');}");
+
+        String page = awaitWarmupPage();
+        // A page-relative URL is resolved against the document. This probe page has no base URI of
+        // its own, so there is nothing to resolve against and it is dropped; a widget page served
+        // over HTTP keeps it, as an absolute URL.
+        Assert.assertFalse(page, page.contains("/relative/only.woff"));
+        Assert.assertTrue(page, page.contains("/kept.woff"));
+        Assert.assertFalse(page, page.contains("data:font"));
+        Assert.assertFalse(page, page.contains("styles.css"));
+    }
+
+    @Test
+    public void aPageWithNoWebFontsRemembersNothing() {
+        rememberFontsOf("body{font-family:sans-serif}");
+        ScenarioDriver.pause(300);
+        Assert.assertEquals(0, WebFontPrefetch.rememberedCount());
+        Assert.assertNull(WebFontPrefetch.warmupPage());
+    }
+
+    @Test
+    public void withoutTheSdkNothingIsRememberedAndNothingThrows() {
+        Countly.instance().halt();
+        rememberFontsOf("@font-face{font-family:'Inter';src:url('" + base + "/inter.woff') format('woff');}");
+        ScenarioDriver.pause(300);
+        Assert.assertEquals(0, WebFontPrefetch.rememberedCount());
+        Assert.assertNull(WebFontPrefetch.warmupPage());
+    }
+
+    @Test
+    public void aPageWithTooManyFacesIsCapped() {
+        StringBuilder css = new StringBuilder();
+        for (int i = 0; i < 20; i++) {
+            css.append("@font-face{font-family:'F").append(i).append("';src:url('")
+                .append(base).append("/face").append(i).append(".woff') format('woff');}");
+        }
+        rememberFontsOf(css.toString());
+
+        awaitWarmupPage();
+        Assert.assertEquals(8, WebFontPrefetch.rememberedCount());
+    }
+
+    /** Loads a page carrying the given stylesheet and harvests it, the way a widget page is harvested. */
+    private void rememberFontsOf(String css) {
+        AtomicReference<WebView> viewRef = new AtomicReference<>();
+        AtomicReference<Boolean> loaded = new AtomicReference<>(false);
+        FxTestToolkit.onFx(() -> {
+            WebView webView = new WebView();
+            viewRef.set(webView);
+            FxSurfaces.configure(webView.getEngine());
+            webView.getEngine().getLoadWorker().stateProperty().addListener((o, old, state) -> {
+                if (state == javafx.concurrent.Worker.State.SUCCEEDED) {
+                    loaded.set(true);
+                }
+            });
+            webView.getEngine().loadContent("<html><head><style>" + css + "</style></head><body>x</body></html>");
+        });
+
+        for (int i = 0; i < 60 && !loaded.get(); i++) {
+            ScenarioDriver.pause(100);
+        }
+        Assert.assertTrue("the probe page never loaded", loaded.get());
+        FxTestToolkit.onFx(() -> WebFontPrefetch.remember(viewRef.get().getEngine()));
+    }
+
+    /** The list is written off the application thread, so give it a moment to land. */
+    private String awaitWarmupPage() {
+        for (int i = 0; i < 40; i++) {
+            String page = WebFontPrefetch.warmupPage();
+            if (page != null) {
+                return page;
+            }
+            ScenarioDriver.pause(100);
+        }
+        Assert.fail("nothing was remembered");
+        return Collections.<String>emptyList().toString();
+    }
+
+    /** An OpenType face is declared as one; a truetype hint on an .otf made the engine skip it. */
+    @Test
+    public void anOtfFaceIsDeclaredAsOpentype() {
+        rememberFontsOf("@font-face{font-family:'Brand';src:url('" + base + "/brand.otf') format('opentype');}");
+        String page = awaitWarmupPage();
+        Assert.assertTrue(page, page.contains("brand.otf') format('opentype')"));
+        Assert.assertFalse(page, page.contains("brand.otf') format('truetype')"));
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetJsBridgeTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetJsBridgeTests.java
new file mode 100644
index 000000000..5b239dcbc
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetJsBridgeTests.java
@@ -0,0 +1,74 @@
+package ly.count.sdk.java.ui;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+/**
+ * The Java object exposed to a widget page's JavaScript. Its {@code post} method is called
+ * directly here, exactly the way the JavaFX web engine would call it, so no toolkit is needed.
+ */
+@RunWith(JUnit4.class)
+public class WidgetJsBridgeTests {
+
+    /**
+     * A page posting before Java is ready (no listener yet) is dropped, a normal post is forwarded
+     * unchanged, and a listener that throws while handling it must not bring the page's JS thread
+     * down with it.
+     */
+    @Test
+    public void post_forwardsToTheListenerAndSurvivesAThrowingOne() {
+        new WidgetJsBridge(null, null).post("{\"cly_widget_command\":1,\"close\":1}");
+
+        WidgetWebHost.Listener listener = mock(WidgetWebHost.Listener.class);
+        WidgetJsBridge bridge = new WidgetJsBridge(listener, null);
+
+        bridge.post("{\"cly_widget_command\":1,\"close\":1}");
+        verify(listener).onWidgetMessage(eq("{\"cly_widget_command\":1,\"close\":1}"));
+
+        doThrow(new RuntimeException("boom")).when(listener).onWidgetMessage("bad payload");
+        // Must not propagate: a widget page must never see a Java exception surface back into it.
+        bridge.post("bad payload");
+
+        verify(listener, never()).onWidgetMessage("{\"never\":\"sent\"}");
+    }
+
+    /**
+     * The card report the page makes for itself: forwarded with the numbers rounded, dropped when
+     * nothing is listening, and never allowed to throw back into the page.
+     */
+    @Test
+    public void cardChanged_forwardsRoundedNumbersAndSurvivesAThrowingObserver() {
+        // Nothing listening: a page reporting into the void must not throw.
+        new WidgetJsBridge(null, null).cardChanged("480,414,0");
+
+        List<int[]> observed = new ArrayList<>();
+        WidgetJsBridge bridge = new WidgetJsBridge(null,
+            (width, height, overflow) -> observed.add(new int[] { width, height, overflow }));
+
+        bridge.cardChanged("480,414,55");
+        Assert.assertEquals(1, observed.size());
+        Assert.assertArrayEquals(new int[] { 480, 414, 55 }, observed.get(0));
+
+        // Anything that is not three numbers is ignored rather than thrown back into the page.
+        bridge.cardChanged("garbage");
+        bridge.cardChanged(null);
+        bridge.cardChanged("1,2");
+        Assert.assertEquals(1, observed.size());
+
+        WidgetJsBridge throwing = new WidgetJsBridge(null, (width, height, overflow) -> {
+            throw new RuntimeException("boom");
+        });
+        throwing.cardChanged("480,414,0");
+    }
+
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetLayoutTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetLayoutTests.java
new file mode 100644
index 000000000..8814ec3d6
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetLayoutTests.java
@@ -0,0 +1,169 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.FeedbackWidgetType;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Where each widget type is placed. The numbers the tests feed in are the ones the real widget
+ * pages on a Countly server post, captured from them: an NPS asks for {@code 480x563} at
+ * {@code x = parentWidth / 2}, a survey for {@code 500x620} at {@code x = 0}, and a rating asks for
+ * nothing at all.
+ */
+@RunWith(JUnit4.class)
+public class WidgetLayoutTests {
+
+    /** A wide desktop surface, the case the web stylesheet's >=1025px rules target. */
+    private static final WidgetSurface DESKTOP = new WidgetSurface(0, 0, 3840, 2130);
+
+    /** What an NPS page really reports on {@link #DESKTOP}. */
+    private static final ContentPlacement NPS_REQUEST = new ContentPlacement(1920, 1567, 480, 563);
+
+    /** What a survey page really reports on {@link #DESKTOP}. */
+    private static final ContentPlacement SURVEY_REQUEST = new ContentPlacement(0, 1510, 500, 620);
+
+    /**
+     * NPS sits at the bottom, horizontally centred, at the size it asked for.
+     * <p>
+     * The reported x is {@code parentWidth / 2}, and the web stylesheet pulls the card back by half
+     * its own width with {@code translateX(-50%)}. Applying the rect as it stands left the card half
+     * a card right of centre.
+     */
+    @Test
+    public void nps_isCentredAtTheBottom() {
+        ContentPlacement nps = WidgetLayout.resolve(FeedbackWidgetType.nps, null, DESKTOP, NPS_REQUEST);
+
+        Assert.assertEquals("centred, not left-edge-at-centre", (3840 - 480) / 2, nps.x);
+        Assert.assertEquals("flush with the bottom", 2130 - 563, nps.y);
+        Assert.assertEquals(480, nps.width);
+        Assert.assertEquals("the page measured its own content, so this must not be trimmed", 563, nps.height);
+    }
+
+    /**
+     * The size a widget reports is authoritative, whatever the stylesheet's own max-height says.
+     * <p>
+     * The surveys stylesheet caps the iframe at 450px for NPS, but the page itself lays out up to
+     * 620px and reports that; capping it here cut the bottom off the card.
+     */
+    @Test
+    public void theReportedSizeIsHonoured() {
+        ContentPlacement tall = WidgetLayout.resolve(
+            FeedbackWidgetType.nps, null, DESKTOP, new ContentPlacement(1920, 1510, 480, 620));
+        Assert.assertEquals(620, tall.height);
+        Assert.assertEquals(2130 - 620, tall.y);
+
+        ContentPlacement wide = WidgetLayout.resolve(
+            FeedbackWidgetType.survey, "bLeft", DESKTOP, SURVEY_REQUEST);
+        Assert.assertEquals(500, wide.width);
+        Assert.assertEquals(620, wide.height);
+    }
+
+    /**
+     * A rating is a fixed 400x800 card centred on both axes.
+     * <p>
+     * Its page reports no size and paints only the little sticky tab, so there are two ways to get
+     * this wrong, and both were seen: taking a rect it never sent made it fullscreen, and measuring
+     * what it painted made it a 50px sliver.
+     */
+    @Test
+    public void rating_isACentredCardWhateverItReports() {
+        for (ContentPlacement request : new ContentPlacement[] {
+            null,
+            new ContentPlacement(8, 8, 50, 669),                 // the sticky tab it paints
+            new ContentPlacement(0, 0, 3840, 2130) }) {          // the whole surface
+
+            ContentPlacement rating = WidgetLayout.resolve(FeedbackWidgetType.rating, null, DESKTOP, request);
+
+            Assert.assertEquals(WidgetLayout.RATING_WIDTH, rating.width);
+            Assert.assertEquals(WidgetLayout.RATING_HEIGHT, rating.height);
+            Assert.assertEquals((3840 - 400) / 2, rating.x);
+            Assert.assertEquals((2130 - 800) / 2, rating.y);
+        }
+    }
+
+    /**
+     * A survey is anchored by its {@code appearance.position}, 50px in from that edge, at the
+     * bottom. Its own reported x is always 0, so the anchor can only come from the position.
+     */
+    @Test
+    public void survey_isAnchoredByItsAppearancePosition() {
+        ContentPlacement left = WidgetLayout.resolve(FeedbackWidgetType.survey, "bLeft", DESKTOP, SURVEY_REQUEST);
+        Assert.assertEquals(WidgetLayout.SIDE_MARGIN, left.x);
+        Assert.assertEquals(2130 - 620, left.y);
+
+        ContentPlacement right = WidgetLayout.resolve(FeedbackWidgetType.survey, "bRight", DESKTOP, SURVEY_REQUEST);
+        Assert.assertEquals(3840 - 500 - WidgetLayout.SIDE_MARGIN, right.x);
+
+        // Case and padding come from a server field, so they must not decide the anchor.
+        Assert.assertEquals(right.x, WidgetLayout.resolve(FeedbackWidgetType.survey, "  bright  ", DESKTOP, SURVEY_REQUEST).x);
+
+        // No position sent: the left anchor is the default the web SDK falls back to.
+        Assert.assertEquals(left.x, WidgetLayout.resolve(FeedbackWidgetType.survey, null, DESKTOP, SURVEY_REQUEST).x);
+    }
+
+    /**
+     * A widget that reported nothing usable still gets a sane card, rather than a 0x0 window.
+     */
+    @Test
+    public void nothingReported_fallsBackToTheStylesheetSize() {
+        ContentPlacement nps = WidgetLayout.resolve(FeedbackWidgetType.nps, null, DESKTOP, null);
+        Assert.assertEquals(WidgetLayout.DEFAULT_WIDTH, nps.width);
+        Assert.assertEquals(WidgetLayout.NPS_DEFAULT_HEIGHT, nps.height);
+
+        ContentPlacement survey = WidgetLayout.resolve(
+            FeedbackWidgetType.survey, "bLeft", DESKTOP, new ContentPlacement(0, 0, 0, 0));
+        Assert.assertEquals(WidgetLayout.DEFAULT_WIDTH, survey.width);
+        Assert.assertEquals(WidgetLayout.SURVEY_DEFAULT_HEIGHT, survey.height);
+    }
+
+    /**
+     * A surface smaller than the card, which is what a small window or a phone-sized screen gives:
+     * nothing may be placed off screen or sized beyond the surface.
+     */
+    @Test
+    public void aSurfaceSmallerThanTheCard_isNeverOverflowed() {
+        WidgetSurface tiny = new WidgetSurface(100, 50, 320, 400);
+
+        for (FeedbackWidgetType type : FeedbackWidgetType.values()) {
+            for (ContentPlacement request : new ContentPlacement[] { null, NPS_REQUEST, SURVEY_REQUEST }) {
+                ContentPlacement placed = WidgetLayout.resolve(type, "bRight", tiny, request);
+                Assert.assertTrue(type + " too wide", placed.width <= tiny.width);
+                Assert.assertTrue(type + " too tall", placed.height <= tiny.height);
+                Assert.assertTrue(type + " off the left", placed.x >= tiny.x);
+                Assert.assertTrue(type + " off the top", placed.y >= tiny.y);
+                Assert.assertTrue(type + " off the right", placed.x + placed.width <= tiny.x + tiny.width);
+                Assert.assertTrue(type + " off the bottom", placed.y + placed.height <= tiny.y + tiny.height);
+            }
+        }
+    }
+
+    /**
+     * The surface origin is honoured, so a card lands on the monitor the application is on rather
+     * than on the primary screen.
+     */
+    @Test
+    public void theSurfaceOriginIsHonoured() {
+        WidgetSurface secondMonitor = new WidgetSurface(-3840, -1174, 3840, 2130);
+
+        ContentPlacement nps = WidgetLayout.resolve(FeedbackWidgetType.nps, null, secondMonitor, NPS_REQUEST);
+        Assert.assertEquals(-3840 + (3840 - 480) / 2, nps.x);
+        Assert.assertEquals(-1174 + 2130 - 563, nps.y);
+
+        ContentPlacement rating = WidgetLayout.resolve(FeedbackWidgetType.rating, null, secondMonitor, null);
+        Assert.assertEquals(-3840 + (3840 - 400) / 2, rating.x);
+        Assert.assertEquals(-1174 + (2130 - 800) / 2, rating.y);
+    }
+
+    /**
+     * An unknown type is centred rather than guessed at, and must not throw.
+     */
+    @Test
+    public void anUnknownType_isCentred() {
+        ContentPlacement placed = WidgetLayout.resolve(null, null, DESKTOP, NPS_REQUEST);
+        Assert.assertEquals((3840 - 480) / 2, placed.x);
+        Assert.assertEquals((2130 - 563) / 2, placed.y);
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetMessageParserTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetMessageParserTests.java
new file mode 100644
index 000000000..2666353ee
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetMessageParserTests.java
@@ -0,0 +1,33 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.WidgetAction;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * {@link WidgetPlacementTests#widgetMessageParser_readsOnlyWidgetCommands()} already exercises the
+ * parser's boolean and numeric {@code close} shapes; a widget page can also send {@code close} as a
+ * quoted JSON string, which {@code isTruthy}'s string fallback has to handle on its own.
+ */
+@RunWith(JUnit4.class)
+public class WidgetMessageParserTests {
+
+    /**
+     * {@code close} sent as a JSON string, both a truthy and a non-truthy value, exercises the
+     * {@code isTruthy} string fallback that only runs once the value is neither a boolean nor a
+     * number.
+     */
+    @Test
+    public void parse_readsCloseSentAsAQuotedString() {
+        WidgetAction truthy = WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":\"true\"}");
+        Assert.assertTrue("a quoted \"true\" must still close the widget", truthy.close);
+
+        WidgetAction truthyOne = WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":\"1\"}");
+        Assert.assertTrue("a quoted \"1\" must still close the widget", truthyOne.close);
+
+        WidgetAction notTruthy = WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":\"nope\"}");
+        Assert.assertFalse("any other string must not close the widget", notTruthy.close);
+    }
+}
diff --git a/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetPlacementTests.java b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetPlacementTests.java
new file mode 100644
index 000000000..21e80212b
--- /dev/null
+++ b/sdk-java-ui/src/test/java/ly/count/sdk/java/ui/WidgetPlacementTests.java
@@ -0,0 +1,255 @@
+package ly.count.sdk.java.ui;
+
+import ly.count.sdk.java.internal.ContentPlacement;
+import ly.count.sdk.java.internal.WidgetAction;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Mapping a requested rectangle onto a surface, and reading the {@code postMessage} payloads a
+ * widget sends.
+ */
+@RunWith(JUnit4.class)
+public class WidgetPlacementTests {
+
+    /**
+     * A rectangle that fits is placed as asked, one that does not is clamped so it stays on the
+     * surface, and both are offset by the surface origin.
+     */
+    @Test
+    public void resolve_offsetsAndClampsToTheSurface() {
+        WidgetSurface surface = new WidgetSurface(200, 100, 800, 600);
+
+        ContentPlacement fits = WidgetPlacement.resolve(new ContentPlacement(10, 20, 300, 400), surface);
+        Assert.assertEquals(210, fits.x);
+        Assert.assertEquals(120, fits.y);
+        Assert.assertEquals(300, fits.width);
+        Assert.assertEquals(400, fits.height);
+
+        // Too big: sized down to the surface and pinned to its origin.
+        ContentPlacement tooBig = WidgetPlacement.resolve(new ContentPlacement(50, 50, 2000, 2000), surface);
+        Assert.assertEquals(200, tooBig.x);
+        Assert.assertEquals(100, tooBig.y);
+        Assert.assertEquals(800, tooBig.width);
+        Assert.assertEquals(600, tooBig.height);
+
+        // Pushed off the right and bottom edges: slid back so the whole card stays visible.
+        ContentPlacement offScreen = WidgetPlacement.resolve(new ContentPlacement(700, 500, 300, 200), surface);
+        Assert.assertEquals(200 + 500, offScreen.x);
+        Assert.assertEquals(100 + 400, offScreen.y);
+
+        // Negative coordinates are pulled back onto the surface.
+        ContentPlacement negative = WidgetPlacement.resolve(new ContentPlacement(-50, -50, 100, 100), surface);
+        Assert.assertEquals(200, negative.x);
+        Assert.assertEquals(100, negative.y);
+
+        Assert.assertNull(WidgetPlacement.resolve((ContentPlacement) null, surface));
+        Assert.assertNull(WidgetPlacement.resolve(new ContentPlacement(0, 0, 10, 10), null));
+        Assert.assertNull(WidgetPlacement.resolve((WidgetAction) null, surface));
+    }
+
+    /**
+     * The orientation of the surface decides which rectangle of a signal is used, and either one is
+     * used when only one was sent.
+     */
+    @Test
+    public void resolve_picksTheRectangleMatchingTheSurface() {
+        WidgetAction action = new WidgetAction();
+        action.hasResize = true;
+        action.portrait = new ContentPlacement(0, 0, 100, 200);
+        action.landscape = new ContentPlacement(0, 0, 200, 100);
+
+        Assert.assertEquals(200, WidgetPlacement.resolve(action, new WidgetSurface(0, 0, 1600, 900)).width);
+        Assert.assertEquals(100, WidgetPlacement.resolve(action, new WidgetSurface(0, 0, 900, 1600)).width);
+
+        action.landscape = null;
+        Assert.assertEquals(100, WidgetPlacement.resolve(action, new WidgetSurface(0, 0, 1600, 900)).width);
+
+        action.hasResize = false;
+        Assert.assertNull(WidgetPlacement.resolve(action, new WidgetSurface(0, 0, 1600, 900)));
+    }
+
+    /**
+     * Every shape of the widget's own message channel: a close, a resize, a rectangle without a
+     * usable size, and payloads that are not widget commands at all.
+     */
+    @Test
+    public void widgetMessageParser_readsOnlyWidgetCommands() {
+        WidgetAction close = WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":1}");
+        Assert.assertNotNull(close);
+        Assert.assertTrue(close.isWidgetCommand);
+        Assert.assertTrue(close.close);
+        Assert.assertFalse(close.hasResize);
+
+        Assert.assertTrue(WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":true}").close);
+        Assert.assertFalse(WidgetMessageParser.parse("{\"cly_widget_command\":1,\"close\":0}").close);
+        Assert.assertFalse(WidgetMessageParser.parse("{\"cly_widget_command\":1}").close);
+
+        WidgetAction resize = WidgetMessageParser.parse(
+            "{\"cly_widget_command\":1,\"resize_me\":{\"p\":{\"x\":1,\"y\":2,\"w\":3,\"h\":4}}}");
+        Assert.assertTrue(resize.hasResize);
+        Assert.assertEquals(3, resize.portrait.width);
+        Assert.assertNull(resize.landscape);
+
+        WidgetAction unusable = WidgetMessageParser.parse(
+            "{\"cly_widget_command\":1,\"resize_me\":{\"p\":{\"x\":1,\"y\":2,\"w\":0,\"h\":4}}}");
+        Assert.assertFalse(unusable.hasResize);
+
+        Assert.assertNull(WidgetMessageParser.parse("{\"type\":\"resize\",\"width\":10}"));
+        Assert.assertNull(WidgetMessageParser.parse("not json"));
+        Assert.assertNull(WidgetMessageParser.parse("[1,2,3]"));
+        Assert.assertNull(WidgetMessageParser.parse(""));
+        Assert.assertNull(WidgetMessageParser.parse(null));
+    }
+
+    /**
+     * A window that changed size keeps the block's share of it. The server's own numbers: a large
+     * sticky centre block is 60% of the width, capped at 1021, so 768 in a 1280 wide window.
+     */
+    @Test
+    public void rescale_keepsTheBlocksShareOfTheWindow() {
+        WidgetSurface asFetched = new WidgetSurface(0, 0, 1280, 820);
+        ContentPlacement asked = new ContentPlacement(256, 16, 768, 95);
+
+        ContentPlacement narrower = WidgetPlacement.rescale(asked, asFetched, new WidgetSurface(0, 0, 640, 820));
+        Assert.assertEquals(384, narrower.width);
+        Assert.assertEquals(128, narrower.x);
+        Assert.assertEquals(95, narrower.height);
+
+        ContentPlacement wider = WidgetPlacement.rescale(asked, asFetched, new WidgetSurface(0, 0, 2560, 820));
+        Assert.assertEquals(1536, wider.width);
+        Assert.assertEquals(512, wider.x);
+    }
+
+    /** Nothing to re-state when the surface has not changed, or when there is nothing to compare to. */
+    @Test
+    public void rescale_leavesTheRectangleAloneWhenItStillFits() {
+        WidgetSurface surface = new WidgetSurface(100, 50, 1280, 820);
+        ContentPlacement asked = new ContentPlacement(256, 16, 768, 95);
+
+        Assert.assertSame(asked, WidgetPlacement.rescale(asked, surface, new WidgetSurface(-2560, -519, 1280, 820)));
+        Assert.assertSame(asked, WidgetPlacement.rescale(asked, null, surface));
+        Assert.assertSame(asked, WidgetPlacement.rescale(asked, new WidgetSurface(0, 0, 0, 0), surface));
+    }
+
+    /** A rescaled rectangle is still surface relative, so placing it lands inside the window. */
+    @Test
+    public void rescale_thenResolve_landsInsideTheWindow() {
+        WidgetSurface asFetched = new WidgetSurface(0, 0, 1280, 820);
+        WidgetSurface now = new WidgetSurface(-2560, -519, 640, 410);
+        ContentPlacement asked = new ContentPlacement(256, 16, 768, 95);
+
+        ContentPlacement placed = WidgetPlacement.resolve(WidgetPlacement.rescale(asked, asFetched, now), now);
+        Assert.assertEquals(-2560 + 128, placed.x);
+        Assert.assertEquals(-519 + 8, placed.y);
+        Assert.assertEquals(384, placed.width);
+        Assert.assertTrue(placed.x + placed.width <= now.x + now.width);
+    }
+
+
+    /**
+     * Once the page has asked for a rectangle it is the one that gets used: it is the only party
+     * that knows how tall its own content turned out.
+     */
+    @Test
+    public void following_prefersWhatThePageAskedFor() {
+        WidgetSurface surface = new WidgetSurface(0, 0, 1280, 820);
+        ContentPlacement fromServer = new ContentPlacement(256, 16, 768, 95);
+        ContentPlacement fromPage = new ContentPlacement(256, 16, 768, 240);
+
+        ContentPlacement server = WidgetPlacement.following(null, null, fromServer, surface, surface);
+        Assert.assertEquals(95, server.height);
+
+        ContentPlacement page = WidgetPlacement.following(fromPage, surface, fromServer, surface, surface);
+        Assert.assertEquals("the page's own height must win", 240, page.height);
+    }
+
+    /**
+     * A page's own rectangle is a size, not a proportion: across a resize it is kept and clamped, never
+     * scaled. Scaling it squeezed a hosted survey to a sliver as the window narrowed, while the same
+     * survey as a widget kept its 500 wide card.
+     */
+    @Test
+    public void following_keepsThePagesOwnSizeAcrossAResize() {
+        WidgetSurface asAsked = new WidgetSurface(0, 0, 1280, 820);
+        WidgetSurface narrower = new WidgetSurface(-2560, -519, 640, 820);
+        ContentPlacement fromServer = new ContentPlacement(256, 16, 768, 95);
+        ContentPlacement fromPage = new ContentPlacement(0, 200, 500, 620);
+
+        ContentPlacement placed = WidgetPlacement.following(fromPage, asAsked, fromServer, asAsked, narrower);
+        Assert.assertEquals("the page's width is kept, not scaled to 250", 500, placed.width);
+        Assert.assertEquals(620, placed.height);
+        Assert.assertEquals("anchored where the page put it, on the new surface", -2560, placed.x);
+        Assert.assertEquals("and still against the bottom edge it was placed by", -519 + 820 - 620, placed.y);
+
+        // Only when the window is narrower than the card does the card give way, by clamping.
+        WidgetSurface tiny = new WidgetSurface(0, 0, 370, 820);
+        ContentPlacement clamped = WidgetPlacement.following(fromPage, asAsked, fromServer, asAsked, tiny);
+        Assert.assertEquals(370, clamped.width);
+        Assert.assertEquals(620, clamped.height);
+
+        // The server's rectangle is a proportion of the area and still scales.
+        ContentPlacement scaled = WidgetPlacement.following(null, null, fromServer, asAsked, narrower);
+        Assert.assertEquals(384, scaled.width);
+    }
+
+
+    /**
+     * A hosted survey accepts the display's resize message only when the URL carries its own origin,
+     * which the server's content URL does not.
+     */
+    @Test
+    public void contentUrl_gainsItsOwnOriginOnce() {
+        Assert.assertEquals(
+            "https://master.count.ly/_external/content?app_id=1&id=2&origin=https://master.count.ly",
+            JavaFxContentDisplay.withOrigin("https://master.count.ly/_external/content?app_id=1&id=2"));
+        Assert.assertEquals("http://localhost:3001/content?origin=http://localhost:3001",
+            JavaFxContentDisplay.withOrigin("http://localhost:3001/content"));
+
+        // Already present, not a URL, or nothing at all: left alone.
+        String carrying = "https://x.count.ly/content?origin=https://x.count.ly";
+        Assert.assertSame(carrying, JavaFxContentDisplay.withOrigin(carrying));
+        Assert.assertEquals("not a url", JavaFxContentDisplay.withOrigin("not a url"));
+        Assert.assertNull(JavaFxContentDisplay.withOrigin(null));
+    }
+
+
+    /**
+     * A page's rectangle follows the edge it was placed against, not its old coordinates. A bottom
+     * left survey computed for an 820 tall window sat at y=246; when the window grew to 1000 tall it
+     * kept y=246 and floated mid-window until the page happened to recompute. It belongs at the new
+     * bottom, the same distance from the same edge.
+     */
+    @Test
+    public void reanchor_keepsTheCardAgainstTheEdgeItWasPlacedBy() {
+        WidgetSurface was = new WidgetSurface(53, -1475, 1280, 820);
+        WidgetSurface taller = new WidgetSurface(53, -1475, 1339, 1000);
+
+        // bottom left: left margin 0, bottom margin 0
+        ContentPlacement bottomLeft = WidgetPlacement.reanchor(new ContentPlacement(0, 246, 500, 574), was, taller);
+        Assert.assertEquals(0, bottomLeft.x);
+        Assert.assertEquals(1000 - 574, bottomLeft.y);
+
+        // bottom right: right margin 0
+        ContentPlacement bottomRight = WidgetPlacement.reanchor(new ContentPlacement(780, 246, 500, 574), was, taller);
+        Assert.assertEquals(1339 - 500, bottomRight.x);
+        Assert.assertEquals(1000 - 574, bottomRight.y);
+
+        // centred horizontally, bottom anchored - an NPS card - stays centred and at the bottom
+        ContentPlacement centred = WidgetPlacement.reanchor(new ContentPlacement(400, 406, 480, 414), was, taller);
+        Assert.assertEquals((1339 - 480) / 2, centred.x);
+        Assert.assertEquals(1000 - 414, centred.y);
+
+        // top anchored keeps its top margin
+        ContentPlacement top = WidgetPlacement.reanchor(new ContentPlacement(0, 16, 500, 200), was, taller);
+        Assert.assertEquals(16, top.y);
+
+        // Same surface, or no surface to compare against: untouched.
+        ContentPlacement same = new ContentPlacement(0, 246, 500, 574);
+        Assert.assertSame(same, WidgetPlacement.reanchor(same, was, new WidgetSurface(0, 0, 1280, 820)));
+        Assert.assertSame(same, WidgetPlacement.reanchor(same, null, taller));
+    }
+
+}
diff --git a/sdk-java/build.gradle b/sdk-java/build.gradle
index a7db00098..365bf0758 100644
--- a/sdk-java/build.gradle
+++ b/sdk-java/build.gradle
@@ -2,19 +2,8 @@ apply plugin: 'java-library'
 // apply plugin: 'maven'
 
 
-buildscript {
-  repositories {
-    mavenCentral()
-    //mavenLocal()
-  }
-  dependencies {
-    // Load publish plugin ONLY when publish task is requested
-    if (gradle.startParameter.taskNames.any { it.toLowerCase().contains("publish") }) {
-      // This requires minimum java 11 to work
-      classpath 'com.vanniktech:gradle-maven-publish-plugin:0.28.0'
-    } 
-  }
-}
+// The maven publish plugin is put on the classpath by the root build.gradle, so that every module
+// shares one copy of it.
 
 java {
   sourceCompatibility = JavaVersion.VERSION_1_8
@@ -22,7 +11,7 @@ java {
 }
 
 dependencies {
-  implementation 'org.json:json:20250107'
+  implementation 'org.json:json:20250517'
   implementation 'com.google.code.findbugs:jsr305:3.0.2'
 
   testImplementation 'junit:junit:4.13.1'
@@ -30,6 +19,24 @@ dependencies {
   //testImplementation 'com.squareup.okhttp3:mockwebserver:3.7.0'
 }
 
+// Coverage. Reports land in build/reports/jacoco/test/ (HTML to read, XML for tooling).
+// "./gradlew coverage" from the repo root runs this and prints a summary.
+apply plugin: 'jacoco'
+
+jacoco {
+  toolVersion = JACOCO_VERSION
+}
+
+jacocoTestReport {
+  dependsOn test
+
+  reports {
+    html.required = true
+    xml.required = true
+    csv.required = false
+  }
+}
+
 if (gradle.startParameter.taskNames.any { it.toLowerCase().contains("publish") }) {
   apply plugin: "com.vanniktech.maven.publish"
 }
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/Config.java b/sdk-java/src/main/java/ly/count/sdk/java/Config.java
index 11a83338d..56275a98f 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/Config.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/Config.java
@@ -10,6 +10,7 @@
 import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
+import ly.count.sdk.java.internal.ConfigContent;
 import ly.count.sdk.java.internal.ConfigViews;
 import ly.count.sdk.java.internal.CoreFeature;
 import ly.count.sdk.java.internal.Log;
@@ -68,7 +69,7 @@ public class Config {
     /**
      * Countly SDK version to be sent in HTTP requests
      */
-    protected String sdkVersion = "24.1.6";
+    protected String sdkVersion = "26.8.0";
 
     /**
      * Countly SDK version to be sent in HTTP requests
@@ -238,6 +239,13 @@ public class Config {
 
     public ConfigViews views = new ConfigViews(this);
 
+    /**
+     * Init time options of the content feature.
+     *
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public ConfigContent content = new ConfigContent(this);
+
     protected String location = null;
     protected String ip = null;
     protected String city = null;
@@ -1410,7 +1418,8 @@ public enum Feature {
         Location(CoreFeature.Location.getIndex()),
         UserProfiles(CoreFeature.UserProfiles.getIndex()),
         Feedback(CoreFeature.Feedback.getIndex()),
-        RemoteConfig(CoreFeature.RemoteConfig.getIndex());
+        RemoteConfig(CoreFeature.RemoteConfig.getIndex()),
+        Content(CoreFeature.Content.getIndex());
         //        StarRating(1 << 12),
         //        PerformanceMonitoring(1 << 14);
 
@@ -1441,6 +1450,8 @@ public static Config.Feature byIndex(int index) {
                 return RemoteConfig;
             } else if (index == Feedback.index) {
                 return Feedback;
+            } else if (index == Content.index) {
+                return Content;
             } else {
                 return null;
             }
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/Countly.java b/sdk-java/src/main/java/ly/count/sdk/java/Countly.java
index e044a13f4..86486768d 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/Countly.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/Countly.java
@@ -7,6 +7,7 @@
 import ly.count.sdk.java.internal.InternalConfig;
 import ly.count.sdk.java.internal.Log;
 import ly.count.sdk.java.internal.ModuleBackendMode;
+import ly.count.sdk.java.internal.ModuleContent;
 import ly.count.sdk.java.internal.ModuleCrashes;
 import ly.count.sdk.java.internal.ModuleDeviceIdCore;
 import ly.count.sdk.java.internal.ModuleEvents;
@@ -66,13 +67,14 @@ public Countly() {
      * @param config configuration object
      */
     public void init(final Config config) {
-        File directory = config.sdkStorageRootDirectory;
-
         if (config == null) {
             System.out.println("[ERROR][Countly] Config cannot be null");
             return;
         }
 
+        // Read only after the null check: doing it first made the check unreachable.
+        File directory = config.sdkStorageRootDirectory;
+
         InternalConfig internalConfig;
 
         if (config instanceof InternalConfig) {
@@ -133,6 +135,10 @@ public void init(final Config config) {
      * @deprecated use {@link #init(Config)} instead via instance() call
      */
     public static void init(final File sdkStorageRootDirectory, final Config config) {
+        if (config == null) {
+            System.out.println("[ERROR][Countly] Config cannot be null");
+            return;
+        }
         config.sdkStorageRootDirectory = sdkStorageRootDirectory;
         SingletonHolder.INSTANCE.init(config);
     }
@@ -402,6 +408,24 @@ public ModuleFeedback.Feedback feedback() {
         return sdk.feedback();
     }
 
+    /**
+     * <code>Content</code> interface to enter, leave and refresh content zones, and to preview a
+     * content block. A {@link ly.count.sdk.java.internal.ContentDisplay} has to be registered
+     * before a content zone can be entered; the "ly.count.sdk:java-ui" artifact ships a JavaFX one.
+     *
+     * @return {@link ModuleContent.Content} instance.
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public ModuleContent.Content content() {
+        if (!isInitialized()) {
+            if (L != null) {
+                L.e("[Countly] content, SDK is not initialized yet.");
+            }
+            return null;
+        }
+        return sdk.content();
+    }
+
     /**
      * <code>RemoteConfig</code> interface to use remote config feature.
      *
@@ -525,7 +549,10 @@ public ModuleUserProfile.UserProfile userProfile() {
      */
     public ModuleLocation.Location location() {
         if (!isInitialized()) {
-            L.e("Countly.sharedInstance().init must be called before accessing location");
+            // L is null before init, so this has to be guarded like every sibling accessor.
+            if (L != null) {
+                L.e("Countly.sharedInstance().init must be called before accessing location");
+            }
             return null;
         }
 
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ConfigContent.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ConfigContent.java
new file mode 100644
index 000000000..d13fb2103
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ConfigContent.java
@@ -0,0 +1,66 @@
+package ly.count.sdk.java.internal;
+
+import ly.count.sdk.java.Config;
+
+/**
+ * Init time options of the content feature, reachable through {@link Config#content}.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public class ConfigContent {
+
+    static final int DEFAULT_ZONE_TIMER_INTERVAL = 30;
+    static final int MIN_ZONE_TIMER_INTERVAL = 15;
+
+    private final Config config;
+    protected int zoneTimerInterval = DEFAULT_ZONE_TIMER_INTERVAL;
+    protected ContentCallback globalContentCallback = null;
+    protected ContentUrlHandler contentUrlHandler = null;
+
+    public ConfigContent(Config config) {
+        this.config = config;
+    }
+
+    /**
+     * Set how often the SDK asks the server whether there is content to show, while it is in a
+     * content zone. Values below {@value #MIN_ZONE_TIMER_INTERVAL} seconds are ignored, so the
+     * default of {@value #DEFAULT_ZONE_TIMER_INTERVAL} seconds stays in effect.
+     *
+     * @param zoneTimerIntervalSeconds the fetch interval, in seconds
+     * @return the same config object for convenient linking
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public synchronized Config setZoneTimerInterval(int zoneTimerIntervalSeconds) {
+        if (zoneTimerIntervalSeconds >= MIN_ZONE_TIMER_INTERVAL) {
+            this.zoneTimerInterval = zoneTimerIntervalSeconds;
+        }
+        return config;
+    }
+
+    /**
+     * Take over opening the links that content blocks and feedback widgets ask to open, instead of
+     * the SDK handing them to the desktop. This is how an application routes its own deep links to
+     * the right screen.
+     *
+     * @param handler consulted for every link, {@code null} to let the SDK open them
+     * @return the same config object for convenient linking
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public synchronized Config setContentUrlHandler(ContentUrlHandler handler) {
+        this.contentUrlHandler = handler;
+        return config;
+    }
+
+    /**
+     * Set a callback that is called whenever a content block reaches an end state, with the query
+     * parameters the content sent along.
+     *
+     * @param callback to call when a content block ends
+     * @return the same config object for convenient linking
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public synchronized Config setGlobalContentCallback(ContentCallback callback) {
+        this.globalContentCallback = callback;
+        return config;
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCallback.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCallback.java
new file mode 100644
index 000000000..1a801ea4e
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCallback.java
@@ -0,0 +1,18 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Map;
+
+/**
+ * Called when a content block reaches an end state. Register one with
+ * {@link ConfigContent#setGlobalContentCallback(ContentCallback)}.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public interface ContentCallback {
+
+    /**
+     * @param contentStatus the state the content ended up in
+     * @param contentData the query parameters the content sent along with its close signal
+     */
+    void onContentCallback(ContentStatus contentStatus, Map<String, Object> contentData);
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCloseCallback.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCloseCallback.java
new file mode 100644
index 000000000..d6093f412
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentCloseCallback.java
@@ -0,0 +1,19 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Map;
+
+/**
+ * Handed to a {@link ContentDisplay} so it can tell the SDK that the content it was showing is
+ * gone. Must be called exactly once per {@link ContentDisplay#present(ContentData, ContentCloseCallback)},
+ * including when the display fails to show anything, otherwise the content zone never resumes
+ * fetching.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public interface ContentCloseCallback {
+
+    /**
+     * @param contentData the query parameters the content sent along with its close signal, may be empty
+     */
+    void onClosed(Map<String, Object> contentData);
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentData.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentData.java
new file mode 100644
index 000000000..ca6919489
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentData.java
@@ -0,0 +1,41 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * One content block the server decided to show: the URL to load and where to put it.
+ * <p>
+ * Only one of {@link #portrait} / {@link #landscape} is guaranteed to be set. A display picks the
+ * one matching its own surface and falls back to the other.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public class ContentData {
+    public final String url;
+    public final ContentPlacement portrait;
+    public final ContentPlacement landscape;
+
+    public ContentData(String url, ContentPlacement portrait, ContentPlacement landscape) {
+        this.url = url;
+        this.portrait = portrait;
+        this.landscape = landscape;
+    }
+
+    /**
+     * The placement to use for a surface of the given shape, or {@code null} if neither
+     * orientation carries one.
+     *
+     * @param landscapeSurface {@code true} when the surface is wider than it is tall
+     * @return the placement to lay the content out with
+     */
+    public ContentPlacement placementFor(boolean landscapeSurface) {
+        ContentPlacement preferred = landscapeSurface ? landscape : portrait;
+        if (preferred != null) {
+            return preferred;
+        }
+        return landscapeSurface ? portrait : landscape;
+    }
+
+    @Override
+    public String toString() {
+        return "ContentData{url=" + url + ", portrait=" + portrait + ", landscape=" + landscape + '}';
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentDisplay.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentDisplay.java
new file mode 100644
index 000000000..a175aefb6
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentDisplay.java
@@ -0,0 +1,31 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * The bridge between the headless content module and whatever can actually draw a web view. The
+ * SDK core never depends on a UI toolkit, so a display has to be registered with
+ * {@link ModuleContent.Content#setContentDisplay(ContentDisplay)} before entering a content zone.
+ * <p>
+ * The "ly.count.sdk:java-ui" artifact ships a JavaFX implementation. Provide your own to render
+ * content with another toolkit.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public interface ContentDisplay {
+
+    /**
+     * Called on every fetch, so the SDK can tell the server how much room there is. Return the
+     * dimensions in the same unit the content is laid out in, which is CSS pixels for a web view.
+     *
+     * @return the surface content can be placed on
+     */
+    ContentScreen getScreen();
+
+    /**
+     * Show the given content. Called off the UI thread, so hop onto your toolkit's thread before
+     * touching any widget.
+     *
+     * @param content what to show and where to put it
+     * @param onClosed must be called exactly once, when the content is gone
+     */
+    void present(ContentData content, ContentCloseCallback onClosed);
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentParser.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentParser.java
new file mode 100644
index 000000000..cbc166ed3
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentParser.java
@@ -0,0 +1,69 @@
+package ly.count.sdk.java.internal;
+
+import org.json.JSONObject;
+
+/**
+ * Turns a {@code /o/sdk/content} response into a {@link ContentData}.
+ * <p>
+ * The server answers with a JSON array (for example {@code [{"result":"No content block found!"}]})
+ * when it has nothing to show. {@link ImmediateRequestMaker} wraps such an array into a
+ * {@code {"jsonArray":[...]}} object, so an array response simply has no {@code html} key here and
+ * is reported as "nothing to show".
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+class ContentParser {
+
+    private ContentParser() {
+    }
+
+    /**
+     * @param response the parsed server response, may be {@code null}
+     * @param L logger
+     * @return the content to show, or {@code null} when the response carries none
+     */
+    static ContentData parse(JSONObject response, Log L) {
+        if (response == null) {
+            L.d("[ContentParser] parse, no response to parse");
+            return null;
+        }
+
+        try {
+            String url = response.optString("html", "");
+            JSONObject geo = response.optJSONObject("geo");
+
+            if (Utils.isEmptyOrNull(url) || geo == null) {
+                L.d("[ContentParser] parse, response does not contain a content block");
+                return null;
+            }
+
+            ContentPlacement portrait = toPlacement(geo.optJSONObject("p"));
+            ContentPlacement landscape = toPlacement(geo.optJSONObject("l"));
+
+            if (portrait == null && landscape == null) {
+                L.w("[ContentParser] parse, content block has no usable placement, ignoring it");
+                return null;
+            }
+
+            return new ContentData(url, portrait, landscape);
+        } catch (Throwable t) {
+            L.e("[ContentParser] parse, failed to parse the content response, [" + t + "]");
+            return null;
+        }
+    }
+
+    private static ContentPlacement toPlacement(JSONObject rect) {
+        if (rect == null) {
+            return null;
+        }
+        int width = rect.optInt("w", 0);
+        int height = rect.optInt("h", 0);
+        if (width <= 0 || height <= 0) {
+            // Like the widget parsers: a degenerate rectangle must fall through to the other
+            // orientation, or to "no usable placement", rather than become an invisible 0x0 window
+            // that holds the zone open with nothing the user can close.
+            return null;
+        }
+        return new ContentPlacement(rect.optInt("x", 0), rect.optInt("y", 0), width, height);
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentPlacement.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentPlacement.java
new file mode 100644
index 000000000..f2a1669b0
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentPlacement.java
@@ -0,0 +1,26 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * A rectangle the server asked a content block to occupy, in the same units the SDK reported the
+ * screen resolution in (see {@link ContentScreen}).
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public class ContentPlacement {
+    public final int x;
+    public final int y;
+    public final int width;
+    public final int height;
+
+    public ContentPlacement(int x, int y, int width, int height) {
+        this.x = x;
+        this.y = y;
+        this.width = width;
+        this.height = height;
+    }
+
+    @Override
+    public String toString() {
+        return "ContentPlacement{x=" + x + ", y=" + y + ", width=" + width + ", height=" + height + '}';
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentRequestBuilder.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentRequestBuilder.java
new file mode 100644
index 000000000..440de6eaf
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentRequestBuilder.java
@@ -0,0 +1,50 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Locale;
+
+/**
+ * Builds the content specific query parameters of a {@code /o/sdk/content} fetch. The common
+ * parameters (app key, device ID, timestamp, SDK name and version) are added by
+ * {@link ModuleRequests#prepareRequiredParamsAsString(InternalConfig, Object...)}.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+class ContentRequestBuilder {
+
+    static final String DEVICE_TYPE = "desktop";
+
+    private ContentRequestBuilder() {
+    }
+
+    /**
+     * @param screen the surface the content has to fit into
+     * @param contentId set to fetch one specific content block as a preview, {@code null} otherwise
+     * @param L logger
+     * @return the content specific parameters, ready to be appended to a request
+     */
+    static Params build(ContentScreen screen, String contentId, Log L) {
+        int width = screen == null ? 0 : screen.width;
+        int height = screen == null ? 0 : screen.height;
+
+        // A desktop surface does not rotate, so both orientations report the same rectangle.
+        String resolution = "{\"l\":{\"w\":" + width + ",\"h\":" + height + "},\"p\":{\"w\":" + width + ",\"h\":" + height + "}}";
+
+        Params params = new Params()
+            .add("method", "queue")
+            .add("resolution", resolution)
+            .add("la", language())
+            .add("dt", DEVICE_TYPE);
+
+        if (!Utils.isEmptyOrNull(contentId)) {
+            params.add("content_id", contentId).add("preview", "true");
+        }
+
+        L.v("[ContentRequestBuilder] build, resolution:[" + resolution + "] preview:[" + !Utils.isEmptyOrNull(contentId) + "]");
+        return params;
+    }
+
+    private static String language() {
+        String language = Locale.getDefault().getLanguage();
+        return language == null ? "" : language;
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentScreen.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentScreen.java
new file mode 100644
index 000000000..3aeef8384
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentScreen.java
@@ -0,0 +1,23 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * The surface a {@link ContentDisplay} can place content on. The SDK reports these dimensions to
+ * the server, and the server answers with a {@link ContentPlacement} expressed in the same units,
+ * so a display must report and place in one consistent unit (CSS pixels on a desktop web view).
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public class ContentScreen {
+    public final int width;
+    public final int height;
+
+    public ContentScreen(int width, int height) {
+        this.width = width;
+        this.height = height;
+    }
+
+    @Override
+    public String toString() {
+        return "ContentScreen{width=" + width + ", height=" + height + '}';
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentStatus.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentStatus.java
new file mode 100644
index 000000000..306b9b3e7
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentStatus.java
@@ -0,0 +1,10 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * The state a content block ended up in.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public enum ContentStatus {
+    COMPLETED, CLOSED
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentUrlHandler.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentUrlHandler.java
new file mode 100644
index 000000000..1bb9b2f97
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ContentUrlHandler.java
@@ -0,0 +1,21 @@
+package ly.count.sdk.java.internal;
+
+/**
+ * Lets the application open links itself instead of the SDK handing them to the desktop.
+ * <p>
+ * Register one with {@link ConfigContent#setContentUrlHandler(ContentUrlHandler)}. It is consulted
+ * for links from both content blocks and feedback widgets, which is how an application routes its
+ * own deep links, custom scheme or https, to the right screen rather than having them opened in a
+ * browser.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public interface ContentUrlHandler {
+
+    /**
+     * @param url the URL the web content is trying to open
+     * @return {@code true} if the application handled it; {@code false} to let the SDK open it as
+     *     usual
+     */
+    boolean onContentUrl(String url);
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/CoreFeature.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/CoreFeature.java
index 76aa0a4dd..b57531715 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/CoreFeature.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/CoreFeature.java
@@ -21,7 +21,8 @@ public enum CoreFeature {
     DeviceId(1 << 20, ModuleDeviceIdCore::new),
     Requests(1 << 21, ModuleRequests::new),
     Logs(1 << 22),
-    Feedback(1 << 23, ModuleFeedback::new);
+    Feedback(1 << 23, ModuleFeedback::new),
+    Content(1 << 24, ModuleContent::new);
 
     private final int index;
 
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyFeedbackWidget.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyFeedbackWidget.java
index e65e80915..178313d46 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyFeedbackWidget.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyFeedbackWidget.java
@@ -9,6 +9,13 @@ public class CountlyFeedbackWidget {
     public String name;
     public String[] tags;
 
+    /**
+     * The widget's {@code appearance.position}, for example "bLeft" or "bRight", or {@code null}
+     * when the server did not send one. A display uses it to anchor the card the way the web SDK's
+     * stylesheet does.
+     */
+    public String position;
+
     @Override
     public boolean equals(Object o) {
         if (!(o instanceof CountlyFeedbackWidget)) {
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyTimer.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyTimer.java
index 08b912d84..f2dd22058 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyTimer.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/CountlyTimer.java
@@ -16,11 +16,19 @@ protected CountlyTimer(Log logger) {
     }
 
     protected void stopTimer() {
+        stopTimer(true);
+    }
+
+    /**
+     * @param awaitTermination whether to wait for a running task to finish. Must be {@code false}
+     *     when called from the timer's own task, because a task cannot wait for itself.
+     */
+    protected void stopTimer(boolean awaitTermination) {
         L.i("[CountlyTimer] stopTimer, Stopping global timer");
         if (timerService != null) {
             try {
                 timerService.shutdown();
-                if (!timerService.awaitTermination(1, TimeUnit.SECONDS)) {
+                if (awaitTermination && !timerService.awaitTermination(1, TimeUnit.SECONDS)) {
                     timerService.shutdownNow();
                     if (!timerService.awaitTermination(1, TimeUnit.SECONDS)) {
                         L.e("[SDKCore] Global timer must be locked");
@@ -34,20 +42,30 @@ protected void stopTimer() {
     }
 
     protected void startTimer(long timerDelay, Runnable runnable) {
-        L.i("[CountlyTimer] startTimer, Starting global timer timerDelay: [" + timerDelay + "]");
-        timerDelay = timerDelay * 1000;
+        startTimer(timerDelay, -1, runnable);
+    }
+
+    /**
+     * @param timerDelay interval between two runs, in seconds
+     * @param initialDelayMs how long to wait before the first run, in milliseconds. A negative
+     *     value uses the interval itself as the initial delay.
+     * @param runnable what to run on every tick
+     */
+    protected void startTimer(long timerDelay, long initialDelayMs, Runnable runnable) {
+        L.i("[CountlyTimer] startTimer, Starting global timer timerDelay: [" + timerDelay + "] initialDelayMs: [" + initialDelayMs + "]");
+        long delay = timerDelay * 1000;
 
-        if (timerDelay < 1000) {
-            timerDelay = 1000;
+        if (delay < 1000) {
+            delay = 1000;
         }
 
-        long startTime = timerDelay;
+        long startTime = initialDelayMs < 0 ? delay : initialDelayMs;
 
         if (TIMER_DELAY_MS > 0) {
-            timerDelay = TIMER_DELAY_MS;
+            delay = TIMER_DELAY_MS;
             startTime = 0;
         }
 
-        timerService.scheduleWithFixedDelay(runnable, startTime, timerDelay, TimeUnit.MILLISECONDS);
+        timerService.scheduleWithFixedDelay(runnable, startTime, delay, TimeUnit.MILLISECONDS);
     }
 }
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/FeedbackWidgetSelector.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/FeedbackWidgetSelector.java
new file mode 100644
index 000000000..22db4f788
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/FeedbackWidgetSelector.java
@@ -0,0 +1,59 @@
+package ly.count.sdk.java.internal;
+
+import java.util.List;
+
+/**
+ * Picks one feedback widget out of a fetched list, by type and optionally by a name, ID or tag.
+ * Kept free of any UI toolkit so the quick present calls of every display implementation select the
+ * same way.
+ */
+public class FeedbackWidgetSelector {
+
+    private FeedbackWidgetSelector() {
+    }
+
+    /**
+     * @param widgets the widgets available for this device, may be {@code null}
+     * @param type the type of widget to look for
+     * @param nameIDorTag the widget ID, name or one of its tags. {@code null} or empty takes the
+     *     first widget of that type.
+     * @return the widget to show, or {@code null} when the list holds no match
+     */
+    public static CountlyFeedbackWidget select(List<CountlyFeedbackWidget> widgets, FeedbackWidgetType type, String nameIDorTag) {
+        if (widgets == null || widgets.isEmpty() || type == null) {
+            return null;
+        }
+
+        boolean matchAny = Utils.isEmptyOrNull(nameIDorTag);
+
+        for (CountlyFeedbackWidget widget : widgets) {
+            if (widget == null || widget.type != type) {
+                continue;
+            }
+
+            if (matchAny || matches(widget, nameIDorTag)) {
+                return widget;
+            }
+        }
+
+        return null;
+    }
+
+    private static boolean matches(CountlyFeedbackWidget widget, String nameIDorTag) {
+        if (nameIDorTag.equals(widget.widgetId) || nameIDorTag.equals(widget.name)) {
+            return true;
+        }
+
+        if (widget.tags == null) {
+            return false;
+        }
+
+        for (String tag : widget.tags) {
+            if (nameIDorTag.equals(tag)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleBackendMode.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleBackendMode.java
index 6d95307f7..2dfc65d49 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleBackendMode.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleBackendMode.java
@@ -55,6 +55,11 @@ public void stop(InternalConfig config, final boolean clear) {
 
     public void disableModule() {
         disabledModule = true;
+        if (L == null) {
+            // The placeholder handed out when backend mode is off is never init'ed, so it has no
+            // logger of its own. Borrow the SDK's, or every call through it would fail on logging.
+            L = SDKCore.logger();
+        }
     }
 
     private void recordEventInternal(String deviceID, String key, int count, Double sum, Double dur, Map<String, Object> segmentation, Long timestamp) {
@@ -365,12 +370,12 @@ public class BackendMode {
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordView(String deviceID, String name, Map<String, Object> segmentation, Long timestamp) {
-            L.i(String.format(":recordView: deviceID = %s, key = %s, segmentation = %s, timestamp = %d", deviceID, name, segmentation, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format(":recordView: deviceID = %s, key = %s, segmentation = %s, timestamp = %d", deviceID, name, segmentation, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordView: DeviceID can not be null or empty.");
                 return;
@@ -402,12 +407,12 @@ public void recordView(String deviceID, String name, Map<String, Object> segment
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordEvent(String deviceID, String key, int count, Double sum, Double dur, Map<String, Object> segmentation, Long timestamp) {
-            L.i(String.format("recordEvent: deviceID = %s, key = %s, count = %d, sum = %f, dur = %f, segmentation = %s, timestamp = %d", deviceID, key, count, sum, dur, segmentation, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("recordEvent: deviceID = %s, key = %s, count = %d, sum = %f, dur = %f, segmentation = %s, timestamp = %d", deviceID, key, count, sum, dur, segmentation, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordEvent: DeviceID can not be null or empty.");
                 return;
@@ -433,12 +438,12 @@ public void recordEvent(String deviceID, String key, int count, Double sum, Doub
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void sessionBegin(String deviceID, Map<String, String> metrics, Map<String, String> location, Long timestamp) {
-            L.i(String.format("sessionBegin: deviceID = %s, timestamp = %d", deviceID, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("sessionBegin: deviceID = %s, timestamp = %d", deviceID, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] sessionBegin: DeviceID can not be null or empty.");
                 return;
@@ -455,12 +460,12 @@ public void sessionBegin(String deviceID, Map<String, String> metrics, Map<Strin
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void sessionUpdate(String deviceID, double duration, Long timestamp) {
-            L.i(String.format("sessionUpdate: deviceID = %s, duration = %f, timestamp = %d", deviceID, duration, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("sessionUpdate: deviceID = %s, duration = %f, timestamp = %d", deviceID, duration, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] sessionUpdate: DeviceID can not be null or empty.");
                 return;
@@ -481,12 +486,12 @@ public void sessionUpdate(String deviceID, double duration, Long timestamp) {
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void sessionEnd(String deviceID, double duration, Long timestamp) {
-            L.i(String.format("sessionEnd: deviceID = %s, duration = %f, timestamp = %d", deviceID, duration, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("sessionEnd: deviceID = %s, duration = %f, timestamp = %d", deviceID, duration, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] sessionEnd: DeviceID can not be null or empty.");
                 return;
@@ -509,12 +514,12 @@ public void sessionEnd(String deviceID, double duration, Long timestamp) {
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordException(String deviceID, Throwable throwable, Map<String, Object> segmentation, Map<String, String> crashDetails, Long timestamp) {
-            L.i(String.format("recordException: deviceID = %s, throwable = %s, segmentation = %s, timestamp = %d", deviceID, throwable, segmentation, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("recordException: deviceID = %s, throwable = %s, segmentation = %s, timestamp = %d", deviceID, throwable, segmentation, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordException: DeviceID can not be null or empty.");
                 return;
@@ -543,12 +548,12 @@ public void recordException(String deviceID, Throwable throwable, Map<String, Ob
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordException(String deviceID, String message, String stacktrace, Map<String, Object> segmentation, Map<String, String> crashDetails, Long timestamp) {
-            L.i(String.format("recordException: deviceID = %s, message = %s, stacktrace = %s, segmentation = %s, timestamp = %d", deviceID, message, stacktrace, segmentation, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("recordException: deviceID = %s, message = %s, stacktrace = %s, segmentation = %s, timestamp = %d", deviceID, message, stacktrace, segmentation, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordException: DeviceID can not be null or empty.");
                 return;
@@ -575,12 +580,12 @@ public void recordException(String deviceID, String message, String stacktrace,
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordUserProperties(String deviceID, Map<String, Object> userProperties, Long timestamp) {
-            L.i(String.format("recordUserProperties: deviceID = %s, userProperties = %s, timestamp = %d", deviceID, userProperties, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("recordUserProperties: deviceID = %s, userProperties = %s, timestamp = %d", deviceID, userProperties, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordUserProperties: DeviceID can not be null or empty.");
                 return;
@@ -601,12 +606,12 @@ public void recordUserProperties(String deviceID, Map<String, Object> userProper
          * @param timestamp record time in milliseconds, leave null if you don't have it
          */
         public void recordDirectRequest(String deviceID, Map<String, String> requestData, Long timestamp) {
-            L.i(String.format("recordDirectRequest: deviceID = %s, requestData = %s, timestamp = %d", deviceID, requestData, timestamp));
-
             if (disabledModule) {
                 return;
             }
 
+            L.i(String.format("recordDirectRequest: deviceID = %s, requestData = %s, timestamp = %d", deviceID, requestData, timestamp));
+
             if (deviceID == null || deviceID.isEmpty()) {
                 L.e("[BackendMode] recordDirectRequest: DeviceID can not be null or empty.");
                 return;
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleContent.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleContent.java
new file mode 100644
index 000000000..c60d04d98
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleContent.java
@@ -0,0 +1,553 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;
+import javax.annotation.Nullable;
+import ly.count.sdk.java.Countly;
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+/**
+ * Fetches content blocks from the server while the app is in a content zone, and hands whatever the
+ * server decided to show to a {@link ContentDisplay}.
+ * <p>
+ * The module itself never touches a UI toolkit. A display has to be registered through
+ * {@link Content#setContentDisplay(ContentDisplay)} before a content zone can be entered; the
+ * "ly.count.sdk:java-ui" artifact ships a JavaFX one.
+ *
+ * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+ */
+public class ModuleContent extends ModuleBase {
+
+    /**
+     * How long after the SDK started the first fetch of a zone may happen, so a zone entered right
+     * after init does not race the rest of the SDK coming up.
+     * <p>
+     * It is a floor measured from init, not a delay charged to every {@code enterContentZone}: an
+     * application that turns the zone on later has already waited it out, and charging it anyway put
+     * four seconds between the call and the content appearing every single time. Same rule as the
+     * Android SDK's {@code CONTENT_START_DELAY_MS}, which only adds it while the SDK is that new.
+     */
+    static final long START_DELAY_MS = 4000;
+
+    /**
+     * How many timer ticks are skipped after a content block was closed, giving the server time to
+     * process whatever the content recorded before the SDK asks for the next one.
+     */
+    static final int POST_CLOSE_SKIPPED_TICKS = 2;
+
+    Content contentInterface = null;
+    ContentDisplay display = null;
+    CountlyTimer contentTimer = null;
+
+    private final Object contentLock = new Object();
+    private boolean zoneActive = false;
+    private boolean shouldFetch = false;
+    private boolean contentShown = false;
+    private boolean fetching = false;
+    private int waitForDelay = 0;
+    private int generation = 0;
+
+    private int zoneTimerInterval = ConfigContent.DEFAULT_ZONE_TIMER_INTERVAL;
+
+    /** When the SDK came up, which is what {@link #START_DELAY_MS} is measured from. */
+    private long startedAt = 0;
+    private ContentCallback globalContentCallback = null;
+
+    ModuleContent() {
+    }
+
+    @Override
+    public void init(InternalConfig config) {
+        super.init(config);
+        L.v("[ModuleContent] Initializing");
+
+        zoneTimerInterval = config.content.zoneTimerInterval;
+        globalContentCallback = config.content.globalContentCallback;
+        contentInterface = new Content();
+        startedAt = TimeUtils.uniqueTimestampMs();
+    }
+
+    @Override
+    public Boolean onRequest(Request request) {
+        return true;
+    }
+
+    @Override
+    public void stop(InternalConfig config, boolean clear) {
+        super.stop(config, clear);
+        exitContentZoneInternal();
+        display = null;
+        contentInterface = null;
+        globalContentCallback = null;
+    }
+
+    /**
+     * A device ID change without merge means a different user, so whatever the server decided to
+     * show the previous one no longer applies. The zone is torn down and the developer decides
+     * whether to enter it again for the new user. A change with merge is the same user, so the zone
+     * keeps running.
+     */
+    @Override
+    protected void deviceIdChanged(String oldDeviceId, boolean withMerge) {
+        super.deviceIdChanged(oldDeviceId, withMerge);
+        L.d("[ModuleContent] deviceIdChanged, oldDeviceId:[" + oldDeviceId + "] withMerge:[" + withMerge + "]");
+
+        if (withMerge) {
+            return;
+        }
+
+        L.i("[ModuleContent] deviceIdChanged, the device ID changed without merge, leaving the content zone");
+        exitContentZoneInternal();
+    }
+
+    void setContentDisplayInternal(ContentDisplay contentDisplay) {
+        L.d("[ModuleContent] setContentDisplayInternal, display set:[" + (contentDisplay != null) + "]");
+        synchronized (contentLock) {
+            display = contentDisplay;
+        }
+    }
+
+    void enterContentZoneInternal() {
+        if (display == null) {
+            L.w("[ModuleContent] enterContentZoneInternal, no content display is registered, ignoring the call");
+            return;
+        }
+
+        if (internalConfig.isTemporaryIdEnabled()) {
+            L.w("[ModuleContent] enterContentZoneInternal, content can't be fetched while in temporary device ID mode");
+            return;
+        }
+
+        synchronized (contentLock) {
+            if (zoneActive) {
+                L.d("[ModuleContent] enterContentZoneInternal, already in a content zone, ignoring the call");
+                return;
+            }
+
+            zoneActive = true;
+            shouldFetch = true;
+            contentShown = false;
+            fetching = false;
+            waitForDelay = 0;
+            // Any fetch left in flight from a previous zone belongs to an older generation and is
+            // discarded when it completes.
+            generation++;
+
+            contentTimer = new CountlyTimer(L);
+            contentTimer.startTimer(zoneTimerInterval, firstFetchDelay(), this::onZoneTimerTick);
+        }
+
+        L.i("[ModuleContent] enterContentZoneInternal, entered the content zone, fetch interval:[" + zoneTimerInterval + "] seconds");
+    }
+
+    /**
+     * @return how long the first fetch of this zone has to wait: whatever is left of
+     *     {@link #START_DELAY_MS} since the SDK started, and nothing once that has passed
+     */
+    long firstFetchDelay() {
+        long sinceStart = TimeUtils.uniqueTimestampMs() - startedAt;
+        long remaining = START_DELAY_MS - sinceStart;
+        return remaining > 0 ? remaining : 0;
+    }
+
+    /**
+     * Pretends the SDK started at another time, so a test can exercise the delay rule without
+     * waiting out the window.
+     *
+     * @param when when the SDK is to be considered started, in milliseconds
+     */
+    void startedAtForTests(long when) {
+        startedAt = when;
+    }
+
+    void exitContentZoneInternal() {
+        exitContentZoneInternal(true);
+    }
+
+    /**
+     * @param awaitTimerTermination must be {@code false} when called from the zone timer's own
+     *     tick, because a task cannot wait for itself to finish
+     */
+    private void exitContentZoneInternal(boolean awaitTimerTermination) {
+        CountlyTimer timerToStop;
+        synchronized (contentLock) {
+            zoneActive = false;
+            shouldFetch = false;
+            contentShown = false;
+            fetching = false;
+            waitForDelay = 0;
+            generation++;
+
+            timerToStop = contentTimer;
+            contentTimer = null;
+        }
+
+        // Stopped outside the lock: stopping waits for a running tick, and that tick needs the lock.
+        if (timerToStop != null) {
+            timerToStop.stopTimer(awaitTimerTermination);
+        }
+
+        L.i("[ModuleContent] exitContentZoneInternal, left the content zone");
+    }
+
+    void refreshContentZoneInternal() {
+        synchronized (contentLock) {
+            if (contentShown) {
+                L.d("[ModuleContent] refreshContentZoneInternal, a content block is on screen, ignoring the call");
+                return;
+            }
+        }
+
+        // Push whatever is queued out first, so the trigger the developer just recorded has a
+        // chance of being processed before the next fetch lands.
+        flushEventQueue();
+
+        exitContentZoneInternal();
+        enterContentZoneInternal();
+    }
+
+    void previewContentInternal(String contentId) {
+        if (display == null) {
+            L.w("[ModuleContent] previewContentInternal, no content display is registered, ignoring the call");
+            return;
+        }
+
+        if (internalConfig.isTemporaryIdEnabled()) {
+            L.w("[ModuleContent] previewContentInternal, content can't be fetched while in temporary device ID mode");
+            return;
+        }
+
+        int currentGeneration;
+        synchronized (contentLock) {
+            if (contentShown || fetching) {
+                L.d("[ModuleContent] previewContentInternal, another content block is already being fetched or shown, ignoring the call");
+                return;
+            }
+            fetching = true;
+            currentGeneration = generation;
+        }
+
+        L.i("[ModuleContent] previewContentInternal, previewing content:[" + contentId + "]");
+        fetchContents(contentId, currentGeneration);
+    }
+
+    void recordContentEventsInternal(String eventsJson) {
+        if (Utils.isEmptyOrNull(eventsJson)) {
+            L.d("[ModuleContent] recordContentEventsInternal, no events to record");
+            return;
+        }
+
+        ModuleEvents.Events events = SDKCore.instance == null ? null : SDKCore.instance.events();
+        if (events == null) {
+            L.w("[ModuleContent] recordContentEventsInternal, events are not available, content events are dropped");
+            return;
+        }
+
+        boolean recorded = false;
+        try {
+            JSONArray array = new JSONArray(eventsJson);
+            for (int i = 0; i < array.length(); i++) {
+                JSONObject event = array.optJSONObject(i);
+                if (event == null) {
+                    continue;
+                }
+
+                String key = event.optString("key", "");
+                if (Utils.isEmptyOrNull(key)) {
+                    L.w("[ModuleContent] recordContentEventsInternal, an event without a key was received, dropping it");
+                    continue;
+                }
+
+                JSONObject segmentation = event.optJSONObject("sg");
+                if (segmentation == null) {
+                    segmentation = event.optJSONObject("segmentation");
+                }
+
+                events.recordEvent(key, toSegmentation(segmentation));
+                recorded = true;
+            }
+        } catch (Throwable t) {
+            L.e("[ModuleContent] recordContentEventsInternal, failed to record the content events, [" + t + "]");
+        }
+
+        if (recorded) {
+            // The server has to see these before it can decide what to show next.
+            flushEventQueue();
+        }
+    }
+
+    private Map<String, Object> toSegmentation(JSONObject segmentation) {
+        if (segmentation == null) {
+            return Collections.emptyMap();
+        }
+
+        Map<String, Object> result = new HashMap<>();
+        Iterator<String> keys = segmentation.keys();
+        while (keys.hasNext()) {
+            String key = keys.next();
+            result.put(key, segmentation.opt(key));
+        }
+        return result;
+    }
+
+    private void flushEventQueue() {
+        if (SDKCore.instance == null) {
+            return;
+        }
+        ModuleEvents module = SDKCore.instance.module(ModuleEvents.class);
+        if (module == null) {
+            L.d("[ModuleContent] flushEventQueue, events module is not available, nothing to flush");
+            return;
+        }
+        module.checkEventQueueToSend(true);
+    }
+
+    /**
+     * One poll of the content zone. Package visible so tests can drive the zone without waiting on
+     * a real timer.
+     */
+    void onZoneTimerTick() {
+        try {
+            zoneTimerTick();
+        } catch (Throwable t) {
+            // An exception escaping a scheduled task cancels the schedule, which would kill the zone
+            // for good. The SDK can be torn down under this timer at any moment, so swallow and live.
+            L.e("[ModuleContent] onZoneTimerTick, the content zone poll failed, [" + t + "]");
+        }
+    }
+
+    private void zoneTimerTick() {
+        if (SDKCore.instance == null || !Countly.isInitialized()) {
+            // The SDK was stopped while this timer was still armed; nothing left to fetch.
+            return;
+        }
+
+        if (!SDKCore.instance.hasConsentForFeature(CoreFeature.Content)) {
+            L.d("[ModuleContent] onZoneTimerTick, content consent was removed, leaving the content zone");
+            exitContentZoneInternal(false);
+            return;
+        }
+
+        int currentGeneration;
+        synchronized (contentLock) {
+            if (waitForDelay > 0) {
+                waitForDelay--;
+                L.v("[ModuleContent] onZoneTimerTick, waiting for [" + waitForDelay + "] more ticks before fetching again");
+                return;
+            }
+
+            if (!shouldFetch || contentShown || fetching) {
+                return;
+            }
+
+            fetching = true;
+            currentGeneration = generation;
+        }
+
+        fetchContents(null, currentGeneration);
+    }
+
+    private void fetchContents(String contentId, int fetchGeneration) {
+        try {
+            ContentDisplay currentDisplay;
+            synchronized (contentLock) {
+                currentDisplay = display;
+            }
+
+            if (currentDisplay == null) {
+                L.w("[ModuleContent] fetchContents, the content display went away, aborting the fetch");
+                clearFetching(fetchGeneration);
+                return;
+            }
+
+            ContentScreen screen = currentDisplay.getScreen();
+            String requestData = ModuleRequests.prepareRequiredParams(internalConfig)
+                .add(ContentRequestBuilder.build(screen, contentId, L))
+                .toString();
+
+            Transport transport = SDKCore.instance.networking.getTransport();
+            final boolean networkingIsEnabled = internalConfig.getNetworkingEnabled();
+
+            L.d("[ModuleContent] fetchContents, requesting content with:[" + requestData + "]");
+
+            internalConfig.immediateRequestGenerator.createImmediateRequestMaker()
+                .doWork(requestData, "/o/sdk/content?", transport, false, networkingIsEnabled,
+                    response -> onContentFetched(response, fetchGeneration), L);
+        } catch (Throwable t) {
+            L.e("[ModuleContent] fetchContents, failed to request content, [" + t + "]");
+            clearFetching(fetchGeneration);
+        }
+    }
+
+    private void onContentFetched(JSONObject response, int fetchGeneration) {
+        try {
+            ContentData content = ContentParser.parse(response, L);
+            if (content == null) {
+                L.d("[ModuleContent] onContentFetched, nothing to show");
+                return;
+            }
+
+            ContentDisplay currentDisplay;
+            synchronized (contentLock) {
+                if (fetchGeneration != generation) {
+                    L.d("[ModuleContent] onContentFetched, the content zone changed while this fetch was in flight, discarding the content");
+                    return;
+                }
+                currentDisplay = display;
+            }
+
+            if (currentDisplay == null) {
+                L.w("[ModuleContent] onContentFetched, the content display went away, discarding the content");
+                return;
+            }
+
+            L.i("[ModuleContent] onContentFetched, showing content:[" + content + "]");
+            currentDisplay.present(content, this::onContentClosed);
+
+            // Committed only once the display accepted the content: a display that throws must not
+            // leave the zone believing something is on screen, which would block every later fetch.
+            synchronized (contentLock) {
+                if (fetchGeneration == generation) {
+                    contentShown = true;
+                    shouldFetch = false;
+                }
+            }
+        } catch (Throwable t) {
+            L.e("[ModuleContent] onContentFetched, the content display failed to show the content, [" + t + "]");
+        } finally {
+            clearFetching(fetchGeneration);
+        }
+    }
+
+    private void onContentClosed(Map<String, Object> contentData) {
+        L.d("[ModuleContent] onContentClosed, content closed with:[" + contentData + "]");
+
+        synchronized (contentLock) {
+            contentShown = false;
+            if (zoneActive) {
+                shouldFetch = true;
+                waitForDelay = POST_CLOSE_SKIPPED_TICKS;
+            }
+        }
+
+        ContentCallback callback = globalContentCallback;
+        if (callback == null) {
+            return;
+        }
+
+        try {
+            callback.onContentCallback(ContentStatus.CLOSED, contentData == null ? Collections.emptyMap() : contentData);
+        } catch (Throwable t) {
+            L.e("[ModuleContent] onContentClosed, the global content callback threw, [" + t + "]");
+        }
+    }
+
+    /**
+     * Releases the single fetch slot, but only for the generation that took it, so a stale fetch
+     * completing late cannot release a newer one.
+     *
+     * @param fetchGeneration the generation the finished fetch was started in
+     */
+    private void clearFetching(int fetchGeneration) {
+        synchronized (contentLock) {
+            if (fetchGeneration == generation) {
+                fetching = false;
+            }
+        }
+    }
+
+    /**
+     * Retrieves and displays Countly content.
+     *
+     * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+     */
+    public class Content {
+
+        /**
+         * Register the display that draws content blocks. Required before entering a content zone.
+         * Pass {@code null} to unregister.
+         *
+         * @param contentDisplay the display to draw content with
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void setContentDisplay(@Nullable ContentDisplay contentDisplay) {
+            synchronized (Countly.instance()) {
+                setContentDisplayInternal(contentDisplay);
+            }
+        }
+
+        /**
+         * Start asking the server for content to show. Ignored while already in a content zone.
+         *
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void enterContentZone() {
+            synchronized (Countly.instance()) {
+                L.i("[Content] enterContentZone, entering the content zone");
+                enterContentZoneInternal();
+            }
+        }
+
+        /**
+         * Stop asking the server for content. A content block that is already on screen stays
+         * there, so the user can finish with it.
+         *
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void exitContentZone() {
+            synchronized (Countly.instance()) {
+                L.i("[Content] exitContentZone, leaving the content zone");
+                exitContentZoneInternal();
+            }
+        }
+
+        /**
+         * Re-enter the content zone right away, after flushing the event queue. Use it when a
+         * trigger condition just changed. Ignored while a content block is on screen.
+         *
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void refreshContentZone() {
+            synchronized (Countly.instance()) {
+                L.i("[Content] refreshContentZone, refreshing the content zone");
+                refreshContentZoneInternal();
+            }
+        }
+
+        /**
+         * Fetch and show one specific content block, bypassing the server's targeting. Meant for
+         * previewing content while building it.
+         *
+         * @param contentId the ID of the content block to show
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void previewContent(@Nullable String contentId) {
+            synchronized (Countly.instance()) {
+                L.i("[Content] previewContent, previewing content:[" + contentId + "]");
+                if (Utils.isEmptyOrNull(contentId)) {
+                    L.w("[Content] previewContent, content ID is null or empty, ignoring the call");
+                    return;
+                }
+                previewContentInternal(contentId);
+            }
+        }
+
+        /**
+         * Record the events a content block asked for, and push the event queue to the server so it
+         * can act on them straight away. Called by a {@link ContentDisplay} when the content sends
+         * an {@code action=event} signal.
+         *
+         * @param eventsJson a JSON array of {@code {key, sg}} objects, as sent by the content
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public void recordContentEvents(@Nullable String eventsJson) {
+            synchronized (Countly.instance()) {
+                L.d("[Content] recordContentEvents, recording the events of a content block");
+                recordContentEventsInternal(eventsJson);
+            }
+        }
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleCrashes.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleCrashes.java
index a869a434d..2dbfb15ad 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleCrashes.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleCrashes.java
@@ -94,7 +94,8 @@ protected void recordExceptionInternal(Throwable t, boolean handled, Map<String,
 
         CrashImpl crash = new CrashImpl(L).addThrowable(t).setFatal(!handled).addSegments(segments);
 
-        if (Utils.isEmptyOrNull(legacyCrashName)) {
+        // Guard was inverted: a real name was never applied and an empty one was sent as '_name:""'.
+        if (!Utils.isEmptyOrNull(legacyCrashName)) {
             crash.setName(legacyCrashName);
         }
 
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleFeedback.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleFeedback.java
index c8659ac75..d088a5262 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleFeedback.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/ModuleFeedback.java
@@ -128,10 +128,16 @@ static String parseFeedbackList(JSONObject requestResponse, List<CountlyFeedback
                             continue;
                         }
 
+                        // appearance.position anchors the card on screen; the web SDK applies it as
+                        // a CSS class. Dropping it left every survey in the default corner.
+                        JSONObject appearance = jObj.optJSONObject("appearance");
+                        String valPosition = appearance == null ? null : appearance.optString("position", null);
+
                         CountlyFeedbackWidget se = new CountlyFeedbackWidget();
                         se.type = plannedType;
                         se.widgetId = valId;
                         se.name = valName;
+                        se.position = valPosition;
                         se.tags = valTagsArr.toArray(new String[0]);
 
                         parsedRes.add(se);
@@ -243,10 +249,13 @@ private void reportFeedbackWidgetManuallyInternal(CountlyFeedbackWidget widgetIn
             }
         }
 
+        // A ConcurrentHashMap rejects null values, and the application version is unset unless the
+        // integrator supplied one, so putting it in blindly threw a NullPointerException out of a
+        // public API for every integration that never called 'setApplicationVersion'.
         Map<String, Object> segm = new ConcurrentHashMap<>();
-        segm.put("platform", internalConfig.getSdkPlatform());
-        segm.put("app_version", cachedAppVersion);
-        segm.put("widget_id", widgetInfo.widgetId);
+        putIfNotNull(segm, "platform", WidgetUrlBuilder.PLATFORM);
+        putIfNotNull(segm, "app_version", cachedAppVersion);
+        putIfNotNull(segm, "widget_id", widgetInfo.widgetId);
 
         if (widgetResult == null) {
             //mark as closed
@@ -260,6 +269,14 @@ private void reportFeedbackWidgetManuallyInternal(CountlyFeedbackWidget widgetIn
         Countly.instance().events().recordEvent(widgetInfo.type.eventKey, segm);
     }
 
+    private void putIfNotNull(Map<String, Object> segmentation, String key, Object value) {
+        if (value == null) {
+            L.d("[ModuleFeedback] putIfNotNull, no value for [" + key + "], leaving it out of the segmentation");
+            return;
+        }
+        segmentation.put(key, value);
+    }
+
     private <T> void callCallback(String errorLog, CallbackOnFinish<T> callback) {
         L.e(errorLog);
         if (callback != null) {
@@ -284,7 +301,7 @@ private void getFeedbackWidgetDataInternal(CountlyFeedbackWidget widgetInfo, Cal
             .add("shown", "1")
             .add("sdk_version", internalConfig.getSdkVersion())
             .add("sdk_name", internalConfig.getSdkName())
-            .add("platform", internalConfig.getSdkPlatform())
+            .add("platform", WidgetUrlBuilder.PLATFORM)
             .add("app_version", cachedAppVersion)
             .add("av", internalConfig.getApplicationVersion());
 
@@ -326,6 +343,10 @@ private String validateFields(Object callback, CountlyFeedbackWidget widget) {
     }
 
     private String constructFeedbackWidgetUrlInternal(CountlyFeedbackWidget widgetInfo) {
+        return constructFeedbackWidgetUrlInternal(widgetInfo, 0, 0);
+    }
+
+    private String constructFeedbackWidgetUrlInternal(CountlyFeedbackWidget widgetInfo, int surfaceWidth, int surfaceHeight) {
         L.d("[ModuleFeedback] constructFeedbackWidgetUrlInternal, widgetInfo :[" + widgetInfo + "]");
 
         if (widgetInfo == null) {
@@ -343,23 +364,10 @@ private String constructFeedbackWidgetUrlInternal(CountlyFeedbackWidget widgetIn
             return null;
         }
 
-        StringBuilder widgetListUrl = new StringBuilder();
-        widgetListUrl.append(internalConfig.getServerURL());
-        widgetListUrl.append("/feedback/");
-        widgetListUrl.append(widgetInfo.type.name());
-        widgetListUrl.append('?');
-        Params params = new Params()
-            .add("widget_id", widgetInfo.widgetId)
-            .add("device_id", internalConfig.getDeviceId().id)
-            .add("app_key", internalConfig.getServerAppKey())
-            .add("sdk_version", internalConfig.getSdkVersion())
-            .add("sdk_name", internalConfig.getSdkName())
-            .add("platform", internalConfig.getSdkPlatform());
+        final String preparedWidgetUrl = WidgetUrlBuilder.build(internalConfig, widgetInfo, cachedAppVersion,
+            surfaceWidth, surfaceHeight);
 
-        widgetListUrl.append(params.toString());
-        final String preparedWidgetUrl = widgetListUrl.toString();
-
-        L.d("[ModuleFeedback] constructFeedbackWidgetUrlInternal, Using following url for widget:[" + widgetListUrl + "]");
+        L.d("[ModuleFeedback] constructFeedbackWidgetUrlInternal, Using following url for widget:[" + preparedWidgetUrl + "]");
         return preparedWidgetUrl;
     }
 
@@ -391,6 +399,30 @@ public String constructFeedbackWidgetUrl(@Nullable CountlyFeedbackWidget widgetI
             }
         }
 
+        /**
+         * Construct a URL that can be used to present a feedback widget in a web viewer, telling the
+         * widget how much room it has.
+         * <p>
+         * A widget template lays its card out against these dimensions and reports the rectangle it
+         * wants back through {@code resize_me}. Without them it falls back to its largest breakpoint
+         * with no idea of the real area, which caps its height and anchors it to the top rather than
+         * the edge it belongs on. A display that knows its surface should use this.
+         *
+         * @param widgetInfo widget info
+         * @param surfaceWidth the width the widget may occupy, in the page's own pixels
+         * @param surfaceHeight the height the widget may occupy, in the page's own pixels
+         * @return the URL to load, or {@code null} when one cannot be built
+         * @apiNote This is an EXPERIMENTAL feature, and it can have breaking changes
+         */
+        public String constructFeedbackWidgetUrl(@Nullable CountlyFeedbackWidget widgetInfo, int surfaceWidth, int surfaceHeight) {
+            synchronized (Countly.instance()) {
+                L.i("[Feedback] constructFeedbackWidgetUrl, building a URL for a "
+                    + surfaceWidth + "x" + surfaceHeight + " surface");
+
+                return constructFeedbackWidgetUrlInternal(widgetInfo, surfaceWidth, surfaceHeight);
+            }
+        }
+
         /**
          * Download data for a specific widget so that it can be displayed with a custom UI
          * When requesting this data, it will count as a shown widget (will increment that "shown" count in the dashboard)
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKCore.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKCore.java
index 1a273436d..3c8aa1938 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKCore.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKCore.java
@@ -1,5 +1,6 @@
 package ly.count.sdk.java.internal;
 
+import java.io.File;
 import java.util.ArrayDeque;
 import java.util.ArrayList;
 import java.util.List;
@@ -69,6 +70,7 @@ protected static void registerDefaultModuleMappings() {
         moduleMappings.put(CoreFeature.CrashReporting, ModuleCrashes.class);
         moduleMappings.put(CoreFeature.BackendMode, ModuleBackendMode.class);
         moduleMappings.put(CoreFeature.Feedback, ModuleFeedback.class);
+        moduleMappings.put(CoreFeature.Content, ModuleContent.class);
         moduleMappings.put(CoreFeature.Events, ModuleEvents.class);
         moduleMappings.put(CoreFeature.RemoteConfig, ModuleRemoteConfig.class);
         moduleMappings.put(CoreFeature.UserProfiles, ModuleUserProfile.class);
@@ -577,6 +579,46 @@ public void changeDeviceIdWithMerge(InternalConfig config, String id) {
         deviceId().changeWithMerge(id);
     }
 
+    /**
+     * The logger the SDK was configured with, so code outside of this package (a
+     * {@link ContentDisplay} implementation, for example) can log through the same level and
+     * listener the integrator set up.
+     *
+     * @return the SDK logger, or {@code null} while the SDK is not initialized
+     */
+    public static Log logger() {
+        SDKCore core = instance;
+        return core == null ? null : core.L;
+    }
+
+    /**
+     * The application's link handler, so code outside this package (a display implementation) can
+     * offer it a link before opening it itself.
+     *
+     * @return the handler, or {@code null} when none was configured or the SDK is not initialized
+     */
+    public static ContentUrlHandler contentUrlHandler() {
+        SDKCore core = instance;
+        if (core == null || core.config == null) {
+            return null;
+        }
+        return core.config.content.contentUrlHandler;
+    }
+
+    /**
+     * The directory the SDK keeps its files in, so a display implementation outside this package can
+     * cache what it needs to show a widget without waiting for the network.
+     *
+     * @return the directory, or {@code null} when the SDK is not initialized
+     */
+    public static File sdkStorageDirectory() {
+        SDKCore core = instance;
+        if (core == null || core.config == null) {
+            return null;
+        }
+        return core.config.getSdkStorageRootDirectory();
+    }
+
     public static boolean enabled(int feature) {
         return (feature & instance.consents) == feature &&
             (feature & instance.config().getFeatures1()) == feature;
@@ -728,7 +770,29 @@ public ModuleFeedback.Feedback feedback() {
             return null;
         }
 
-        return module(ModuleFeedback.class).feedbackInterface;
+        ModuleFeedback module = module(ModuleFeedback.class);
+        if (module == null) {
+            // Consent is not the only gate: the feature may simply never have been enabled,
+            // in which case the module was never built and there is nothing to hand back.
+            L.v("[SDKCore] feedback, feedback feature was not enabled, returning null");
+            return null;
+        }
+
+        return module.feedbackInterface;
+    }
+
+    public ModuleContent.Content content() {
+        if (!hasConsentForFeature(CoreFeature.Content)) {
+            L.v("[SDKCore] content, Content feature has no consent, returning null");
+            return null;
+        }
+
+        ModuleContent module = module(ModuleContent.class);
+        if (module == null) {
+            return null;
+        }
+
+        return module.contentInterface;
     }
 
     public ModuleCrashes.Crashes crashes() {
@@ -737,7 +801,15 @@ public ModuleCrashes.Crashes crashes() {
             return null;
         }
 
-        return module(ModuleCrashes.class).crashInterface;
+        ModuleCrashes module = module(ModuleCrashes.class);
+        if (module == null) {
+            // Consent is not the only gate: the feature may simply never have been enabled,
+            // in which case the module was never built and there is nothing to hand back.
+            L.v("[SDKCore] crashes, crashes feature was not enabled, returning null");
+            return null;
+        }
+
+        return module.crashInterface;
     }
 
     public ModuleViews.Views views() {
@@ -760,7 +832,15 @@ public ModuleRemoteConfig.RemoteConfig remoteConfig() {
             return null;
         }
 
-        return module(ModuleRemoteConfig.class).remoteConfigInterface;
+        ModuleRemoteConfig module = module(ModuleRemoteConfig.class);
+        if (module == null) {
+            // Consent is not the only gate: the feature may simply never have been enabled,
+            // in which case the module was never built and there is nothing to hand back.
+            L.v("[SDKCore] remoteConfig, remoteConfig feature was not enabled, returning null");
+            return null;
+        }
+
+        return module.remoteConfigInterface;
     }
 
     public ModuleUserProfile.UserProfile userProfile() {
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKStorage.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKStorage.java
index 37e8bda1a..4575608ed 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKStorage.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/SDKStorage.java
@@ -140,7 +140,14 @@ public Boolean storableWrite(ly.count.sdk.java.internal.InternalConfig config, S
     }
 
     public <T extends Storable> Boolean storableWrite(ly.count.sdk.java.internal.InternalConfig config, T storable) {
-        return storableWrite(config, storable.storagePrefix(), storable.storageId(), storable.store(L));
+        byte[] data = storable.store(L);
+        if (data == null) {
+            // Writing nothing still created the file, which then read back as a corrupt storable.
+            L.w("[SDKStorage] storableWrite, " + storable.storagePrefix() + " " + storable.storageId()
+                + " could not be serialised, nothing written");
+            return false;
+        }
+        return storableWrite(config, storable.storagePrefix(), storable.storageId(), data);
     }
 
     private String createFileFullPath(ly.count.sdk.java.internal.InternalConfig config, String filename) {
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/Transport.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/Transport.java
index 0b7957f7d..e745e30bf 100644
--- a/sdk-java/src/main/java/ly/count/sdk/java/internal/Transport.java
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/Transport.java
@@ -393,8 +393,9 @@ private static String trimPem(String pem) {
         if (pem.contains("-----END ")) {
             pem = pem.substring(0, pem.indexOf("-----END"));
         }
-        String res = pem.replaceAll("\n", "");
-        return res;
+        // All whitespace, not only "\n": keytool and Windows tools write the base64 body with
+        // "\r\n" line ends, and a stray "\r" makes the decoder reject the whole pin.
+        return pem.replaceAll("\\s", "");
     }
 
     private void setPins(Set<String> keys, Set<String> certs) throws CertificateException {
@@ -414,6 +415,13 @@ private void setPins(Set<String> keys, Set<String> certs) throws CertificateExce
                         data = Utils.Base64.decode(trimPem(key), L);
                     }
 
+                    if (data == null) {
+                        // Base64.decode returns null for a malformed pin; passing that on made
+                        // Countly.init() throw instead of reporting a bad pin.
+                        L.e("[network] Public key pin is not valid base64, ignoring it: " + key);
+                        continue;
+                    }
+
                     try {
                         X509EncodedKeySpec spec = new X509EncodedKeySpec(data);
                         KeyFactory kf = KeyFactory.getInstance("RSA");
@@ -444,6 +452,11 @@ private void setPins(Set<String> keys, Set<String> certs) throws CertificateExce
                     data = Utils.Base64.decode(trimPem(cert), L);
                 }
 
+                if (data == null) {
+                    L.e("[network] Certificate pin is not valid base64, ignoring it: " + cert);
+                    continue;
+                }
+
                 CertificateFactory cf = CertificateFactory.getInstance("X.509");
                 Certificate certificate = cf.generateCertificate(new ByteArrayInputStream(data));
                 certPins.add(certificate.getEncoded());
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetAction.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetAction.java
new file mode 100644
index 000000000..1fbf8f590
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetAction.java
@@ -0,0 +1,50 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Collections;
+import java.util.Map;
+
+/**
+ * A signal a feedback widget or a content block sent to the SDK by navigating to a
+ * {@code https://countly_action_event} URL, already parsed. See {@link WidgetActionParser}.
+ */
+public class WidgetAction {
+
+    /** {@code true} when the URL is one of the SDK's own signalling URLs and not a real navigation. */
+    public boolean isSdkSignal;
+    /** {@code true} for a feedback widget command ({@code cly_widget_command=1}). */
+    public boolean isWidgetCommand;
+    /** {@code true} for a content action event ({@code cly_x_action_event=1}). */
+    public boolean isActionEvent;
+    /** {@code true} when the whole URL should be opened in an external browser ({@code cly_x_int=1}). */
+    public boolean isExternalLink;
+    /** {@code true} when whatever is on screen should be dismissed after the action was processed. */
+    public boolean close;
+    /** {@code true} when {@link #portrait} or {@link #landscape} carries a new rectangle. */
+    public boolean hasResize;
+    public ContentPlacement portrait;
+    public ContentPlacement landscape;
+    /** {@code action=link}: the destination to open in an external browser. */
+    public String link;
+    /** {@code action=event}: the raw JSON array of {@code {key, sg|segmentation}} objects. */
+    public String eventPayload;
+    /** Every query parameter of the URL, as sent. */
+    public Map<String, Object> queryParams = Collections.emptyMap();
+
+    /**
+     * The rectangle to apply on a surface of the given shape, or {@code null} when the action
+     * carries none.
+     *
+     * @param landscapeSurface {@code true} when the surface is wider than it is tall
+     * @return the requested rectangle
+     */
+    public ContentPlacement resizeFor(boolean landscapeSurface) {
+        if (!hasResize) {
+            return null;
+        }
+        ContentPlacement preferred = landscapeSurface ? landscape : portrait;
+        if (preferred != null) {
+            return preferred;
+        }
+        return landscapeSurface ? portrait : landscape;
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetActionParser.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetActionParser.java
new file mode 100644
index 000000000..46906d1d5
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetActionParser.java
@@ -0,0 +1,180 @@
+package ly.count.sdk.java.internal;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import org.json.JSONObject;
+
+/**
+ * Parses the URLs a feedback widget or a content block navigates to in order to talk back to the
+ * SDK. Both use the {@code https://countly_action_event} host, plus an {@code cly_x_int=1} flag on
+ * any URL that should be handed to an external browser instead.
+ * <p>
+ * Kept free of any UI toolkit so it can be unit tested and reused by every display implementation.
+ */
+public class WidgetActionParser {
+
+    /**
+     * The host a widget or content block navigates to in order to talk to the SDK. Public because a
+     * display implementation outside this package has to recognise it, and because JavaFX's network
+     * stack reports it as an error that has to be filtered by name.
+     */
+    public static final String ACTION_HOST = "countly_action_event";
+    public static final String ACTION_URL_START = "https://" + ACTION_HOST;
+
+    private WidgetActionParser() {
+    }
+
+    /**
+     * @param url the URL the web view is about to navigate to
+     * @param L logger
+     * @return the parsed signal, never {@code null}; check {@link WidgetAction#isSdkSignal} to see
+     *     whether the URL was one of the SDK's own
+     */
+    public static WidgetAction parse(String url, Log L) {
+        WidgetAction action = new WidgetAction();
+
+        if (Utils.isEmptyOrNull(url)) {
+            return action;
+        }
+
+        Map<String, Object> query = parseQuery(url);
+        action.queryParams = query;
+        action.isExternalLink = "1".equals(query.get("cly_x_int"));
+        action.isWidgetCommand = "1".equals(query.get("cly_widget_command"));
+        action.isActionEvent = "1".equals(query.get("cly_x_action_event"));
+        action.isSdkSignal = url.contains(ACTION_HOST) || action.isExternalLink || action.isWidgetCommand || action.isActionEvent;
+
+        if (!action.isSdkSignal) {
+            return action;
+        }
+
+        // Read before the external link returns: a "cly_x_int=1" link may also carry "close=1",
+        // asking to be opened AND to dismiss the block, and reading it afterwards made every
+        // open-and-close branch downstream unreachable.
+        action.close = isTruthy(query.get("close"));
+
+        if (action.isExternalLink) {
+            // The whole URL is the destination; there is nothing else to process.
+            action.link = url;
+            return action;
+        }
+
+        Object resize = query.get("resize_me");
+        if (resize != null) {
+            readResize(action, resize.toString(), L);
+        }
+
+        Object link = query.get("link");
+        if (link != null && !Utils.isEmptyOrNull(link.toString())) {
+            // A close carried inside the destination's own query ("link=https://x?close=1") is a
+            // signal to us, not part of the destination, so it is honoured and then stripped.
+            Map<String, Object> linkQuery = parseQuery(link.toString());
+            if (!action.close && isTruthy(linkQuery.get("close"))) {
+                action.close = true;
+            }
+            action.link = stripParam(link.toString(), "close");
+        }
+
+        Object event = query.get("event");
+        if (event != null && !Utils.isEmptyOrNull(event.toString())) {
+            action.eventPayload = event.toString();
+        }
+
+        return action;
+    }
+
+    private static void readResize(WidgetAction action, String resize, Log L) {
+        try {
+            JSONObject rects = new JSONObject(resize);
+            action.portrait = toPlacement(rects.optJSONObject("p"));
+            action.landscape = toPlacement(rects.optJSONObject("l"));
+            action.hasResize = action.portrait != null || action.landscape != null;
+        } catch (Throwable t) {
+            if (L != null) {
+                L.w("[WidgetActionParser] readResize, malformed 'resize_me' payload, ignoring it, [" + t + "]");
+            }
+        }
+    }
+
+    private static ContentPlacement toPlacement(JSONObject rect) {
+        if (rect == null) {
+            return null;
+        }
+        int width = rect.optInt("w", 0);
+        int height = rect.optInt("h", 0);
+        if (width <= 0 || height <= 0) {
+            return null;
+        }
+        return new ContentPlacement(rect.optInt("x", 0), rect.optInt("y", 0), width, height);
+    }
+
+    private static boolean isTruthy(Object value) {
+        if (value == null) {
+            return false;
+        }
+        String asString = value.toString();
+        return "1".equals(asString) || "true".equalsIgnoreCase(asString);
+    }
+
+    /**
+     * @param url the URL to clean up
+     * @param name the query parameter to drop
+     * @return the URL without that parameter, and without the '?' if nothing else is left
+     */
+    static String stripParam(String url, String name) {
+        int question = url.indexOf('?');
+        if (question < 0) {
+            return url;
+        }
+
+        StringBuilder kept = new StringBuilder();
+        for (String pair : url.substring(question + 1).split("&")) {
+            int equals = pair.indexOf('=');
+            String key = equals > 0 ? pair.substring(0, equals) : pair;
+            if (name.equals(key)) {
+                continue;
+            }
+            if (kept.length() > 0) {
+                kept.append('&');
+            }
+            kept.append(pair);
+        }
+
+        String base = url.substring(0, question);
+        if (kept.length() == 0) {
+            return base;
+        }
+        return base + "?" + kept;
+    }
+
+    /**
+     * @param url URL to read the query of
+     * @return the URL decoded query parameters, in the order they appeared
+     */
+    static Map<String, Object> parseQuery(String url) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        int question = url.indexOf('?');
+        if (question < 0 || question == url.length() - 1) {
+            return result;
+        }
+
+        for (String pair : url.substring(question + 1).split("&")) {
+            int equals = pair.indexOf('=');
+            if (equals <= 0) {
+                continue;
+            }
+            result.put(decode(pair.substring(0, equals)), decode(pair.substring(equals + 1)));
+        }
+        return result;
+    }
+
+    private static String decode(String value) {
+        try {
+            return URLDecoder.decode(value, Utils.UTF8);
+        } catch (UnsupportedEncodingException | IllegalArgumentException e) {
+            return value;
+        }
+    }
+}
diff --git a/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetUrlBuilder.java b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetUrlBuilder.java
new file mode 100644
index 000000000..45cba38f1
--- /dev/null
+++ b/sdk-java/src/main/java/ly/count/sdk/java/internal/WidgetUrlBuilder.java
@@ -0,0 +1,115 @@
+package ly.count.sdk.java.internal;
+
+import java.net.URL;
+
+/**
+ * Builds the URL that renders a feedback widget in a web view. Kept free of any UI toolkit so it
+ * can be unit tested and reused by every display implementation.
+ */
+class WidgetUrlBuilder {
+
+    /**
+     * Desktop follows the web SDK model: the widget draws itself as a positioned card with its own
+     * close button, rather than filling the whole viewport. {@code tc} lets it close itself,
+     * {@code xb} makes it draw the close button.
+     */
+    static final String CUSTOM_PARAMS = "{\"tc\":1,\"xb\":1}";
+
+    /**
+     * What a feedback widget is told this platform is, and what its answers are segmented by.
+     * <p>
+     * One value for every desktop, the way the Android SDK sends {@code android} and the web SDK
+     * sends {@code web}. The SDK's configurable platform defaults to the operating system's name,
+     * which would split one integration's widget answers across "Mac OS X", "Windows 11" and
+     * "Linux" in the dashboard while adding nothing: the operating system is already reported, as
+     * {@code _os} and {@code _os_version} in the session metrics. It also has to agree with what the
+     * widget page itself reports, since the page sends this value back with the answer.
+     * <p>
+     * The templates read it for one decision only - whether to draw their own close button, which
+     * they do when it is {@code Web} - so any other value behaves identically. This is also the
+     * value {@code ContentRequestBuilder} declares as {@code dt} for content.
+     */
+    static final String PLATFORM = ContentRequestBuilder.DEVICE_TYPE;
+
+    /**
+     * The area the widget has, in the {@code custom} parameter, which is where every template reads
+     * it from: {@code custom.width} and {@code custom.height} seed the parent dimensions each one
+     * computes its card against. Without them an NPS page falls through to its largest breakpoint
+     * with undefined dimensions, so it caps its own height and anchors to zero instead of the bottom
+     * edge. The web SDK sends the same two values.
+     *
+     * @param width the surface width in logical pixels, ignored when not positive
+     * @param height the surface height in logical pixels, ignored when not positive
+     * @return the custom parameter to send
+     */
+    static String customParams(int width, int height) {
+        if (width <= 0 || height <= 0) {
+            return CUSTOM_PARAMS;
+        }
+        return "{\"tc\":1,\"xb\":1,\"width\":" + width + ",\"height\":" + height + "}";
+    }
+
+    private WidgetUrlBuilder() {
+    }
+
+    /**
+     * @param config to read the server URL, app key, device ID and SDK identity from
+     * @param widget the widget to display
+     * @param appVersion the application version to report
+     * @return the URL to load in a web view
+     */
+    static String build(InternalConfig config, CountlyFeedbackWidget widget, String appVersion) {
+        return build(config, widget, appVersion, 0, 0);
+    }
+
+    /**
+     * @param config to read the server URL, app key, device ID and SDK identity from
+     * @param widget the widget to display
+     * @param appVersion the application version to report
+     * @param surfaceWidth the width the widget has to lay itself out in
+     * @param surfaceHeight the height the widget has to lay itself out in
+     * @return the URL to load in a web view
+     */
+    static String build(InternalConfig config, CountlyFeedbackWidget widget, String appVersion,
+        int surfaceWidth, int surfaceHeight) {
+        Params params = new Params()
+            .add("widget_id", widget.widgetId)
+            .add("device_id", config.getDeviceId().id)
+            .add("app_key", config.getServerAppKey())
+            .add("sdk_version", config.getSdkVersion())
+            .add("sdk_name", config.getSdkName())
+            .add("platform", PLATFORM);
+
+        if (!Utils.isEmptyOrNull(appVersion)) {
+            params.add("app_version", appVersion);
+        }
+
+        params.add("custom", customParams(surfaceWidth, surfaceHeight));
+
+        // The widget page only accepts the SDK's post-load {type:'resize'} message when 'origin'
+        // matches the page's own origin. Without it the message is dropped and the widget has no
+        // viewport to size itself against. Sent unencoded, the same way the web SDK sends it.
+        String origin = originOf(config.getServerURL());
+        if (origin != null) {
+            params.add("&origin=" + origin);
+        }
+
+        return config.getServerURL() + "/feedback/" + widget.type.name() + "?" + params;
+    }
+
+    /**
+     * @param serverUrl the configured server URL
+     * @return scheme and authority of the server URL, or {@code null} when there is none
+     */
+    static String originOf(URL serverUrl) {
+        if (serverUrl == null || serverUrl.getProtocol() == null || Utils.isEmptyOrNull(serverUrl.getHost())) {
+            return null;
+        }
+
+        String origin = serverUrl.getProtocol() + "://" + serverUrl.getHost();
+        if (serverUrl.getPort() > 0) {
+            origin += ":" + serverUrl.getPort();
+        }
+        return origin;
+    }
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ConfigSurfaceTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ConfigSurfaceTests.java
new file mode 100644
index 000000000..25086e94c
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ConfigSurfaceTests.java
@@ -0,0 +1,366 @@
+package ly.count.sdk.java.internal;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The {@link Config} builder: its fluent chain, its validation, and the enums a customer's
+ * configuration is expressed in.
+ * <p>
+ * {@code ConfigTests} covers the defaults and the storage plumbing. This covers the rest of the
+ * surface, and where a setting is observable from outside the SDK it is asserted on the wire rather
+ * than on the field it was written to.
+ */
+@RunWith(JUnit4.class)
+public class ConfigSurfaceTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * The whole fluent chain in one pass, with values that must all be accepted, and then the
+     * getters confirming each one landed. Proves the builder really is chainable and that nothing
+     * silently overwrites a neighbouring setting.
+     */
+    @Test
+    public void fluentChain_acceptsEverySaneValueAndReadsItBack() {
+        Map<String, String> headers = new HashMap<>();
+        headers.put("X-Chain", "yes");
+
+        Config config = TestUtils.getBaseConfig()
+            .setApplicationName("ChainedApp")
+            .setUpdateSessionTimerDelay(20)
+            .setEventQueueSizeToSend(9)
+            .setRequestQueueMaxSize(321)
+            .setMaxBreadcrumbCount(12)
+            .setNetworkConnectTimeout(11)
+            .setNetworkReadTimeout(12)
+            .setNetworkRequestCooldown(1300)
+            .setNetworkImportantRequestCooldown(7)
+            .setLoggingLevel(Config.LoggingLevel.WARN)
+            .setSdkPlatform("test-platform")
+            .addCustomNetworkRequestHeaders(headers)
+            .enableParameterTamperingProtection("chain-salt")
+            .disableUnhandledCrashReporting()
+            .enableFeatures(Config.Feature.Events, Config.Feature.Views);
+
+        // setApplicationName / getApplicationName are documented deprecated no-ops.
+        Assert.assertEquals("", config.getApplicationName());
+        Assert.assertEquals(20, config.getSendUpdateEachSeconds());
+        Assert.assertEquals(9, config.getEventsBufferSize());
+        Assert.assertEquals(321, config.getRequestQueueMaxSize());
+        Assert.assertEquals(11, config.getNetworkConnectionTimeout());
+        Assert.assertEquals(12, config.getNetworkReadTimeout());
+        Assert.assertEquals(1300, config.getNetworkRequestCooldown());
+        Assert.assertEquals(7, config.getNetworkImportantRequestCooldown());
+        Assert.assertEquals(Config.LoggingLevel.WARN, config.getLoggingLevel());
+        Assert.assertEquals("chain-salt", config.getParameterTamperingProtectionSalt());
+        Assert.assertEquals("yes", config.getCustomNetworkRequestHeaders().get("X-Chain"));
+
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Events));
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Views));
+        Assert.assertFalse(config.isFeatureEnabled(Config.Feature.Location));
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Events.getIndex()));
+
+        Set<Config.Feature> enabled = config.getFeatures();
+        Assert.assertEquals(2, enabled.size());
+        Assert.assertTrue(enabled.contains(Config.Feature.Events));
+        Assert.assertTrue(enabled.contains(Config.Feature.Views));
+        Assert.assertEquals(Config.Feature.Events.getIndex() | Config.Feature.Views.getIndex(), config.getFeaturesMap());
+
+        // The platform really reaches the server, which is the only reason it is configurable.
+        Countly.instance().init(config);
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals("test-platform", SDKCore.instance.config.getSdkPlatform());
+        // These two are only readable off the internal config, which is what the modules see.
+        Assert.assertEquals(12, SDKCore.instance.config.getMaxBreadcrumbCount());
+        Assert.assertFalse(SDKCore.instance.config.isUnhandledCrashReportingEnabled());
+    }
+
+    /**
+     * Every out of range value the network and session setters must refuse, walked in one loop. Each
+     * rejection has to leave the previous good value in place, because silently accepting a nonsense
+     * timeout would strand a customer's requests.
+     */
+    @Test
+    public void outOfRangeValues_areRefusedAndLeaveTheGoodValueInPlace() {
+        Config config = TestUtils.getBaseConfig()
+            .setNetworkConnectTimeout(10)
+            .setNetworkReadTimeout(10)
+            .setNetworkRequestCooldown(100)
+            .setNetworkImportantRequestCooldown(5);
+
+        // connect timeout and read timeout accept 1..300 only
+        for (int bad : new int[] { 0, -1, 301, Integer.MAX_VALUE }) {
+            config.setNetworkConnectTimeout(bad);
+            Assert.assertEquals("connect timeout must reject " + bad, 10, config.getNetworkConnectionTimeout());
+            config.setNetworkReadTimeout(bad);
+            Assert.assertEquals("read timeout must reject " + bad, 10, config.getNetworkReadTimeout());
+        }
+
+        // request cooldown accepts 0..30000
+        for (int bad : new int[] { -1, 30001 }) {
+            config.setNetworkRequestCooldown(bad);
+            Assert.assertEquals("request cooldown must reject " + bad, 100, config.getNetworkRequestCooldown());
+        }
+
+        // important request cooldown accepts 0..30
+        for (int bad : new int[] { -1, 31 }) {
+            config.setNetworkImportantRequestCooldown(bad);
+            Assert.assertEquals("important cooldown must reject " + bad, 5, config.getNetworkImportantRequestCooldown());
+        }
+
+        // The deprecated setters are aliases of the current ones, so each pair must move together
+        // rather than quietly maintaining two different values.
+        config.setSendUpdateEachSeconds(45);
+        Assert.assertEquals(45, config.getSendUpdateEachSeconds());
+        config.setUpdateSessionTimerDelay(60);
+        Assert.assertEquals(60, config.getSendUpdateEachSeconds());
+        config.setUpdateSessionTimerDelay(-1);
+        Assert.assertEquals("a negative session timer delay must be refused", 60, config.getSendUpdateEachSeconds());
+
+        config.setEventsBufferSize(17);
+        Assert.assertEquals(17, config.getEventsBufferSize());
+        config.setEventQueueSizeToSend(23);
+        Assert.assertEquals(23, config.getEventsBufferSize());
+        config.setEventQueueSizeToSend(-5);
+        Assert.assertEquals("a negative event queue size must be refused", 23, config.getEventsBufferSize());
+
+        // The boundary values themselves are valid.
+        Assert.assertEquals(300, config.setNetworkConnectTimeout(300).getNetworkConnectionTimeout());
+        Assert.assertEquals(1, config.setNetworkReadTimeout(1).getNetworkReadTimeout());
+        Assert.assertEquals(0, config.setNetworkRequestCooldown(0).getNetworkRequestCooldown());
+        Assert.assertEquals(30000, config.setNetworkRequestCooldown(30000).getNetworkRequestCooldown());
+        Assert.assertEquals(30, config.setNetworkImportantRequestCooldown(30).getNetworkImportantRequestCooldown());
+    }
+
+    /**
+     * Enabling, disabling and replacing the feature set, including the null inputs a caller can
+     * stumble into. The feature bitmask must never be corrupted by a bad argument.
+     */
+    @Test
+    public void featureSet_isBuiltAndUnbuiltWithoutBeingCorrupted() {
+        Config config = TestUtils.getBaseConfig();
+
+        config.enableFeatures(Config.Feature.Events, Config.Feature.Views, Config.Feature.Location);
+        Assert.assertEquals(3, config.getFeatures().size());
+
+        config.disableFeatures(Config.Feature.Views);
+        Assert.assertFalse(config.isFeatureEnabled(Config.Feature.Views));
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Events));
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Location));
+
+        // setFeatures replaces rather than adds.
+        config.setFeatures(Config.Feature.Feedback);
+        Assert.assertEquals(1, config.getFeatures().size());
+        Assert.assertTrue(config.isFeatureEnabled(Config.Feature.Feedback));
+        Assert.assertFalse(config.isFeatureEnabled(Config.Feature.Events));
+
+        // Null arrays and null elements are ignored, not fatal, and leave the mask untouched.
+        int before = config.getFeaturesMap();
+        config.enableFeatures((Config.Feature[]) null);
+        config.disableFeatures((Config.Feature[]) null);
+        config.enableFeatures(Config.Feature.Events, null);
+        config.disableFeatures(Config.Feature.Events, null);
+        Assert.assertEquals(before, config.getFeaturesMap());
+
+        // setFeatures with nothing at all clears the mask.
+        config.setFeatures();
+        Assert.assertEquals(0, config.getFeaturesMap());
+        config.setFeatures((Config.Feature[]) null);
+        Assert.assertEquals(0, config.getFeaturesMap());
+        config.setFeatures(Config.Feature.Events, null);
+        Assert.assertEquals(Config.Feature.Events.getIndex(), config.getFeaturesMap());
+    }
+
+    /**
+     * The device id strategy, which decides whether the SDK invents an id or uses the customer's.
+     * A custom strategy without an id must fall back rather than leave the SDK with no id at all.
+     */
+    @Test
+    public void deviceIdStrategy_switchesAndFallsBackWhenNoIdIsGiven() {
+        Config config = TestUtils.getBaseConfig();
+
+        Assert.assertEquals(Config.DeviceIdStrategy.CUSTOM_ID, config.getDeviceIdStrategyEnum());
+
+        config.setDeviceIdStrategy(Config.DeviceIdStrategy.UUID);
+        Assert.assertEquals(Config.DeviceIdStrategy.UUID, config.getDeviceIdStrategyEnum());
+
+        config.setDeviceIdStrategy(Config.DeviceIdStrategy.CUSTOM_ID, "chosen_id");
+        Assert.assertEquals(Config.DeviceIdStrategy.CUSTOM_ID, config.getDeviceIdStrategyEnum());
+        Assert.assertEquals("chosen_id", config.getCustomDeviceId());
+
+        // Custom strategy with no usable id drops back to the generated strategy.
+        for (String bad : new String[] { null, "" }) {
+            config.setDeviceIdStrategy(Config.DeviceIdStrategy.CUSTOM_ID, bad);
+            Assert.assertEquals(Config.DeviceIdStrategy.UUID, config.getDeviceIdStrategyEnum());
+            Assert.assertNull(config.getCustomDeviceId());
+        }
+
+        // A null strategy is ignored rather than clearing the current one.
+        config.setDeviceIdStrategy(Config.DeviceIdStrategy.CUSTOM_ID, "kept_id");
+        config.setDeviceIdStrategy(null);
+        Assert.assertEquals(Config.DeviceIdStrategy.CUSTOM_ID, config.getDeviceIdStrategyEnum());
+        Assert.assertEquals("kept_id", config.getCustomDeviceId());
+    }
+
+    /**
+     * The enums a configuration is expressed in. Index round trips must be exact, because they are
+     * what the consent bitmask and the persisted device id strategy are stored as.
+     */
+    @Test
+    public void configEnums_roundTripThroughTheirIndexes() {
+        for (Config.Feature feature : Config.Feature.values()) {
+            Assert.assertSame("Feature." + feature + " must round trip", feature, Config.Feature.byIndex(feature.getIndex()));
+        }
+        Assert.assertNull("an unknown feature index has no feature", Config.Feature.byIndex(0));
+        Assert.assertNull(Config.Feature.byIndex(1 << 30));
+
+        for (Config.DeviceIdStrategy strategy : Config.DeviceIdStrategy.values()) {
+            Assert.assertSame(strategy, Config.DeviceIdStrategy.fromIndex(strategy.getIndex()));
+        }
+        Assert.assertNull(Config.DeviceIdStrategy.fromIndex(7));
+
+        // Logging levels are ordered, and "prints" is what the logger gates on.
+        Assert.assertEquals(0, Config.LoggingLevel.VERBOSE.getLevel());
+        Assert.assertEquals(5, Config.LoggingLevel.OFF.getLevel());
+        Assert.assertTrue(Config.LoggingLevel.VERBOSE.prints(Config.LoggingLevel.ERROR));
+        Assert.assertFalse(Config.LoggingLevel.ERROR.prints(Config.LoggingLevel.VERBOSE));
+    }
+
+    /**
+     * The device id holder, which storage and the request queue compare instances of. Equality must
+     * take both the id and the strategy into account, or a strategy change would go unnoticed.
+     */
+    @Test
+    public void deviceIdHolder_comparesIdAndStrategy() {
+        Config.DID custom = new Config.DID(Config.DID.STRATEGY_CUSTOM, "same_id");
+        Config.DID sameAgain = new Config.DID(Config.DID.STRATEGY_CUSTOM, "same_id");
+        Config.DID differentStrategy = new Config.DID(Config.DID.STRATEGY_UUID, "same_id");
+        Config.DID differentId = new Config.DID(Config.DID.STRATEGY_CUSTOM, "other_id");
+
+        Assert.assertEquals(custom, sameAgain);
+        Assert.assertEquals(custom.hashCode(), sameAgain.hashCode());
+        Assert.assertNotEquals(custom, differentStrategy);
+        Assert.assertNotEquals(custom, differentId);
+        Assert.assertNotEquals(custom, "not a did");
+        Assert.assertTrue(custom.toString().contains("same_id"));
+    }
+
+    /**
+     * A log listener installed through the config really receives what the SDK logs, which is the
+     * only way an integrator can pipe SDK output into their own logging.
+     */
+    @Test
+    public void logListener_receivesWhatTheSdkLogs() {
+        StringBuilder captured = new StringBuilder();
+
+        Config config = TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.Events)
+            .setLoggingLevel(Config.LoggingLevel.VERBOSE)
+            .setLogListener((message, level) -> captured.append('[').append(level).append(']').append(message).append('\n'));
+
+        Assert.assertNotNull(config.getLogListener());
+
+        Countly.instance().init(config);
+        Countly.instance().events().recordEvent("loggedEvent");
+
+        Assert.assertTrue("the listener must have received SDK output", captured.length() > 0);
+        Assert.assertTrue(captured.toString().contains("loggedEvent"));
+    }
+
+    /**
+     * The setters that are kept only for source compatibility. Each is documented as doing nothing,
+     * and each must be verified to actually do nothing: a half removed setting that silently ignores
+     * its argument while a getter still reports something plausible is worse than a compile error.
+     */
+    @Test
+    public void deprecatedSetters_areRealNoOpsWithConstantGetters() {
+        Config config = TestUtils.getBaseConfig();
+
+        Assert.assertSame(config, config.setDeviceIdFallbackAllowed(false));
+        Assert.assertTrue("the fallback flag is a constant now", config.isDeviceIdFallbackAllowed());
+
+        Assert.assertSame(config, config.setLoggingTag("MyTag"));
+        Assert.assertEquals("Countly", config.getLoggingTag());
+
+        Assert.assertSame(config, config.enableTestMode());
+        Assert.assertFalse("test mode cannot be turned on any more", config.isTestModeEnabled());
+        Assert.assertSame(config, config.disableTestMode());
+        Assert.assertFalse(config.isTestModeEnabled());
+
+        Assert.assertSame(config, config.setApplicationName("Ignored"));
+        Assert.assertEquals("", config.getApplicationName());
+
+        Assert.assertSame(config, config.setCrashReportingANRCheckingPeriod(99));
+        Assert.assertEquals("the ANR period is a constant now", 5, config.getCrashReportingANRCheckingPeriod());
+        Assert.assertSame(config, config.disableANRCrashReporting());
+        Assert.assertEquals(5, config.getCrashReportingANRCheckingPeriod());
+
+        // The SDK identity is fixed, and it is what goes on the wire, so these must not move it.
+        Assert.assertSame(config, config.setSdkName("not-my-sdk"));
+        Assert.assertSame(config, config.setSdkVersion("0.0.0"));
+        Assert.assertEquals(TestUtils.SDK_NAME, config.getSdkName());
+        Assert.assertEquals(TestUtils.SDK_VERSION, config.getSdkVersion());
+
+        // Module overrides are never recorded, so nothing can be looked back up. The setter itself
+        // is protected and unreachable from here, which is part of why the map stays empty.
+        Assert.assertNull(config.getModuleOverride(Config.Feature.Events));
+        Assert.assertNull(config.getModuleOverride(7));
+
+        // And the identity really does reach the server unchanged.
+        Countly.instance().init(config.enableFeatures(Config.Feature.Events).setEventQueueSizeToSend(1));
+        Countly.instance().events().recordEvent("identityEvent");
+        Storage.await(SDKCore.instance.config.getLogger());
+        Map<String, String>[] queue = TestUtils.getCurrentRQ();
+        Assert.assertTrue(queue.length > 0);
+        TestUtils.validateSdkIdentityParams(queue[0]);
+        Assert.assertEquals(TestUtils.SDK_NAME, queue[0].get("sdk_name"));
+    }
+
+    /**
+     * The pin accumulators. Both kinds start empty, accumulate, deduplicate, and refuse an empty pin
+     * so a typo cannot silently disable pinning.
+     */
+    @Test
+    public void pinAccumulators_collectDeduplicateAndRefuseEmptyPins() {
+        Config config = TestUtils.getBaseConfig();
+
+        Assert.assertNull(config.getPublicKeyPins());
+        Assert.assertNull(config.getCertificatePins());
+
+        config.addPublicKeyPin("key-one").addPublicKeyPin("key-two").addPublicKeyPin("key-one");
+        config.addCertificatePin("cert-one").addCertificatePin("cert-two");
+
+        Assert.assertEquals(2, config.getPublicKeyPins().size());
+        Assert.assertTrue(config.getPublicKeyPins().contains("key-one"));
+        Assert.assertEquals(2, config.getCertificatePins().size());
+
+        for (String bad : new String[] { null, "" }) {
+            config.addPublicKeyPin(bad);
+            config.addCertificatePin(bad);
+        }
+        Assert.assertEquals("an empty pin must not be stored", 2, config.getPublicKeyPins().size());
+        Assert.assertEquals(2, config.getCertificatePins().size());
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ContentParsingTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ContentParsingTests.java
new file mode 100644
index 000000000..d1a8af7cb
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ContentParsingTests.java
@@ -0,0 +1,280 @@
+package ly.count.sdk.java.internal;
+
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * The pure parsing and URL building around the content and feedback widget web views.
+ */
+@RunWith(JUnit4.class)
+public class ContentParsingTests {
+
+    private final Log L = mock(Log.class);
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    /**
+     * Every shape of a {@code /o/sdk/content} response: a usable block, a block with only one
+     * orientation, and the several ways a response can carry nothing to show.
+     */
+    @Test
+    public void contentParser_acceptsUsableBlocksAndRejectsTheRest() throws JSONException {
+        ContentData both = ContentParser.parse(new JSONObject(
+            "{\"html\":\"https://a.b/c\",\"geo\":{\"p\":{\"x\":1,\"y\":2,\"w\":3,\"h\":4},\"l\":{\"x\":5,\"y\":6,\"w\":7,\"h\":8}}}"), L);
+        Assert.assertNotNull(both);
+        Assert.assertEquals("https://a.b/c", both.url);
+        Assert.assertEquals(1, both.portrait.x);
+        Assert.assertEquals(8, both.landscape.height);
+        Assert.assertEquals(both.landscape, both.placementFor(true));
+        Assert.assertEquals(both.portrait, both.placementFor(false));
+
+        // Only one orientation: both shapes have to fall back to it.
+        ContentData portraitOnly = ContentParser.parse(new JSONObject(
+            "{\"html\":\"https://a.b/c\",\"geo\":{\"p\":{\"x\":1,\"y\":2,\"w\":3,\"h\":4}}}"), L);
+        Assert.assertNotNull(portraitOnly);
+        Assert.assertEquals(portraitOnly.portrait, portraitOnly.placementFor(true));
+
+        // Missing coordinates default to zero rather than failing the whole block.
+        // A rectangle missing its height is no rectangle: it is dropped rather than becoming a 3x0
+        // window nobody can see or close, which is what the widget parsers do with it too.
+        ContentData partial = ContentParser.parse(new JSONObject("{\"html\":\"https://a.b/c\",\"geo\":{\"p\":{\"w\":3}}}"), L);
+        Assert.assertTrue(partial == null || partial.portrait == null);
+        Assert.assertTrue(partial == null || partial.placementFor(false) == null);
+
+        Assert.assertNull(ContentParser.parse(null, L));
+        Assert.assertNull(ContentParser.parse(new JSONObject("{\"jsonArray\":[{\"result\":\"No content block found!\"}]}"), L));
+        Assert.assertNull(ContentParser.parse(new JSONObject("{\"html\":\"https://a.b/c\"}"), L));
+        Assert.assertNull(ContentParser.parse(new JSONObject("{\"geo\":{\"p\":{\"x\":1,\"y\":2,\"w\":3,\"h\":4}}}"), L));
+        Assert.assertNull(ContentParser.parse(new JSONObject("{\"html\":\"\",\"geo\":{\"p\":{\"x\":1,\"y\":2,\"w\":3,\"h\":4}}}"), L));
+        Assert.assertNull(ContentParser.parse(new JSONObject("{\"html\":\"https://a.b/c\",\"geo\":{}}"), L));
+    }
+
+    /**
+     * The signalling URLs a content block navigates to: an event payload, a resize request, a link
+     * with the close flag hidden in its own query, and an external link.
+     */
+    @Test
+    public void widgetActionParser_readsEveryContentSignal() {
+        WidgetAction event = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=event"
+                + "&event=%5B%7B%22key%22%3A%22ev1%22%7D%5D&close=0", L);
+        Assert.assertTrue(event.isSdkSignal);
+        Assert.assertTrue(event.isActionEvent);
+        Assert.assertFalse(event.close);
+        Assert.assertEquals("[{\"key\":\"ev1\"}]", event.eventPayload);
+        Assert.assertEquals("1", event.queryParams.get("cly_x_action_event"));
+
+        WidgetAction resize = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=resize_me"
+                + "&resize_me=%7B%22p%22%3A%7B%22x%22%3A1%2C%22y%22%3A2%2C%22w%22%3A3%2C%22h%22%3A4%7D%2C"
+                + "%22l%22%3A%7B%22x%22%3A5%2C%22y%22%3A6%2C%22w%22%3A7%2C%22h%22%3A8%7D%7D&close=1", L);
+        Assert.assertTrue(resize.hasResize);
+        Assert.assertTrue(resize.close);
+        Assert.assertEquals(3, resize.resizeFor(false).width);
+        Assert.assertEquals(7, resize.resizeFor(true).width);
+
+        // A rectangle without a positive size is not usable.
+        WidgetAction emptyResize = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&resize_me=%7B%22p%22%3A%7B%22w%22%3A0%2C%22h%22%3A0%7D%7D", L);
+        Assert.assertFalse(emptyResize.hasResize);
+        Assert.assertNull(emptyResize.resizeFor(false));
+
+        WidgetAction malformedResize = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&resize_me=not-json", L);
+        Assert.assertTrue(malformedResize.isSdkSignal);
+        Assert.assertFalse(malformedResize.hasResize);
+
+        // The close flag inside the destination's own query belongs to us, not to the destination.
+        WidgetAction link = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=link"
+                + "&link=https%3A%2F%2Fcount.ly%3Fa%3D1%26close%3D1", L);
+        Assert.assertTrue(link.close);
+        Assert.assertEquals("https://count.ly?a=1", link.link);
+
+        WidgetAction external = WidgetActionParser.parse("https://count.ly/pricing?cly_x_int=1", L);
+        Assert.assertTrue(external.isSdkSignal);
+        Assert.assertTrue(external.isExternalLink);
+        Assert.assertEquals("https://count.ly/pricing?cly_x_int=1", external.link);
+
+        WidgetAction widgetClose = WidgetActionParser.parse("https://countly_action_event/?cly_widget_command=1&close=1", L);
+        Assert.assertTrue(widgetClose.isWidgetCommand);
+        Assert.assertTrue(widgetClose.close);
+
+        // A plain page navigation is not a signal and must be left alone.
+        WidgetAction plain = WidgetActionParser.parse("https://test.server.com/feedback/nps?widget_id=1", L);
+        Assert.assertFalse(plain.isSdkSignal);
+        Assert.assertFalse(plain.close);
+
+        Assert.assertFalse(WidgetActionParser.parse(null, L).isSdkSignal);
+        Assert.assertFalse(WidgetActionParser.parse("", L).isSdkSignal);
+    }
+
+    /**
+     * A "mailto:" destination survives parsing intact, and the close flag beside it is honoured.
+     * <p>
+     * Both shapes matter: close as its own parameter, and close carried inside the destination's own
+     * query, which has to be honoured and then stripped so the address is left clean.
+     */
+    @Test
+    public void widgetActionParser_handlesMailLinksWithClose() {
+        WidgetAction plain = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=link"
+                + "&link=mailto%3Asupport%40count.ly&close=1", L);
+        Assert.assertTrue(plain.close);
+        Assert.assertEquals("mailto:support@count.ly", plain.link);
+
+        WidgetAction withSubject = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=link"
+                + "&link=mailto%3Asupport%40count.ly%3Fsubject%3DHelp%26close%3D1", L);
+        Assert.assertTrue("close inside the destination's query must be honoured", withSubject.close);
+        Assert.assertEquals("the address must be left clean", "mailto:support@count.ly?subject=Help", withSubject.link);
+
+        WidgetAction noClose = WidgetActionParser.parse(
+            "https://countly_action_event/?cly_x_action_event=1&action=link"
+                + "&link=mailto%3Asupport%40count.ly&close=0", L);
+        Assert.assertFalse(noClose.close);
+        Assert.assertEquals("mailto:support@count.ly", noClose.link);
+    }
+
+    /**
+     * Dropping a query parameter has to leave a valid URL behind, whatever position it was in.
+     */
+    @Test
+    public void widgetActionParser_stripsOneParameterAtATime() {
+        Assert.assertEquals("https://a.b/c", WidgetActionParser.stripParam("https://a.b/c?close=1", "close"));
+        Assert.assertEquals("https://a.b/c?x=1", WidgetActionParser.stripParam("https://a.b/c?close=1&x=1", "close"));
+        Assert.assertEquals("https://a.b/c?x=1", WidgetActionParser.stripParam("https://a.b/c?x=1&close=1", "close"));
+        Assert.assertEquals("https://a.b/c?x=1&y=2", WidgetActionParser.stripParam("https://a.b/c?x=1&close=1&y=2", "close"));
+        Assert.assertEquals("https://a.b/c", WidgetActionParser.stripParam("https://a.b/c", "close"));
+
+        Map<String, Object> query = WidgetActionParser.parseQuery("https://a.b/c?x=1&broken&y=%7B%22a%22%3A1%7D");
+        Assert.assertEquals(2, query.size());
+        Assert.assertEquals("1", query.get("x"));
+        Assert.assertEquals("{\"a\":1}", query.get("y"));
+    }
+
+    /**
+     * The feedback widget display URL carries everything a desktop web view needs: the widget
+     * identity, the SDK identity, the card rendering flags and the page origin.
+     */
+    @Test
+    public void widgetUrlBuilder_buildsADesktopReadyUrl() {
+        Countly.instance().init(TestUtils.getConfigFeedback());
+
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = "widget_1";
+        widget.type = FeedbackWidgetType.nps;
+
+        String url = Countly.instance().feedback().constructFeedbackWidgetUrl(widget);
+        Assert.assertTrue(url.startsWith(TestUtils.SERVER_URL + "/feedback/nps?"));
+
+        Map<String, String> params = TestUtils.parseQueryParams(url.substring(url.indexOf('?') + 1));
+        Assert.assertEquals("widget_1", params.get("widget_id"));
+        Assert.assertEquals(TestUtils.DEVICE_ID, params.get("device_id"));
+        Assert.assertEquals(TestUtils.SERVER_APP_KEY, params.get("app_key"));
+        Assert.assertEquals(WidgetUrlBuilder.CUSTOM_PARAMS, Utils.urldecode(params.get("custom")));
+        Assert.assertEquals(TestUtils.SERVER_URL, params.get("origin"));
+        Assert.assertFalse(params.get("sdk_name").isEmpty());
+        Assert.assertFalse(params.get("sdk_version").isEmpty());
+    }
+
+    /**
+     * The origin of a server URL, with and without an explicit port.
+     */
+    @Test
+    public void widgetUrlBuilder_readsTheOrigin() throws Exception {
+        Assert.assertEquals("https://try.count.ly", WidgetUrlBuilder.originOf(new java.net.URL("https://try.count.ly")));
+        Assert.assertEquals("http://localhost:3001", WidgetUrlBuilder.originOf(new java.net.URL("http://localhost:3001/path")));
+        Assert.assertNull(WidgetUrlBuilder.originOf(null));
+    }
+
+    /**
+     * The content fetch parameters, and the preview flags.
+     */
+    @Test
+    public void contentRequestBuilder_buildsTheFetchParameters() {
+        Params plain = ContentRequestBuilder.build(new ContentScreen(800, 600), null, L);
+        Map<String, String> params = TestUtils.parseQueryParams(plain.toString());
+        Assert.assertEquals("queue", params.get("method"));
+        Assert.assertEquals(ContentRequestBuilder.DEVICE_TYPE, params.get("dt"));
+        Assert.assertEquals("{\"l\":{\"w\":800,\"h\":600},\"p\":{\"w\":800,\"h\":600}}", Utils.urldecode(params.get("resolution")));
+        Assert.assertNull(params.get("content_id"));
+        Assert.assertNull(params.get("preview"));
+        // Content categories are not supported by the server, so nothing is sent for them.
+        Assert.assertNull(params.get("category"));
+
+        Params preview = ContentRequestBuilder.build(new ContentScreen(800, 600), "block_1", L);
+        Map<String, String> previewParams = TestUtils.parseQueryParams(preview.toString());
+        Assert.assertEquals("block_1", previewParams.get("content_id"));
+        Assert.assertEquals("true", previewParams.get("preview"));
+
+        // A missing screen must not throw; it simply reports nothing to fit into.
+        Params noScreen = ContentRequestBuilder.build(null, null, L);
+        Assert.assertEquals("{\"l\":{\"w\":0,\"h\":0},\"p\":{\"w\":0,\"h\":0}}",
+            Utils.urldecode(TestUtils.parseQueryParams(noScreen.toString()).get("resolution")));
+    }
+
+    /**
+     * The content feature has its own consent bit, and it has to survive the round trip through
+     * {@link Config.Feature#byIndex(int)} the consent plumbing relies on.
+     */
+    @Test
+    public void contentFeature_isWiredIntoTheFeatureBitmask() {
+        Assert.assertEquals(CoreFeature.Content.getIndex(), Config.Feature.Content.getIndex());
+        Assert.assertEquals(Config.Feature.Content, Config.Feature.byIndex(CoreFeature.Content.getIndex()));
+        Assert.assertNotNull(CoreFeature.Content.getCreator());
+    }
+
+    /**
+     * A link that also asks to close: both are read. Reading close after the external-link return
+     * made every open-and-dismiss branch downstream unreachable.
+     */
+    @Test
+    public void widgetActionParser_externalLinkCanAlsoClose() {
+        WidgetAction action = WidgetActionParser.parse("https://count.ly/offer?cly_x_int=1&close=1", L);
+        Assert.assertTrue(action.isExternalLink);
+        Assert.assertTrue("the close travels with the link", action.close);
+        Assert.assertEquals("https://count.ly/offer?cly_x_int=1&close=1", action.link);
+
+        WidgetAction plain = WidgetActionParser.parse("https://count.ly/offer?cly_x_int=1", L);
+        Assert.assertTrue(plain.isExternalLink);
+        Assert.assertFalse(plain.close);
+    }
+
+    /**
+     * A zero-sized geo rectangle is no rectangle: it falls through to the other orientation, and
+     * two of them leave the block without a usable placement instead of an invisible window.
+     */
+    @Test
+    public void contentParser_rejectsZeroSizedRectangles() {
+        ContentData data = ContentParser.parse(new JSONObject(
+            "{\"html\":\"https://x.count.ly/c\",\"geo\":{\"l\":{},\"p\":{\"x\":0,\"y\":400,\"w\":768,\"h\":420}}}"), L);
+        Assert.assertNotNull(data);
+        Assert.assertNull("an empty landscape rect is not a placement", data.landscape);
+        Assert.assertEquals("so the valid portrait one is used on a landscape desktop", 420, data.placementFor(true).height);
+
+        ContentData none = ContentParser.parse(new JSONObject(
+            "{\"html\":\"https://x.count.ly/c\",\"geo\":{\"l\":{\"w\":0,\"h\":95},\"p\":{\"w\":768,\"h\":0}}}"), L);
+        Assert.assertTrue(none == null || (none.landscape == null && none.portrait == null));
+    }
+
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/CoreRobustnessTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/CoreRobustnessTests.java
new file mode 100644
index 000000000..860fb210d
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/CoreRobustnessTests.java
@@ -0,0 +1,211 @@
+package ly.count.sdk.java.internal;
+
+import java.io.File;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Regression tests for defects found while raising coverage. Each one is a public API that either
+ * crashed or silently did the wrong thing under a perfectly ordinary configuration.
+ */
+@RunWith(JUnit4.class)
+public class CoreRobustnessTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    /**
+     * The crash name given to "addCrashReport" has to reach the request.
+     * <p>
+     * The guard applying it was inverted, so a real name was dropped and an empty one was sent as
+     * an empty "_name", which made that argument of the public API dead.
+     */
+    @Test
+    public void crashName_isAppliedWhenGivenAndOmittedWhenNot() {
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.CrashReporting));
+        Countly.session().begin();
+
+        Countly.session().addCrashReport(new IllegalStateException("boom"), false, "PaymentFailure", null);
+
+        String named = findCrashRequest();
+        Assert.assertNotNull("a crash request should have been queued", named);
+        Assert.assertTrue("the crash name must reach the wire, got: " + named,
+            named.contains("PaymentFailure"));
+
+        // An empty name is not a name: it must not be sent as an empty _name.
+        Countly.instance().halt();
+        TestUtils.createCleanTestState();
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.CrashReporting));
+        Countly.session().begin();
+        Countly.session().addCrashReport(new IllegalStateException("boom"), false, "", null);
+
+        String unnamed = findCrashRequest();
+        Assert.assertNotNull(unnamed);
+        Assert.assertFalse("an empty name must not be sent, got: " + unnamed, unnamed.contains("_name"));
+    }
+
+    /**
+     * A null config is refused by both init entry points instead of throwing. The guard existed but
+     * was unreachable, because the config was dereferenced one line above it.
+     */
+    @Test
+    public void init_withANullConfig_isRefusedWithoutCrashing() {
+        Countly.instance().init(null);
+        Assert.assertFalse(Countly.isInitialized());
+
+        Countly.init(TestUtils.getTestSDirectory(), null);
+        Assert.assertFalse(Countly.isInitialized());
+
+        // Still usable with a real config afterwards.
+        Countly.instance().init(TestUtils.getConfigEvents(2));
+        Assert.assertTrue(Countly.isInitialized());
+    }
+
+    /**
+     * Feature accessors for features that were never enabled return null rather than throwing.
+     * <p>
+     * They dereferenced a module that was never built, and consent is not the gate that stops them:
+     * with consent not required, the consent check passes and the null module was used anyway.
+     */
+    @Test
+    public void accessors_forFeaturesThatWereNeverEnabled_returnNull() {
+        Countly.instance().init(TestUtils.getConfigEvents(2));
+
+        Assert.assertNull(Countly.instance().feedback());
+        Assert.assertNull(Countly.instance().crashes());
+        Assert.assertNull(Countly.instance().remoteConfig());
+        Assert.assertNull(Countly.instance().content());
+
+        // The feature that IS enabled still works, so the guards did not break the happy path.
+        Assert.assertNotNull(Countly.instance().events());
+    }
+
+    /**
+     * Accessors used before init log and return null. "location" logged through a logger that does
+     * not exist yet, unlike every sibling accessor.
+     */
+    @Test
+    public void accessors_beforeInit_returnNullWithoutCrashing() {
+        Countly.instance().halt();
+
+        Assert.assertNull(Countly.instance().location());
+        Assert.assertNull(Countly.instance().feedback());
+        Assert.assertNull(Countly.instance().content());
+        Assert.assertNull(Countly.instance().remoteConfig());
+        Assert.assertNull(Countly.instance().backendM());
+    }
+
+    /**
+     * The placeholder handed out when backend mode is off is inert: every call is a no-op, nothing
+     * is queued, and nothing throws. It used to log before checking it was disabled, through a
+     * logger it never had.
+     */
+    @Test
+    public void backendModePlaceholder_isInertInsteadOfCrashing() {
+        Countly.instance().init(TestUtils.getConfigEvents(2));
+
+        ModuleBackendMode.BackendMode backendMode = Countly.instance().backendM();
+        Assert.assertNotNull("a dummy is expected, not null", backendMode);
+
+        int before = TestUtils.getCurrentRQ().length;
+
+        backendMode.recordEvent("device", "key", 1, 0.0, 0.0, null, null);
+        backendMode.recordView("device", "view", null, null);
+        backendMode.sessionBegin("device", null, null, null);
+        backendMode.sessionUpdate("device", 1.0, null);
+        backendMode.sessionEnd("device", 1.0, null);
+        backendMode.recordException("device", new IllegalStateException("boom"), null, null, null);
+        backendMode.recordUserProperties("device", null, null);
+        backendMode.recordDirectRequest("device", null, null);
+
+        Assert.assertEquals("an inert placeholder must not queue anything", before, TestUtils.getCurrentRQ().length);
+    }
+
+    /**
+     * A pin that is not valid base64 is reported and skipped, rather than taking init down with it.
+     */
+    @Test
+    public void aMalformedPin_doesNotBreakInit() {
+        Config config = TestUtils.getConfigEvents(2)
+            .addPublicKeyPin("this is definitely not base64 !!!")
+            .addCertificatePin("neither is this !!!");
+
+        Countly.instance().init(config);
+
+        Assert.assertTrue("a bad pin must be reported, not fatal", Countly.isInitialized());
+    }
+
+    /**
+     * A storable that cannot serialise itself reports failure and leaves no file behind. It used to
+     * write a zero length file that later read back as a corrupt storable.
+     */
+    @Test
+    public void aStorableThatCannotSerialise_leavesNoFileBehind() {
+        Countly.instance().init(TestUtils.getConfigEvents(2));
+        InternalConfig config = SDKCore.instance.config;
+
+        UnserialisableStorable storable = new UnserialisableStorable();
+        Assert.assertFalse("a failed write must report failure", Storage.push(config, storable));
+
+        File[] litter = TestUtils.getTestSDirectory().listFiles((dir, name) -> name.contains(UnserialisableStorable.PREFIX));
+        Assert.assertNotNull(litter);
+        Assert.assertEquals("no file should have been created, found: " + litter.length, 0, litter.length);
+    }
+
+    /**
+     * The queued crash request, or null when none was queued.
+     *
+     * @return the value of the "crash" parameter
+     */
+    private static String findCrashRequest() {
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            if (request.containsKey("crash")) {
+                return request.get("crash");
+            }
+        }
+        return null;
+    }
+
+    private static class UnserialisableStorable implements Storable {
+
+        static final String PREFIX = "unserialisable";
+
+        @Override
+        public Long storageId() {
+            return 12345L;
+        }
+
+        @Override
+        public String storagePrefix() {
+            return PREFIX;
+        }
+
+        @Override
+        public void setId(Long id) {
+        }
+
+        @Override
+        public byte[] store(Log L) {
+            return null;
+        }
+
+        @Override
+        public boolean restore(byte[] data, Log L) {
+            return false;
+        }
+    }
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/CountlyFacadeTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/CountlyFacadeTests.java
new file mode 100644
index 000000000..973fdccab
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/CountlyFacadeTests.java
@@ -0,0 +1,314 @@
+package ly.count.sdk.java.internal;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.Session;
+import ly.count.sdk.java.Usage;
+import ly.count.sdk.java.User;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The static {@link Countly} facade and the {@link SDKCore} accessors behind it.
+ * <p>
+ * Two contracts are covered: before {@code init} every accessor must answer with null and a logged
+ * error instead of throwing, and after {@code init} the deprecated {@link Usage} API must still route
+ * to the live session. Both matter because they are the surface an integration touches first.
+ */
+@RunWith(JUnit4.class)
+public class CountlyFacadeTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * Nothing may throw before {@code init}. Every module accessor and every state query is walked in
+     * one pass, so a newly added accessor that forgets its guard shows up here.
+     */
+    @Test
+    public void beforeInit_everyAccessorAnswersNullInsteadOfThrowing() {
+        Assert.assertFalse(Countly.isInitialized());
+
+        Assert.assertNull(Countly.session());
+        Assert.assertNull(Countly.instance().backendM());
+        Assert.assertNull(Countly.backendMode());
+        Assert.assertNull(Countly.instance().feedback());
+        Assert.assertNull(Countly.instance().content());
+        Assert.assertNull(Countly.instance().events());
+        Assert.assertNull(Countly.instance().views());
+        Assert.assertNull(Countly.instance().crashes());
+        Assert.assertNull(Countly.instance().remoteConfig());
+        Assert.assertNull(Countly.instance().deviceId());
+        Assert.assertNull(Countly.instance().userProfile());
+        // Countly.location() is deliberately NOT called here: its own uninitialised guard logs
+        // through the instance logger without a null check, so it throws NPE before it can return
+        // null. Reported as a bug rather than asserted, so a fix does not have to touch this test.
+
+        // isTracking short circuits on the uninitialised check rather than dereferencing the SDK.
+        for (Config.Feature feature : Config.Feature.values()) {
+            Assert.assertFalse(feature + " cannot be tracked before init", Countly.isTracking(feature));
+        }
+
+        // Consent calls before init are no-ops, not crashes.
+        Countly.onConsent(Config.Feature.Events);
+        Countly.onConsentRemoval(Config.Feature.Events);
+
+        // api() is just the singleton, and it is available at any time.
+        Assert.assertSame(Countly.instance(), Countly.api());
+    }
+
+    /**
+     * The deprecated {@link Usage} API a long lived integration still calls. One session, every entry
+     * point exercised, and the resulting events and crash asserted on the queue and the wire.
+     */
+    @Test
+    public void deprecatedUsageApi_stillRoutesEverythingIntoTheSession() {
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.Events, Config.Feature.Views,
+            Config.Feature.CrashReporting, Config.Feature.Location, Config.Feature.UserProfiles));
+
+        Assert.assertTrue(Countly.isInitialized());
+        Assert.assertTrue(Countly.isTracking(Config.Feature.Events));
+
+        Session session = Countly.session();
+        Assert.assertNotNull(session);
+        Assert.assertSame("session() must hand back the same live session", session, Countly.session());
+
+        Usage usage = Countly.api();
+        // addParam is delegated to the session, so the session is what comes back, not the facade.
+        Assert.assertNotNull(usage.addParam("customParam", "customValue"));
+
+        User user = Countly.instance().user();
+        Assert.assertNotNull(user);
+
+        Assert.assertNotNull(Countly.instance().view("deprecatedView", true));
+        Assert.assertNotNull(Countly.instance().addLocation(52.5, 13.4));
+        Assert.assertNotNull(Countly.instance().addCrashReport(new IllegalStateException("deprecated crash"), false));
+
+        Map<String, String> segments = new HashMap<>();
+        segments.put("where", "deprecated");
+        Assert.assertNotNull(Countly.instance().addCrashReport(
+            new IllegalArgumentException("named crash"), false, "crashName", segments, "log line"));
+
+        Assert.assertEquals(TestUtils.DEVICE_ID, Countly.instance().getDeviceId());
+        Assert.assertEquals(DeviceIdType.DEVELOPER_SUPPLIED, Countly.instance().getDeviceIdType());
+
+        // The crashes really left the SDK, which is what the deprecated call is for.
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertTrue("the deprecated crash API must produce requests", requestsContaining("crash") >= 1);
+    }
+
+    /**
+     * Login and logout through the deprecated facade. A login is a device id change with merge, so it
+     * must put the old id on the wire; the logout that follows must not.
+     */
+    @Test
+    public void deprecatedLoginAndLogout_changeTheDeviceIdOnTheWire() {
+        Countly.instance().init(TestUtils.getConfigDeviceId(TestUtils.DEVICE_ID));
+
+        Usage usage = Countly.instance().login("facade_user");
+        Assert.assertSame(Countly.instance(), usage);
+        Assert.assertEquals("facade_user", Countly.instance().getDeviceId());
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertTrue("a login must send the old id so profiles can merge",
+            requestsContaining(Params.PARAM_OLD_DEVICE_ID) >= 1);
+
+        Assert.assertSame(Countly.instance(), Countly.instance().logout());
+
+        // Both deprecated device id changes route through the same module as the modern API.
+        Countly.instance().changeDeviceIdWithMerge("merged_facade_user");
+        Assert.assertEquals("merged_facade_user", Countly.instance().getDeviceId());
+        Countly.instance().changeDeviceIdWithoutMerge("fresh_facade_user");
+        Assert.assertEquals("fresh_facade_user", Countly.instance().getDeviceId());
+        Assert.assertEquals(DeviceIdType.DEVELOPER_SUPPLIED, Countly.instance().getDeviceIdType());
+    }
+
+    /**
+     * Backend mode is either on, in which case the real interface reaches the request queue, or off,
+     * in which case a disabled placeholder is handed out instead of null.
+     */
+    @Test
+    public void backendMode_placeholderWhenOffAndRealInterfaceWhenOn() {
+        Countly.instance().init(TestUtils.getConfigEvents(100));
+
+        // A placeholder rather than null, so an integration that calls it does not have to null check.
+        // Its methods are not exercised here: they log before checking the disabled flag and the
+        // placeholder has no logger, so they throw. Reported as a bug.
+        Assert.assertNotNull(Countly.instance().backendM());
+
+        Countly.instance().halt();
+        TestUtils.createCleanTestState();
+
+        Config config = TestUtils.getBaseConfig().setEventQueueSizeToSend(1);
+        config.enableBackendMode();
+        Countly.instance().init(config);
+
+        ModuleBackendMode.BackendMode real = Countly.instance().backendM();
+        Assert.assertNotNull(real);
+        Assert.assertNotNull(real.getModule());
+
+        Map<String, Object> segmentation = new HashMap<>();
+        segmentation.put("from", "backendMode");
+        real.recordEvent("backend_device", "backendEvent", 2, 4.0, 1.0, segmentation, null);
+
+        // Backend mode queues into memory, and the event batch flushes at the configured size.
+        Assert.assertFalse("backend mode must queue its own requests", SDKCore.instance.requestQueueMemory.isEmpty());
+        Request queued = SDKCore.instance.requestQueueMemory.peek();
+        Assert.assertNotNull(queued);
+        Assert.assertEquals("backend_device", queued.params.get("device_id"));
+        Assert.assertTrue(Utils.urldecode(queued.params.get("events")).contains("backendEvent"));
+    }
+
+    /**
+     * Backend mode refuses every call that has no usable device id or key, across its whole surface.
+     * Each rejection must leave the request queue exactly as it was, because a backend mode
+     * integration supplies the device id per call and a silent default would attribute data to the
+     * wrong user.
+     */
+    @Test
+    public void backendMode_rejectsEveryCallWithoutAUsableDeviceIdOrKey() {
+        Config config = TestUtils.getBaseConfig().setEventQueueSizeToSend(1);
+        config.enableBackendMode();
+        Countly.instance().init(config);
+
+        ModuleBackendMode.BackendMode backend = Countly.instance().backendM();
+        Assert.assertNotNull(backend);
+
+        int before = SDKCore.instance.requestQueueMemory.size();
+
+        for (String badDeviceId : new String[] { null, "" }) {
+            backend.recordEvent(badDeviceId, "key", 1, 1.0, 1.0, null, null);
+            backend.recordView(badDeviceId, "view", null, null);
+            backend.sessionBegin(badDeviceId, null, null, null);
+            backend.sessionUpdate(badDeviceId, 1.0, null);
+            backend.sessionEnd(badDeviceId, 1.0, null);
+            backend.recordUserProperties(badDeviceId, null, null);
+            backend.recordDirectRequest(badDeviceId, null, null);
+            backend.recordException(badDeviceId, new IllegalStateException("nope"), null, null, null);
+            backend.recordException(badDeviceId, "message", "stack", null, null, null);
+        }
+
+        // A usable device id but no usable key or payload is refused just the same.
+        backend.recordEvent("device", null, 1, 1.0, 1.0, null, null);
+        backend.recordEvent("device", "", 1, 1.0, 1.0, null, null);
+        backend.recordView("device", null, null, null);
+        backend.recordView("device", "", null, null);
+        backend.recordUserProperties("device", null, null);
+        backend.recordUserProperties("device", new HashMap<>(), null);
+        backend.recordDirectRequest("device", null, null);
+        backend.recordDirectRequest("device", new HashMap<>(), null);
+        backend.recordException("device", (Throwable) null, null, null, null);
+        backend.recordException("device", null, "stack", null, null, null);
+
+        Assert.assertEquals("no rejected backend mode call may reach the request queue",
+            before, SDKCore.instance.requestQueueMemory.size());
+
+        // And a well formed call still works, so the guards are not blocking everything.
+        backend.recordEvent("device", "goodBackendEvent", 1, 1.0, 1.0, null, null);
+        Assert.assertTrue(SDKCore.instance.requestQueueMemory.size() > before);
+    }
+
+    /**
+     * A module override installed through {@link SDKCore} really replaces the built in module and
+     * receives the lifecycle callbacks, which is the hook the SDK's own tests rely on.
+     */
+    @Test
+    public void moduleOverride_replacesTheBuiltInModuleAndGetsTheCallbacks() {
+        AtomicInteger initialised = new AtomicInteger();
+        AtomicInteger stopped = new AtomicInteger();
+
+        SDKCore.testDummyModule = new ModuleBase() {
+            @Override
+            public void init(InternalConfig config) {
+                super.init(config);
+                initialised.incrementAndGet();
+            }
+
+            @Override
+            public void stop(InternalConfig config, boolean clear) {
+                stopped.incrementAndGet();
+            }
+        };
+
+        try {
+            Countly.instance().init(TestUtils.getConfigEvents(100));
+            Assert.assertEquals("the overridden module must be initialised", 1, initialised.get());
+
+            Countly.instance().halt();
+            Assert.assertEquals("the overridden module must be stopped on halt", 1, stopped.get());
+        } finally {
+            SDKCore.testDummyModule = null;
+        }
+    }
+
+    /**
+     * Consent gating of the accessors. With consent required and nothing granted the feature
+     * interfaces must be withheld; granting afterwards must hand them over.
+     */
+    @Test
+    public void consentGating_withholdsThenReleasesTheFeatureInterfaces() {
+        Config config = TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.Events, Config.Feature.Views, Config.Feature.Location,
+                Config.Feature.Feedback, Config.Feature.RemoteConfig, Config.Feature.CrashReporting)
+            .setRequiresConsent(true);
+        Countly.instance().init(config);
+
+        Assert.assertFalse(Countly.isTracking(Config.Feature.Events));
+        Assert.assertNull(Countly.instance().events());
+        Assert.assertNull(Countly.instance().views());
+        Assert.assertNull(Countly.instance().location());
+        Assert.assertNull(Countly.instance().feedback());
+        Assert.assertNull(Countly.instance().remoteConfig());
+        Assert.assertNull(Countly.instance().crashes());
+
+        Countly.onConsent(Config.Feature.values());
+
+        Assert.assertTrue(Countly.isTracking(Config.Feature.Events));
+        Assert.assertNotNull(Countly.instance().events());
+        Assert.assertNotNull(Countly.instance().views());
+        Assert.assertNotNull(Countly.instance().location());
+        Assert.assertNotNull(Countly.instance().feedback());
+        Assert.assertNotNull(Countly.instance().remoteConfig());
+        Assert.assertNotNull(Countly.instance().crashes());
+
+        Countly.onConsentRemoval(Config.Feature.values());
+
+        Assert.assertFalse(Countly.isTracking(Config.Feature.Events));
+        Assert.assertNull(Countly.instance().events());
+        Assert.assertNull(Countly.instance().views());
+    }
+
+    // endregion
+    // region helpers
+
+    /**
+     * @return how many queued requests carry the given parameter
+     */
+    private int requestsContaining(String parameter) {
+        int found = 0;
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            if (request != null && request.containsKey(parameter)) {
+                found++;
+            }
+        }
+        return found;
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/CrashFlowTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/CrashFlowTests.java
new file mode 100644
index 000000000..2b488c34f
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/CrashFlowTests.java
@@ -0,0 +1,333 @@
+package ly.count.sdk.java.internal;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.Crash;
+import ly.count.sdk.java.CrashProcessor;
+import org.json.JSONObject;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * Crash reporting: the {@link CrashImpl} payload, its {@link Storable} form, and the
+ * {@link ModuleCrashes} flow that turns a {@link Throwable} into a request.
+ * <p>
+ * A crash is the one report a customer cannot reproduce on demand, so the assertions here are on the
+ * crash JSON that reaches the wire rather than on internal state.
+ */
+@RunWith(JUnit4.class)
+public class CrashFlowTests {
+
+    /**
+     * Records what the SDK handed it and optionally vetoes the crash.
+     */
+    public static class RecordingProcessor implements CrashProcessor {
+        static volatile Crash lastSeen;
+        static volatile boolean veto;
+
+        @Override
+        public Crash process(Crash crash) {
+            lastSeen = crash;
+            return veto ? null : crash;
+        }
+    }
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+        RecordingProcessor.lastSeen = null;
+        RecordingProcessor.veto = false;
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * A handled exception with segmentation and breadcrumbs, end to end. Proves the crash JSON on the
+     * wire carries the stack trace, the non-fatal marker, the custom segmentation, the breadcrumbs
+     * and the device metrics.
+     */
+    @Test
+    public void handledException_reachesTheWireWithEverythingAttached() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.CrashReporting));
+
+        Countly.instance().crashes().addCrashBreadcrumb("first breadcrumb");
+        Countly.instance().crashes().addCrashBreadcrumb("second breadcrumb");
+
+        Map<String, Object> segmentation = new HashMap<>();
+        segmentation.put("screen", "checkout");
+        segmentation.put("retries", 2);
+        Countly.instance().crashes().recordHandledException(
+            new IllegalStateException("handled boom"), segmentation);
+
+        JSONObject crash = crashOnTheWire();
+        Assert.assertTrue("the stack trace must be present", crash.getString("_error").contains("handled boom"));
+        Assert.assertTrue("a handled exception is non fatal", crash.getBoolean("_nonfatal"));
+        Assert.assertEquals("checkout", crash.getJSONObject("_custom").getString("screen"));
+        Assert.assertEquals(2, crash.getJSONObject("_custom").getInt("retries"));
+        Assert.assertTrue(crash.getString("_logs").contains("first breadcrumb"));
+        Assert.assertTrue(crash.getString("_logs").contains("second breadcrumb"));
+        Assert.assertTrue("device metrics must ride along", crash.has("_os"));
+        Assert.assertTrue(crash.has("_run"));
+    }
+
+    /**
+     * An unhandled exception is the fatal variant, and the breadcrumb log is cleared once it has been
+     * attached so the next crash does not repeat it.
+     */
+    @Test
+    public void unhandledException_isFatalAndConsumesTheBreadcrumbs() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.CrashReporting));
+
+        Countly.instance().crashes().addCrashBreadcrumb("only once");
+        Countly.instance().crashes().recordUnhandledException(new RuntimeException("fatal boom"));
+
+        JSONObject first = crashOnTheWire();
+        Assert.assertFalse("an unhandled exception is fatal", first.getBoolean("_nonfatal"));
+        Assert.assertTrue(first.getString("_logs").contains("only once"));
+
+        Countly.instance().crashes().recordHandledException(new RuntimeException("second boom"));
+        JSONObject second = crashOnTheWire(1);
+        Assert.assertFalse("breadcrumbs must not be repeated on the next crash", second.has("_logs"));
+    }
+
+    /**
+     * Everything the module must refuse: a null throwable, an empty breadcrumb, and any crash at all
+     * while backend mode owns the wire. None may produce a request.
+     */
+    @Test
+    public void crashReporting_refusesBadInputAndStandsDownUnderBackendMode() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.CrashReporting));
+
+        Countly.instance().crashes().recordHandledException(null);
+        Countly.instance().crashes().recordUnhandledException(null);
+        Countly.instance().crashes().recordHandledException(null, new HashMap<>());
+        for (String badBreadcrumb : new String[] { null, "" }) {
+            Countly.instance().crashes().addCrashBreadcrumb(badBreadcrumb);
+        }
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals("a null throwable must not produce a crash", 0, crashRequestCount());
+
+        Countly.instance().halt();
+        TestUtils.createCleanTestState();
+
+        Config backendConfig = TestUtils.getBaseConfig().enableFeatures(Config.Feature.CrashReporting);
+        backendConfig.enableBackendMode();
+        Countly.instance().init(backendConfig);
+
+        ModuleCrashes module = SDKCore.instance.module(ModuleCrashes.class);
+        Assert.assertNotNull(module);
+        module.recordExceptionInternal(new RuntimeException("ignored under backend mode"), true, null, null);
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals("backend mode must suppress the ordinary crash path", 0, crashRequestCount());
+    }
+
+    /**
+     * Consent gating. With consent required and CrashReporting not granted the interface is withheld
+     * entirely; once granted the crash flows.
+     */
+    @Test
+    public void crashReporting_isGatedOnConsent() {
+        Config config = TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.CrashReporting)
+            .setRequiresConsent(true);
+        Countly.instance().init(config);
+
+        Assert.assertNull("no consent means no crash interface", Countly.instance().crashes());
+
+        Countly.onConsent(Config.Feature.CrashReporting);
+        Assert.assertNotNull(Countly.instance().crashes());
+
+        Countly.instance().crashes().recordHandledException(new RuntimeException("after consent"));
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals(1, crashRequestCount());
+    }
+
+    /**
+     * The {@link CrashProcessor} hook a customer installs to scrub or drop crashes. It must see the
+     * crash, and returning null from it must stop the crash from being sent at all.
+     */
+    @Test
+    public void crashProcessor_seesTheCrashAndCanVetoIt() {
+        Countly.instance().init(TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.CrashReporting)
+            .setCrashProcessorClass(RecordingProcessor.class));
+
+        Countly.instance().crashes().recordHandledException(new IllegalArgumentException("inspected"));
+        Assert.assertNotNull("the processor must be handed the crash", RecordingProcessor.lastSeen);
+        Assert.assertTrue(RecordingProcessor.lastSeen.getThrowable() instanceof IllegalArgumentException);
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals(1, crashRequestCount());
+
+        // Vetoing must remove the crash rather than send it anyway.
+        RecordingProcessor.veto = true;
+        RecordingProcessor.lastSeen = null;
+        Countly.instance().crashes().recordHandledException(new IllegalArgumentException("vetoed"));
+        Assert.assertNotNull(RecordingProcessor.lastSeen);
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals("a vetoed crash must not be sent", 1, crashRequestCount());
+    }
+
+    /**
+     * The ANR shaped report: {@code addTraces} dumps every thread's stack, naming the main thread
+     * first and marking the report as an ANR rather than a crash.
+     */
+    @Test
+    public void addTraces_buildsAnAnrReportOverEveryThread() {
+        Log logger = mock(Log.class);
+        CrashImpl crash = new CrashImpl(logger);
+
+        Thread main = Thread.currentThread();
+        Thread other = new Thread(() -> {
+        }, "worker-thread");
+
+        Map<Thread, StackTraceElement[]> traces = new HashMap<>();
+        traces.put(main, new StackTraceElement[] {
+            new StackTraceElement("MainClass", "mainMethod", "MainClass.java", 11)
+        });
+        // A null element must be tolerated: a live stack can be raced while it is being read.
+        traces.put(other, new StackTraceElement[] {
+            new StackTraceElement("WorkerClass", "workerMethod", "WorkerClass.java", 22), null
+        });
+
+        Assert.assertSame(crash, crash.addTraces(main, traces));
+        Assert.assertSame(traces, crash.getTraces());
+
+        JSONObject data = crash.getData();
+        Assert.assertEquals("anr", data.getString("_type"));
+        String error = data.getString("_error");
+        Assert.assertTrue(error.startsWith("Thread [main]:"));
+        Assert.assertTrue(error.contains("MainClass.mainMethod"));
+        Assert.assertTrue(error.contains("Thread [worker-thread]:"));
+        Assert.assertTrue(error.contains("WorkerClass.workerMethod"));
+        Assert.assertTrue("an unreadable frame must not break the dump", error.contains("<<Unknown>>"));
+
+        // Null traces are refused rather than producing an empty ANR report.
+        CrashImpl refused = new CrashImpl(logger);
+        Assert.assertSame(refused, refused.addTraces(main, null));
+        Assert.assertFalse(refused.getData().has("_type"));
+
+        // A main thread that is not in the map at all simply gets no "main" section.
+        CrashImpl noMain = new CrashImpl(logger);
+        noMain.addTraces(null, traces);
+        Assert.assertFalse(noMain.getData().getString("_error").contains("Thread [main]:"));
+    }
+
+    /**
+     * The crash accessors and the storable round trip, which is how a crash survives the process
+     * death that produced it.
+     */
+    @Test
+    public void crashPayload_readsBackEverythingAndSurvivesStorage() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.CrashReporting));
+        InternalConfig config = SDKCore.instance.config;
+        Log logger = mock(Log.class);
+
+        IllegalStateException thrown = new IllegalStateException("readable");
+        CrashImpl crash = new CrashImpl(logger);
+        Assert.assertSame(crash, crash.addException(thrown));
+        Assert.assertSame(thrown, crash.getThrowable());
+
+        // A fresh crash is non-fatal by default; setFatal flips it and isFatal reports it.
+        Assert.assertFalse(crash.isFatal());
+        crash.setFatal(true);
+        Assert.assertTrue(crash.isFatal());
+        crash.setFatal(false);
+        Assert.assertFalse(crash.isFatal());
+
+        Assert.assertNull("an unnamed crash has no name", crash.getName());
+        crash.setName("NamedCrash");
+        Assert.assertEquals("NamedCrash", crash.getName());
+
+        Assert.assertNull("no segments means null, not an empty map", crash.getSegments());
+        Map<String, String> segments = new HashMap<>();
+        segments.put("area", "billing");
+        crash.setSegments(segments);
+        Assert.assertEquals("billing", crash.getSegments().get("area"));
+
+        Assert.assertNull(crash.getLogs());
+        crash.setLogs(new String[] { "line one", "line two" });
+        Assert.assertEquals(2, crash.getLogs().size());
+        Assert.assertEquals("line one", crash.getLogs().get(0));
+        // Empty and null log arrays are ignored rather than clearing what is there.
+        crash.setLogs(new String[0]);
+        crash.setLogs(null);
+        Assert.assertEquals(2, crash.getLogs().size());
+
+        // add() ignores a null value and an empty key rather than writing junk into the payload.
+        Assert.assertSame(crash, crash.add("ignoredNull", null));
+        Assert.assertSame(crash, crash.add("", "ignoredKey"));
+        Assert.assertFalse(crash.getData().has("ignoredNull"));
+        Assert.assertFalse(crash.getData().has(""));
+
+        // The storable round trip: the JSON payload comes back intact.
+        Assert.assertTrue(Storage.push(config, crash));
+        CrashImpl restored = Storage.read(config, new CrashImpl(crash.storageId(), logger));
+        Assert.assertNotNull(restored);
+        Assert.assertEquals("NamedCrash", restored.getName());
+        Assert.assertEquals("billing", restored.getSegments().get("area"));
+        Assert.assertTrue(restored.getData().getString("_error").contains("readable"));
+        Assert.assertEquals(CrashImpl.getStoragePrefix(), restored.storagePrefix());
+
+        // Corrupt bytes are logged and skipped, leaving the crash usable rather than throwing.
+        CrashImpl corrupt = new CrashImpl(logger);
+        Assert.assertTrue("restore reports success even when the payload was unreadable",
+            corrupt.restore("not json".getBytes(), logger));
+
+        corrupt.setId(4321L);
+        Assert.assertEquals(Long.valueOf(4321L), corrupt.storageId());
+        Assert.assertEquals(corrupt.getJSON(), corrupt.toString());
+    }
+
+    // endregion
+    // region helpers
+
+    private int crashRequestCount() {
+        int found = 0;
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            if (request != null && request.containsKey("crash")) {
+                found++;
+            }
+        }
+        return found;
+    }
+
+    private JSONObject crashOnTheWire() {
+        return crashOnTheWire(0);
+    }
+
+    /**
+     * @param index which crash request to read, in queue order
+     * @return the decoded "crash" parameter of that request
+     */
+    private JSONObject crashOnTheWire(int index) {
+        Storage.await(SDKCore.instance.config.getLogger());
+        List<String> crashes = new java.util.ArrayList<>();
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            if (request != null && request.containsKey("crash")) {
+                crashes.add(request.get("crash"));
+            }
+        }
+        Assert.assertTrue("expected at least " + (index + 1) + " crash request(s), got " + crashes.size(),
+            crashes.size() > index);
+        return new JSONObject(crashes.get(index));
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/EventImplWireTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/EventImplWireTests.java
new file mode 100644
index 000000000..7d41fea18
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/EventImplWireTests.java
@@ -0,0 +1,282 @@
+package ly.count.sdk.java.internal;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.Event;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * The fluent {@link Event} builder, its validation, and its JSON form.
+ * <p>
+ * Driven through {@code Countly.instance().event(key)}, which is the builder a customer still has,
+ * so these also exercise {@code SessionImpl.event} and {@code SessionImpl.recordEvent} on the way to
+ * the event queue. Assertions are on the queued event, which is what later goes on the wire.
+ */
+@RunWith(JUnit4.class)
+public class EventImplWireTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * A complete event built with the fluent setters reaches the queue with every field intact, and
+     * the JSON it serialises to is the shape the server expects.
+     */
+    @Test
+    public void fluentEvent_carriesEveryFieldIntoTheQueue() {
+        Countly.instance().init(TestUtils.getConfigEvents(4));
+
+        Countly.instance().event("fluentKey")
+            .setCount(3)
+            .setSum(9.5)
+            .setDuration(4.25)
+            .addSegment("colour", "amber")
+            .addSegments("shape", "round", "size", "large")
+            .record();
+
+        List<EventImpl> queued = TestUtils.getCurrentEQ();
+        Assert.assertEquals(1, queued.size());
+
+        Map<String, Object> expected = new HashMap<>();
+        expected.put("colour", "amber");
+        expected.put("shape", "round");
+        expected.put("size", "large");
+        TestUtils.validateEvent(queued.get(0), "fluentKey", expected, 3, 9.5, 4.25, "_CLY_", null, "", null);
+
+        // The JSON form is what gets url-encoded into the "events" parameter.
+        String json = queued.get(0).toJSON(mock(Log.class));
+        Assert.assertTrue(json.contains("\"key\":\"fluentKey\""));
+        Assert.assertTrue(json.contains("\"count\":3"));
+        Assert.assertTrue(json.contains("\"sum\":9.5"));
+        Assert.assertTrue(json.contains("\"dur\":4.25"));
+        Assert.assertTrue(json.contains("\"amber\""));
+    }
+
+    /**
+     * Every way of giving the builder a nonsense value marks the event invalid, and an invalid event
+     * is never recorded. One flow per bad value, so a regression in any single guard shows up as this
+     * test failing rather than as a silent extra event on a customer's dashboard.
+     */
+    @Test
+    public void fluentEvent_rejectsEveryBadValueAndRecordsNothing() {
+        Countly.instance().init(TestUtils.getConfigEvents(100));
+
+        List<String> cases = new ArrayList<>();
+        List<Event> bad = new ArrayList<>();
+
+        cases.add("zero count");
+        bad.add(Countly.instance().event("badCount").setCount(0));
+        cases.add("negative count");
+        bad.add(Countly.instance().event("negCount").setCount(-4));
+        cases.add("NaN sum");
+        bad.add(Countly.instance().event("nanSum").setSum(Double.NaN));
+        cases.add("infinite sum");
+        bad.add(Countly.instance().event("infSum").setSum(Double.POSITIVE_INFINITY));
+        cases.add("NaN duration");
+        bad.add(Countly.instance().event("nanDur").setDuration(Double.NaN));
+        cases.add("negative duration");
+        bad.add(Countly.instance().event("negDur").setDuration(-1.0));
+        cases.add("empty segmentation key");
+        bad.add(Countly.instance().event("emptyKey").addSegment("", "value"));
+        cases.add("null segmentation key");
+        bad.add(Countly.instance().event("nullKey").addSegment(null, "value"));
+        cases.add("empty segmentation value");
+        bad.add(Countly.instance().event("emptyValue").addSegment("key", ""));
+        cases.add("null segmentation value");
+        bad.add(Countly.instance().event("nullValue").addSegment("key", null));
+        cases.add("odd length varargs");
+        bad.add(Countly.instance().event("oddVarargs").addSegments("only"));
+        cases.add("empty varargs");
+        bad.add(Countly.instance().event("emptyVarargs").addSegments());
+        cases.add("null segmentation map");
+        bad.add(Countly.instance().event("nullMap").setSegmentation(null));
+
+        for (int i = 0; i < bad.size(); i++) {
+            Assert.assertTrue(cases.get(i) + " must mark the event invalid", ((EventImpl) bad.get(i)).isInvalid());
+            bad.get(i).record();
+        }
+
+        Assert.assertEquals("no invalid event may be recorded", 0, TestUtils.getCurrentEQ().size());
+
+        // The very same builder, with sane values, still works: the guards are not a blanket block.
+        Countly.instance().event("goodAfterBad").setCount(1).setSum(1.0).record();
+        List<EventImpl> queued = TestUtils.getCurrentEQ();
+        Assert.assertEquals(1, queued.size());
+        Assert.assertEquals("goodAfterBad", queued.get(0).key);
+    }
+
+    /**
+     * A recorded event is recorded once. The second {@code record()} is dropped, which is what stops
+     * a retry loop in customer code from multiplying a metric.
+     */
+    @Test
+    public void recordingTheSameEventTwice_onlyQueuesItOnce() {
+        Countly.instance().init(TestUtils.getConfigEvents(100));
+
+        Event event = Countly.instance().event("recordedOnce").setCount(1);
+        event.record();
+        event.record();
+        event.record();
+
+        Assert.assertEquals(1, TestUtils.getCurrentEQ().size());
+    }
+
+    /**
+     * {@code endAndRecord} stamps the elapsed time as the duration. Proves the duration is derived
+     * rather than left unset, without asserting a wall-clock value.
+     */
+    @Test
+    public void endAndRecord_stampsAnElapsedDuration() {
+        Countly.instance().init(TestUtils.getConfigEvents(100));
+
+        Countly.instance().event("timedByHand").setCount(1).endAndRecord();
+
+        List<EventImpl> queued = TestUtils.getCurrentEQ();
+        Assert.assertEquals(1, queued.size());
+        Assert.assertNotNull("endAndRecord must set a duration", queued.get(0).duration);
+        Assert.assertTrue("duration must not be negative", queued.get(0).duration >= 0);
+    }
+
+    /**
+     * Backend mode owns the wire, so the ordinary event builder must stand down entirely rather than
+     * queue events nobody will send.
+     */
+    @Test
+    public void backendModeEnabled_makesTheEventBuilderInert() {
+        Config config = TestUtils.getBaseConfig().enableFeatures(Config.Feature.Events);
+        config.enableBackendMode();
+        Countly.instance().init(config);
+
+        EventImpl direct = new EventImpl(event -> Assert.fail("backend mode must not record events"), "backendModeEvent", mock(Log.class));
+        direct.setCount(1);
+        direct.record();
+        direct.endAndRecord();
+
+        Assert.assertEquals(0, TestUtils.getCurrentEQ().size());
+    }
+
+    /**
+     * Equality is identity for the event queue's purposes: same key, timestamp and payload is the
+     * same event. One table, both directions, plus the hash code agreeing with it.
+     */
+    @Test
+    public void eventEquality_comparesThePayloadNotTheInstance() {
+        Log logger = mock(Log.class);
+
+        EventImpl base = event(logger, "sameKey", 1000L, 2, 3.0, 4.0, "a", "b");
+        EventImpl identical = event(logger, "sameKey", 1000L, 2, 3.0, 4.0, "a", "b");
+
+        Assert.assertEquals(base, identical);
+        Assert.assertEquals(identical, base);
+        Assert.assertEquals(base.hashCode(), identical.hashCode());
+        Assert.assertEquals(base, base);
+
+        Map<String, EventImpl> differing = new HashMap<>();
+        differing.put("key", event(logger, "otherKey", 1000L, 2, 3.0, 4.0, "a", "b"));
+        differing.put("timestamp", event(logger, "sameKey", 2000L, 2, 3.0, 4.0, "a", "b"));
+        differing.put("count", event(logger, "sameKey", 1000L, 9, 3.0, 4.0, "a", "b"));
+        differing.put("sum", event(logger, "sameKey", 1000L, 2, 9.0, 4.0, "a", "b"));
+        differing.put("duration", event(logger, "sameKey", 1000L, 2, 3.0, 9.0, "a", "b"));
+        differing.put("segmentation", event(logger, "sameKey", 1000L, 2, 3.0, 4.0, "a", "z"));
+        differing.put("null sum", event(logger, "sameKey", 1000L, 2, null, 4.0, "a", "b"));
+        differing.put("null duration", event(logger, "sameKey", 1000L, 2, 3.0, null, "a", "b"));
+
+        differing.forEach((what, other) -> {
+            Assert.assertNotEquals("differing " + what + " must not be equal", base, other);
+            Assert.assertNotEquals("differing " + what + " must not be equal either way", other, base);
+        });
+
+        // Anything that is not an event is simply not equal, never a class cast.
+        Assert.assertNotEquals(base, "not an event");
+        Assert.assertNotEquals(base, null);
+    }
+
+    /**
+     * The JSON round trip the event queue relies on, plus every way the stored form can be broken.
+     * A corrupt entry must come back as null rather than take the queue down with it.
+     */
+    @Test
+    public void jsonRoundTrip_survivesAndRejectsCorruptEntries() {
+        Log logger = mock(Log.class);
+
+        EventImpl original = event(logger, "roundTrip", 1234567890L, 7, 1.5, 2.5, "seg", "val");
+        original.id = "eid";
+        original.pvid = "pvid";
+        original.cvid = "cvid";
+        original.peid = "peid";
+
+        EventImpl restored = EventImpl.fromJSON(original.toJSON(logger), null, logger);
+        Assert.assertNotNull(restored);
+        Assert.assertEquals(original, restored);
+        Assert.assertEquals("roundTrip", restored.getKey());
+        Assert.assertEquals(7, restored.getCount());
+        Assert.assertEquals(Double.valueOf(1.5), restored.getSum());
+        Assert.assertEquals(Double.valueOf(2.5), restored.getDuration());
+        Assert.assertEquals("val", restored.getSegment("seg"));
+        Assert.assertEquals("eid", restored.id);
+        Assert.assertEquals("pvid", restored.pvid);
+        Assert.assertEquals("cvid", restored.cvid);
+        Assert.assertEquals("peid", restored.peid);
+        Assert.assertTrue(restored.getHour() >= 0 && restored.getHour() < 24);
+        Assert.assertTrue(restored.getDow() >= 0 && restored.getDow() < 7);
+        Assert.assertEquals(1, restored.getSegmentation().size());
+
+        // Every broken stored form must be refused, not half-parsed.
+        Map<String, String> broken = new HashMap<>();
+        broken.put("not json at all", "}{");
+        broken.put("missing key", "{\"count\":1}");
+        broken.put("null key", "{\"key\":null,\"count\":1}");
+        broken.put("empty object", "{}");
+        broken.forEach((what, json) ->
+            Assert.assertNull(what + " must not deserialize", EventImpl.fromJSON(json, null, logger)));
+
+        // A segmentation value of an unsupported type is dropped, the rest of the event survives.
+        EventImpl mixed = EventImpl.fromJSON(
+            "{\"key\":\"mixed\",\"count\":1,\"segmentation\":{\"ok\":\"yes\",\"bad\":{\"nested\":1},\"nulled\":null}}",
+            null, logger);
+        Assert.assertNotNull(mixed);
+        Assert.assertEquals("yes", mixed.getSegment("ok"));
+        Assert.assertEquals("only the supported segmentation value survives", 1, mixed.getSegmentation().size());
+
+        // A restored event has no recorder, so recording it is a logged no-op rather than a crash.
+        Assert.assertNotNull(restored);
+        restored.record();
+    }
+
+    // endregion
+    // region helpers
+
+    /**
+     * Builds an event directly, which is the only way to pin the timestamp that equality depends on.
+     */
+    private static EventImpl event(Log logger, String key, long timestamp, int count, Double sum, Double duration,
+        String segmentKey, String segmentValue) {
+        Map<String, Object> segmentation = new HashMap<>();
+        segmentation.put(segmentKey, segmentValue);
+        EventImpl event = new EventImpl(key, count, sum, duration, segmentation, logger, null, null, null, null);
+        event.timestamp = timestamp;
+        return event;
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ImmediateRequestMakerTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ImmediateRequestMakerTests.java
new file mode 100644
index 000000000..6bda5aad1
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ImmediateRequestMakerTests.java
@@ -0,0 +1,220 @@
+package ly.count.sdk.java.internal;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.json.JSONObject;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * {@link ImmediateRequestMaker}, the "answer me now" path that feedback widgets, remote config and
+ * content all use instead of the request queue.
+ * <p>
+ * Driven against a real loopback {@link HttpServer} so the response handling is exercised for real:
+ * the other module tests replace this class with a lambda, which is why it had no coverage. The
+ * distinction that matters is how each response shape is handed back, because a widget that gets a
+ * null where it expected an object simply never appears.
+ */
+@RunWith(JUnit4.class)
+public class ImmediateRequestMakerTests {
+
+    private HttpServer server;
+    private int port;
+    private volatile int responseCode = 200;
+    private volatile String responseBody = "{\"result\":\"ok\"}";
+    private final AtomicReference<String> lastQuery = new AtomicReference<>();
+
+    @Before
+    public void beforeTest() throws IOException {
+        TestUtils.createCleanTestState();
+        responseCode = 200;
+        responseBody = "{\"result\":\"ok\"}";
+        lastQuery.set(null);
+
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        port = server.getAddress().getPort();
+        server.createContext("/", exchange -> {
+            lastQuery.set(exchange.getRequestURI().getRawQuery());
+            byte[] out = responseBody.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(responseCode, out.length);
+            try (OutputStream body = exchange.getResponseBody()) {
+                body.write(out);
+            }
+        });
+        server.start();
+    }
+
+    @After
+    public void stop() {
+        if (server != null) {
+            server.stop(0);
+        }
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * The three response shapes a Countly endpoint can answer with, and what each must become. A
+     * bare array has to be wrapped under "jsonArray", because that is the contract the content and
+     * feedback parsers are written against.
+     */
+    @Test
+    public void responseShapes_areHandedBackInTheFormTheCallersExpect() throws Exception {
+        Transport transport = transport();
+
+        responseBody = "{\"result\":\"an object\"}";
+        JSONObject object = request(transport, "method=object");
+        Assert.assertNotNull(object);
+        Assert.assertEquals("an object", object.getString("result"));
+        Assert.assertEquals("method=object", lastQuery.get());
+
+        // A bare array is wrapped, so callers always receive an object.
+        responseBody = "[{\"one\":1},{\"two\":2}]";
+        JSONObject wrapped = request(transport, "method=array");
+        Assert.assertNotNull(wrapped);
+        Assert.assertTrue(wrapped.has("jsonArray"));
+        Assert.assertEquals(2, wrapped.getJSONArray("jsonArray").length());
+        Assert.assertEquals(1, wrapped.getJSONArray("jsonArray").getJSONObject(0).getInt("one"));
+
+        // Leading whitespace must not stop the array from being recognised.
+        responseBody = "   [{\"three\":3}]";
+        JSONObject padded = request(transport, "method=paddedArray");
+        Assert.assertNotNull(padded);
+        Assert.assertTrue(padded.has("jsonArray"));
+    }
+
+    /**
+     * Every way a request can fail must hand back null rather than a half built object, so a caller
+     * can tell "no answer" from "an empty answer".
+     */
+    @Test
+    public void failureModes_allHandBackNull() throws Exception {
+        Transport transport = transport();
+
+        // A server error is not an answer.
+        responseCode = 500;
+        responseBody = "{\"result\":\"nope\"}";
+        Assert.assertNull(request(transport, "method=serverError"));
+
+        // Neither is a body that is not JSON at all.
+        responseCode = 200;
+        responseBody = "<html>not json</html>";
+        Assert.assertNull(request(transport, "method=notJson"));
+
+        // An empty body cannot be parsed either.
+        responseBody = "";
+        Assert.assertNull(request(transport, "method=empty"));
+    }
+
+    /**
+     * With networking switched off the request must be abandoned before a socket is opened, which is
+     * what stops the SDK from talking to a server a customer has told it not to use.
+     */
+    @Test
+    public void networkingDisabled_abandonsTheRequestWithoutContactingTheServer() throws Exception {
+        Transport transport = transport();
+
+        CountDownLatch done = new CountDownLatch(1);
+        AtomicReference<JSONObject> result = new AtomicReference<>();
+        AtomicBoolean called = new AtomicBoolean(false);
+
+        new ImmediateRequestMaker().doWork("method=disabled", "/o/sdk?", transport, false, false, response -> {
+            called.set(true);
+            result.set(response);
+            done.countDown();
+        }, logger());
+
+        Assert.assertTrue("the callback must still be invoked", done.await(10, TimeUnit.SECONDS));
+        Assert.assertTrue(called.get());
+        Assert.assertNull("a cancelled request has no result", result.get());
+        Assert.assertNull("nothing may reach the server", lastQuery.get());
+    }
+
+    /**
+     * The delayed variant, used right after a device id change so the server has a chance to catch
+     * up. It must still deliver, just later.
+     */
+    @Test
+    public void delayedRequest_stillReachesTheServerAndAnswers() throws Exception {
+        Transport transport = transport();
+        responseBody = "{\"result\":\"delayed\"}";
+
+        CountDownLatch done = new CountDownLatch(1);
+        AtomicReference<JSONObject> result = new AtomicReference<>();
+
+        new ImmediateRequestMaker().doWork("method=delayed", "/o/sdk?", transport, true, true, response -> {
+            result.set(response);
+            done.countDown();
+        }, logger());
+
+        Assert.assertTrue("a delayed request must still complete", done.await(15, TimeUnit.SECONDS));
+        Assert.assertNotNull(result.get());
+        Assert.assertEquals("delayed", result.get().getString("result"));
+        Assert.assertEquals("method=delayed", lastQuery.get());
+    }
+
+    /**
+     * A transport pointed at a port nothing is listening on must fail cleanly rather than propagating
+     * the connection error out of the SDK.
+     */
+    @Test
+    public void anUnreachableServer_failsCleanly() throws Exception {
+        server.stop(0);
+        server = null;
+
+        Transport transport = transport();
+        Assert.assertNull(request(transport, "method=unreachable"));
+    }
+
+    // endregion
+    // region helpers
+
+    private Log logger() {
+        return new Log(Config.LoggingLevel.OFF, null);
+    }
+
+    private Transport transport() {
+        Config config = new Config("http://127.0.0.1:" + port, TestUtils.SERVER_APP_KEY, TestUtils.getTestSDirectory())
+            .setApplicationVersion(TestUtils.APPLICATION_VERSION)
+            .setLoggingLevel(Config.LoggingLevel.OFF);
+        Transport transport = new Transport();
+        transport.init(TestUtils.getInternalConfigWithLogger(config));
+        return transport;
+    }
+
+    /**
+     * Runs one immediate request and waits for its callback.
+     *
+     * @param transport the transport to send through
+     * @param requestData the url-encoded request parameters
+     * @return whatever the maker handed the callback, possibly null
+     */
+    private JSONObject request(Transport transport, String requestData) throws InterruptedException {
+        CountDownLatch done = new CountDownLatch(1);
+        AtomicReference<JSONObject> result = new AtomicReference<>();
+
+        new ImmediateRequestMaker().doWork(requestData, "/o/sdk?", transport, false, true, response -> {
+            result.set(response);
+            done.countDown();
+        }, logger());
+
+        Assert.assertTrue("the immediate request never completed", done.await(15, TimeUnit.SECONDS));
+        return result.get();
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/InternalConfigTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/InternalConfigTests.java
new file mode 100644
index 000000000..7c30d6f7f
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/InternalConfigTests.java
@@ -0,0 +1,147 @@
+package ly.count.sdk.java.internal;
+
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * {@link InternalConfig}, the copy of the customer's {@link Config} that the modules actually read.
+ * <p>
+ * Its job is to carry every configured value across unchanged and to hold the device id list, so the
+ * two things worth proving are that the copy is faithful and that the device id bookkeeping cannot
+ * lose the current id.
+ */
+@RunWith(JUnit4.class)
+public class InternalConfigTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * The copy constructor must carry the customer's settings across verbatim. A value that failed to
+     * copy would leave the modules running on a default nobody asked for.
+     */
+    @Test
+    public void copyConstructor_carriesTheCustomerSettingsAcross() {
+        Config source = TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.Events, Config.Feature.Views)
+            .setEventQueueSizeToSend(13)
+            .setUpdateSessionTimerDelay(44)
+            .setNetworkConnectTimeout(19)
+            .setLoggingLevel(Config.LoggingLevel.INFO)
+            .enableParameterTamperingProtection("copy-salt");
+
+        InternalConfig copy = new InternalConfig(source);
+
+        Assert.assertEquals(source.getServerURL().toString(), copy.getServerURL().toString());
+        Assert.assertEquals(source.getServerAppKey(), copy.getServerAppKey());
+        Assert.assertEquals(source.getApplicationVersion(), copy.getApplicationVersion());
+        Assert.assertEquals(13, copy.getEventsBufferSize());
+        Assert.assertEquals(44, copy.getSendUpdateEachSeconds());
+        Assert.assertEquals(19, copy.getNetworkConnectionTimeout());
+        Assert.assertEquals(Config.LoggingLevel.INFO, copy.getLoggingLevel());
+        Assert.assertEquals("copy-salt", copy.getParameterTamperingProtectionSalt());
+        Assert.assertEquals(source.getFeaturesMap(), copy.getFeatures1());
+        Assert.assertTrue(copy.isFeatureEnabled(Config.Feature.Events));
+
+        // Nothing was configured to override, so the override set is empty rather than null.
+        Assert.assertNotNull(copy.getModuleOverrides());
+        Assert.assertTrue(copy.getModuleOverrides().isEmpty());
+
+        // Networking defaults to in-process and is switchable.
+        Assert.assertTrue(copy.isDefaultNetworking());
+        copy.setDefaultNetworking(false);
+        Assert.assertFalse(copy.isDefaultNetworking());
+        copy.setDefaultNetworking(true);
+        Assert.assertTrue(copy.isDefaultNetworking());
+    }
+
+    /**
+     * The device id list. Setting a new id must hand back the one it replaced so the caller can put
+     * it on the wire as the old id, and removing must work by instance and by id string alike.
+     */
+    @Test
+    public void deviceIdBookkeeping_replacesAndRemovesById() {
+        InternalConfig config = new InternalConfig(TestUtils.getBaseConfig());
+
+        Assert.assertNull("a fresh config has no device id", config.getDeviceId());
+
+        Config.DID first = new Config.DID(Config.DID.STRATEGY_CUSTOM, "first_id");
+        Assert.assertNull("the first set replaces nothing", config.setDeviceId(first));
+        Assert.assertEquals(first, config.getDeviceId());
+
+        Config.DID second = new Config.DID(Config.DID.STRATEGY_CUSTOM, "second_id");
+        Assert.assertEquals("setting a new id must return the previous one", first, config.setDeviceId(second));
+        Assert.assertEquals(second, config.getDeviceId());
+
+        // Removing by a matching id string finds and drops it.
+        Assert.assertTrue(config.removeDeviceId("second_id"));
+        Assert.assertNull(config.getDeviceId());
+
+        // Removing something that is not there is false, not an exception.
+        Assert.assertFalse(config.removeDeviceId("never_stored"));
+        Assert.assertFalse(config.removeDeviceId(first));
+
+        // And removing by instance works too.
+        config.setDeviceId(first);
+        Assert.assertTrue(config.removeDeviceId(first));
+        Assert.assertNull(config.getDeviceId());
+    }
+
+    /**
+     * The two constructors that exist only to be refused. Both would leave the SDK without a usable
+     * server URL, so each must fail loudly at construction rather than later on the first request.
+     */
+    @Test
+    public void theUnusableConstructors_refuseToBuild() {
+        try {
+            new InternalConfig("http://count.ly", "a key");
+            Assert.fail("the url and app key constructor must not be usable");
+        } catch (IllegalStateException expected) {
+            Assert.assertTrue(expected.getMessage().contains("should not be used"));
+        }
+
+        // The no-argument one builds, but only with placeholder values that are not a real server.
+        InternalConfig placeholder = new InternalConfig();
+        Assert.assertEquals("http://count.ly", placeholder.getServerURL().toString());
+        Assert.assertEquals("not a key", placeholder.getServerAppKey());
+    }
+
+    /**
+     * The logger the modules use comes off the internal config, and it must be the one built from the
+     * customer's configured level rather than a default.
+     */
+    @Test
+    public void theModuleLogger_comesFromTheConfiguredLevel() {
+        StringBuilder captured = new StringBuilder();
+
+        Countly.instance().init(TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.Events)
+            .setLoggingLevel(Config.LoggingLevel.VERBOSE)
+            .setLogListener((message, level) -> captured.append(message).append('\n')));
+
+        InternalConfig config = SDKCore.instance.config;
+        Assert.assertNotNull(config.getLogger());
+        Assert.assertSame("the SDK must expose itself on its own config", SDKCore.instance, config.sdk);
+        Assert.assertNotNull(config.storageProvider);
+
+        config.getLogger().i("[InternalConfigTests] a message through the module logger");
+        Assert.assertTrue(captured.toString().contains("a message through the module logger"));
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleContentTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleContentTests.java
new file mode 100644
index 000000000..1691226a4
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleContentTests.java
@@ -0,0 +1,548 @@
+package ly.count.sdk.java.internal;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Content zone behaviour, driven through the public {@code Countly.instance().content()} interface.
+ * <p>
+ * The zone timer is driven by hand ({@link ModuleContent#onZoneTimerTick()}) in every test but
+ * {@link #zoneTimer_drivesFetchesOnItsOwn()}, so the assertions do not depend on wall clock timing.
+ */
+@RunWith(JUnit4.class)
+public class ModuleContentTests {
+
+    private static final String CONTENT_URL = "https://content.count.ly/block-1";
+    private static final String CONTENT_RESPONSE =
+        "{\"html\":\"" + CONTENT_URL + "\",\"geo\":{"
+            + "\"p\":{\"x\":10,\"y\":20,\"w\":300,\"h\":400},"
+            + "\"l\":{\"x\":30,\"y\":40,\"w\":500,\"h\":600}}}";
+    private static final String NO_CONTENT_RESPONSE = "{\"jsonArray\":[{\"result\":\"No content block found!\"}]}";
+
+    private final List<Map<String, String>> requests = new ArrayList<>();
+    private final List<String> endpoints = new ArrayList<>();
+    private JSONObject nextResponse = null;
+    private CountDownLatch requestLatch = null;
+
+    private FakeDisplay display;
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+        requests.clear();
+        endpoints.clear();
+        nextResponse = null;
+        requestLatch = null;
+        display = new FakeDisplay();
+    }
+
+    @After
+    public void stop() {
+        CountlyTimer.TIMER_DELAY_MS = 0;
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * Entering a content zone, then letting the zone poll once.
+     * <p>
+     * Verifies the wire shape of the fetch, that the parsed content reaches the display with the
+     * placement matching the surface orientation, and that a second poll does not fetch again while
+     * that content is still on screen.
+     */
+    @Test
+    public void enterContentZone_fetchesOnceAndPresentsTheContent() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        // The first fetch waits for the zone's start delay, so nothing is on the wire yet.
+        Assert.assertTrue(requests.isEmpty());
+
+        tick();
+
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals("/o/sdk/content?", endpoints.get(0));
+
+        Map<String, String> params = requests.get(0);
+        TestUtils.validateRequiredParams(params);
+        Assert.assertEquals("queue", params.get("method"));
+        Assert.assertEquals("desktop", params.get("dt"));
+        // Content categories are not supported by the server, so nothing is sent for them.
+        Assert.assertNull(params.get("category"));
+        Assert.assertFalse(params.get("la").isEmpty());
+        Assert.assertEquals("{\"l\":{\"w\":1600,\"h\":900},\"p\":{\"w\":1600,\"h\":900}}", Utils.urldecode(params.get("resolution")));
+        Assert.assertNull(params.get("content_id"));
+        Assert.assertNull(params.get("preview"));
+
+        Assert.assertEquals(1, display.presented.size());
+        ContentData shown = display.presented.get(0);
+        Assert.assertEquals(CONTENT_URL, shown.url);
+        // A 1600x900 surface is landscape, so the landscape rectangle wins.
+        ContentPlacement placement = shown.placementFor(true);
+        Assert.assertEquals(30, placement.x);
+        Assert.assertEquals(40, placement.y);
+        Assert.assertEquals(500, placement.width);
+        Assert.assertEquals(600, placement.height);
+
+        tick();
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals(1, display.presented.size());
+    }
+
+    /**
+     * A content zone cannot be entered before a display is registered, and entering again once one
+     * is registered works.
+     */
+    @Test
+    public void enterContentZone_withoutADisplay_isIgnored() throws JSONException {
+        init(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertTrue(requests.isEmpty());
+        Assert.assertTrue(display.presented.isEmpty());
+
+        Countly.instance().content().setContentDisplay(display);
+        Countly.instance().content().enterContentZone();
+        tick();
+
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals(1, display.presented.size());
+    }
+
+    /**
+     * With consent required, the content interface is unreachable until content consent is given,
+     * and a zone that is already running is torn down when that consent is taken away again.
+     */
+    @Test
+    public void content_isGatedByConsent() throws JSONException {
+        Config config = TestUtils.getConfigContent().setRequiresConsent(true);
+        init(config);
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Assert.assertNull(Countly.instance().content());
+
+        Countly.onConsent(Config.Feature.Content, Config.Feature.Events);
+        installRequestMaker();
+
+        ModuleContent.Content content = Countly.instance().content();
+        Assert.assertNotNull(content);
+        content.setContentDisplay(display);
+        content.enterContentZone();
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        Countly.onConsentRemoval(Config.Feature.Content);
+        Assert.assertNull(Countly.instance().content());
+        Assert.assertEquals(1, requests.size());
+    }
+
+    /**
+     * A response the server sends when it has nothing to show, and a failed request, both leave the
+     * zone polling instead of wedging it.
+     */
+    @Test
+    public void noContentInResponse_keepsThePollingGoing() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+
+        Countly.instance().content().enterContentZone();
+
+        nextResponse = new JSONObject(NO_CONTENT_RESPONSE);
+        tick();
+        Assert.assertEquals(1, requests.size());
+        Assert.assertTrue(display.presented.isEmpty());
+
+        // A null response is what a failed request looks like to the module.
+        nextResponse = null;
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertTrue(display.presented.isEmpty());
+
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+        tick();
+        Assert.assertEquals(3, requests.size());
+        Assert.assertEquals(1, display.presented.size());
+    }
+
+    /**
+     * Closing a content block reports it to the global content callback and holds the zone back for
+     * a couple of polls, so the server can process whatever the content recorded.
+     */
+    @Test
+    public void contentClose_reportsToTheCallbackAndPausesTheZone() throws JSONException {
+        final List<ContentStatus> statuses = new ArrayList<>();
+        final List<Map<String, Object>> payloads = new ArrayList<>();
+
+        Config config = TestUtils.getConfigContent();
+        config.content.setGlobalContentCallback((status, data) -> {
+            statuses.add(status);
+            payloads.add(data);
+        });
+        initWithContent(config);
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(1, display.presented.size());
+
+        Map<String, Object> closeData = new HashMap<>();
+        closeData.put("cly_x_action_event", "1");
+        closeData.put("close", "1");
+        display.lastCallback.onClosed(closeData);
+
+        Assert.assertEquals(1, statuses.size());
+        Assert.assertEquals(ContentStatus.CLOSED, statuses.get(0));
+        Assert.assertEquals("1", payloads.get(0).get("close"));
+
+        for (int i = 0; i < ModuleContent.POST_CLOSE_SKIPPED_TICKS; i++) {
+            tick();
+            Assert.assertEquals(1, requests.size());
+        }
+
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals(2, display.presented.size());
+    }
+
+    /**
+     * Leaving a content zone stops the polling but leaves a content block that is already on screen
+     * alone, and entering again restarts the cycle.
+     */
+    @Test
+    public void exitContentZone_stopsPollingWithoutClosingWhatIsOnScreen() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals(1, display.presented.size());
+
+        Countly.instance().content().exitContentZone();
+        Assert.assertFalse(display.closed.get());
+
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals(2, display.presented.size());
+    }
+
+    /**
+     * A display that throws while showing content must not leave the zone believing something is on
+     * screen, which would block every later fetch.
+     */
+    @Test
+    public void throwingDisplay_doesNotWedgeTheZone() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        display.throwOnPresent = true;
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals(1, display.presented.size());
+
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals(2, display.presented.size());
+    }
+
+    /**
+     * Previewing one specific content block: the fetch carries the block's ID, a blank ID is
+     * rejected, and a preview cannot stack on top of a content block that is already on screen.
+     */
+    @Test
+    public void previewContent_fetchesTheGivenBlockAndGuardsAgainstStacking() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().previewContent(null);
+        Countly.instance().content().previewContent("");
+        Assert.assertTrue(requests.isEmpty());
+
+        Countly.instance().content().previewContent("block_42");
+        Assert.assertEquals(1, requests.size());
+        Assert.assertEquals("/o/sdk/content?", endpoints.get(0));
+        Assert.assertEquals("block_42", requests.get(0).get("content_id"));
+        Assert.assertEquals("true", requests.get(0).get("preview"));
+        Assert.assertEquals(1, display.presented.size());
+
+        Countly.instance().content().previewContent("block_43");
+        Assert.assertEquals(1, requests.size());
+    }
+
+    /**
+     * Refreshing a content zone flushes the event queue and re-enters, but is ignored while a
+     * content block is on screen.
+     */
+    @Test
+    public void refreshContentZone_flushesEventsAndReEnters() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(1, display.presented.size());
+
+        Countly.instance().content().refreshContentZone();
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        display.lastCallback.onClosed(new HashMap<>());
+
+        Countly.instance().events().recordEvent("trigger_event");
+        Assert.assertEquals(1, eventQueueSize());
+
+        Countly.instance().content().refreshContentZone();
+        Assert.assertEquals(0, eventQueueSize());
+
+        // Re-entering resets the post close wait, so the very next poll fetches.
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals(2, display.presented.size());
+    }
+
+    /**
+     * Events a content block asks for are recorded with either segmentation key, entries without a
+     * key are dropped, and the queue is pushed out so the server can act on them.
+     */
+    @Test
+    public void recordContentEvents_recordsEveryUsableEntryAndFlushes() {
+        initWithContent(TestUtils.getConfigContent());
+
+        Countly.instance().content().recordContentEvents(
+            "[{\"key\":\"[CLY]_content_shown\",\"sg\":{\"a\":\"1\"}},"
+                + "{\"key\":\"with_segmentation\",\"segmentation\":{\"b\":2}},"
+                + "{\"sg\":{\"c\":\"3\"}},"
+                + "{\"key\":\"\"}]");
+
+        Assert.assertEquals(0, eventQueueSize());
+        List<EventImpl> events = TestUtils.readEventsFromRequest();
+        Assert.assertEquals(2, events.size());
+        Assert.assertEquals("[CLY]_content_shown", events.get(0).key);
+        Assert.assertEquals("1", events.get(0).segmentation.get("a"));
+        Assert.assertEquals("with_segmentation", events.get(1).key);
+        Assert.assertEquals(2, events.get(1).segmentation.get("b"));
+
+        // Nothing usable, nothing recorded, and no crash on malformed input.
+        int requestCount = TestUtils.getCurrentRQ().length;
+        Countly.instance().content().recordContentEvents("not json at all");
+        Countly.instance().content().recordContentEvents("");
+        Countly.instance().content().recordContentEvents(null);
+        Assert.assertEquals(requestCount, TestUtils.getCurrentRQ().length);
+    }
+
+    /**
+     * Switching users. A device ID change with merge is the same user, so the zone keeps polling. A
+     * change without merge is a different user, so the zone is torn down and only a deliberate
+     * enter brings it back.
+     */
+    @Test
+    public void deviceIdChange_withoutMergeLeavesTheContentZone() throws JSONException {
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(NO_CONTENT_RESPONSE);
+
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        // Same user: the zone survives and keeps fetching, now under the new ID.
+        Countly.instance().deviceId().changeWithMerge("merged_user");
+        tick();
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals("merged_user", requests.get(1).get("device_id"));
+
+        // Different user: the zone is gone, so polling stops.
+        Countly.instance().deviceId().changeWithoutMerge("other_user");
+        tick();
+        Assert.assertEquals(2, requests.size());
+
+        // Only a deliberate enter brings it back, and it fetches for the new user.
+        Countly.instance().content().setContentDisplay(display);
+        Countly.instance().content().enterContentZone();
+        tick();
+        Assert.assertEquals(3, requests.size());
+        Assert.assertEquals("other_user", requests.get(2).get("device_id"));
+    }
+
+    /**
+     * "setID" changes the device ID without merge once an ID was already developer supplied, so it
+     * leaves the content zone. Granting the consents again and entering again is what an application
+     * runs on a login, and it has to end with a working zone.
+     */
+    @Test
+    public void setID_leavesTheZoneAndSurvivesAConsentRegrant() throws JSONException {
+        Config config = TestUtils.getConfigContent().setRequiresConsent(true);
+        init(config);
+        Countly.onConsent(Config.Feature.values());
+        installRequestMaker();
+
+        Countly.instance().content().setContentDisplay(display);
+        Countly.instance().content().enterContentZone();
+        nextResponse = new JSONObject(NO_CONTENT_RESPONSE);
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        // The test config supplies a custom device ID, so setID changes it without merge.
+        Countly.instance().deviceId().setID("logged_in_user");
+        tick();
+        Assert.assertEquals(1, requests.size());
+
+        Countly.onConsent(Config.Feature.values());
+
+        ModuleContent.Content content = Countly.instance().content();
+        Assert.assertNotNull(content);
+        content.setContentDisplay(display);
+        content.enterContentZone();
+        tick();
+
+        Assert.assertEquals(2, requests.size());
+        Assert.assertEquals("logged_in_user", requests.get(1).get("device_id"));
+    }
+
+    /**
+     * The zone fetch interval only accepts sane values, so a mistyped configuration cannot turn the
+     * zone into a busy loop.
+     */
+    @Test
+    public void zoneTimerInterval_rejectsValuesBelowTheMinimum() {
+        Config config = TestUtils.getConfigContent();
+
+        config.content.setZoneTimerInterval(1);
+        Assert.assertEquals(ConfigContent.DEFAULT_ZONE_TIMER_INTERVAL, config.content.zoneTimerInterval);
+
+        config.content.setZoneTimerInterval(ConfigContent.MIN_ZONE_TIMER_INTERVAL - 1);
+        Assert.assertEquals(ConfigContent.DEFAULT_ZONE_TIMER_INTERVAL, config.content.zoneTimerInterval);
+
+        config.content.setZoneTimerInterval(60);
+        Assert.assertEquals(60, config.content.zoneTimerInterval);
+    }
+
+    /**
+     * The zone really is driven by its own timer, not only by the hand driven ticks the other tests
+     * use.
+     */
+    @Test
+    public void zoneTimer_drivesFetchesOnItsOwn() throws JSONException, InterruptedException {
+        CountlyTimer.TIMER_DELAY_MS = 50;
+        initWithContent(TestUtils.getConfigContent());
+        nextResponse = new JSONObject(CONTENT_RESPONSE);
+        requestLatch = new CountDownLatch(1);
+
+        Countly.instance().content().enterContentZone();
+
+        Assert.assertTrue("the zone timer never fetched", requestLatch.await(5, TimeUnit.SECONDS));
+        Countly.instance().content().exitContentZone();
+    }
+
+    // endregion
+    // region helpers
+
+    private void init(Config config) {
+        Countly.instance().init(config);
+        installRequestMaker();
+    }
+
+    private void initWithContent(Config config) {
+        init(config);
+        Countly.instance().content().setContentDisplay(display);
+    }
+
+    private void installRequestMaker() {
+        ImmediateRequestI requestMaker = (requestData, customEndpoint, cp, requestShouldBeDelayed, networkingIsEnabled, callback, log) -> {
+            synchronized (requests) {
+                requests.add(TestUtils.parseQueryParams(requestData));
+                endpoints.add(customEndpoint);
+            }
+            if (requestLatch != null) {
+                requestLatch.countDown();
+            }
+            callback.callback(nextResponse);
+        };
+        SDKCore.instance.config.immediateRequestGenerator = () -> requestMaker;
+    }
+
+    private void tick() {
+        SDKCore.instance.module(ModuleContent.class).onZoneTimerTick();
+    }
+
+    private int eventQueueSize() {
+        return SDKCore.instance.module(ModuleEvents.class).eventQueue.eqSize();
+    }
+
+    private static class FakeDisplay implements ContentDisplay {
+
+        final List<ContentData> presented = new ArrayList<>();
+        final AtomicBoolean closed = new AtomicBoolean(false);
+        ContentCloseCallback lastCallback;
+        boolean throwOnPresent = false;
+
+        @Override
+        public ContentScreen getScreen() {
+            return new ContentScreen(1600, 900);
+        }
+
+        @Override
+        public void present(ContentData content, ContentCloseCallback onClosed) {
+            presented.add(content);
+            lastCallback = data -> {
+                closed.set(true);
+                onClosed.onClosed(data);
+            };
+            if (throwOnPresent) {
+                throw new IllegalStateException("this display cannot show anything");
+            }
+        }
+    }
+
+    // endregion
+    /**
+     * The first fetch of a zone waits only for what is left of the SDK's own start up window.
+     * <p>
+     * Charging the full delay to every call put four seconds between "enter the content zone" and
+     * anything appearing, however long the application had been running, which reads as content that
+     * loads late. The floor still holds for a zone entered in the same breath as init, which is what
+     * it is there for.
+     */
+    @Test
+    public void firstFetchDelay_isAFloorFromInitNotAToll() {
+        Countly.instance().init(TestUtils.getConfigContent());
+        ModuleContent module = (ModuleContent) SDKCore.instance.module(ModuleContent.class);
+
+        long atInit = module.firstFetchDelay();
+        Assert.assertTrue("a zone entered at init still waits: " + atInit,
+            atInit > 0 && atInit <= ModuleContent.START_DELAY_MS);
+
+        // An application that has been up longer than the window has already waited it out.
+        module.startedAtForTests(System.currentTimeMillis() - ModuleContent.START_DELAY_MS - 1);
+        Assert.assertEquals(0, module.firstFetchDelay());
+
+        // Halfway through the window, only the remainder is left.
+        module.startedAtForTests(System.currentTimeMillis() - ModuleContent.START_DELAY_MS / 2);
+        long halfway = module.firstFetchDelay();
+        Assert.assertTrue("about half the window should remain: " + halfway,
+            halfway > 0 && halfway <= ModuleContent.START_DELAY_MS / 2 + 200);
+    }
+
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleFeedbackTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleFeedbackTests.java
index 815dbbdd3..266b148d8 100644
--- a/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleFeedbackTests.java
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ModuleFeedbackTests.java
@@ -81,6 +81,33 @@ public void parseFeedbackList() throws JSONException {
         ValidateReturnedFeedbackWidget(FeedbackWidgetType.rating, "ratingName1", "614871419f030e44be07d82f", new String[] { "/" }, ret.get(3));
     }
 
+    /**
+     * "parseFeedbackList"
+     * Widgets given with and without an 'appearance.position'
+     * The position should be parsed when present and left null otherwise, since it anchors the
+     * widget on screen and a missing one has to fall back to the type's default
+     */
+    @Test
+    public void parseFeedbackList_position() throws JSONException {
+        init(TestUtils.getConfigFeedback());
+
+        String requestJson = "{\"result\":["
+            + "{\"_id\":\"id1\",\"type\":\"survey\",\"appearance\":{\"position\":\"bRight\"},\"name\":\"w1\",\"tg\":[]},"
+            + "{\"_id\":\"id2\",\"type\":\"survey\",\"appearance\":{\"color\":\"#fff\"},\"name\":\"w2\",\"tg\":[]},"
+            + "{\"_id\":\"id3\",\"type\":\"nps\",\"name\":\"w3\",\"tg\":[]},"
+            + "{\"_id\":\"id4\",\"type\":\"rating\",\"appearance\":{\"position\":\"mleft\"},\"name\":\"w4\",\"tg\":[]}"
+            + "]}";
+
+        List<CountlyFeedbackWidget> ret = new ArrayList<>();
+        Assert.assertNull(ModuleFeedback.parseFeedbackList(new JSONObject(requestJson), ret));
+        Assert.assertEquals(4, ret.size());
+
+        Assert.assertEquals("bRight", ret.get(0).position);
+        Assert.assertNull("no position in appearance", ret.get(1).position);
+        Assert.assertNull("no appearance at all", ret.get(2).position);
+        Assert.assertEquals("mleft", ret.get(3).position);
+    }
+
     /**
      * "parseFeedbackList"
      * Response with partial entries given
@@ -224,6 +251,53 @@ public void getAvailableFeedbackWidgets_base(List<CountlyFeedbackWidget> expecte
         });
     }
 
+    /**
+     * "FeedbackWidgetSelector.select"
+     * A fetched widget list is searched by type, and by widget ID, name or tag
+     * The first widget matching both the type and the selector is returned, and a selector that
+     * matches nothing returns "null" instead of an unrelated widget
+     */
+    @Test
+    public void selectWidget_byTypeAndNameIdOrTag() {
+        List<CountlyFeedbackWidget> widgets = new ArrayList<>();
+        widgets.add(widget("nps_1", FeedbackWidgetType.nps, "First NPS", new String[] { "checkout" }));
+        widgets.add(widget("nps_2", FeedbackWidgetType.nps, "Second NPS", new String[] { "onboarding", "beta" }));
+        widgets.add(widget("survey_1", FeedbackWidgetType.survey, "Only survey", new String[] {}));
+        widgets.add(widget("rating_1", FeedbackWidgetType.rating, "Only rating", null));
+
+        // No selector: the first widget of that type wins.
+        Assert.assertEquals("nps_1", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, null).widgetId);
+        Assert.assertEquals("nps_1", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "").widgetId);
+        Assert.assertEquals("survey_1", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.survey, "").widgetId);
+
+        // By ID, by name and by tag.
+        Assert.assertEquals("nps_2", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "nps_2").widgetId);
+        Assert.assertEquals("nps_2", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "Second NPS").widgetId);
+        Assert.assertEquals("nps_2", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "beta").widgetId);
+        Assert.assertEquals("nps_1", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "checkout").widgetId);
+
+        // The type always wins over the selector: a survey tag must not return the NPS widget.
+        Assert.assertNull(FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.survey, "checkout"));
+        Assert.assertNull(FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.nps, "nothing_matches"));
+
+        // A widget with no tags at all must not blow up the search.
+        Assert.assertEquals("rating_1", FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.rating, "Only rating").widgetId);
+        Assert.assertNull(FeedbackWidgetSelector.select(widgets, FeedbackWidgetType.rating, "some_tag"));
+
+        Assert.assertNull(FeedbackWidgetSelector.select(null, FeedbackWidgetType.nps, ""));
+        Assert.assertNull(FeedbackWidgetSelector.select(new ArrayList<>(), FeedbackWidgetType.nps, ""));
+        Assert.assertNull(FeedbackWidgetSelector.select(widgets, null, ""));
+    }
+
+    private static CountlyFeedbackWidget widget(String id, FeedbackWidgetType type, String name, String[] tags) {
+        CountlyFeedbackWidget widget = new CountlyFeedbackWidget();
+        widget.widgetId = id;
+        widget.type = type;
+        widget.name = name;
+        widget.tags = tags;
+        return widget;
+    }
+
     public void constructFeedbackWidgetUrl_base(CountlyFeedbackWidget widgetInfo, boolean goodResult) {
         init(TestUtils.getConfigFeedback());
 
@@ -247,7 +321,17 @@ public void constructFeedbackWidgetUrl_base(CountlyFeedbackWidget widgetInfo, bo
         widgetListUrl.append("&sdk_name=");
         widgetListUrl.append(TestUtils.SDK_NAME);
         widgetListUrl.append("&platform=");
-        widgetListUrl.append(Utils.urlencode(getOS(), L));
+        // The feedback platform is one value for every desktop, not the operating system's name:
+        // see WidgetUrlBuilder.PLATFORM.
+        widgetListUrl.append(WidgetUrlBuilder.PLATFORM);
+        widgetListUrl.append("&app_version=");
+        widgetListUrl.append(Utils.urlencode(TestUtils.APPLICATION_VERSION, L));
+        // Desktop web views need the widget to draw itself as a card with its own close button, and
+        // the page only accepts the SDK's viewport message when the origin matches.
+        widgetListUrl.append("&custom=");
+        widgetListUrl.append(Utils.urlencode(WidgetUrlBuilder.CUSTOM_PARAMS, L));
+        widgetListUrl.append("&origin=");
+        widgetListUrl.append(TestUtils.SERVER_URL);
 
         Assert.assertEquals(widgetListUrl.toString(), Countly.instance().feedback().constructFeedbackWidgetUrl(widgetInfo));
     }
@@ -533,7 +617,8 @@ public void reportFeedbackWidgetManually_rq() {
 
     private void validateWidgetDataParams(Map<String, String> params, CountlyFeedbackWidget widgetInfo) {
         Assert.assertEquals(widgetInfo.widgetId, params.get("widget_id"));
-        Assert.assertEquals(Utils.urlencode(getOS(), L), params.get("platform"));
+        // One value for every desktop, not the operating system's name: see WidgetUrlBuilder.PLATFORM.
+        Assert.assertEquals(WidgetUrlBuilder.PLATFORM, params.get("platform"));
         Assert.assertEquals("1", params.get("shown"));
         Assert.assertEquals(String.valueOf(SDKCore.instance.config.getApplicationVersion()), params.get("app_version"));
         TestUtils.validateSdkIdentityParams(params);
@@ -579,7 +664,7 @@ private ModuleEvents moduleEvents() {
 
     private Map<String, Object> requiredWidgetSegmentation(String widgetId, Map<String, Object> widgetResult) {
         Map<String, Object> segm = new ConcurrentHashMap<>();
-        segm.put("platform", getOS());
+        segm.put("platform", WidgetUrlBuilder.PLATFORM);
         segm.put("app_version", SDKCore.instance.config.getApplicationVersion());
         segm.put("widget_id", widgetId);
         if (widgetResult != null) {
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioLocationTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioLocationTests.java
index 6e5e6c1fe..7faf8818b 100644
--- a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioLocationTests.java
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioLocationTests.java
@@ -190,9 +190,15 @@ protected void validateLocationRequestInRQ(Map<String, Object> expectedParams, i
             TestUtils.validateMetrics(requestsInQ[rqIdx].get("metrics"));
             expectedSessionParams += 2; // we need to add 2 more params for metrics and session_id
         } else if (expectedParams.containsKey("end_session")) {
-            expectedSessionParams += 1; // we need to add 1 more param for session_duration
+            expectedSessionParams += 1; // session_id
+            // session_duration is sent only when the session lasted long enough to round up to a
+            // second, so under load these short sessions carry it and on a quiet machine they don't.
+            if (requestsInQ[rqIdx].containsKey("session_duration")) {
+                expectedSessionParams += 1;
+            }
         }
-        Assert.assertEquals(9 + expectedParams.size() + expectedSessionParams, requestsInQ[rqIdx].size()); // so we need to add expect 9 + params size
+        Assert.assertEquals("params were " + new java.util.TreeMap<>(requestsInQ[rqIdx]).keySet(),
+            9 + expectedParams.size() + expectedSessionParams, requestsInQ[rqIdx].size()); // so we need to add expect 9 + params size
         expectedParams.forEach((key, value) -> Assert.assertEquals(value.toString(), requestsInQ[rqIdx].get(key)));
     }
 }
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioNetworkDeadlockTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioNetworkDeadlockTests.java
index 5a2cd31a5..852ec3702 100644
--- a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioNetworkDeadlockTests.java
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioNetworkDeadlockTests.java
@@ -134,7 +134,15 @@ public void serverRecovery_sdkResumesSending() throws Exception {
 
         Countly.instance().init(configForLocalServer());
         Countly.session().begin();
-        Thread.sleep(2000);
+
+        // Poll instead of sleeping a fixed 2s and asserting immediately. The
+        // property under test is "the SDK does not stay stuck sending", so
+        // waiting longer for isSending() to clear is correct; a genuine deadlock
+        // still fails the assertion when the budget runs out.
+        long deadline = System.currentTimeMillis() + 30_000;
+        while (SDKCore.instance.networking.isSending() && System.currentTimeMillis() < deadline) {
+            Thread.sleep(100);
+        }
 
         Assert.assertFalse(
             "SDK should recover from 502 HTML response",
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioRequestQueueStallTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioRequestQueueStallTests.java
index 5f4c46f44..7dab91b7f 100644
--- a/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioRequestQueueStallTests.java
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/ScenarioRequestQueueStallTests.java
@@ -1,11 +1,14 @@
 package ly.count.sdk.java.internal;
 
 import com.sun.net.httpserver.HttpServer;
+import java.io.File;
 import java.io.OutputStream;
 import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.BooleanSupplier;
 import ly.count.sdk.java.Config;
 import ly.count.sdk.java.Countly;
 import org.junit.After;
@@ -29,12 +32,48 @@
  * To reproduce deterministically we hold request #1 open with a CountDownLatch
  * while we generate a backlog, then release it and assert the backlog drains
  * without any external trigger.
+ *
+ * Timing note: every wait here is a *generous upper bound* on a condition we
+ * poll for, never a fixed sleep calibrated to one machine. The regression this
+ * guards against is "the queue stops forever", so a slow CI runner must make
+ * the test slower, never red. Only the drain assertion is a real assertion —
+ * the setup waits are preconditions.
+ *
+ * Deliberately left on the production session update interval (60s). Shortening
+ * it makes the SDK's own timer drain the backlog, which would make this test
+ * pass even with the issue-271 bug present. The callback re-entry path must be
+ * the only thing that can drain the queue here.
  */
 @RunWith(JUnit4.class)
 public class ScenarioRequestQueueStallTests {
 
+    /**
+     * Upper bound for a precondition to become true. Not a measurement.
+     *
+     * Sized from observed behaviour with a large margin: while a request is in
+     * flight the synchronous Countly calls in the setup phase have been seen to
+     * block for ~17s on a developer machine, and the drain runs at roughly one
+     * request per second. These bounds cost nothing when the test passes -- the
+     * waits return as soon as their condition holds -- so they are set well
+     * above the worst case rather than close to the typical case.
+     */
+    private static final long SETUP_TIMEOUT_MS = 60_000;
+    /** Upper bound for the queue to drain once request #1 is released. */
+    private static final long DRAIN_TIMEOUT_MS = 60_000;
+    /**
+     * How long the server handler holds request #1 open. Must comfortably
+     * exceed the whole setup phase: if it expires on its own the request
+     * completes early and the backlog scenario never happens, which would show
+     * up as a confusing drain failure rather than an honest timeout.
+     */
+    private static final long HOLD_TIMEOUT_MS = 120_000;
+    private static final int BACKLOG_SIZE = 5;
+    private static final int POLL_INTERVAL_MS = 50;
+
     private HttpServer server;
     private int port;
+    /** Released in tearDown too, so a failed assertion never leaves the handler thread parked. */
+    private final CountDownLatch releaseFirstRequest = new CountDownLatch(1);
 
     @Before
     public void setUp() {
@@ -43,6 +82,7 @@ public void setUp() {
 
     @After
     public void tearDown() {
+        releaseFirstRequest.countDown();
         Countly.instance().halt();
         if (server != null) {
             server.stop(0);
@@ -57,6 +97,37 @@ private Config configForLocalServer() {
             .setEventQueueSizeToSend(1);
     }
 
+    /**
+     * Polls until the condition holds or the budget runs out.
+     *
+     * @return true if the condition became true within the budget
+     */
+    private static boolean waitFor(long timeoutMs, BooleanSupplier condition) throws InterruptedException {
+        long deadline = System.currentTimeMillis() + timeoutMs;
+        while (System.currentTimeMillis() < deadline) {
+            if (condition.getAsBoolean()) {
+                return true;
+            }
+            Thread.sleep(POLL_INTERVAL_MS);
+        }
+        return condition.getAsBoolean();
+    }
+
+    /** Number of persisted request files currently waiting on disk. */
+    private static int queuedRequestFileCount() {
+        File[] files = TestUtils.getTestSDirectory().listFiles();
+        if (files == null) {
+            return 0;
+        }
+        int count = 0;
+        for (File file : files) {
+            if (file.isFile() && file.getName().startsWith("[CLY]_request_")) {
+                count++;
+            }
+        }
+        return count;
+    }
+
     /**
      * Reproduces the user-reported symptom: with multiple requests piled up
      * on disk while the network is busy, the queue must drain without
@@ -69,7 +140,6 @@ private Config configForLocalServer() {
     public void backloggedRequests_drainAfterInFlightCompletes() throws Exception {
         AtomicInteger requestCount = new AtomicInteger(0);
         CountDownLatch firstRequestArrived = new CountDownLatch(1);
-        CountDownLatch releaseFirstRequest = new CountDownLatch(1);
 
         server = HttpServer.create(new InetSocketAddress(0), 0);
         port = server.getAddress().getPort();
@@ -79,58 +149,83 @@ public void backloggedRequests_drainAfterInFlightCompletes() throws Exception {
                 // Hold request #1 open until the test has built up a backlog.
                 firstRequestArrived.countDown();
                 try {
-                    releaseFirstRequest.await(10, TimeUnit.SECONDS);
+                    releaseFirstRequest.await(HOLD_TIMEOUT_MS, TimeUnit.MILLISECONDS);
                 } catch (InterruptedException ignored) {
+                    Thread.currentThread().interrupt();
                 }
             }
             String body = "{\"result\":\"Success\"}";
-            exchange.sendResponseHeaders(200, body.length());
-            OutputStream os = exchange.getResponseBody();
-            os.write(body.getBytes());
-            os.close();
+            byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(200, bytes.length);
+            try (OutputStream os = exchange.getResponseBody()) {
+                os.write(bytes);
+            }
         });
         server.start();
 
         Countly.instance().init(configForLocalServer());
         Countly.session().begin();
 
-        // Wait until request #1 has reached the server and is being held.
+        // Queue the backlog BEFORE waiting for request #1 to land.
+        //
+        // Ordering matters here and getting it wrong is what made this test
+        // flaky. DefaultNetworking.check() no-ops while config.getDeviceId() is
+        // still null, so the check() triggered by begin_session can lose that
+        // startup race. Every subsequently queued request calls check() again
+        // (SDKCore.onRequest -> Signal.Ping -> checkNetworking), so recording
+        // the events here guarantees the queue head gets dispatched. Waiting
+        // for request #1 first instead left the 60s session timer as the only
+        // retry, which is far longer than any sane test timeout.
+        //
+        // Each recordEvent flushes a new request to disk; while the server
+        // holds #1 they all pile up, because check() short-circuits on
+        // isRunning() == true.
+        for (int i = 0; i < BACKLOG_SIZE; i++) {
+            Countly.instance().events().recordEvent("backlog_evt_" + i);
+        }
+
+        // Precondition: request #1 reached the server and is being held.
         Assert.assertTrue(
-            "request #1 should reach the server within 5s",
-            firstRequestArrived.await(5, TimeUnit.SECONDS)
+            "request #1 never reached the local server within " + SETUP_TIMEOUT_MS
+                + "ms - the SDK never sent anything, so the drain scenario could not be set up",
+            firstRequestArrived.await(SETUP_TIMEOUT_MS, TimeUnit.MILLISECONDS)
         );
 
-        // Build up a backlog: each recordEvent flushes a new request to disk.
-        // While the server holds #1, all of these queue up because
-        // DefaultNetworking.check() short-circuits on isRunning() == true.
-        final int backlogSize = 5;
-        for (int i = 0; i < backlogSize; i++) {
-            Countly.instance().events().recordEvent("backlog_evt_" + i);
-        }
+        // Precondition: the backlog is actually persisted. Waiting on the
+        // observable state beats sleeping a fixed interval and hoping the
+        // writes landed - that guess is what made this test runner-dependent.
+        Assert.assertTrue(
+            "expected " + BACKLOG_SIZE + " queued request files on disk within "
+                + SETUP_TIMEOUT_MS + "ms, found " + queuedRequestFileCount(),
+            waitFor(SETUP_TIMEOUT_MS, () -> queuedRequestFileCount() >= BACKLOG_SIZE)
+        );
 
-        // Give the event flushes time to actually write request files to disk.
-        Thread.sleep(500);
+        // Guard against this test quietly becoming vacuous: if the backlog had
+        // already drained while #1 was held, the assertion below would pass
+        // without ever exercising the callback re-entry path.
+        int expectedMinimum = 1 + BACKLOG_SIZE;
+        Assert.assertTrue(
+            "the backlog drained before request #1 was released (" + requestCount.get()
+                + " requests) - the stall scenario was never set up, so this test would "
+                + "no longer prove anything about issue #271",
+            requestCount.get() < expectedMinimum
+        );
 
         // Release #1. From this point on no external code calls check() —
         // the queue must self-drain via the callback re-entry path that
         // issue #271 broke.
         releaseFirstRequest.countDown();
 
-        // Poll for drain. Total expected = 1 (begin_session) + backlogSize.
+        // The actual assertion. Total expected = 1 (begin_session) + backlog.
         // Use >= because device-id resolution or merge requests may add extras;
-        // the regression is "queue stops at 1", so any number > 1 + a generous
-        // wait is the meaningful signal.
-        int expectedMinimum = 1 + backlogSize;
-        long deadline = System.currentTimeMillis() + 10_000;
-        while (System.currentTimeMillis() < deadline && requestCount.get() < expectedMinimum) {
-            Thread.sleep(100);
-        }
+        // the regression is "queue stops at 1".
+        boolean drained = waitFor(DRAIN_TIMEOUT_MS, () -> requestCount.get() >= expectedMinimum);
 
         Assert.assertTrue(
             "request queue should drain to >= " + expectedMinimum + " requests "
                 + "without external check() calls — got " + requestCount.get()
                 + " (queue stalled if << expected)",
-            requestCount.get() >= expectedMinimum
+            drained
         );
     }
 }
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/SessionStorableTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/SessionStorableTests.java
new file mode 100644
index 000000000..1d7475033
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/SessionStorableTests.java
@@ -0,0 +1,271 @@
+package ly.count.sdk.java.internal;
+
+import java.util.HashMap;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * {@link SessionImpl} as a {@link Storable}, plus the recovery path that runs on the next start after
+ * a crash.
+ * <p>
+ * A session is the one object the SDK persists across process death, so its serialisation is what
+ * decides whether a customer loses a session or gets a duplicate. Everything here goes through the
+ * real {@link Storage} rather than calling {@code store}/{@code restore} directly, so the on-disk
+ * form is what is being asserted.
+ */
+@RunWith(JUnit4.class)
+public class SessionStorableTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * A session with every field populated survives a round trip through storage. Proves the events,
+     * the extra params and the consent mask all come back, and that the restored session compares
+     * equal to the one that was written.
+     */
+    @Test
+    public void fullSession_survivesARoundTripThroughStorage() {
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.Events));
+        InternalConfig config = SDKCore.instance.config;
+
+        SessionImpl original = new SessionImpl(config, 5_000_000_000L);
+        original.begin(1_000L);
+        original.update(2_000L);
+        original.addParam("extraKey", "extraValue");
+        original.setConsents(config, CoreFeature.Events.getIndex() | CoreFeature.Sessions.getIndex());
+        original.recordEvent(original.event("storedEvent").setCount(2).setSum(3.0));
+
+        Assert.assertTrue(Storage.push(config, original));
+
+        SessionImpl restored = Storage.read(config, new SessionImpl(config, original.getId()));
+        Assert.assertNotNull("the session must be readable back off disk", restored);
+        Assert.assertEquals(original.getId(), restored.getId());
+        Assert.assertEquals(original.getBegan(), restored.getBegan());
+        Assert.assertEquals(original.getEnded(), restored.getEnded());
+        Assert.assertEquals("extraValue", restored.params.get("extraKey"));
+        Assert.assertTrue(restored.hasConsent(CoreFeature.Events.getIndex()));
+        Assert.assertTrue(restored.hasConsent(CoreFeature.Sessions.getIndex()));
+        Assert.assertFalse(restored.hasConsent(CoreFeature.Location.getIndex()));
+        Assert.assertEquals(original, restored);
+
+        // Removing it really takes it off disk, so a recovered session cannot be sent twice.
+        Assert.assertTrue(Storage.remove(config, restored));
+        Assert.assertNull(Storage.read(config, new SessionImpl(config, original.getId())));
+    }
+
+    /**
+     * A corrupt or truncated session file must be refused rather than half restored, because a
+     * half restored session would send nonsense durations to the server.
+     */
+    @Test
+    public void corruptSessionData_isRefusedRatherThanHalfRestored() {
+        Countly.instance().init(TestUtils.getConfigSessions());
+        InternalConfig config = SDKCore.instance.config;
+        Log logger = mock(Log.class);
+
+        SessionImpl good = new SessionImpl(config, 6_000_000_000L);
+        good.begin(1_000L);
+        byte[] stored = good.store(logger);
+        Assert.assertNotNull(stored);
+
+        Map<String, byte[]> broken = new HashMap<>();
+        broken.put("empty", new byte[0]);
+        broken.put("not a serialized stream", "definitely not a session".getBytes());
+        broken.put("truncated halfway", java.util.Arrays.copyOf(stored, stored.length / 2));
+
+        broken.forEach((what, data) ->
+            Assert.assertFalse(what + " must not restore", new SessionImpl(config, 6_000_000_000L).restore(data, logger)));
+
+        // The intact bytes still restore, so the guard is not rejecting everything.
+        Assert.assertTrue(new SessionImpl(config, 6_000_000_000L).restore(stored, logger));
+
+        // A restore with a mismatched id logs but still reads the payload, which is the documented
+        // behaviour: the id comes from the file name, not the contents.
+        SessionImpl mismatched = new SessionImpl(config, 9_999L);
+        Assert.assertTrue(mismatched.restore(stored, logger));
+        Assert.assertEquals(Long.valueOf(1_000L), mismatched.getBegan());
+    }
+
+    /**
+     * Recovery of the sessions left behind by a process that died. Each shape a leftover session can
+     * have is driven through {@code recover} in one flow: never begun, begun but never updated or
+     * ended, begun and updated, and already ended.
+     */
+    @Test
+    public void leftoverSessions_areRecoveredOrDiscardedByShape() {
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.Events));
+        InternalConfig config = SDKCore.instance.config;
+
+        // Never begun: nothing happened, so it is simply dropped.
+        SessionImpl neverBegun = new SessionImpl(config, 1_000_000L);
+        Storage.push(config, neverBegun);
+        Assert.assertTrue(neverBegun.recover(config));
+        Assert.assertNull(Storage.read(config, new SessionImpl(config, 1_000_000L)));
+
+        // Begun and already ended: also nothing to do but drop it.
+        SessionImpl alreadyEnded = new SessionImpl(config, 2_000_000L);
+        alreadyEnded.begin(1_000L);
+        alreadyEnded.ended = 2_000L;
+        Storage.push(config, alreadyEnded);
+        Assert.assertTrue(alreadyEnded.recover(config));
+
+        // Begun, never updated, never ended: ended at its begin time so no duration is invented.
+        SessionImpl begunOnly = new SessionImpl(config, 3_000_000L);
+        begunOnly.begin(1_000L);
+        Storage.push(config, begunOnly);
+        Assert.assertNotNull(begunOnly.recover(config));
+        Assert.assertNotNull("recovery must close the session", begunOnly.getEnded());
+
+        // Begun and updated: ended at the last update, which is the last moment we know it was alive.
+        SessionImpl updated = new SessionImpl(config, 4_000_000L);
+        updated.begin(1_000L);
+        updated.update(2_000L);
+        Storage.push(config, updated);
+        Assert.assertNotNull(updated.recover(config));
+        Assert.assertNotNull(updated.getEnded());
+
+        // A session stamped in the future cannot be reasoned about, so recovery declines to guess.
+        SessionImpl fromTheFuture = new SessionImpl(config, System.currentTimeMillis() + 600_000L);
+        fromTheFuture.begin(1_000L);
+        Assert.assertNull("a session from the future must not be recovered", fromTheFuture.recover(config));
+    }
+
+    /**
+     * Session equality, which storage relies on to tell two persisted sessions apart. One table over
+     * every field that participates, checked both ways round.
+     */
+    @Test
+    public void sessionEquality_comparesTheStoredFields() {
+        Countly.instance().init(TestUtils.getConfigSessions());
+        InternalConfig config = SDKCore.instance.config;
+
+        SessionImpl base = session(config, 7_000_000L, 10L, 20L, 30L);
+        SessionImpl identical = session(config, 7_000_000L, 10L, 20L, 30L);
+        Assert.assertEquals(base, identical);
+        Assert.assertEquals(identical, base);
+        Assert.assertEquals(base, base);
+
+        Map<String, SessionImpl> differing = new HashMap<>();
+        differing.put("id", session(config, 8_000_000L, 10L, 20L, 30L));
+        differing.put("began", session(config, 7_000_000L, 99L, 20L, 30L));
+        differing.put("updated", session(config, 7_000_000L, 10L, 99L, 30L));
+        differing.put("ended", session(config, 7_000_000L, 10L, 20L, 99L));
+        differing.put("null began", session(config, 7_000_000L, null, 20L, 30L));
+        differing.put("null ended", session(config, 7_000_000L, 10L, 20L, null));
+
+        differing.forEach((what, other) -> {
+            Assert.assertNotEquals("differing " + what, base, other);
+            Assert.assertNotEquals("differing " + what + " either way", other, base);
+        });
+
+        Assert.assertNotEquals(base, "not a session");
+    }
+
+    /**
+     * The session's own event recorder. An event recorded on a session with the Events feature off
+     * must be dropped, and one recorded with it on must reach the event queue.
+     */
+    @Test
+    public void sessionEventRecording_honoursTheEventsFeature() {
+        Countly.instance().init(TestUtils.getConfigSessions());
+        Assert.assertFalse(SDKCore.enabled(CoreFeature.Events));
+
+        SessionImpl withoutEvents = (SessionImpl) Countly.session();
+        Assert.assertNotNull(withoutEvents);
+        withoutEvents.recordEvent(withoutEvents.event("droppedEvent").setCount(1));
+        Assert.assertEquals("an event needs the Events feature", 0, TestUtils.getCurrentEQ().size());
+
+        Countly.instance().halt();
+        TestUtils.createCleanTestState();
+
+        Countly.instance().init(TestUtils.getConfigSessions(Config.Feature.Events).setEventQueueSizeToSend(100));
+        SessionImpl withEvents = (SessionImpl) Countly.session();
+        Assert.assertNotNull(withEvents);
+        withEvents.recordEvent(withEvents.event("keptEvent").setCount(4).setSum(2.0));
+
+        Assert.assertEquals(1, TestUtils.getCurrentEQ().size());
+        TestUtils.validateEvent(TestUtils.getCurrentEQ().get(0), "keptEvent", null, 4, 2.0, null, "_CLY_", null, "", null);
+    }
+
+    /**
+     * Backend mode owns the wire, so the session API must stand down: begin does nothing and neither
+     * device id change is forwarded.
+     */
+    @Test
+    public void backendMode_makesTheSessionApiInert() {
+        Config config = TestUtils.getBaseConfig().enableFeatures(Config.Feature.Sessions);
+        config.enableBackendMode();
+        Countly.instance().init(config);
+
+        SessionImpl session = new SessionImpl(SDKCore.instance.config, 12_000_000L);
+        Assert.assertSame(session, session.begin());
+        Assert.assertNull("backend mode must not begin a session", session.getBegan());
+
+        Assert.assertSame(session, session.changeDeviceIdWithMerge("ignored_merge"));
+        Assert.assertSame(session, session.changeDeviceIdWithoutMerge("ignored_no_merge"));
+        Assert.assertEquals("the device id must be untouched", TestUtils.DEVICE_ID, session.getDeviceId());
+    }
+
+    /**
+     * Beginning a session twice, or beginning one that already ended, must be refused so a customer
+     * cannot double count a session.
+     */
+    @Test
+    public void beginningASessionTwice_isRefused() {
+        Countly.instance().init(TestUtils.getConfigSessions());
+        InternalConfig config = SDKCore.instance.config;
+
+        SessionImpl session = new SessionImpl(config, 13_000_000L);
+        Assert.assertNotNull(session.begin(1_000L));
+        Assert.assertNull("a second begin must be refused", session.begin(2_000L));
+
+        SessionImpl ended = new SessionImpl(config, 14_000_000L);
+        ended.ended = 5_000L;
+        Assert.assertNull("an ended session cannot begin", ended.begin(1_000L));
+
+        // The single argument constructor stamps its own id, which must be usable straight away.
+        SessionImpl fresh = new SessionImpl(config);
+        Assert.assertNotNull(fresh.getId());
+        Assert.assertTrue(fresh.getId() > 0);
+        Assert.assertNull(fresh.getBegan());
+        Assert.assertNull(fresh.getEnded());
+        Assert.assertEquals(SessionImpl.getStoragePrefix(), fresh.storagePrefix());
+        Assert.assertEquals(fresh.getId(), fresh.storageId());
+
+        fresh.setId(15_000_000L);
+        Assert.assertEquals(Long.valueOf(15_000_000L), fresh.getId());
+        Assert.assertSame(fresh, fresh.setPushOnChange(false));
+    }
+
+    // endregion
+    // region helpers
+
+    private static SessionImpl session(InternalConfig config, long id, Long began, Long updated, Long ended) {
+        SessionImpl session = new SessionImpl(config, id);
+        session.began = began;
+        session.updated = updated;
+        session.ended = ended;
+        return session;
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/StorageLayerTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/StorageLayerTests.java
new file mode 100644
index 000000000..168559913
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/StorageLayerTests.java
@@ -0,0 +1,330 @@
+package ly.count.sdk.java.internal;
+
+import java.io.File;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * The {@link Storage} facade and the {@link SDKStorage} file layer under it, plus the
+ * {@link TimedEvents} storable.
+ * <p>
+ * The interesting part of this layer is what happens when the disk does not cooperate: a missing
+ * file, an unreadable one, a corrupt payload. Those paths are what stop the SDK from losing a
+ * customer's data or crashing their application, and they are the ones the ordinary happy path tests
+ * never reach.
+ */
+@RunWith(JUnit4.class)
+public class StorageLayerTests {
+
+    private InternalConfig config;
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+        Countly.instance().init(TestUtils.getConfigEvents(100));
+        config = SDKCore.instance.config;
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * The full storable lifecycle through the public {@link Storage} API: push, list, read, readOne
+     * both ways round, pop, and remove. Proves the ordering contract of the slice argument, which the
+     * request queue depends on to send oldest first.
+     */
+    @Test
+    public void storableLifecycle_pushesListsReadsAndPops() {
+        Request first = requestWith(1_000L, "order", "first");
+        Request second = requestWith(2_000L, "order", "second");
+        Request third = requestWith(3_000L, "order", "third");
+
+        Assert.assertTrue(Storage.push(config, first));
+        Assert.assertTrue(Storage.push(config, second));
+        Assert.assertTrue(Storage.push(config, third));
+
+        List<Long> all = Storage.list(config, Request.getStoragePrefix());
+        Assert.assertEquals(3, all.size());
+        Assert.assertEquals(Long.valueOf(1_000L), all.get(0));
+        Assert.assertEquals(Long.valueOf(3_000L), all.get(2));
+
+        // A positive slice returns the first N oldest first, a negative slice the last N newest first.
+        List<Long> firstTwo = Storage.list(config, Request.getStoragePrefix(), 2);
+        Assert.assertEquals(2, firstTwo.size());
+        Assert.assertEquals(Long.valueOf(1_000L), firstTwo.get(0));
+
+        List<Long> lastTwo = Storage.list(config, Request.getStoragePrefix(), -2);
+        Assert.assertEquals(2, lastTwo.size());
+        Assert.assertEquals(Long.valueOf(3_000L), lastTwo.get(0));
+
+        // readOne ascending gives the oldest, descending the newest.
+        Request oldest = Storage.readOne(config, new Request(0L), true);
+        Assert.assertNotNull(oldest);
+        Assert.assertEquals("first", oldest.params.get("order"));
+
+        Request newest = Storage.readOne(config, new Request(0L), false);
+        Assert.assertNotNull(newest);
+        Assert.assertEquals("third", newest.params.get("order"));
+
+        // read leaves the file in place, pop takes it away.
+        Assert.assertNotNull(Storage.read(config, new Request(2_000L)));
+        Assert.assertNotNull(Storage.read(config, new Request(2_000L)));
+
+        Request popped = Storage.pop(config, new Request(2_000L));
+        Assert.assertNotNull(popped);
+        Assert.assertEquals("second", popped.params.get("order"));
+        Assert.assertNull("a popped storable is gone", Storage.read(config, new Request(2_000L)));
+
+        Assert.assertTrue(Storage.remove(config, first));
+        Assert.assertEquals(1, Storage.list(config, Request.getStoragePrefix()).size());
+    }
+
+    /**
+     * Everything that can be absent or broken on disk, in one pass. Each must answer with null or
+     * false rather than throwing, because the SDK runs inside a customer's application and a storage
+     * fault must never surface as a crash.
+     */
+    @Test
+    public void missingAndCorruptFiles_answerNullRatherThanThrowing() {
+        // Nothing stored under this id at all.
+        Assert.assertNull(Storage.read(config, new Request(4_242L)));
+        Assert.assertNull(Storage.pop(config, new Request(4_242L)));
+        Assert.assertNull(Storage.readOne(config, new Request(0L), true));
+        Assert.assertEquals(0, Storage.list(config, Request.getStoragePrefix()).size());
+        Assert.assertEquals(0, Storage.list(config, "no-such-prefix").size());
+
+        // A file that exists but whose contents are not a valid request.
+        TestUtils.writeToFile("request_5555", "this is not a request payload");
+        Assert.assertNull("a corrupt payload must not restore", Storage.read(config, new Request(5_555L)));
+
+        // An empty file is equally unusable.
+        TestUtils.createFile("request_6666");
+        Assert.assertNull(Storage.read(config, new Request(6_666L)));
+
+        // Removing something that was never there is a no-op, not an error.
+        Assert.assertFalse(Storage.remove(config, new Request(7_777L)));
+
+        // await must return even when there is nothing outstanding, and tolerate a null logger.
+        Storage.await(mock(Log.class));
+        Storage.await(null);
+    }
+
+    /**
+     * The file layer's own answers when asked for something that is not there. {@code getName} and
+     * {@code extractName} are private, so they are exercised only through the storable operations
+     * above rather than directly.
+     */
+    @Test
+    public void fileLayer_answersEmptyForAnythingItDoesNotHave() {
+        SDKStorage storage = config.sdk.sdkStorage;
+
+        Assert.assertNull(storage.storableReadBytes(config, "request", 999_999L));
+        Assert.assertNull(storage.storableReadBytes(config, "no-such-thing"));
+
+        // Listing a prefix nothing was ever written under is empty, not null.
+        Assert.assertNotNull(storage.storableList(config, "request", 0));
+        Assert.assertEquals(0, storage.storableList(config, "nothing-here", 0).size());
+
+        // Popping something absent reports "not successful" rather than inventing a storable. The
+        // return is a nullable Boolean, and absent is signalled as null.
+        Assert.assertNotEquals(Boolean.TRUE, storage.storablePop(config, new Request(999_998L)));
+
+        // A written payload is readable back byte for byte, and then listable by its prefix.
+        Assert.assertTrue(storage.storableWrite(config, "request", 9_500L, "raw=payload".getBytes()));
+        Assert.assertArrayEquals("raw=payload".getBytes(), storage.storableReadBytes(config, "request", 9_500L));
+        Assert.assertTrue(storage.storableList(config, "request", 0).contains(9_500L));
+    }
+
+    /**
+     * The event queue's own file, which is written and read as raw text rather than as a storable.
+     * A round trip must be exact, and a missing file must read back as empty rather than null.
+     */
+    @Test
+    public void eventQueueFile_roundTripsAndToleratesAbsence() {
+        SDKStorage storage = config.sdk.sdkStorage;
+
+        storage.storeEventQueue("event-one:::event-two");
+        Assert.assertEquals("event-one:::event-two", storage.readEventQueue());
+
+        // Overwriting replaces rather than appends.
+        storage.storeEventQueue("only-this");
+        Assert.assertEquals("only-this", storage.readEventQueue());
+
+        // Clearing it leaves an empty read rather than a null.
+        storage.storeEventQueue("");
+        Assert.assertEquals("", storage.readEventQueue());
+    }
+
+    /**
+     * The bulk transform used by the migration helper: every stored payload is handed to the
+     * transformer and the replacement is written back. A transformer that declines to change a
+     * payload must leave it exactly as it was.
+     */
+    @Test
+    public void bulkTransform_rewritesOnlyWhatTheTransformerReplaces() {
+        Storage.push(config, requestWith(8_001L, "keep", "unchanged"));
+        Storage.push(config, requestWith(8_002L, "change", "me"));
+
+        Map<Long, Integer> seen = new HashMap<>();
+        boolean success = Storage.transform(config, Request.getStoragePrefix(), (id, data) -> {
+            seen.merge(id, 1, Integer::sum);
+            String payload = new String(data);
+            if (payload.contains("change=me")) {
+                return payload.replace("change=me", "change=done").getBytes();
+            }
+            // Declining to transform must leave the stored bytes alone.
+            return null;
+        });
+
+        Assert.assertTrue("the transform must report success", success);
+        Assert.assertEquals("every stored payload must be visited", 2, seen.size());
+
+        Request untouched = Storage.read(config, new Request(8_001L));
+        Assert.assertNotNull(untouched);
+        Assert.assertEquals("unchanged", untouched.params.get("keep"));
+
+        Request rewritten = Storage.read(config, new Request(8_002L));
+        Assert.assertNotNull(rewritten);
+        Assert.assertEquals("done", rewritten.params.get("change"));
+    }
+
+    /**
+     * {@link TimedEvents} is the persisted map of events that were started but not yet ended, so it
+     * has to survive a restart. Proves the round trip and that a broken payload is refused.
+     */
+    @Test
+    public void timedEvents_surviveARoundTripAndRefuseCorruptData() {
+        Log logger = mock(Log.class);
+
+        TimedEvents original = new TimedEvents();
+        Assert.assertEquals(0, original.size());
+        Assert.assertFalse(original.has("nothing"));
+        Assert.assertTrue(original.keys().isEmpty());
+        Assert.assertEquals(Long.valueOf(0L), original.storageId());
+        Assert.assertEquals("timedEvent", original.storagePrefix());
+
+        // setId is deliberately a no-op: there is only ever one timed event map.
+        original.setId(99L);
+        Assert.assertEquals(Long.valueOf(0L), original.storageId());
+
+        byte[] stored = original.store(logger);
+        Assert.assertNotNull(stored);
+
+        TimedEvents restored = new TimedEvents();
+        Assert.assertTrue(restored.restore(stored, logger));
+        Assert.assertEquals(0, restored.size());
+
+        // A started event is held by the events module, and the persisted map reflects it.
+        Countly.instance().events().startEvent("timedByModule");
+        ModuleEvents events = SDKCore.instance.module(ModuleEvents.class);
+        Assert.assertNotNull(events);
+        Assert.assertTrue(events.timedEvents.containsKey("timedByModule"));
+
+        TimedEvents withOne = new TimedEvents();
+        byte[] persisted = withOne.store(logger);
+        Assert.assertNotNull(persisted);
+
+        // Corrupt payloads are refused rather than half applied.
+        for (byte[] broken : new byte[][] { new byte[0], "not a stream".getBytes() }) {
+            Assert.assertFalse(new TimedEvents().restore(broken, logger));
+        }
+
+        // Restoring a real payload routes the events into the module when one is present.
+        Assert.assertTrue(new TimedEvents().restore(stored, logger));
+    }
+
+    /**
+     * A timed event started and ended through the deprecated {@link TimedEvents} entry points still
+     * ends up on the event queue, because a long lived integration may still be using them.
+     */
+    @Test
+    public void deprecatedTimedEventApi_stillEndsUpOnTheEventQueue() {
+        TimedEvents timed = new TimedEvents();
+
+        EventImpl started = timed.event(config, "deprecatedTimed");
+        Assert.assertNotNull("starting a timed event must hand one back", started);
+        Assert.assertEquals("deprecatedTimed", started.key);
+
+        started.setCount(2).setSum(5.0);
+        timed.recordEvent(started);
+
+        List<EventImpl> queued = TestUtils.getCurrentEQ();
+        Assert.assertEquals(1, queued.size());
+        Assert.assertEquals("deprecatedTimed", queued.get(0).key);
+        Assert.assertEquals(2, queued.get(0).count);
+        Assert.assertEquals(Double.valueOf(5.0), queued.get(0).sum);
+    }
+
+    /**
+     * Pushing a storable whose serialisation fails must be reported as a failure rather than
+     * silently dropping the data.
+     */
+    @Test
+    public void aStorableThatCannotSerialize_isReportedAsAFailure() {
+        Storable unserializable = new Storable() {
+            @Override
+            public Long storageId() {
+                return 9_100L;
+            }
+
+            @Override
+            public String storagePrefix() {
+                return "broken";
+            }
+
+            @Override
+            public void setId(Long id) {
+            }
+
+            @Override
+            public byte[] store(Log L) {
+                // Exactly what a Storable does when it cannot serialise itself.
+                return null;
+            }
+
+            @Override
+            public boolean restore(byte[] data, Log L) {
+                return false;
+            }
+        };
+
+        Assert.assertFalse("a storable that serialises to nothing must not report success",
+            Storage.push(config, unserializable));
+
+        // Whatever it left behind must not read back as usable data. Note it does leave a zero
+        // length file in the storage directory, which is reported as a bug rather than asserted.
+        Assert.assertNull(Storage.read(config, new Request(9_100L)));
+    }
+
+    // endregion
+    // region helpers
+
+    private static Request requestWith(long id, String key, String value) {
+        Request request = new Request(id);
+        request.params = new Params();
+        request.params.add(key, value);
+        return request;
+    }
+
+    @SuppressWarnings("unused")
+    private static File storageDirectory() {
+        return TestUtils.getTestSDirectory();
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/TestUtils.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/TestUtils.java
index eaaa4849e..491973593 100644
--- a/sdk-java/src/test/java/ly/count/sdk/java/internal/TestUtils.java
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/TestUtils.java
@@ -39,7 +39,7 @@ public class TestUtils {
     static String SERVER_APP_KEY = "COUNTLY_APP_KEY";
     static String DEVICE_ID = "some_random_test_device_id";
     static String SDK_NAME = "java-native";
-    static String SDK_VERSION = "24.1.6";
+    static String SDK_VERSION = "26.8.0";
     static String APPLICATION_VERSION = "1.0";
 
     public static final String[] eKeys = new String[] { "eventKey1", "eventKey2", "eventKey3", "eventKey4", "eventKey5", "eventKey6", "eventKey7" };
@@ -124,6 +124,15 @@ static Config getConfigFeedback(Config.Feature... features) {
         return config;
     }
 
+    static Config getConfigContent(Config.Feature... features) {
+        Config config = getBaseConfig();
+
+        config.enableFeatures(features);
+        config.enableFeatures(Config.Feature.Content, Config.Feature.Events);
+
+        return config;
+    }
+
     public static File getTestSDirectory() {
         // System specific folder structure
         String[] sdkStorageRootPath = { System.getProperty("user.home"), "__COUNTLY", "java_test" };
@@ -309,6 +318,14 @@ public static Map<String, String> parseQueryParams(String data) {
         return paramMap;
     }
 
+    /**
+     * Slack allowed above an expected event duration that was produced by a
+     * Thread.sleep in a test. Absolute rather than proportional, so it soaks up
+     * scheduler overrun on a loaded CI runner without meaningfully weakening
+     * the large, synthetically-set durations some tests assert.
+     */
+    private static final double SLEEP_OVERRUN_TOLERANCE_SECONDS = 2.0;
+
     static void validateEvent(EventImpl gonnaValidate, String key, Map<String, Object> segmentation, int count, Double sum, Double duration, String id, String pvid, String cvid, String peid) {
         Assert.assertEquals(key, gonnaValidate.key);
 
@@ -324,7 +341,21 @@ static void validateEvent(EventImpl gonnaValidate, String key, Map<String, Objec
 
         if (duration != null) {
             double delta = 0.5;
-            Assert.assertTrue(duration + " expected duration, got " + gonnaValidate.duration, Math.abs(duration - gonnaValidate.duration) < delta);
+            if (duration == 0.0) {
+                // A view that has only just started must report exactly 0.
+                // Loosening this would hide a real "duration never reset" bug.
+                Assert.assertTrue(duration + " expected duration, got " + gonnaValidate.duration, Math.abs(duration - gonnaValidate.duration) < delta);
+            } else {
+                // Non-zero expectations come from a Thread.sleep in the test, and
+                // a sleep can only overrun - never finish early. Asserting
+                // near-equality therefore asserts the machine is not busy, which
+                // is why these tests flake on CI (a 1s sleep measured as 2s, a 5s
+                // sleep as 6s). Keep the lower bound strict so a duration that was
+                // never recorded still fails, and allow bounded overrun above it.
+                Assert.assertTrue(duration + " expected duration, got " + gonnaValidate.duration,
+                    gonnaValidate.duration >= duration - delta
+                        && gonnaValidate.duration <= duration + SLEEP_OVERRUN_TOLERANCE_SECONDS);
+            }
         }
 
         Assert.assertTrue(gonnaValidate.dow >= 0 && gonnaValidate.dow < 7);
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportConnectionTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportConnectionTests.java
new file mode 100644
index 000000000..731986264
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportConnectionTests.java
@@ -0,0 +1,489 @@
+package ly.count.sdk.java.internal;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.concurrent.ConcurrentHashMap;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.PredefinedUserPropertyKeys;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Integration tests for {@link Transport#connection(Request)} and {@link Transport#response(HttpURLConnection)}
+ * driven against a real local {@link HttpServer} (JDK built-in, no extra dependency).
+ * <p>
+ * Every test builds a bare {@link Transport}, initializes it against the local server via
+ * {@link Transport#init(InternalConfig)} and then calls {@code connection()}/{@code response()}
+ * directly, asserting on what the local server actually received on the wire (method, path,
+ * query string, headers, body bytes) rather than only on internal SDK state.
+ * <p>
+ * {@link TransportTests} already covers {@code processResponse} in isolation; this file does not
+ * duplicate that and focuses on everything upstream/downstream of it.
+ */
+@RunWith(JUnit4.class)
+public class TransportConnectionTests {
+
+    private HttpServer server;
+    private int port;
+    private final List<RecordedRequest> received = Collections.synchronizedList(new ArrayList<>());
+    private volatile int nextResponseCode = 200;
+    private volatile String nextResponseBody = "{\"result\":true}";
+
+    @Before
+    public void setUp() throws IOException {
+        TestUtils.createCleanTestState();
+        received.clear();
+        nextResponseCode = 200;
+        nextResponseBody = "{\"result\":true}";
+        server = HttpServer.create(new InetSocketAddress("localhost", 0), 0);
+        port = server.getAddress().getPort();
+        server.createContext("/", exchange -> {
+            try {
+                // Case-insensitive on purpose: HTTP header names are case-insensitive on the wire,
+                // and different JDKs normalize casing differently (e.g. "Content-Type" vs
+                // "Content-type") when HttpURLConnection writes them out.
+                Map<String, String> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+                exchange.getRequestHeaders().forEach((k, v) -> headers.put(k, v.isEmpty() ? "" : v.get(0)));
+                byte[] body = readAll(exchange.getRequestBody());
+                received.add(new RecordedRequest(exchange.getRequestMethod(), exchange.getRequestURI().getPath(),
+                    exchange.getRequestURI().getRawQuery(), headers, body));
+
+                byte[] respBytes = nextResponseBody.getBytes(StandardCharsets.UTF_8);
+                exchange.sendResponseHeaders(nextResponseCode, respBytes.length);
+                try (OutputStream os = exchange.getResponseBody()) {
+                    os.write(respBytes);
+                }
+            } finally {
+                exchange.close();
+            }
+        });
+        server.start();
+    }
+
+    @After
+    public void tearDown() {
+        if (server != null) {
+            server.stop(0);
+        }
+        Countly.instance().halt();
+    }
+
+    // ==================== helpers ====================
+
+    private static byte[] readAll(InputStream in) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        byte[] buf = new byte[4096];
+        int n;
+        while ((n = in.read(buf)) != -1) {
+            out.write(buf, 0, n);
+        }
+        return out.toByteArray();
+    }
+
+    /** Byte-exact, reversible string view of a raw HTTP body, safe for mixed text/binary multipart bodies. */
+    private static String iso(byte[] bytes) {
+        return new String(bytes, StandardCharsets.ISO_8859_1);
+    }
+
+    private Config localServerConfig() {
+        return new Config("http://localhost:" + port, TestUtils.SERVER_APP_KEY, TestUtils.getTestSDirectory())
+            .setApplicationVersion(TestUtils.APPLICATION_VERSION)
+            .setLoggingLevel(Config.LoggingLevel.OFF);
+    }
+
+    private Transport buildTransport(Config config) {
+        InternalConfig ic = new InternalConfig(config);
+        ic.setLogger(new Log(Config.LoggingLevel.OFF, null));
+        Transport transport = new Transport();
+        transport.init(ic);
+        return transport;
+    }
+
+    private RecordedRequest lastRequest() {
+        Assert.assertFalse("server received no requests", received.isEmpty());
+        return received.get(received.size() - 1);
+    }
+
+    private static class RecordedRequest {
+        final String method;
+        final String path;
+        final String query;
+        final Map<String, String> headers;
+        final byte[] body;
+
+        RecordedRequest(String method, String path, String query, Map<String, String> headers, byte[] body) {
+            this.method = method;
+            this.path = path;
+            this.query = query;
+            this.headers = headers;
+            this.body = body;
+        }
+    }
+
+    // ==================== GET / device id fallback / custom headers ====================
+
+    /**
+     * Short request with no explicit "device_id" and no explicit endpoint, against a config with
+     * custom network headers set. Proves: default endpoint "/i" is used, GET is chosen for a short
+     * request, the missing device_id is filled in from {@link InternalConfig#getDeviceId()}, custom
+     * headers reach the wire, and {@link Transport#response(HttpURLConnection)} reads a normal 200
+     * body back correctly.
+     */
+    @Test
+    public void connection_shortGetRequest_defaultEndpointDeviceIdFallbackAndCustomHeaders() throws IOException {
+        Config config = localServerConfig();
+        Map<String, String> customHeaders = new ConcurrentHashMap<>();
+        customHeaders.put("X-Countly-Test", "hello-world");
+        config.addCustomNetworkRequestHeaders(customHeaders);
+        InternalConfig ic = new InternalConfig(config);
+        ic.setLogger(new Log(Config.LoggingLevel.OFF, null));
+        ic.setDeviceId(new Config.DID(Config.DID.STRATEGY_CUSTOM, "fallback-device-id"));
+        Transport transport = new Transport();
+        transport.init(ic);
+
+        Request request = new Request();
+        request.params.add("key1", "value1");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        int code = connection.getResponseCode();
+        String body = transport.response(connection);
+        connection.disconnect();
+
+        Assert.assertEquals(200, code);
+        // response() appends '\n' after every line it reads, including the last one.
+        Assert.assertEquals("{\"result\":true}\n", body);
+
+        RecordedRequest recorded = lastRequest();
+        Assert.assertEquals("GET", recorded.method);
+        Assert.assertEquals("/i", recorded.path);
+        Assert.assertEquals(0, recorded.body.length);
+        Assert.assertEquals("hello-world", recorded.headers.get("X-Countly-Test"));
+
+        Map<String, String> query = TestUtils.parseQueryParams(recorded.query);
+        Assert.assertEquals("value1", query.get("key1"));
+        Assert.assertEquals("fallback-device-id", query.get("device_id"));
+        // The Request.ENDPOINT marker must never leak onto the wire.
+        Assert.assertFalse(recorded.query.contains("endpoint="));
+        Assert.assertFalse(request.params.has(Request.ENDPOINT));
+    }
+
+    /**
+     * When the request already carries a "device_id" the fallback from {@link InternalConfig#getDeviceId()}
+     * must not override it, even though a device id is configured.
+     */
+    @Test
+    public void connection_requestOwnDeviceIdIsNotOverriddenByConfigFallback() throws IOException {
+        Config config = localServerConfig();
+        InternalConfig ic = new InternalConfig(config);
+        ic.setLogger(new Log(Config.LoggingLevel.OFF, null));
+        ic.setDeviceId(new Config.DID(Config.DID.STRATEGY_CUSTOM, "config-device-id"));
+        Transport transport = new Transport();
+        transport.init(ic);
+
+        Request request = new Request();
+        request.params.add("device_id", "request-own-device-id");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        connection.getResponseCode();
+        connection.disconnect();
+
+        Map<String, String> query = TestUtils.parseQueryParams(lastRequest().query);
+        Assert.assertEquals("request-own-device-id", query.get("device_id"));
+    }
+
+    // ==================== POST: forced, and auto-switched due to length ====================
+
+    /**
+     * {@link Config#enableForcedHTTPPost()} must force POST for a request that would otherwise be
+     * GET-able. Proves: method is POST, Content-Type is urlencoded, the URL carries no query string,
+     * and the wire body is exactly the request's param string.
+     */
+    @Test
+    public void connection_forcedHttpPost_urlEncodedBodyWireFormat() throws IOException {
+        Config config = localServerConfig().enableForcedHTTPPost();
+        Transport transport = buildTransport(config);
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+        request.params.add("key1", "value1");
+        request.endpoint("/i?");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        int code = connection.getResponseCode();
+        connection.disconnect();
+
+        Assert.assertEquals(200, code);
+        RecordedRequest recorded = lastRequest();
+        Assert.assertEquals("POST", recorded.method);
+        Assert.assertEquals("application/x-www-form-urlencoded", recorded.headers.get("Content-Type"));
+        // The endpoint itself ends in '?', so the URL keeps an empty query rather than none at all.
+        Assert.assertTrue("GET-style query string must be absent from a POST URL, got [" + recorded.query + "]",
+            recorded.query == null || recorded.query.isEmpty());
+        Assert.assertEquals(request.params.toString(), iso(recorded.body));
+    }
+
+    /**
+     * A request long enough that {@link Request#isGettable(java.net.URL)} is false must switch to
+     * POST automatically, without {@link Config#isHTTPPostForced()} being set. Proves the length-based
+     * branch in {@code connection()}, independent from the forced-POST branch above.
+     */
+    @Test
+    public void connection_longRequestAutoSwitchesToPostWithoutBeingForced() throws IOException {
+        Config config = localServerConfig();
+        Assert.assertFalse("precondition: this config must not force POST", config.isHTTPPostForced());
+        Transport transport = buildTransport(config);
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+        StringBuilder longValue = new StringBuilder();
+        for (int i = 0; i < 2000; i++) {
+            longValue.append('a');
+        }
+        request.params.add("bigfield", longValue.toString());
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        connection.getResponseCode();
+        connection.disconnect();
+
+        RecordedRequest recorded = lastRequest();
+        Assert.assertEquals("POST", recorded.method);
+        Assert.assertTrue(iso(recorded.body).contains("bigfield="));
+    }
+
+    // ==================== Parameter tampering checksum ====================
+
+    /**
+     * With {@link Config#enableParameterTamperingProtection(String)} set, a GET-able request must
+     * carry a "checksum256" query parameter equal to the SHA-256 hex digest of (params + salt),
+     * computed over the params exactly as they stood right before the checksum was appended (the
+     * checksum is always the last param added, so stripping its own trailing "&checksum256=..."
+     * recovers that exact pre-checksum string).
+     */
+    @Test
+    public void connection_getWithParameterTamperingProtection_checksumMatchesWireAndInternalState() throws IOException {
+        String salt = "s3cr3t-salt";
+        Config config = localServerConfig().enableParameterTamperingProtection(salt);
+        Transport transport = buildTransport(config);
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+        request.params.add("key1", "value1");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        connection.getResponseCode();
+        connection.disconnect();
+
+        String full = request.params.toString();
+        String checksumOnWire = TestUtils.parseQueryParams(lastRequest().query).get("checksum256");
+        Assert.assertNotNull("checksum256 must be present on the wire", checksumOnWire);
+        Assert.assertEquals(64, checksumOnWire.length());
+
+        String suffix = "&checksum256=" + checksumOnWire;
+        Assert.assertTrue(full.endsWith(suffix));
+        String withoutChecksum = full.substring(0, full.length() - suffix.length());
+        String expected = Utils.digestHex("SHA-256", withoutChecksum + salt, null);
+        Assert.assertEquals(expected, checksumOnWire);
+        Assert.assertEquals(checksumOnWire, request.params.get("checksum256"));
+    }
+
+    /**
+     * Same protection, but on a forced-POST (non-multipart) request: the checksum is appended to
+     * {@code request.params} a second time (a distinct call site from the GET branch) and shipped
+     * in the POST body rather than the query string.
+     */
+    @Test
+    public void connection_postWithParameterTamperingProtection_checksumInBody() throws IOException {
+        String salt = "another-salt";
+        Config config = localServerConfig().enableForcedHTTPPost().enableParameterTamperingProtection(salt);
+        Transport transport = buildTransport(config);
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+        request.params.add("key1", "value1");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        connection.getResponseCode();
+        connection.disconnect();
+
+        String bodyOnWire = iso(lastRequest().body);
+        Assert.assertEquals(request.params.toString(), bodyOnWire);
+
+        String checksum = request.params.get("checksum256");
+        Assert.assertNotNull(checksum);
+        String full = request.params.toString();
+        String suffix = "&checksum256=" + checksum;
+        Assert.assertTrue(full.endsWith(suffix));
+        String withoutChecksum = full.substring(0, full.length() - suffix.length());
+        Assert.assertEquals(Utils.digestHex("SHA-256", withoutChecksum + salt, null), checksum);
+    }
+
+    // ==================== Multipart / picture ====================
+
+    /**
+     * A request carrying in-memory picture bytes (as {@code ModuleUserProfile.PICTURE_BYTES}) forces
+     * multipart POST regardless of request length, and with parameter-tampering protection enabled
+     * also exercises the multipart checksum branch of {@code addMultipart}. Proves the full wire
+     * shape: multipart Content-Type with boundary, the binary part's headers and exact image bytes,
+     * each remaining param as its own text part, and a checksum text part whose value matches the
+     * same digest formula {@code connection()} uses internally.
+     */
+    @Test
+    public void connection_pictureBytesInRequest_multipartWireFormatWithChecksum() throws IOException {
+        String salt = "multipart-salt";
+        Config config = localServerConfig().enableParameterTamperingProtection(salt);
+        Transport transport = buildTransport(config);
+
+        byte[] imageBytes = "FAKE-JPEG-BYTES-0123456789".getBytes(StandardCharsets.US_ASCII);
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+        request.params.add("key1", "value1");
+        // Snapshot the params that will end up salted, BEFORE picture bytes are added: picture
+        // params are stripped by getPictureDataFromRequest before the salting loop ever sees them.
+        Map<String, String> saltedParams = request.params.map();
+        request.params.add(ModuleUserProfile.PICTURE_BYTES, Utils.Base64.encode(imageBytes));
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        int code = connection.getResponseCode();
+        connection.disconnect();
+
+        Assert.assertEquals(200, code);
+        RecordedRequest recorded = lastRequest();
+        Assert.assertEquals("POST", recorded.method);
+
+        String contentType = recorded.headers.get("Content-Type");
+        Assert.assertNotNull(contentType);
+        Assert.assertTrue(contentType.startsWith("multipart/form-data; boundary="));
+        String boundary = contentType.substring(contentType.indexOf("boundary=") + "boundary=".length());
+
+        String bodyText = iso(recorded.body);
+        Assert.assertTrue("boundary must delimit the body", bodyText.contains("--" + boundary));
+        Assert.assertTrue(bodyText.contains("Content-Disposition: form-data; name=\"binaryFile\"; filename=\"image\""));
+        Assert.assertTrue(bodyText.contains("Content-Type: image/jpeg"));
+        Assert.assertTrue("raw image bytes must be present verbatim in the body", bodyText.contains(iso(imageBytes)));
+        Assert.assertTrue(bodyText.contains("Content-Disposition: form-data; name=\"key1\""));
+        Assert.assertTrue(bodyText.contains("value1"));
+        Assert.assertTrue("terminating boundary must close the multipart body", bodyText.trim().endsWith("--" + boundary + "--"));
+
+        // Multipart checksum: same digest formula as connection(), computed over the pre-picture
+        // params (urldecoded, "key=value&" joined) rather than the raw query string.
+        StringBuilder salting = new StringBuilder();
+        for (String key : saltedParams.keySet()) {
+            salting.append(key).append('=').append(saltedParams.get(key)).append('&');
+        }
+        String expectedChecksum = Utils.digestHex("SHA-256", salting.substring(0, salting.length() - 1) + salt, null);
+        Assert.assertTrue(bodyText.contains("Content-Disposition: form-data; name=\"checksum256\""));
+        Assert.assertTrue("checksum computed over the pre-picture salted params must appear in the multipart body",
+            bodyText.contains(expectedChecksum));
+
+        // Picture params must never leak into request.params after connection() has consumed them.
+        Assert.assertFalse(request.params.has(ModuleUserProfile.PICTURE_BYTES));
+    }
+
+    /**
+     * Picture resolution from a local file path (the "file does not exist" branch and the
+     * "read succeeds" branch of {@code getPictureDataFromRequest}), in one coherent flow:
+     * a request pointing at a real file sends multipart with those exact bytes, while a request
+     * pointing at a missing file degrades gracefully to a normal (non-multipart) request instead
+     * of crashing.
+     */
+    @Test
+    public void connection_pictureFromLocalPath_existingFileMultipartMissingFileDegradesGracefully() throws IOException {
+        Config config = localServerConfig();
+
+        byte[] fileBytes = "picture-bytes-from-disk".getBytes(StandardCharsets.US_ASCII);
+        File pictureFile = new File(TestUtils.getTestSDirectory(), "test_picture.bin");
+        Files.write(pictureFile.toPath(), fileBytes);
+        try {
+            Transport transportA = buildTransport(config);
+            Request requestA = new Request();
+            requestA.params.add("device_id", "d1");
+            requestA.params.add(PredefinedUserPropertyKeys.PICTURE_PATH, pictureFile.getAbsolutePath());
+
+            HttpURLConnection connA = transportA.connection(requestA);
+            connA.connect();
+            connA.getResponseCode();
+            connA.disconnect();
+
+            RecordedRequest recordedA = lastRequest();
+            Assert.assertEquals("POST", recordedA.method);
+            String contentTypeA = recordedA.headers.get("Content-Type");
+            Assert.assertNotNull(contentTypeA);
+            Assert.assertTrue(contentTypeA.startsWith("multipart/form-data"));
+            Assert.assertTrue("exact bytes read from disk must be sent",
+                iso(recordedA.body).contains(iso(fileBytes)));
+            Assert.assertFalse(requestA.params.has(PredefinedUserPropertyKeys.PICTURE_PATH));
+        } finally {
+            Files.deleteIfExists(pictureFile.toPath());
+        }
+
+        received.clear();
+        Transport transportB = buildTransport(config);
+        Request requestB = new Request();
+        requestB.params.add("device_id", "d1");
+        requestB.params.add(PredefinedUserPropertyKeys.PICTURE_PATH, TestUtils.getTestSDirectory() + "/does_not_exist_at_all.bin");
+
+        HttpURLConnection connB = transportB.connection(requestB);
+        connB.connect();
+        int codeB = connB.getResponseCode();
+        connB.disconnect();
+
+        Assert.assertEquals(200, codeB);
+        RecordedRequest recordedB = lastRequest();
+        String contentTypeB = recordedB.headers.get("Content-Type");
+        Assert.assertTrue("missing picture file must not produce a multipart request",
+            contentTypeB == null || !contentTypeB.startsWith("multipart/form-data"));
+        Assert.assertFalse(requestB.params.has(PredefinedUserPropertyKeys.PICTURE_PATH));
+    }
+
+    // ==================== response() against non-2xx codes ====================
+
+    /**
+     * {@link Transport#response(HttpURLConnection)} falls back from {@code getInputStream()} to
+     * {@code getErrorStream()} whenever the server answers with a non-2xx code; proves that fallback
+     * actually returns the server's error body rather than null or an exception.
+     */
+    @Test
+    public void response_non2xxServerCode_readsErrorStreamBody() throws IOException {
+        nextResponseCode = 500;
+        nextResponseBody = "{\"result\":\"Internal Server Error\"}";
+        Transport transport = buildTransport(localServerConfig());
+
+        Request request = new Request();
+        request.params.add("device_id", "d1");
+
+        HttpURLConnection connection = transport.connection(request);
+        connection.connect();
+        int code = connection.getResponseCode();
+        String body = transport.response(connection);
+        connection.disconnect();
+
+        Assert.assertEquals(500, code);
+        Assert.assertEquals(nextResponseBody + "\n", body);
+    }
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportNetworkTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportNetworkTests.java
new file mode 100644
index 000000000..c3e66c0ad
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportNetworkTests.java
@@ -0,0 +1,330 @@
+package ly.count.sdk.java.internal;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.PredefinedUserPropertyKeys;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import static org.mockito.Mockito.mock;
+
+/**
+ * The networking stack end to end, against a real HTTP server on loopback.
+ * <p>
+ * Everything else in the suite fakes the transport away, which leaves {@link Transport} the largest
+ * untested class in the SDK. Here the SDK is pointed at a {@code com.sun.net.httpserver.HttpServer}
+ * (part of the JDK, so no new dependency) and driven through its public API, so the assertions are
+ * on what a Countly server would actually have received: the HTTP method, the path, and the
+ * url-encoded parameters.
+ */
+@RunWith(JUnit4.class)
+public class TransportNetworkTests {
+
+    /**
+     * One request as the server saw it.
+     */
+    private static class Received {
+        String method;
+        String path;
+        String query;
+        byte[] body;
+        Map<String, String> headers = new HashMap<>();
+
+        /**
+         * @return the request parameters, whether they arrived on the query string or in the body
+         */
+        Map<String, String> params() {
+            String source = query != null && !query.isEmpty() ? query : new String(body, StandardCharsets.UTF_8);
+            return TestUtils.parseQueryParams(source);
+        }
+
+        String bodyText() {
+            return new String(body, StandardCharsets.UTF_8);
+        }
+    }
+
+    private HttpServer server;
+    private int port;
+    private final List<Received> received = new ArrayList<>();
+
+    private volatile int responseCode = 200;
+    private volatile String responseBody = "{\"result\":\"Success\"}";
+
+    @Before
+    public void beforeTest() throws IOException {
+        TestUtils.createCleanTestState();
+        received.clear();
+        responseCode = 200;
+        responseBody = "{\"result\":\"Success\"}";
+
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        port = server.getAddress().getPort();
+        server.createContext("/", exchange -> {
+            Received r = new Received();
+            r.method = exchange.getRequestMethod();
+            r.path = exchange.getRequestURI().getPath();
+            r.query = exchange.getRequestURI().getRawQuery();
+            r.body = readAll(exchange.getRequestBody());
+            exchange.getRequestHeaders().forEach((key, values) -> {
+                if (!values.isEmpty()) {
+                    r.headers.put(key.toLowerCase(), values.get(0));
+                }
+            });
+
+            synchronized (received) {
+                received.add(r);
+                received.notifyAll();
+            }
+
+            byte[] out = responseBody.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(responseCode, out.length);
+            try (OutputStream body = exchange.getResponseBody()) {
+                body.write(out);
+            }
+        });
+        // Single threaded, so the recorded order is the order the SDK sent them in.
+        server.setExecutor(Executors.newSingleThreadExecutor());
+        server.start();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    // region scenarios
+
+    /**
+     * The ordinary path: an event recorded through the public API is url-encoded onto a GET query
+     * string, reaches {@code /i}, and once the server accepts it the request leaves the on-disk
+     * queue. Proves the whole loop, not just that a request was built.
+     */
+    @Test
+    public void recordedEvent_reachesTheServerAsGetAndLeavesTheQueue() throws Exception {
+        Countly.instance().init(config(Config.Feature.Events).setEventQueueSizeToSend(1));
+
+        Countly.instance().events().recordEvent("networkedEvent", TestUtils.map("colour", "green"), 2, 3.5, null);
+
+        Received request = awaitRequestWith("events");
+
+        Assert.assertEquals("GET", request.method);
+        Assert.assertEquals("/i", request.path);
+        Assert.assertEquals(0, request.body.length);
+
+        Map<String, String> params = request.params();
+        Assert.assertEquals(TestUtils.SERVER_APP_KEY, params.get("app_key"));
+        Assert.assertEquals(TestUtils.DEVICE_ID, Utils.urldecode(params.get("device_id")));
+        Assert.assertEquals(TestUtils.SDK_NAME, params.get("sdk_name"));
+        Assert.assertTrue(Long.parseLong(params.get("timestamp")) > 0);
+
+        String events = Utils.urldecode(params.get("events"));
+        Assert.assertTrue("events payload was [" + events + "]", events.contains("\"key\":\"networkedEvent\""));
+        Assert.assertTrue(events.contains("\"count\":2"));
+        Assert.assertTrue(events.contains("\"sum\":3.5"));
+        Assert.assertTrue(events.contains("\"colour\":\"green\""));
+
+        // The server said "result", so the request must not be left behind on disk.
+        awaitEmptyRequestQueue();
+    }
+
+    /**
+     * A rejected request must survive. The server answers 500, so {@code processResponse} fails the
+     * send and the request stays queued for a later attempt rather than being dropped.
+     */
+    @Test
+    public void serverRejectsTheRequest_soItStaysInTheQueue() throws Exception {
+        responseCode = 500;
+        responseBody = "{\"result\":\"nope\"}";
+
+        Countly.instance().init(config(Config.Feature.Events).setEventQueueSizeToSend(1));
+        Countly.instance().events().recordEvent("rejectedEvent");
+
+        Received request = awaitRequestWith("events");
+        Assert.assertTrue(Utils.urldecode(request.params().get("events")).contains("rejectedEvent"));
+
+        // Still on disk: a 500 is retryable, so nothing may be discarded.
+        Storage.await(mock(Log.class));
+        Assert.assertTrue("a rejected request must stay queued", queuedRequestCount() >= 1);
+    }
+
+    /**
+     * A response that is not JSON at all is a failure, not a crash. Proves the parse guard in
+     * {@code processResponse} and that the request is kept.
+     */
+    @Test
+    public void nonJsonResponse_isTreatedAsAFailureAndKeepsTheRequest() throws Exception {
+        responseBody = "<html>gateway error</html>";
+
+        Countly.instance().init(config(Config.Feature.Events).setEventQueueSizeToSend(1));
+        Countly.instance().events().recordEvent("gatewayEvent");
+
+        awaitRequestWith("events");
+
+        Storage.await(mock(Log.class));
+        Assert.assertTrue("an unparseable response must not drop the request", queuedRequestCount() >= 1);
+    }
+
+
+
+
+    /**
+     * A device id change is an "important" request and carries the old id, which is the branch that
+     * picks the important-request cooldown in the send loop. Proves the old id reaches the server so
+     * it can merge the two profiles.
+     */
+    @Test
+    public void deviceIdChangeWithMerge_sendsTheOldIdThenTracksUnderTheNewOne() throws Exception {
+        Countly.instance().init(config(Config.Feature.Events).setEventQueueSizeToSend(1));
+
+        // A login, then the first thing the application tracks as the logged in user.
+        Countly.instance().deviceId().changeWithMerge("merged_network_user");
+        Countly.instance().events().recordEvent("afterLogin");
+
+        Received merge = awaitRequestWith(Params.PARAM_OLD_DEVICE_ID);
+        Map<String, String> mergeParams = merge.params();
+        Assert.assertEquals(TestUtils.DEVICE_ID, Utils.urldecode(mergeParams.get(Params.PARAM_OLD_DEVICE_ID)));
+        Assert.assertEquals("merged_network_user", Utils.urldecode(mergeParams.get("device_id")));
+
+        // Everything after the change must be attributed to the new id.
+        Received event = awaitRequestWith("events");
+        Assert.assertEquals("merged_network_user", Utils.urldecode(event.params().get("device_id")));
+        Assert.assertTrue(Utils.urldecode(event.params().get("events")).contains("afterLogin"));
+
+        awaitEmptyRequestQueue();
+    }
+
+
+    // endregion
+    // region helpers
+
+    private Config config(Config.Feature... features) {
+        File directory = TestUtils.getTestSDirectory();
+        TestUtils.checkSdkStorageRootDirectoryExist(directory);
+
+        Config config = new Config("http://127.0.0.1:" + port, TestUtils.SERVER_APP_KEY, directory);
+        config.setApplicationVersion(TestUtils.APPLICATION_VERSION);
+        config.setCustomDeviceId(TestUtils.DEVICE_ID);
+        config.enableFeatures(features);
+        // Nothing here should wait: the cooldowns only exist to be kind to a real server.
+        config.setNetworkRequestCooldown(0);
+        config.setNetworkImportantRequestCooldown(0);
+        return config;
+    }
+
+    /**
+     * Nudges the send loop. {@code DefaultNetworking.check} is what picks the next request off the
+     * queue, and the SDK only calls it when something is pushed, so a test that waits for a request
+     * already on disk has to ask for it. This is the same idea as driving the content zone timer by
+     * hand in {@code ModuleContentTests} rather than sleeping.
+     */
+    private void pump() {
+        if (SDKCore.instance != null && SDKCore.instance.networking != null) {
+            SDKCore.instance.networking.check(SDKCore.instance.config);
+        }
+    }
+
+    private static byte[] readAll(InputStream stream) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        byte[] buffer = new byte[4096];
+        int read;
+        while ((read = stream.read(buffer)) != -1) {
+            out.write(buffer, 0, read);
+        }
+        return out.toByteArray();
+    }
+
+    /**
+     * Waits for a request carrying the given parameter. A condition wait rather than a fixed sleep,
+     * so the test is as fast as the SDK is and still fails loudly if nothing arrives.
+     */
+    private Received awaitRequestWith(String parameter) throws InterruptedException {
+        long deadline = System.currentTimeMillis() + 15_000;
+        synchronized (received) {
+            while (System.currentTimeMillis() < deadline) {
+                for (Received candidate : received) {
+                    if (candidate.params().containsKey(parameter)) {
+                        return candidate;
+                    }
+                }
+                received.wait(50);
+                pump();
+            }
+            Assert.fail("no request carrying [" + parameter + "] arrived, saw " + received.size() + " request(s)");
+        }
+        return null;
+    }
+
+    private Received awaitRequestAfter(int alreadySeen) throws InterruptedException {
+        long deadline = System.currentTimeMillis() + 15_000;
+        synchronized (received) {
+            while (received.size() <= alreadySeen && System.currentTimeMillis() < deadline) {
+                received.wait(50);
+                pump();
+            }
+            Assert.assertTrue("no further request arrived", received.size() > alreadySeen);
+            return received.get(alreadySeen);
+        }
+    }
+
+    /**
+     * Counts queue files without reading them. {@link TestUtils#getCurrentRQ()} fails the test if a
+     * file disappears between listing and reading, which is exactly what the network loop does while
+     * it drains, so it cannot be used to watch a queue that is still moving.
+     */
+    private int queuedRequestCount() {
+        File[] files = TestUtils.getTestSDirectory().listFiles(
+            (dir, name) -> name.startsWith("[CLY]_request_"));
+        return files == null ? 0 : files.length;
+    }
+
+    private void awaitEmptyRequestQueue() throws InterruptedException {
+        long deadline = System.currentTimeMillis() + 15_000;
+        while (System.currentTimeMillis() < deadline) {
+            if (queuedRequestCount() == 0) {
+                return;
+            }
+            pump();
+            Thread.sleep(50);
+        }
+        Assert.assertEquals("an accepted request must be removed from the queue", 0, queuedRequestCount());
+    }
+
+    /**
+     * @return the index of {@code needle} inside {@code haystack}, or -1
+     */
+    private static int indexOf(byte[] haystack, byte[] needle) {
+        outer:
+        for (int i = 0; i <= haystack.length - needle.length; i++) {
+            for (int j = 0; j < needle.length; j++) {
+                if (haystack[i + j] != needle[j]) {
+                    continue outer;
+                }
+            }
+            return i;
+        }
+        return -1;
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportPinningTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportPinningTests.java
new file mode 100644
index 000000000..4488a915d
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/TransportPinningTests.java
@@ -0,0 +1,275 @@
+package ly.count.sdk.java.internal;
+
+import java.io.ByteArrayInputStream;
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Certificate and public key pinning, which is the part of {@link Transport} a customer turns on to
+ * stop a man in the middle and which had no coverage at all.
+ * <p>
+ * Driven with a self signed certificate generated for this test. The pin strings a customer passes
+ * to {@link Config#addPublicKeyPin(String)} are either a classpath resource name or, as here, the
+ * PEM text itself.
+ */
+@RunWith(JUnit4.class)
+public class TransportPinningTests {
+
+    /**
+     * A self signed certificate and its RSA public key, PEM encoded. Only ever compared against
+     * itself, never presented to a real server.
+     */
+    private static final String CERTIFICATE_PEM =
+        "-----BEGIN CERTIFICATE-----\n"
+            + "MIIDCTCCAfGgAwIBAgIUS9wHlLn6udicFTbrdAF3APj5aGswDQYJKoZIhvcNAQEL\n"
+            + "BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDkwMTA4MzI0NloXDTM2MDgy\n"
+            + "OTA4MzI0NlowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\n"
+            + "AAOCAQ8AMIIBCgKCAQEAoEAoIix1JRqGjxxZlVLcEYuoQE5QvdClJjdFxtkqnTxH\n"
+            + "im0Qlvh8tA0EoiFgDdhCvp2HLk3w8EloR5Op2JQKkyTEqPk5OY7ftg39WVsGIAP0\n"
+            + "CxwoyCymGgmP2gRimjV1wa+58Ng3f5MktTKAVWX91/ki9khQ2XVIXUv5wq3Yx0Vy\n"
+            + "CZa80W7bifXqfDnLmkhOA8jFy7effR/pkLk5j0HS9g3zYPFmid1gJHxF2/j7oZ9N\n"
+            + "OG7KBfKuB3Aml8R3Y9Xg/3RAbbh7jVwlYj8CJ1gCTU7V9bCRX+DFjX8XcCP7hVM8\n"
+            + "yHadS63dsnKPPlUtUbVQouNKqWA+ubhEpQsrxEmvjQIDAQABo1MwUTAdBgNVHQ4E\n"
+            + "FgQU+cWHVu0aVrvyLvuRIXNlS4jscpQwHwYDVR0jBBgwFoAU+cWHVu0aVrvyLvuR\n"
+            + "IXNlS4jscpQwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMV9b\n"
+            + "sJ86mBCSBvqS+dmfGxLLa1Idlz6msoSBdkdpC24F+85CvdxZCskyTtL5neQTXu62\n"
+            + "5KqFsI5AKi442YnMN+QlPnzrPF/CKozTKKWktNV2bbXWXsgE5XWn7Q0Fw9bRHznz\n"
+            + "KcQGuNc1A/ByE/LEjVgyJL6YndXCGMXvI6acU/b92r1g5D3lVvhP8BBEqM8/irGd\n"
+            + "HqGqgnWjyR+/ge3njjms6owidEXCO2bKmw80ONHD/jaZUWoQz3cw4lXaCoWkG89S\n"
+            + "ov+c+pXvQtgwT6gJ0V4B1MKAt9jtG2xkgJCZVz4moeFLqh5qEE5+t/hCzW6Pft1E\n"
+            + "1s4ekpbY3ieWeWxsOw==\n"
+            + "-----END CERTIFICATE-----\n";
+
+    private static final String PUBLIC_KEY_PEM =
+        "-----BEGIN PUBLIC KEY-----\n"
+            + "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoEAoIix1JRqGjxxZlVLc\n"
+            + "EYuoQE5QvdClJjdFxtkqnTxHim0Qlvh8tA0EoiFgDdhCvp2HLk3w8EloR5Op2JQK\n"
+            + "kyTEqPk5OY7ftg39WVsGIAP0CxwoyCymGgmP2gRimjV1wa+58Ng3f5MktTKAVWX9\n"
+            + "1/ki9khQ2XVIXUv5wq3Yx0VyCZa80W7bifXqfDnLmkhOA8jFy7effR/pkLk5j0HS\n"
+            + "9g3zYPFmid1gJHxF2/j7oZ9NOG7KBfKuB3Aml8R3Y9Xg/3RAbbh7jVwlYj8CJ1gC\n"
+            + "TU7V9bCRX+DFjX8XcCP7hVM8yHadS63dsnKPPlUtUbVQouNKqWA+ubhEpQsrxEmv\n"
+            + "jQIDAQAB\n"
+            + "-----END PUBLIC KEY-----\n";
+
+    /**
+     * A structurally valid but unrelated RSA public key, so a pin mismatch can be told apart from a
+     * parse failure.
+     */
+    private static final String OTHER_PUBLIC_KEY_PEM =
+        "-----BEGIN PUBLIC KEY-----\n"
+            + "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1oFvBHnrHqLJ0YfBiFTs\n"
+            + "kFYX1yiMTBTeuHfUCJHTUmVNbXQdaWm2H2i7ExHFdaOhBcJn2n1ZbnvVMSlLXCYq\n"
+            + "5b1oGCB9OJgLD1TZBOKZq7GEnBEIOxKPcVOSp0lPCLNRHYpVfj0P0j6EGWyBQ0LO\n"
+            + "2xIvBUnhVc6ZDcYUCoHRSJ0zGNsvhBQoRz1qCHU5tPmXQeIzXNxNZMKKGgFqpTV3\n"
+            + "L1kM8vBQoTZ2xJ5nDCXBqEFhZBGKzMFdV2gRBQnJXqOvBqUzPnMcmTKGXBOxvDCn\n"
+            + "9YJqBGKzXvQnJ0mBQoRzHFdaOhBcJn2n1ZbnvVMSlLXCYq5b1oGCB9OJgLD1TZBO\n"
+            + "KwIDAQAB\n"
+            + "-----END PUBLIC KEY-----\n";
+
+    private X509Certificate certificate;
+
+    @Before
+    public void beforeTest() throws Exception {
+        TestUtils.createCleanTestState();
+        CertificateFactory factory = CertificateFactory.getInstance("X.509");
+        certificate = (X509Certificate) factory.generateCertificate(
+            new ByteArrayInputStream(CERTIFICATE_PEM.getBytes(StandardCharsets.UTF_8)));
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * A public key pin given as PEM text is parsed, stored, and accepts the matching server key while
+     * rejecting an unrelated one. Also proves an empty chain and a missing auth type are refused
+     * before any comparison happens, which is what stops a stripped handshake from passing.
+     */
+    @Test
+    public void publicKeyPin_acceptsTheMatchingKeyAndRejectsEverythingElse() throws Exception {
+        Transport transport = pinnedTransport(PUBLIC_KEY_PEM, null);
+
+        // The pin came from the same key pair as the certificate, so this chain must pass.
+        transport.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+
+        // A chain the pin does not cover must be refused.
+        Transport other = pinnedTransport(OTHER_PUBLIC_KEY_PEM, null);
+        assertPinningRejects(other, new X509Certificate[] { certificate }, "RSA");
+
+        // Malformed handshakes are refused before the pins are even consulted.
+        try {
+            transport.checkServerTrusted(null, "RSA");
+            Assert.fail("a null chain must be refused");
+        } catch (IllegalArgumentException expected) {
+            Assert.assertTrue(expected.getMessage().contains("null"));
+        }
+        try {
+            transport.checkServerTrusted(new X509Certificate[0], "RSA");
+            Assert.fail("an empty chain must be refused");
+        } catch (IllegalArgumentException expected) {
+            Assert.assertTrue(expected.getMessage().contains("empty"));
+        }
+        try {
+            transport.checkServerTrusted(new X509Certificate[] { certificate }, null);
+            Assert.fail("a null auth type must be refused");
+        } catch (CertificateException expected) {
+            Assert.assertTrue(expected.getMessage().contains("AuthType is null"));
+        }
+        try {
+            transport.checkServerTrusted(new X509Certificate[] { certificate }, "");
+            Assert.fail("an empty auth type must be refused");
+        } catch (CertificateException expected) {
+            Assert.assertTrue(expected.getMessage().contains("AuthType is empty"));
+        }
+    }
+
+    /**
+     * A certificate pin, the other half of the feature. Pinning the whole certificate accepts the
+     * same chain, and a public key pin that is actually a certificate is still accepted because the
+     * SDK falls back to reading the key out of it.
+     */
+    @Test
+    public void certificatePin_andACertificatePassedAsAKeyPin_bothAccept() throws Exception {
+        Transport byCertificate = pinnedTransport(null, CERTIFICATE_PEM);
+        byCertificate.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+
+        // A customer who pastes a certificate where a public key was expected must still be pinned,
+        // not silently unprotected.
+        Transport byCertificateAsKey = pinnedTransport(CERTIFICATE_PEM, null);
+        byCertificateAsKey.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+
+        // And the unrelated chain still fails against a certificate pin.
+        Transport unrelated = pinnedTransport(null, null);
+        // No pins at all means pinning is off, so anything passes.
+        unrelated.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+        unrelated.checkServerTrusted(null, "RSA");
+    }
+
+    /**
+     * Pins can be given with or without the PEM armour and with stray whitespace, because that is how
+     * they arrive when copied out of a terminal. All spellings must produce the same pin, and a pin
+     * that is not decodable must not take initialisation down.
+     */
+    @Test
+    public void pinParsing_toleratesArmourWhitespaceAndGarbage() throws Exception {
+        String bare = PUBLIC_KEY_PEM
+            .replace("-----BEGIN PUBLIC KEY-----", "")
+            .replace("-----END PUBLIC KEY-----", "")
+            .replace("\n", "");
+
+        // Bare base64, armoured, and armoured with padding whitespace must all pin the same key.
+        for (String spelling : new String[] { bare, PUBLIC_KEY_PEM, "\n  " + PUBLIC_KEY_PEM + "  \n" }) {
+            Transport transport = pinnedTransport(spelling, null);
+            transport.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+        }
+
+        // A pin that decodes but is not a key or a certificate is refused loudly, which is the
+        // documented contract of Transport#init.
+        Transport unusable = new Transport();
+        Config config = TestUtils.getBaseConfig();
+        config.addPublicKeyPin(Utils.Base64.encode("not a key at all"));
+        try {
+            unusable.init(TestUtils.getInternalConfigWithLogger(config));
+            Assert.fail("a pin that is neither a key nor a certificate must be refused");
+        } catch (IllegalArgumentException expected) {
+            Assert.assertTrue(expected.getCause() instanceof CertificateException);
+        }
+    }
+
+    /**
+     * keytool and the Windows tools write the base64 body with "\r\n" line ends. Such a pin used to
+     * fail to decode, and since an undecodable pin is skipped rather than refused, pinning was silently
+     * off for exactly the customer who exported the certificate with the JDK's own tool. The pins must
+     * be registered, not merely tolerated: with no pins at all the trust check passes everything.
+     */
+    @Test
+    public void pinParsing_acceptsCrlfLineEndsAsKeytoolWritesThem() throws Exception {
+        Transport byCertificate = pinnedTransport(null, CERTIFICATE_PEM.replace("\n", "\r\n"));
+        Assert.assertEquals(1, pinsOf(byCertificate, "certPins").size());
+        byCertificate.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+
+        Transport byKey = pinnedTransport(PUBLIC_KEY_PEM.replace("\n", "\r\n"), null);
+        Assert.assertEquals(1, pinsOf(byKey, "keyPins").size());
+        byKey.checkServerTrusted(new X509Certificate[] { certificate }, "RSA");
+    }
+
+    private static java.util.List<?> pinsOf(Transport transport, String field) throws Exception {
+        Field pins = Transport.class.getDeclaredField(field);
+        pins.setAccessible(true);
+        return (java.util.List<?>) pins.get(transport);
+    }
+
+    /**
+     * The trust manager contract the SDK implements. Client side checks delegate to the platform, and
+     * the accepted issuer list is deliberately empty because the SDK never acts as a server.
+     */
+    @Test
+    public void trustManagerContract_delegatesClientChecksAndPublishesNoIssuers() throws Exception {
+        Transport transport = pinnedTransport(PUBLIC_KEY_PEM, null);
+
+        Assert.assertEquals(0, transport.getAcceptedIssuers().length);
+
+        // With the platform trust manager removed this is a no-op rather than a crash.
+        setDefaultTrustManager(transport, null);
+        transport.checkClientTrusted(new X509Certificate[] { certificate }, "RSA");
+    }
+
+    // endregion
+    // region helpers
+
+    /**
+     * Builds a transport with the given pins installed through the public {@link Config} API.
+     * <p>
+     * The platform trust manager is then cleared, because it is the one thing this test cannot
+     * satisfy: a self signed certificate can never chain to a system root, so leaving it in place
+     * would make every scenario fail on the standard TLS check before the SDK's own pin comparison
+     * is ever reached. Reflection is the established pattern in this suite for reaching into
+     * {@link Transport} (see {@code TransportTests}).
+     */
+    private Transport pinnedTransport(String keyPin, String certificatePin) throws Exception {
+        Config config = TestUtils.getBaseConfig();
+        if (keyPin != null) {
+            config.addPublicKeyPin(keyPin);
+        }
+        if (certificatePin != null) {
+            config.addCertificatePin(certificatePin);
+        }
+
+        Transport transport = new Transport();
+        transport.init(TestUtils.getInternalConfigWithLogger(config));
+        setDefaultTrustManager(transport, null);
+        return transport;
+    }
+
+    private static void setDefaultTrustManager(Transport transport, Object value) throws Exception {
+        Field field = Transport.class.getDeclaredField("defaultTrustManager");
+        field.setAccessible(true);
+        field.set(transport, value);
+    }
+
+    private static void assertPinningRejects(Transport transport, X509Certificate[] chain, String authType) {
+        try {
+            transport.checkServerTrusted(chain, authType);
+            Assert.fail("a chain that matches no pin must be rejected");
+        } catch (CertificateException expected) {
+            Assert.assertTrue("unexpected message: " + expected.getMessage(),
+                expected.getMessage().contains("pinning validation"));
+        }
+    }
+
+    // endregion
+}
diff --git a/sdk-java/src/test/java/ly/count/sdk/java/internal/UserProfileLegacyTests.java b/sdk-java/src/test/java/ly/count/sdk/java/internal/UserProfileLegacyTests.java
new file mode 100644
index 000000000..dd4312ed3
--- /dev/null
+++ b/sdk-java/src/test/java/ly/count/sdk/java/internal/UserProfileLegacyTests.java
@@ -0,0 +1,227 @@
+package ly.count.sdk.java.internal;
+
+import java.util.HashMap;
+import java.util.Map;
+import ly.count.sdk.java.Config;
+import ly.count.sdk.java.Countly;
+import ly.count.sdk.java.User;
+import ly.count.sdk.java.UserEditor;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * The legacy {@link UserEditor} surface and the {@link UserImpl} it hands back.
+ * <p>
+ * {@code UserEditorTests} covers the property setters that still write to the wire. This covers the
+ * location shortcuts, which are routed into the location module rather than into user details, the
+ * accessors on {@link UserImpl}, and the deprecated calls that must be verified to really do nothing.
+ */
+@RunWith(JUnit4.class)
+public class UserProfileLegacyTests {
+
+    @Before
+    public void beforeTest() {
+        TestUtils.createCleanTestState();
+    }
+
+    @After
+    public void stop() {
+        Countly.instance().halt();
+    }
+
+    // region scenarios
+
+    /**
+     * The location shortcuts on the user editor are really location calls: country, city and a
+     * "lat,lon" string all end up in the location module's request rather than in user details.
+     */
+    @Test
+    public void locationShortcuts_routeIntoTheLocationRequest() {
+        Countly.instance().init(TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.UserProfiles, Config.Feature.Location));
+
+        UserEditor editor = Countly.instance().user().edit();
+        Assert.assertSame(editor, editor.setCountry("DE"));
+        Assert.assertSame(editor, editor.setCity("Berlin"));
+        Assert.assertSame(editor, editor.setLocation("52.5,13.4"));
+        editor.commit();
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Map<String, String> location = lastRequestWith("location");
+        Assert.assertNotNull("a location must have been sent", location);
+        Assert.assertEquals("52.5,13.4", location.get("location"));
+
+        Map<String, String> country = lastRequestWith("country_code");
+        Assert.assertNotNull(country);
+        Assert.assertEquals("DE", country.get("country_code"));
+
+        Map<String, String> city = lastRequestWith("city");
+        Assert.assertNotNull(city);
+        Assert.assertEquals("Berlin", city.get("city"));
+    }
+
+    /**
+     * The latitude and longitude overload, and every malformed location string that must be refused
+     * rather than sent as nonsense coordinates.
+     */
+    @Test
+    public void locationStrings_areValidatedBeforeBeingSent() {
+        Countly.instance().init(TestUtils.getBaseConfig()
+            .enableFeatures(Config.Feature.UserProfiles, Config.Feature.Location));
+
+        UserEditor editor = Countly.instance().user().edit();
+
+        // Every one of these is not a "lat,lon" pair and must not produce a location.
+        for (String bad : new String[] { "notALocation", "1,2,3", "one,two", "", "52.5," }) {
+            editor.setLocation(bad);
+        }
+        // The legacy setters only buffer; the buffered values are flushed on commit.
+        editor.commit();
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertNull("a malformed location must not be sent", lastRequestWith("location"));
+
+        // The typed overload always produces a well formed pair.
+        Assert.assertSame(editor, editor.setLocation(1.5, -2.5));
+        editor.commit();
+        Storage.await(SDKCore.instance.config.getLogger());
+        Map<String, String> sent = lastRequestWith("location");
+        Assert.assertNotNull(sent);
+        Assert.assertEquals("1.5,-2.5", sent.get("location"));
+
+        // Opting out clears the location on the server rather than simply stopping updates.
+        Assert.assertSame(editor, editor.optOutFromLocationServices());
+        editor.commit();
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertNotNull(lastRequestWith("location"));
+    }
+
+    /**
+     * The accessors on {@link UserImpl}. They read the in-memory profile the SDK keeps, so they are
+     * driven by populating that profile and reading it back, which is what an integration that holds
+     * on to a {@link User} reference sees.
+     */
+    @Test
+    public void userAccessors_readBackTheInMemoryProfile() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.UserProfiles));
+
+        UserImpl user = (UserImpl) Countly.instance().user();
+        Assert.assertNotNull(user);
+
+        // Only id, picture and picturePath are ever written by the SDK itself; the rest of the
+        // profile fields are package visible and never populated from a server response, so they are
+        // set here directly to prove the accessors report what the profile holds.
+        user.id = "user-id";
+        user.name = "A Name";
+        user.username = "a_username";
+        user.email = "a@example.com";
+        user.org = "An Org";
+        user.phone = "+100000000";
+        user.gender = User.Gender.FEMALE;
+        user.locale = "de_DE";
+        user.birthyear = 1985;
+        user.country = "DE";
+        user.city = "Berlin";
+        user.location = "52.5,13.4";
+        user.custom = new HashMap<>();
+        user.custom.put("tier", "gold");
+
+        Assert.assertEquals("user-id", user.id());
+        Assert.assertEquals("A Name", user.name());
+        Assert.assertEquals("a_username", user.username());
+        Assert.assertEquals("a@example.com", user.email());
+        Assert.assertEquals("An Org", user.org());
+        Assert.assertEquals("+100000000", user.phone());
+        Assert.assertEquals(User.Gender.FEMALE, user.gender());
+        Assert.assertEquals("de_DE", user.locale());
+        Assert.assertEquals(Integer.valueOf(1985), user.birthyear());
+        Assert.assertEquals("DE", user.country());
+        Assert.assertEquals("Berlin", user.city());
+        Assert.assertEquals("52.5,13.4", user.location());
+        Assert.assertEquals("gold", user.custom().get("tier"));
+
+        // toString is used in logs, so it must at least name the user rather than the class.
+        Assert.assertTrue(user.toString().contains("user-id"));
+    }
+
+    /**
+     * {@link User.Gender} round trips through its wire form, which is the single character the server
+     * expects, and refuses anything else.
+     */
+    @Test
+    public void gender_roundTripsThroughItsWireForm() {
+        Assert.assertEquals(User.Gender.FEMALE, User.Gender.fromString("F"));
+        Assert.assertEquals(User.Gender.MALE, User.Gender.fromString("M"));
+        Assert.assertEquals("F", User.Gender.FEMALE.toString());
+        Assert.assertEquals("M", User.Gender.MALE.toString());
+
+        for (String bad : new String[] { "X", "", "female", null }) {
+            Assert.assertNull("gender must not be guessed from " + bad, User.Gender.fromString(bad));
+        }
+    }
+
+    /**
+     * The deprecated editor calls that are kept for source compatibility. Each must be verified to
+     * really do nothing, and none may produce a request.
+     */
+    @Test
+    public void deprecatedEditorCalls_areRealNoOps() {
+        Countly.instance().init(TestUtils.getBaseConfig().enableFeatures(Config.Feature.UserProfiles));
+
+        UserEditor editor = Countly.instance().user().edit();
+        Storage.await(SDKCore.instance.config.getLogger());
+        int before = TestUtils.getCurrentRQ().length;
+
+        Assert.assertSame(editor, editor.setLocale("en_GB"));
+        Assert.assertSame(editor, editor.addToCohort("a-cohort"));
+        Assert.assertSame(editor, editor.removeFromCohort("a-cohort"));
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        Assert.assertEquals("a deprecated no-op must not send anything",
+            before, TestUtils.getCurrentRQ().length);
+    }
+
+    /**
+     * Committing before the SDK is up, and committing under backend mode, must both answer null
+     * rather than pretending the profile was saved.
+     */
+    @Test
+    public void commit_declinesWhenTheSdkCannotSave() {
+        // Backend mode owns the wire, so an ordinary user profile commit stands down.
+        Config config = TestUtils.getBaseConfig().enableFeatures(Config.Feature.UserProfiles);
+        config.enableBackendMode();
+        Countly.instance().init(config);
+
+        UserImpl user = new UserImpl(SDKCore.instance.config);
+        UserEditorImpl editor = new UserEditorImpl(user, SDKCore.instance.config.getLogger());
+        Assert.assertNull("backend mode must not commit a profile", editor.commit());
+
+        Storage.await(SDKCore.instance.config.getLogger());
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            Assert.assertFalse("no user details may be sent under backend mode",
+                request != null && request.containsKey("user_details"));
+        }
+    }
+
+    // endregion
+    // region helpers
+
+    /**
+     * @param parameter the parameter to look for
+     * @return the last queued request carrying it, or null
+     */
+    private Map<String, String> lastRequestWith(String parameter) {
+        Map<String, String> found = null;
+        for (Map<String, String> request : TestUtils.getCurrentRQ()) {
+            if (request != null && request.containsKey(parameter)) {
+                found = request;
+            }
+        }
+        return found;
+    }
+
+    // endregion
+}
diff --git a/settings.gradle b/settings.gradle
index aa989e7f0..dcc7d2a7e 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -5,10 +5,12 @@ pluginManagement {
     }
 }
 
+
 include ':sdk-java', ':app-java'
 
-// app-javafx uses the openjfx Gradle plugin which requires Java 11+.
-// Skip it on older JVMs so sdk-java / app-java stay buildable on Java 8.
+// sdk-java-ui and app-javafx use the openjfx Gradle plugin which requires Java 11+.
+// Skip them on older JVMs so sdk-java / app-java stay buildable on Java 8.
 if (JavaVersion.current().isJava11Compatible()) {
+    include ':sdk-java-ui'
     include ':app-javafx'
 }