diff --git a/desktop/shell/bin/omarchy-rotate b/desktop/shell/bin/omarchy-rotate
new file mode 100755
index 0000000..512d377
--- /dev/null
+++ b/desktop/shell/bin/omarchy-rotate
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Manual rotation uses the same output protocol as auto-rotation; holds auto until unlock."""
+import json, os, subprocess, sys
+from pathlib import Path
+mode = sys.argv[1] if len(sys.argv)>1 else 'status'
+outputs = json.loads(subprocess.check_output(['wlr-randr', '--json'], text=True))
+panel = next((o for o in outputs if o['name'] == 'eDP-1'), None)
+if panel is None:
+    panel = next(o for o in outputs if o.get('enabled'))
+current = panel['transform']
+turns = ['normal', '90', '180', '270']
+if mode == 'status':
+    print(current); raise SystemExit(0)
+if mode == 'next': mode = turns[(turns.index(current)+1)%4]
+mode = {'portrait':'normal','landscape':'90','portrait-flipped':'180','landscape-flipped':'270'}.get(mode,mode)
+if mode not in turns: raise SystemExit('Usage: omarchy-rotate status|next|normal|90|180|270')
+lock = Path(os.environ.get('XDG_CONFIG_HOME', str(Path.home()/'.config')))/'omarchy/rotation-lock'
+was_locked = lock.exists()
+lock.parent.mkdir(parents=True,exist_ok=True); lock.touch()
+try:
+    subprocess.run(['wlr-randr','--output',panel['name'],'--transform',mode],check=True,timeout=5)
+except (OSError, subprocess.SubprocessError):
+    if not was_locked: lock.unlink(missing_ok=True)
+    raise
diff --git a/desktop/shell/default/omarchy/omarchy-menu.jsonc b/desktop/shell/default/omarchy/omarchy-menu.jsonc
index de7b289..cf0eacc 100644
--- a/desktop/shell/default/omarchy/omarchy-menu.jsonc
+++ b/desktop/shell/default/omarchy/omarchy-menu.jsonc
@@ -35,7 +35,7 @@
   // System
   "system.screensaver": {"icon":"󱄄","label":"Screensaver","action":"omarchy-launch-screensaver force"},
   "system.lock": {"icon":"","label":"Lock","action":"omarchy-system-lock"},
-  "system.suspend": {"icon":"󰒲","label":"Suspend","when":"! omarchy-toggle-enabled suspend-off && ! omarchy-sleep-disabled","action":"systemctl suspend"},
+  "system.suspend": {"icon":"󰒲","label":"Suspend","when":"! omarchy-toggle-enabled suspend-off && /usr/local/bin/ipadlinux-suspend-ready","action":"/usr/local/bin/ipadlinux-suspend-ready && systemctl suspend"},
   "system.hibernate": {"icon":"󰤁","label":"Hibernate","when":"omarchy-hibernation-available && ! omarchy-sleep-disabled","action":"systemctl hibernate"},
   "system.logout": {"icon":"󰍃","label":"Logout","action":"omarchy-system logout"},
   // Orchard: a reboot does not come back into Linux. The device's own boot chain starts its own system; Linux returns through DFU.
@@ -184,6 +184,8 @@
   "trigger.tests.disk-speedtest": {"icon":"󰋊","label":"Disk Speed Test","action":"omarchy-shell shell summon omarchy.disk-speedtest"},
 
   // Setup
+  "setup.tablet": {"icon":"󰦧","label":"Tablet"},
+  "setup.tablet.rotate": {"icon":"󰑢","label":"Rotate Once and Lock","action":"omarchy-rotate next"},
   "setup.monitors": {"icon":"󰍹","label":"Monitors","action":"omarchy-launch-config-editor \"$HOME/.config/hypr/monitors.lua\""},
   "setup.keybindings": {"icon":"","label":"Keybindings","when":"[[ -f ~/.config/hypr/bindings.lua ]]","action":"omarchy-launch-config-editor \"$HOME/.config/hypr/bindings.lua\""},
   "setup.input": {"icon":"","label":"Input","when":"[[ -f ~/.config/hypr/input.lua ]]","action":"omarchy-launch-config-editor \"$HOME/.config/hypr/input.lua\""},
diff --git a/desktop/shell/shell/plugins/services/idle/Service.qml b/desktop/shell/shell/plugins/services/idle/Service.qml
index 9f0511c..a4e384b 100644
--- a/desktop/shell/shell/plugins/services/idle/Service.qml
+++ b/desktop/shell/shell/plugins/services/idle/Service.qml
@@ -285,6 +285,19 @@ Item {
     onTriggered: if (root.screensaverEnabled) root.launchScreensaver()
   }
 
+  // Dim before the 5-minute lock. The power daemon serializes dim/ALS/off;
+  // input restores only if a manual brightness change has not superseded dim.
+  IdleMonitor {
+    id: dimMonitor
+    timeout: 180
+    enabled: Quickshell.env("OMARCHY_TOUCH_MODE") === "1" && root.idleEnabled && root.lockEnabled
+    onIsIdleChanged: {
+      dimProcess.command = ["/usr/libexec/omarchy-powerctl", isIdle ? "dim" : "undim"]
+      dimProcess.running = true
+    }
+  }
+  Process { id: dimProcess }
+
   Timer {
     id: lockTimer
     repeat: false
diff --git a/desktop/stage.py b/desktop/stage.py
index 1cf4f79..b0c1ac0 100644
--- a/desktop/stage.py
+++ b/desktop/stage.py
@@ -123,12 +123,6 @@ def main():
         copy(src, dst)
     # Branding is static; kernel, memory and CPU information use live probes.
     assert "VM prototype" not in (config / "fastfetch/config.jsonc").read_text()
-    # Offer Suspend only when the kernel-side charger PM contract is ready.
-    menu = source / "default/omarchy/omarchy-menu.jsonc"
-    original_menu = menu.read_text()
-    stock_guard = '"when":"! omarchy-toggle-enabled suspend-off && ! omarchy-sleep-disabled"'
-    assert original_menu.count(stock_guard) == 1
-    menu.write_text(original_menu.replace(stock_guard, '"when":"command -v ipadlinux-suspend-ready >/dev/null && ipadlinux-suspend-ready"'))
     (config / "labwc/autostart").chmod(0o755)
     (target / "usr/local/libexec/arch-ipad-first-theme").chmod(0o755)
     (target / "usr/local/libexec/arch-ipad-scale-output").chmod(0o755)
diff --git a/docs/power-and-lock.md b/docs/power-and-lock.md
index f43bfde..90bf3b4 100644
--- a/docs/power-and-lock.md
+++ b/docs/power-and-lock.md
@@ -4,8 +4,8 @@
 of the screen, the lock request and sleep. Its state machine, the `Machine`
 class, has no I/O and no clocks; `tests/test_powerd.py` walks every reachable
 state with every input and checks the invariants below. Whether a board may
-suspend at all is not decided here or by device data: every board may (see
-orchard `docs/bring-up/suspend.md`); this model decides when.
+suspend at all is decided by the kernel's suspend admission; this model decides
+when. Where the kernel refuses, boards retain dim, blank and wake.
 
 ## Requirements
 
@@ -222,3 +222,47 @@ when `user.slice` thaws.
 `omarchy-tablet-power` (one process per press, state in brightness and files, a
 fixed window after resume), `omarchy-screen-toggle` and `omarchy-greeter-wake`
 (a second and third writer of the backlight).
+
+## Suspend readiness
+
+The root overlay installs `/usr/local/bin/ipadlinux-suspend-ready` for both
+fresh roots and public-root refreshes. It reads the kernel's admission query,
+`/sys/power/suspend_ready` (Orchard's suspend topic), on every board: `ready`
+exits 0; `not-ready <who> <errno>` exits 1 naming the refusing provider device
+or precheck. The kernel runs every admission provider's non-reserving check
+(GPU, video decoder) and every early precheck (PCI/NVMe, AOP, USB) for the
+current `mem_sleep` state, takes no reservation, and answers
+`not-ready transition` while a transition runs. A missing, unreadable or
+malformed answer refuses: a kernel without the query cannot show that a suspend
+would be admitted. There is no board list and no feature-state lookup. Refusal
+returns 1 with a reason on stderr. Arguments are rejected with status 2. It
+never writes sysfs, unbinds drivers, runs a PM test or requests suspend. The
+power daemon logs refusal reasons. The answer is advisory; the real suspend
+reserves and checks again.
+
+The source menu used by both desktop staging and `release/public_root.py` uses
+this helper for visibility and again before its suspend action. Powerd uses it
+for every sleep request (Power, idle and closing the Smart Cover); a refusal
+leaves the screen dark until touch, Home, Power or opening the cover wakes it,
+without retrying sleep. Logind ignores lid, idle, suspend and power keys;
+keyboard or direct logind/systemctl requests still pass the same helper in
+`systemd-suspend.service`'s `ExecStartPre`. Hibernation, hybrid sleep and
+suspend-then-hibernate remain disabled and their targets masked. No static
+suspend mask or board-specific override is installed: the kernel's admission is
+the only gate.
+
+Device verification on a rebuilt image:
+
+```sh
+cat /sys/power/suspend_ready
+timeout -k 5 10 /usr/local/bin/ipadlinux-suspend-ready
+```
+
+The helper's status must match the kernel's answer: 0 for `ready`, 1 with the
+same refusal named for `not-ready`. While it refuses, `systemctl suspend` must
+refuse too, the journal must name the kernel's refusal rather than a suspend
+attempt, suspend success counters must not advance, and the final session menu
+must omit Suspend. Use `timeout -k 5 5 omarchy-powerctl idle`, closing the
+Smart Cover, and a short Power press separately; while suspend is refused each
+must blank without sleep, and touch, Power or opening the cover must wake.
+Dim/undim must still restore the previous brightness. These are pending device checks, not host-test results.
diff --git a/release/public_root.py b/release/public_root.py
index 63a2d35..5780274 100644
--- a/release/public_root.py
+++ b/release/public_root.py
@@ -42,6 +42,7 @@ def desktop_replacements():
     replacements['home/tablet/.config/labwc/rc.xml'] = (PROJECT / 'desktop/shell/labwc-rc.xml').read_bytes()
     replacements['home/tablet/.config/labwc/autostart'] = (PROJECT / 'desktop/configuration/labwc-autostart').read_bytes()
     replacements['usr/local/libexec/arch-ipad-rotate-output'] = (PROJECT / 'desktop/configuration/rotate-output').read_bytes()
+    replacements[prefix + 'default/omarchy/omarchy-menu.jsonc'] = (PROJECT / 'desktop/shell/default/omarchy/omarchy-menu.jsonc').read_bytes()
     return replacements
 
 
@@ -129,10 +130,14 @@ def labwc_files(directory, architecture='aarch64'):
 
 
 def desktop_additions():
-    name = 'home/tablet/.local/share/omarchy-ipad/shell/bluetooth-pairing/shell.qml'
-    return {name: ((PROJECT / 'desktop/shell/shell/bluetooth-pairing/shell.qml').read_bytes(), 0o644),
-            'home/tablet/.local/share/omarchy-ipad/bin/omarchy-rotation-lock':
-                ((PROJECT / 'desktop/shell/bin/omarchy-rotation-lock').read_bytes(), 0o755)}
+    prefix = 'home/tablet/.local/share/omarchy-ipad/'
+    return {
+        'usr/local/bin/omarchy-rotate': ((PROJECT / 'desktop/shell/bin/omarchy-rotate').read_bytes(), 0o755),
+        'home/tablet/.local/share/omarchy-ipad/bin/omarchy-rotate': ((PROJECT / 'desktop/shell/bin/omarchy-rotate').read_bytes(), 0o755),
+        'usr/local/bin/omarchy-rotation-lock': ((PROJECT / 'desktop/shell/bin/omarchy-rotation-lock').read_bytes(), 0o755),
+        'home/tablet/.local/share/omarchy-ipad/bin/omarchy-rotation-lock': ((PROJECT / 'desktop/shell/bin/omarchy-rotation-lock').read_bytes(), 0o755),
+        'home/tablet/.local/share/omarchy-ipad/shell/bluetooth-pairing/shell.qml': ((PROJECT / 'desktop/shell/shell/bluetooth-pairing/shell.qml').read_bytes(), 0o644),
+    }
 
 
 def system_files():
@@ -142,7 +147,7 @@ def system_files():
             name = path.relative_to(SYSTEM).as_posix()
             data = path.read_bytes()
             mode = 0o440 if name.startswith('etc/sudoers.d/') else (
-                0o755 if name.startswith(('usr/libexec/', 'etc/NetworkManager/dispatcher.d/')) else 0o644)
+                0o755 if name.startswith(('usr/libexec/', 'usr/bin/', 'usr/local/bin/', 'etc/NetworkManager/dispatcher.d/')) or name in ('usr/lib/orchard-kexec/quiesce-gpu', 'usr/lib/orchard-kexec/fdt-merge') else 0o644)
             additions[name] = (data, mode)
     return additions
 
diff --git a/system/overlay/etc/systemd/logind.conf.d/60-omarchy-a-power.conf b/system/overlay/etc/systemd/logind.conf.d/60-omarchy-a-power.conf
index 4c3908a..61a2812 100644
--- a/system/overlay/etc/systemd/logind.conf.d/60-omarchy-a-power.conf
+++ b/system/overlay/etc/systemd/logind.conf.d/60-omarchy-a-power.conf
@@ -3,3 +3,7 @@ HandlePowerKey=ignore
 HandleSuspendKey=ignore
 HandleHibernateKey=ignore
 IdleAction=ignore
+
+HandleLidSwitch=ignore
+HandleLidSwitchExternalPower=ignore
+HandleLidSwitchDocked=ignore
diff --git a/system/overlay/etc/systemd/sleep.conf.d/60-omarchy-a-no-hibernate.conf b/system/overlay/etc/systemd/sleep.conf.d/60-omarchy-a-no-hibernate.conf
index 01e716c..9e0b786 100644
--- a/system/overlay/etc/systemd/sleep.conf.d/60-omarchy-a-no-hibernate.conf
+++ b/system/overlay/etc/systemd/sleep.conf.d/60-omarchy-a-no-hibernate.conf
@@ -1,5 +1,5 @@
-# No hibernation: nothing restores an image on these devices. Every board may
-# suspend; do not set AllowSuspend here.
+# No hibernation: nothing restores an image on these devices. Suspend is
+# checked at runtime by systemd-suspend.service, against the kernel's admission.
 [Sleep]
 AllowHibernation=no
 AllowHybridSleep=no
diff --git a/system/overlay/etc/systemd/system/systemd-suspend.service.d/60-omarchy-a-qualification.conf b/system/overlay/etc/systemd/system/systemd-suspend.service.d/60-omarchy-a-qualification.conf
new file mode 100644
index 0000000..4c9384e
--- /dev/null
+++ b/system/overlay/etc/systemd/system/systemd-suspend.service.d/60-omarchy-a-qualification.conf
@@ -0,0 +1,4 @@
+# Enforce the same kernel admission check for direct systemctl/logind
+# requests and keyboard bindings, even without a desktop or powerd running.
+[Service]
+ExecStartPre=/usr/local/bin/ipadlinux-suspend-ready
diff --git a/system/overlay/usr/libexec/omarchy-powerd b/system/overlay/usr/libexec/omarchy-powerd
index f414789..30219dc 100755
--- a/system/overlay/usr/libexec/omarchy-powerd
+++ b/system/overlay/usr/libexec/omarchy-powerd
@@ -382,6 +382,17 @@ class Buttons:
         return 'power' if short else None
 
 
+def platform_suspend_ready():
+    helper = '/usr/local/bin/ipadlinux-suspend-ready'
+    if not Path(helper).exists():
+        log('no suspend: missing ' + helper)
+        return False
+    result = command(helper)
+    if result.returncode:
+        log('no suspend: ' + (result.stderr.strip() or 'platform readiness refused'))
+    return result.returncode == 0
+
+
 def command(*argv, timeout=5, **options):
     return subprocess.run(argv, capture_output=True, text=True, timeout=timeout, **options)
 
@@ -414,7 +425,6 @@ def as_user(user, *argv, timeout=5):
 class Daemon:
     def __init__(self):
         self.machine = Machine()
-        self.buttons = Buttons()
         self.cover = Cover()
         self.covers = {}
         self.events = queue.Queue()
@@ -428,8 +438,11 @@ class Daemon:
         self.saved = None
         self.counters = None
         self.sleep_started = None
+        self.buttons = Buttons()
         self.ticks = 0
         self.cancel = threading.Event()
+        self.dim_saved = None
+        self.dim_level = None
         self.dark = threading.Event()
         self.session_jobs = queue.Queue()
         self.inhibitor = None
@@ -557,13 +570,22 @@ class Daemon:
             getattr(self, 'do_' + action.replace('-', '_'))(before)
         self.dark.set() if self.machine.state in (SETTLING, DARK) else self.dark.clear()
 
+    def undim(self):
+        panel = self.backlight()
+        if self.dim_saved is not None and panel:
+            current = int((panel / 'brightness').read_text())
+            if self.machine.state == ON and current == self.dim_level:
+                (panel / 'brightness').write_text(f'{self.dim_saved}\n')
+        self.dim_saved = self.dim_level = None
+
     def do_dark(self, _):
         panel = self.backlight()
         if panel:
             current = int((panel / 'brightness').read_text())
             if current > 0 and self.fade is None:
-                self.saved = current
-                self.remember_brightness(current)
+                self.saved = self.dim_saved or current
+                self.remember_brightness(self.saved)
+            self.dim_saved = self.dim_level = None
             self.start_fade(panel, 0)
 
     def start_fade(self, panel, target):
@@ -700,6 +722,12 @@ class Daemon:
 
     def request_suspend(self):
         try:
+            # Shared with the final menu and systemd's direct suspend guard:
+            # the kernel's non-reserving admission query.
+            if not platform_suspend_ready():
+                log('no suspend: platform readiness contract refused')
+                self.post('suspend-refused')
+                return
             answer = command('busctl', 'call', 'org.freedesktop.login1', '/org/freedesktop/login1',
                              'org.freedesktop.login1.Manager', 'CanSuspend').stdout.strip()
             if answer != 's "yes"':
@@ -722,6 +750,8 @@ class Daemon:
             try:
                 user = session_user()
                 if job == 'lock':
+                    if user is not None:
+                        as_user(user, 'omarchy-keyboard', 'hide')
                     self.post('lock-ok' if user is None or self.lock_session(user) else 'lock-failed')
                 elif user is not None and job == 'woke':
                     as_user(user, 'omarchy-shell', '-q', 'lock', 'woke')
@@ -781,6 +811,34 @@ class Daemon:
                     connection.sendall(answer.encode() + b'\n')
                 elif request == 'status':
                     connection.sendall(self.machine.state.encode() + b'\n')
+                elif request.startswith('brightness '):
+                    parts = request.split()
+                    panel = self.backlight()
+                    reply = b'held\n'
+                    if (len(parts) == 4 and panel and parts[1] == panel.name and
+                            parts[2].isascii() and parts[2].isdigit() and
+                            parts[3].isascii() and parts[3].isdigit()):
+                        level, expected = int(parts[2]), int(parts[3])
+                        current = int((panel / 'brightness').read_text())
+                        maximum = int((panel / 'max_brightness').read_text())
+                        if self.machine.state == ON and self.fade is None and self.dim_saved is None and current > 0 and current == expected and 1 <= level <= maximum:
+                            (panel / 'brightness').write_text(f'{level}\n')
+                            reply = b'ok\n'
+                    connection.sendall(reply)
+                elif request == 'als-state':
+                    connection.sendall(b'lit\n' if self.machine.state == ON and self.fade is None and self.dim_saved is None else b'dark\n')
+                elif request == 'dim':
+                    panel = self.backlight()
+                    if self.machine.state == ON and self.dim_saved is None and panel:
+                        current = int((panel / 'brightness').read_text())
+                        level = max(1, int((panel / 'max_brightness').read_text()) // 10)
+                        if current > level:
+                            self.dim_saved, self.dim_level = current, level
+                            (panel / 'brightness').write_text(f'{level}\n')
+                    connection.sendall(b'ok\n')
+                elif request == 'undim':
+                    self.undim()
+                    connection.sendall(b'ok\n')
                 elif request in ('idle', 'wake', 'lock'):
                     self.feed(request)
                     connection.sendall(b'ok\n')
diff --git a/system/overlay/usr/local/bin/ipadlinux-suspend-ready b/system/overlay/usr/local/bin/ipadlinux-suspend-ready
new file mode 100755
index 0000000..7e3e2fd
--- /dev/null
+++ b/system/overlay/usr/local/bin/ipadlinux-suspend-ready
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Read-only suspend policy probe; 0 permits a request, 1 refuses, 2 is usage.
+
+This never performs a suspend or reserves admission. The kernel remains the
+final authority at the actual transition. The answer comes from the kernel's
+own admission query, /sys/power/suspend_ready ("ready", or
+"not-ready <who> <errno>"), on every board. A kernel without that query
+cannot show that its drivers and platform prechecks would admit a suspend, so
+suspend is refused there; PM callback presence, a loaded module and
+power/state's "freeze" are not proof of admission.
+"""
+from pathlib import Path
+import sys
+
+READINESS = Path('/sys/power/suspend_ready')
+
+
+def admission():
+    """The kernel's readiness answer; None when it reports ready."""
+    try:
+        report = READINESS.read_text(encoding='ascii').strip()
+    except FileNotFoundError:
+        return ('the kernel has no suspend readiness query (/sys/power/suspend_ready); '
+                'driver admission and platform prechecks cannot be verified')
+    except (OSError, UnicodeDecodeError) as error:
+        return f'cannot read kernel suspend readiness: {error}'
+    if report == 'ready':
+        return None
+    words = report.split()
+    if len(words) == 3 and words[0] == 'not-ready':
+        return f'kernel admission refused by {words[1]} ({words[2]})'
+    return f'malformed kernel suspend readiness: {report!r}'
+
+
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv[1:]
+    if argv:
+        print('Usage: ipadlinux-suspend-ready', file=sys.stderr)
+        return 2
+    reason = admission()
+    if reason:
+        print(f'Suspend unavailable: {reason}', file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/tests/test_greeter_staging.py b/tests/test_greeter_staging.py
index 4aa427c..f846c8e 100644
--- a/tests/test_greeter_staging.py
+++ b/tests/test_greeter_staging.py
@@ -66,6 +66,10 @@ def test_trusted_ui_fallback_theme_and_tmpfiles_are_staged(self):
             self.assertEqual((greeter / 'plugins/lock/LockView.qml').read_bytes(),
                              (stage.PORT / 'shell/plugins/lock/LockView.qml').read_bytes())
             self.assertTrue((greeter / 'Commons/Color.qml').is_file())
+            menu = 'default/omarchy/omarchy-menu.jsonc'
+            staged_menu = target / 'home/tablet/.local/share/omarchy-ipad' / menu
+            self.assertEqual(staged_menu.read_bytes(), (stage.PORT / menu).read_bytes())
+            self.assertIn('/usr/local/bin/ipadlinux-suspend-ready', staged_menu.read_text())
             jade = stage.HERE / 'themes/jade-horse'
             self.assertEqual((greeter / 'default-theme/background').read_bytes(),
                              (jade / 'backgrounds/01-mountain-horses.webp').read_bytes())
diff --git a/tests/test_menu_shutdown.py b/tests/test_menu_shutdown.py
index 5e4133b..3088831 100644
--- a/tests/test_menu_shutdown.py
+++ b/tests/test_menu_shutdown.py
@@ -62,6 +62,15 @@ def test_menu_keeps_upstreams_calls(self):
                              ('lock', 'omarchy-system-lock')):
             self.assertEqual(menu_action(name), action)
 
+    def test_final_and_staged_menu_share_the_suspend_gate(self):
+        from release.public_root import desktop_replacements
+        name = 'home/tablet/.local/share/omarchy-ipad/default/omarchy/omarchy-menu.jsonc'
+        self.assertEqual(desktop_replacements()[name], MENU.read_bytes())
+        entry = json.loads(re.search(r'"system\.suspend":\s*(\{[^\n]+\})', MENU.read_text()).group(1))
+        self.assertIn('/usr/local/bin/ipadlinux-suspend-ready', entry['when'])
+        self.assertNotIn('omarchy-sleep-disabled', entry['when'])
+        self.assertEqual(entry['action'], '/usr/local/bin/ipadlinux-suspend-ready && systemctl suspend')
+
     def test_reboot_says_it_leaves_linux(self):
         # A reboot does not come back into Linux; one entry, no other system's name.
         entries = re.findall(r'"system\.reboot[^"]*":\s*(\{[^\n]+\})', MENU.read_text())
diff --git a/tests/test_powerd.py b/tests/test_powerd.py
index d234266..5b4577a 100644
--- a/tests/test_powerd.py
+++ b/tests/test_powerd.py
@@ -591,7 +591,7 @@ def setUp(self):
                               ('STATS', self.stats), ('BACKLIGHTS', self.work / 'backlight'),
                               ('BRIGHTNESS', self.remembered),
                               ('WAKEUP_COUNT', self.work / 'wakeup_count'), ('SOCKET', str(self.work / 'ctl')),
-                              ('session_user', lambda: None), ('command', self.fake_command), ('log', lambda *_: None)):
+                              ('platform_suspend_ready', lambda: True), ('session_user', lambda: None), ('command', self.fake_command), ('log', lambda *_: None)):
             patcher = patch.object(powerd, target, value)
             patcher.start()
             self.addCleanup(patcher.stop)
@@ -660,6 +660,62 @@ def ask(self, request):
             connection.sendall(request.encode() + b'\n')
             return connection.recv(64).decode().strip()
 
+    def test_home_socket_reports_combo_after_screenshot_chord(self):
+        when = time.monotonic()
+        event = powerd.INPUT_EVENT.pack
+        os.write(self.key_write, b''.join(event(int(when+i/10), int((when+i/10)%1*1e6), 1, code, down)
+                     for i, (code, down) in enumerate(((116, 1), (172, 1), (172, 0), (116, 0)))))
+        self.wait(lambda: self.daemon.buttons.home_in_combo)
+        self.assertEqual(self.ask('home'), 'combo')
+        self.assertEqual(self.ask('status'), 'ON')
+
+    def test_idle_dim_restore_and_manual_brightness_supersedes_dim(self):
+        self.assertEqual(self.ask('dim'), 'ok')
+        self.assertEqual(self.brightness(), '300')
+        self.assertEqual(self.ask('als-state'), 'dark')
+        self.assertEqual(self.ask('brightness panel 600 300'), 'held')
+        self.ask('undim'); self.assertEqual(self.brightness(), '1563')
+        self.ask('dim')
+        (self.panel / 'brightness').write_text('700\n')
+        self.ask('undim'); self.assertEqual(self.brightness(), '700')
+
+    def test_unqualified_power_idle_and_cover_lock_stay_dark_and_can_wake(self):
+        with patch.object(powerd, 'platform_suspend_ready', return_value=False):
+            for entry in ('power', 'idle', 'cover'):
+                with self.subTest(entry=entry):
+                    self.requests.clear()
+                    if entry == 'power':
+                        self.press()
+                    elif entry == 'idle':
+                        self.ask('idle')
+                    else:
+                        self.ask('lock')  # what closing the Smart Cover feeds
+                    self.wait(lambda: self.daemon.machine.state == DARK and self.daemon.machine.no_suspend)
+                    self.assertEqual(self.ask('status'), 'DARK')
+                    self.assertEqual(self.brightness(), '0')
+                    self.assertIsNone(self.daemon.settle_at)
+                    self.assertNotIn(('systemctl', 'suspend'), self.requests)
+                    self.assertFalse(any('CanSuspend' in call for call in self.requests))
+                    if entry == 'power':
+                        self.press()
+                        self.wait(lambda: self.brightness() == '1563')
+                    else:
+                        self.ask('wake')  # touch/cover wake path
+                        self.assertEqual(self.brightness(), '1563')
+
+    def test_automatic_brightness_obeys_power_state_and_manual_changes(self):
+        self.assertEqual(self.ask('brightness panel 1800 1563'), 'ok')
+        self.assertEqual(self.brightness(), '1800')
+        self.assertEqual(self.ask('brightness panel 1900 1563'), 'held')
+        self.assertEqual(self.brightness(), '1800')
+        for request in ('brightness panel 0 1800', 'brightness panel 3001 1800',
+                        'brightness other 1900 1800', 'brightness panel ² 1800'):
+            self.assertEqual(self.ask(request), 'held')
+            self.assertEqual(self.brightness(), '1800')
+        self.press(); self.wait(lambda: self.brightness() == '0')
+        self.assertEqual(self.ask('brightness panel 1800 0'), 'held')
+        self.assertEqual(self.brightness(), '0')
+
     def test_press_sleep_wake(self):
         machine = self.daemon.machine
         self.assertEqual(self.ask('input'), 'lit')
diff --git a/tests/test_suspend_ready.py b/tests/test_suspend_ready.py
new file mode 100644
index 0000000..345121e
--- /dev/null
+++ b/tests/test_suspend_ready.py
@@ -0,0 +1,116 @@
+"""Readiness is a read-only policy check, never a speculative PM transition."""
+import contextlib
+import importlib.machinery
+import importlib.util
+import io
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+HELPER = ROOT / 'system/overlay/usr/local/bin/ipadlinux-suspend-ready'
+
+
+def load(name, path):
+    loader = importlib.machinery.SourceFileLoader(name, str(path))
+    spec = importlib.util.spec_from_loader(name, loader)
+    module = importlib.util.module_from_spec(spec)
+    loader.exec_module(module)
+    return module
+
+
+ready = load('suspend_ready', HELPER)
+powerd = load('suspend_ready_powerd', ROOT / 'system/overlay/usr/libexec/omarchy-powerd')
+
+
+class SuspendReady(unittest.TestCase):
+    def invoke(self, readiness=None, argv=()):
+        with tempfile.TemporaryDirectory() as directory:
+            query = Path(directory) / 'suspend_ready'
+            if readiness is not None:
+                query.write_bytes(readiness)
+            out, err = io.StringIO(), io.StringIO()
+            with patch.object(ready, 'READINESS', query), \
+                    contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+                code = ready.main(argv)
+            if readiness is not None:
+                self.assertEqual(query.read_bytes(), readiness)
+            return code, out.getvalue(), err.getvalue()
+
+    def test_no_feature_table_or_board_identity(self):
+        source = HELPER.read_text()
+        for name in ('device-feature', 'devicetree', 'compatible', 'subprocess'):
+            self.assertNotIn(name, source)
+
+    def test_systemd_direct_suspend_uses_same_gate(self):
+        from release.public_root import system_files
+        dropin = 'etc/systemd/system/systemd-suspend.service.d/60-omarchy-a-qualification.conf'
+        data, mode = system_files()[dropin]
+        self.assertIn(b'ExecStartPre=/usr/local/bin/ipadlinux-suspend-ready', data)
+        self.assertEqual(mode, 0o644)
+        logind = system_files()['etc/systemd/logind.conf.d/60-omarchy-a-power.conf'][0].decode()
+        for setting in ('HandlePowerKey', 'HandleSuspendKey', 'HandleHibernateKey',
+                        'HandleLidSwitch', 'HandleLidSwitchExternalPower', 'HandleLidSwitchDocked', 'IdleAction'):
+            self.assertIn(setting + '=ignore', logind)
+
+    def test_refuses_without_an_admission_query(self):
+        code, out, err = self.invoke()
+        self.assertEqual((code, out), (1, ''))
+        self.assertIn('no suspend readiness query', err)
+
+    def test_follows_the_kernel_admission_query(self):
+        self.assertEqual(self.invoke(b'ready\n'), (0, '', ''))
+        code, out, err = self.invoke(b'not-ready 201000000.gpu -16\n')
+        self.assertEqual((code, out), (1, ''))
+        self.assertIn('refused by 201000000.gpu (-16)', err)
+        code, _, err = self.invoke(b'not-ready apple_h9p_sleep_precheck -16\n')
+        self.assertEqual(code, 1)
+        self.assertIn('apple_h9p_sleep_precheck', err)
+        code, _, err = self.invoke(b'not-ready transition -16\n')
+        self.assertEqual(code, 1)
+        self.assertIn('refused by transition', err)
+
+    def test_malformed_kernel_answer_fails_closed(self):
+        for answer in (b'', b'readyish\n', b'not-ready\n', b'\xff\n'):
+            code, out, err = self.invoke(answer)
+            self.assertEqual((code, out), (1, ''))
+            self.assertIn('Suspend unavailable:', err)
+
+    def test_unreadable_answer_fails_closed(self):
+        with patch.object(ready.Path, 'read_text', side_effect=PermissionError('denied')), \
+                contextlib.redirect_stderr(io.StringIO()) as err:
+            self.assertEqual(ready.main([]), 1)
+        self.assertIn('cannot read kernel suspend readiness', err.getvalue())
+
+    def test_no_force_or_alternate_sysfs_option(self):
+        self.assertEqual(self.invoke(b'ready\n', ['--force'])[0], 2)
+        result = subprocess.run([sys.executable, str(HELPER), '--force'], capture_output=True, text=True, timeout=2)
+        self.assertEqual((result.returncode, result.stdout), (2, ''))
+        self.assertIn('Usage:', result.stderr)
+
+    def test_refresh_ships_executable_helper(self):
+        from release.public_root import system_files
+        self.assertEqual(system_files()['usr/local/bin/ipadlinux-suspend-ready'], (HELPER.read_bytes(), 0o755))
+        self.assertEqual(HELPER.stat().st_mode & 0o777, 0o755)
+
+    def test_daemon_uses_exit_status_and_logs_reason(self):
+        messages = []
+        with patch.object(powerd.Path, 'exists', return_value=True), patch.object(powerd, 'log', messages.append), patch.object(powerd, 'command') as command:
+            command.return_value = subprocess.CompletedProcess([], 1, '', 'Suspend unavailable: reason\n')
+            self.assertFalse(powerd.platform_suspend_ready())
+            self.assertIn('reason', messages[-1])
+            command.assert_called_once_with('/usr/local/bin/ipadlinux-suspend-ready')
+            command.return_value = subprocess.CompletedProcess([], 0, '', '')
+            self.assertTrue(powerd.platform_suspend_ready())
+
+    def test_daemon_refuses_missing_helper(self):
+        with patch.object(powerd.Path, 'exists', return_value=False), patch.object(powerd, 'log'), patch.object(powerd, 'command') as command:
+            self.assertFalse(powerd.platform_suspend_ready())
+            command.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_tablet_port.py b/tests/test_tablet_port.py
new file mode 100644
index 0000000..b2edcc8
--- /dev/null
+++ b/tests/test_tablet_port.py
@@ -0,0 +1,38 @@
+import importlib.machinery
+import importlib.util
+import json
+import os
+from pathlib import Path
+import struct
+import subprocess
+import unittest
+from unittest.mock import patch
+import xml.etree.ElementTree as ET
+
+PROJECT = Path(__file__).resolve().parents[1]
+
+def load(name, path):
+    loader=importlib.machinery.SourceFileLoader(name,str(PROJECT/path))
+    spec=importlib.util.spec_from_loader(name,loader)
+    mod=importlib.util.module_from_spec(spec); loader.exec_module(mod); return mod
+
+p=load('power','system/overlay/usr/libexec/omarchy-powerd')
+
+class TabletPort(unittest.TestCase):
+    pass
+
+
+
+
+
+    def test_home_power_overlap_uses_upstream_screenshot_buttons(self):
+        p=load('power', 'system/overlay/usr/libexec/omarchy-powerd')
+        for edges in ((('power', True), ('home', True), ('power', False), ('home', False)),
+                      (('home', True), ('power', True), ('home', False), ('power', False))):
+            buttons=p.Buttons()
+            result=[buttons.edge(name, down, 10+i/10, True) for i,(name,down) in enumerate(edges)]
+            self.assertEqual([x for x in result if x], ['home', 'screenshot'])
+            self.assertTrue(buttons.home_in_combo)
+
+
+if __name__=='__main__': unittest.main()