diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c92504b..140dabc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ env:
   DOCS_BRANCH: ${{ secrets.DOCS_BRANCH }}
   # Snapshot baselines are per-platform and committed; a missing one is a gap, never a pass.
   ANGLESHARP_SNAPSHOT_STRICT: 1
-  ANGLESHARP_VERSION: 1.8.1
-  ANGLESHARP_CSS_VERSION: 1.2.0
+  ANGLESHARP_VERSION: 1.8.5
+  ANGLESHARP_CSS_VERSION: 1.2.1
 
 jobs:
   can_document:
diff --git a/.github/workflows/update-snapshots.yml b/.github/workflows/update-snapshots.yml
index 6425e69..5778bec 100644
--- a/.github/workflows/update-snapshots.yml
+++ b/.github/workflows/update-snapshots.yml
@@ -15,8 +15,8 @@ permissions:
   contents: write
 
 env:
-  ANGLESHARP_VERSION: 1.8.1
-  ANGLESHARP_CSS_VERSION: 1.2.0
+  ANGLESHARP_VERSION: 1.8.5
+  ANGLESHARP_CSS_VERSION: 1.2.1
 
 jobs:
   # Keep this matrix identical to the `test` matrix in ci.yml, images included - a baseline
diff --git a/AGENTS.md b/AGENTS.md
index d5174f1..a2f33c8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,15 +37,17 @@ The renderer and test projects target `net8.0` and `net10.0`; both runtimes are
 3. Installed families - host-dependent, never assert them in snapshots.
 4. Bundled sans-serif as the last resort.
 
+A character the resolved typeface has no glyph for falls back per character (`SplitFallbackRuns`, shared by measuring and painting): the next `font-family` entry that has it, then the bundled fonts, then `SKFontManager.MatchCharacter` (host-dependent, so never in snapshots). Text the typeface fully covers stays one run.
+
 Never resolve named families with `SKTypeface.FromFamilyName`: it substitutes the host default for unknown names instead of returning null, swallowing the rest of the fallback list. Availability goes through a case-insensitive index of installed families (Skia's lookup is case-sensitive on Linux only).
 
 ## Upstream Policy (important)
 
-**Never work around AngleSharp / AngleSharp.Css bugs locally.** Reproduce them with a failing test in the upstream project's own suite, fix them there, verify locally via a temporary `ProjectReference` to the sibling checkout, then revert to `PackageReference` once released. Wrong output in the meantime is acceptable. Current minimums: `AngleSharp` 1.8.1+, `AngleSharp.Css` 1.2.0+, set via `AngleSharpVersion`/`AngleSharpCssVersion` in the `.csproj` and the `ANGLESHARP_VERSION`/`ANGLESHARP_CSS_VERSION` env of `ci.yml` and `update-snapshots.yml` (which override the `.csproj`, so change all three together). Prefer delegating CSS grammar to AngleSharp.Css's public parsers (`TransformParser`, `FilterParser`, `GradientParser`, `GridParser`, `TimingFunctionParser`) and keeping only the conversion to backend-agnostic `Render*` types here. Hand-roll only what upstream genuinely lacks (e.g. `clip-path` basic shapes).
+**Never work around AngleSharp / AngleSharp.Css bugs locally.** Reproduce them with a failing test in the upstream project's own suite, fix them there, verify locally via a temporary `ProjectReference` to the sibling checkout, then revert to `PackageReference` once released. Wrong output in the meantime is acceptable. Current minimums: `AngleSharp` 1.8.5+, `AngleSharp.Css` 1.2.1+, set via `AngleSharpVersion`/`AngleSharpCssVersion` in the `.csproj` and the `ANGLESHARP_VERSION`/`ANGLESHARP_CSS_VERSION` env of `ci.yml` and `update-snapshots.yml` (which override the `.csproj`, so change all three together). Prefer delegating CSS grammar to AngleSharp.Css's public parsers (`TransformParser`, `FilterParser`, `GradientParser`, `GridParser`, `TimingFunctionParser`) and keeping only the conversion to backend-agnostic `Render*` types here. Hand-roll only what upstream genuinely lacks (e.g. `clip-path` basic shapes).
 
 **Styling comes only from the computed style** (the render tree, cascaded with the UA stylesheet), never from tag names: no "`<b>` is bold", "`h1` is 700", "`<span>` is inline", "`<script>` is hidden". An unset `display` is its initial value, `inline`. Tag names are only legitimate for element semantics that CSS does not express (replaced-element content, form-control values, `<select>` options, `ol`/`li` ordinals). When the UA sheet lacks a rule, file it upstream as a failing test.
 
-Upstream status: everything filed so far is fixed as of 1.2.0; no failing upstream tests are open.
+Upstream status: everything filed so far is fixed as of 1.2.1; no failing upstream tests are open.
 
 ## Core Layout Invariants
 
@@ -54,7 +56,10 @@ Upstream status: everything filed so far is fixed as of 1.2.0; no failing upstre
 - **An authored `height` is the height** of block and flex containers; in-flow content overflows it (only `min-height`/`max-height` clamp it). Auto heights come from the laid-out content.
 - **`box-sizing`** is converted in exactly one place, `ResolveAuthoredDimension`; everything downstream works in content-box sizes. Flex item sizes are already converted before `ResolveFlexibleContentDimension` reads them - do not convert twice. Tables honor it too (their width goes through the same method); the HTML default `table { box-sizing: border-box }` has to come from the UA sheet.
 - **Style maps.** `CreateStyleMap` builds a per-element `StyleMap` (string map plus a typed raw-length side channel used by `ParseLength`). Always go through `GetOrCreateStyleMap` (cached per render call in `LayoutContext.StyleMapCache`; the cache must never outlive one `BuildDisplayList`/`RenderToPng`/`CaptureLayoutMetrics` call or interactive state goes stale). Code writing directly into a length entry must call `StyleMap.ClearRawLength` for that key.
-- **Explicit vs computed values.** `background-image`, `grid-template-*`, gaps and `grid-column`/`grid-row` are read from the cascaded-but-uncomputed declaration (`ResolveExplicitPropertyValue` via the cached `LayoutContext.StyleCollection`), because AngleSharp.Css's `.Compute()` resolves their percentages against the viewport instead of the element's box.
+- **Explicit vs computed values.** `background-image`, `grid-template-*`, gaps and `grid-column`/`grid-row` are read from the cascaded-but-uncomputed declaration (`ResolveExplicitPropertyValue` via the cached `LayoutContext.StyleCollection`), because AngleSharp.Css's `.Compute()` resolves their percentages against the viewport instead of the element's box. `width`/`height`/`min-*`/`max-*` take the explicit value only when it contains a `%`; anything else (`em`, `rem`, `vw`) needs the computed one.
+- **The page.** `<html>` is laid out as an ordinary block (so `<body>`'s UA `margin: 8px`, padding, border and width apply); `context.Padding` is 0. `PropagateToViewport` moves the root's background (or `<body>`'s, if the root has none) to the canvas and removes it from that element's style map, and drops their `overflow`. `<html>`'s metrics are re-recorded as the viewport, since it is the scrolling element. Structural tests in `HtmlRendererTests` run with a prepended `body { margin: 0 }` sheet (its `ParseAsync`). The vertical-page path still lays out `<body>`'s children directly.
+- **Blockification.** AngleSharp.Css blockifies the computed `display` of floats, absolutely positioned boxes and the root, so they are never inline-level; handing one to an inline formatting context would lay it out again forever. Flex items are not blockified upstream (it does not know the formatting context), so `LayoutElement` forces them to block layout itself.
+- **Margin collapsing** through first children is recursive (`TryGetFirstCollapsibleChildTopMargin`); a box whose margin its parent absorbed (`suppressNextBlockTopMargin`) absorbs the whole chain below it too. Floats and out-of-flow boxes are skipped; inline-level content (atomics included) stops the chain.
 - **Unset ≠ initial.** AngleSharp.Css often reports an unset property as an empty string rather than its initial value; parsers fall back to the inherited value (inherited properties) or the CSS initial value.
 - Adding a new `RenderPaint` (or other) subtype: check every place that pattern-matches on the existing ones (`PaintBackground` once silently dropped `RenderImagePaint`).
 - **Flow layout.** `LayoutFlowChildren` (used by `LayoutElement` and the page itself) splits children into block-level children and runs of inline-level content. A run of bare text keeps the paragraph path (`LayoutTextNode`/`LayoutWrappedText`/`WrapText`); any run containing an element goes through `LayoutInlineFormattingContext`: the subtree is flattened into `InlinePiece`s (whitespace collapsed across element boundaries, break opportunities per piece), greedily broken into line boxes, and each line is emitted with one baseline (strut + half-leading per piece + atomic margin boxes). Inline boxes paint per line fragment; block-level boxes inside inline content get a line of their own.
@@ -88,6 +93,7 @@ Only the non-obvious parts; see XML doc remarks in `HtmlRenderer.cs` for detail.
 - Masks: `mask-image` layers (image/gradient) with `-size`/`-position`/`-repeat`/`-mode`/`-clip`/`-origin` (border box by default) become a `PushMaskCommand`/`PopMaskCommand` scope, innermost of the whole-element scopes; the backend composites the layers with `DstIn` (luminance via a luma color filter). `mask-composite` other than `add`, and `url(#svg-mask)` references, are not supported.
 - `backdrop-filter` is a `DrawBackdropFilterCommand` emitted right inside the transform scope. SkiaSharp 2.x has no backdrop save-layer, so the backend snapshots the surface behind the box, filters it and draws it back clipped to the rounded border box; content inside a still-open ancestor layer (opacity, filter, mask) is not part of that backdrop.
 - `translate`/`rotate`/`scale` compose before `transform` (`ToTranslateFunction` etc.), around the same `transform-origin`.
+- `<img>` data: AngleSharp disposes a response right after processing it, so `<img>`'s `CurrentDownload` content is closed by paint time. `WithRendering()` registers `ImageResourceService` (`IResourceService<IImageInfo>`), which buffers the bytes per response; `TryLoadImageResource` reads them from there.
 - Backgrounds: colors, `url(...)` images (`data:` or via `IDocumentLoader`, synchronous, shared per-document `DocumentImageCache` with `<img>`; failure falls back to `background-color`), `background-repeat`/`-position`/`-size` resolved at paint time in `CreateImagePaint`. `no-repeat` uses `SKShaderTileMode.Decal`, not `Clamp`. `space`/`round` act as `repeat`.
 - Gradients: linear/radial/conic and `repeating-*` via `GradientParser`. Gotchas: Skia shader matrices map local → world space; `CreateSweepGradient` angles must stay within `[0, 360]` (rotation goes in the matrix); linear angles are shifted by -90° to Skia's convention in `ConvertLinearGradient`, conic does its own conversion; absolute-length stop positions stay unresolved (`AbsolutePositionPixels`) until the geometry is known. SVG gradients are a separate implementation.
 - `aspect-ratio` derives width from a definite height; `object-fit`/`object-position` apply to replaced elements.
@@ -126,7 +132,7 @@ Every text feature exists twice - in the paragraph path (whole lines as strings)
 
 ### Form controls
 - A form control's look (border, padding, background, margins, round radio) comes from the UA stylesheet. `ApplyFormControlDefaults` only fills in the element-derived intrinsic size (text fields 150px, checkbox/radio from font size, buttons/selects/file inputs from their label) when `width`/`height` are unset.
-- `PaintFormControl` paints values, labels, the selected option, checked fills, color swatches, range track/thumb and file inputs; `<option>`s and button labels are excluded from child layout. `<textarea>` flows its text normally. `type=hidden` gets no chrome (hiding it is the UA sheet's job).
+- `PaintFormControl` paints values, labels, the selected option, checked fills, color swatches, range track/thumb and file inputs; `<option>`s and button labels are excluded from child layout. `<textarea>` flows its text normally, unless its live `Value` differs from its child text: then the children are skipped and the value is painted. State is always the live DOM state (`IHtmlInputElement.Value`/`IsChecked`, `IHtmlOptionElement.IsSelected`), never the attributes. Placeholders paint with the computed `::placeholder` style (`ResolvePlaceholderTextStyle`, via `LayoutContext.StyleCollection`; the UA sheet gives it `color: darkgray`). `type=hidden` gets no chrome (hiding it is the UA sheet's job).
 - `input[type=image]` is a replaced element when its `src` loads, else a button labelled with `alt` (default "Submit"). The date/time family (`FormControlKind.DateTime`) shows its value formatted as en-US browsers do (`FormatDateTimeInputValue`; invalid values show the segmented placeholder) beside a calendar or clock icon (`PaintPickerIcon`). `accent-color` (read from the style map, `auto` = `FormControlAccentColor`) colors checked checkboxes/radios and the range thumb.
 - Labels center on ink using `FormControlTextAscentRatio`/`DescentRatio` (font-size fractions measured from the bundled font). The select arrow glyph `⌄` has its own vertical correction.
 - A focused text input / textarea shows a caret (focus read from `IElement.IsFocused`) that fades via `IDomHarness.CurrentTime`; without a harness it is fully opaque.
@@ -134,7 +140,7 @@ Every text feature exists twice - in the paragraph path (whole lines as strings)
 ### Interactivity and scrolling
 - Page scroll: `RenderToPng`/`BuildDisplayList` shift layout by the root scroll offset only when a harness already exists (`TryGetDomHarness`, never `GetDomHarness`, which throws without an `IRenderDevice`). `CaptureLayoutMetrics` never applies the offset (scroll extents must be scroll-independent) and lays out the full page (`measureFullExtent`).
 - `:hover` uses AngleSharp.Css's `SetPseudoClass`, which does not propagate; `UpdateForcedHoverChain` forces the whole ancestor chain and tracks it to un-force later.
-- `CssTransitionTracker`/`CssAnimationTracker` run on a virtual clock (`IDomHarness.AdvanceTime`). Only `CssValueInterpolation.InterpolatableProperties` (colors, lengths, `opacity`, and the function lists `transform`/`translate`/`rotate`/`scale`/`filter`/`backdrop-filter`) interpolate; `all` means that whitelist. Function lists interpolate by structure (`CssFunctionListInterpolation`: matching functions argument by argument, `none`/shorter lists padded with identity functions, mismatched transforms through 2D matrix decomposition, anything else discretely at 50%). An element's natural `transform` is its authored value (`ReadAuthoredTransform`), never the computed one. Overrides are injected by `ApplyActiveTransitionAndAnimationOverrides` over the whole whitelist (not only existing keys). Transition "from" values must be captured before pseudo-class mutation. Reversals restart with the full duration. Animations start at clock zero; fill-mode/direction/iteration share one effective-time computation; `animation-play-state: paused` is supported.
+- `CssTransitionTracker`/`CssAnimationTracker` run on a virtual clock (`IDomHarness.AdvanceTime`). Only `CssValueInterpolation.InterpolatableProperties` (colors, lengths, `opacity`, and the function lists `transform`/`translate`/`rotate`/`scale`/`filter`/`backdrop-filter`) interpolate; `all` means that whitelist. Function lists interpolate by structure (`CssFunctionListInterpolation`: matching functions argument by argument, `none`/shorter lists padded with identity functions, mismatched transforms through 2D matrix decomposition, anything else discretely at 50%). An element's natural `transform` is its authored value (`ReadAuthoredTransform`), never the computed one. Overrides are injected by `ApplyActiveTransitionAndAnimationOverrides` over the whole whitelist (not only existing keys); the animation lookup re-runs the cascade per property, so it only happens for elements whose computed style has an `animation-name`. Transition "from" values must be captured before pseudo-class mutation. Reversals restart with the full duration. Animations start at clock zero; fill-mode/direction/iteration share one effective-time computation; `animation-play-state: paused` is supported.
 
 ### SVG
 `<img src="*.svg">` (sniffed in `TryLoadImageResource`) and inline `<svg>` (rasterized from the live DOM, cached per element). Rasterized at natural size × `OversampleFactor`, not at CSS size. Supports shapes and full path data, percentages, `g`/`a`/`use`/`symbol`/nested `svg`, `text`/`tspan`, `clipPath`, `mask`, gradients, patterns, filters (every primitive, with the filter region and primitive subregions as crop rects, each primitive in its `color-interpolation-filters` space (linearRGB by default, converted with lookup tables since SkiaSharp 2.88 has no gamma color filters) - see `SvgFilterBuilder`), `currentColor`, `preserveAspectRatio`, and an internal `<style>` subset. Inline SVG also takes the page's CSS (`ResolveSvgPageStyle`): the root starts from its computed inherited values (so `color`/`fill`/fonts flow in from the HTML), and each element's own page declarations (`ComputeExplicitStyle`, never `GetDeclarations`, which merges in inherited values that would beat presentation attributes) apply after the SVG-internal rules and before inline `style`. The inline-SVG raster cache is keyed by a fingerprint of the markup and those page styles. An SVG used as an image (`<img src="*.svg">`, CSS `url()`) is an isolated document, so - as in browsers - page CSS never reaches it. `SvgTransformParser` must apply the rightmost function first (`next.PostConcat(result)`) - verify changes there visually.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d93dd2a..8aff9f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,19 @@
+# 0.8.1
+
+Released on Friday, October 23 2026.
+
+- Updated `WithRendering()` to also register an image resource service, which keeps loaded `<img>` data for painting (and gives images their natural size)
+- Updated the required AngleSharp version to 1.8.5 and AngleSharp.Css version to 1.2.1
+- Updated the page layout: `<html>` and `<body>` are laid out as ordinary boxes, so `<body>`'s margin (8px from the default stylesheet), padding, border, width and `max-width` apply; the root's background (or `<body>`'s, when the root has none) paints the canvas, and their `overflow` applies to the viewport
+- Fixed a stack overflow when laying out a floated or absolutely positioned inline-level box (`<span style="float: left">`), which is now blockified
+- Fixed painting failing with `ObjectDisposedException` for documents with loaded `<img>` elements
+- Fixed every paint re-running the cascade per element and property once a DOM harness exists; only elements that declare an `animation-name` are looked up
+- Fixed form controls showing their attributes instead of their live state (`value`, `checked`, `selected`, and a `<textarea>`'s value)
+- Fixed `width`, `height`, `min-*` and `max-*` in units other than `px` and `%` (`em`, `rem`, `vw`, ...) being ignored
+- Fixed top margins collapsing through only one level of first children, and inline-blocks collapsing their margin with their parent's
+- Added `placeholder` text for text inputs and `<textarea>`, styled by `::placeholder` (`color: darkgray` from the default stylesheet)
+- Added per-character font fallback: characters the resolved font lacks come from the next `font-family` entry that has them, then the bundled fonts, then the installed fonts
+
 # 0.8.0
 
 Released on Wednesday, October 21 2026.
diff --git a/src/AngleSharp.Renderer.Docs/package.json b/src/AngleSharp.Renderer.Docs/package.json
index c9a3d89..0c26be3 100644
--- a/src/AngleSharp.Renderer.Docs/package.json
+++ b/src/AngleSharp.Renderer.Docs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@anglesharp/renderer",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "preview": true,
   "description": "The doclet for the AngleSharp.Renderer documentation.",
   "keywords": [
diff --git a/src/AngleSharp.Renderer.Tests/BrowserIntegrationTests.cs b/src/AngleSharp.Renderer.Tests/BrowserIntegrationTests.cs
new file mode 100644
index 0000000..0c657fb
--- /dev/null
+++ b/src/AngleSharp.Renderer.Tests/BrowserIntegrationTests.cs
@@ -0,0 +1,325 @@
+using AngleSharp;
+using AngleSharp.Css;
+using AngleSharp.Dom;
+using AngleSharp.Html.Dom;
+using AngleSharp.Io;
+using AngleSharp.Renderer.Rendering;
+
+using SkiaSharp;
+
+using System.Diagnostics;
+using System.Net;
+using System.Threading;
+
+namespace AngleSharp.Renderer.Tests;
+
+/// <summary>
+/// Regressions found while hosting the renderer in an interactive browser (AngleSharp.Browser).
+/// </summary>
+public sealed class BrowserIntegrationTests
+{
+    private static DefaultRenderDevice CreateDevice() => new()
+    {
+        ViewPortWidth = 800,
+        ViewPortHeight = 600,
+        DeviceWidth = 800,
+        DeviceHeight = 600,
+        FontSize = 16,
+    };
+
+    private static async Task<IDocument> LoadAsync(string html, IConfiguration? configuration = null)
+    {
+        var context = BrowsingContext.New(configuration ?? Configuration.Default.WithCss().WithRendering().WithRenderDevice(CreateDevice()));
+        return await context.OpenAsync(request => request.Content(html));
+    }
+
+    private static byte[] Render(IDocument document) => new HtmlRenderer().RenderToPng(document, CreateDevice()).Data;
+
+    [Theory]
+    [InlineData("<span style='float: left'>A</span>")]
+    [InlineData("<ul><li style='display: inline; float: left'><a href='#'>A</a></li><li style='display: inline; float: left'><a href='#'>B</a></li></ul>")]
+    [InlineData("<span style='display: inline-flex; float: right'>A</span>")]
+    [InlineData("<span style='display: inline-grid; float: left'>A</span>")]
+    [InlineData("<span style='display: inline-table; float: left'>A</span>")]
+    [InlineData("<a style='float: left'><img style='float: right' width=10 height=10></a>")]
+    [InlineData("<span style='position: absolute; top: 10px'>A</span>")]
+    [InlineData("<span style='position: fixed; display: inline-flex'>A</span>")]
+    public async Task FloatedAndPositionedInlineBoxesAreBlockified(string html)
+    {
+        var document = await LoadAsync(html);
+
+        Assert.NotEmpty(Render(document));
+    }
+
+    [Fact]
+    public async Task FloatedSpanGetsBlockBoxBeforeFollowingText()
+    {
+        var document = await LoadAsync("<style>body { margin: 0 }</style><div><span id=s style='float: left; width: 100px; height: 20px; background: red'>A</span>Text</div>");
+
+        var rect = document.GetElementById("s")!.GetBoundingClientRect();
+
+        Assert.Equal(100d, rect.Width, 1);
+        Assert.Equal(20d, rect.Height, 1);
+    }
+
+    private sealed class PngRequester(byte[] png) : BaseRequester
+    {
+        public override bool SupportsProtocol(string protocol) => true;
+
+        protected override Task<IResponse?> PerformRequestAsync(Request request, CancellationToken cancel) =>
+            Task.FromResult<IResponse?>(new DefaultResponse
+            {
+                Address = request.Address,
+                StatusCode = HttpStatusCode.OK,
+                Headers = new Dictionary<string, string> { ["Content-Type"] = "image/png" },
+                Content = new MemoryStream(png),
+            });
+    }
+
+    [Fact]
+    public async Task LoadedImagesCanBePainted()
+    {
+        using var bitmap = new SKBitmap(20, 20);
+        bitmap.Erase(SKColors.Red);
+        var png = bitmap.Encode(SKEncodedImageFormat.Png, 100).ToArray();
+        var configuration = Configuration.Default
+            .WithCss()
+            .WithRendering()
+            .WithRenderDevice(CreateDevice())
+            .WithDefaultLoader(new LoaderOptions { IsResourceLoadingEnabled = true })
+            .With(new PngRequester(png));
+        var document = await LoadAsync("<style>body { margin: 0 }</style><img src='http://localhost/red.png' width=20 height=20>", configuration);
+        await document.WaitForReadyAsync();
+
+        var data = Render(document);
+
+        using var rendered = SKBitmap.Decode(data);
+        Assert.Equal(SKColors.Red, rendered.GetPixel(10, 10));
+    }
+
+    [Fact]
+    public async Task LoadedImagesWithoutTheRenderingServicesDoNotFailThePaint()
+    {
+        using var bitmap = new SKBitmap(20, 20);
+        bitmap.Erase(SKColors.Red);
+        var png = bitmap.Encode(SKEncodedImageFormat.Png, 100).ToArray();
+        var configuration = Configuration.Default
+            .WithCss()
+            .WithRenderDevice(CreateDevice())
+            .WithDefaultLoader(new LoaderOptions { IsResourceLoadingEnabled = true })
+            .With(new PngRequester(png));
+        var document = await LoadAsync("<img src='http://localhost/red.png' width=20 height=20><p>Text</p>", configuration);
+        await document.WaitForReadyAsync();
+
+        Assert.NotEmpty(Render(document));
+    }
+
+    [Fact]
+    public async Task HarnessDoesNotMultiplyPaintCost()
+    {
+        var rules = string.Concat(Enumerable.Range(0, 2000).Select(i => $".c{i} {{ color: red; margin: {i % 7}px }}\n"));
+        var body = string.Concat(Enumerable.Range(0, 150).Select(i => $"<div class='c{i}'><span>Item {i}</span></div>"));
+        var html = $"<style>{rules}</style>{body}";
+
+        var plain = await LoadAsync(html);
+        var interactive = await LoadAsync(html);
+        interactive.Context.GetDomHarness();
+
+        var renderer = new HtmlRenderer();
+        renderer.RenderToPng(plain, CreateDevice());
+        renderer.RenderToPng(interactive, CreateDevice());
+        var watch = Stopwatch.StartNew();
+        renderer.RenderToPng(plain, CreateDevice());
+        var plainTime = watch.Elapsed;
+        watch.Restart();
+        renderer.RenderToPng(interactive, CreateDevice());
+        var interactiveTime = watch.Elapsed;
+
+        Assert.True(interactiveTime.TotalMilliseconds < plainTime.TotalMilliseconds * 2 + 50,
+            $"plain {plainTime.TotalMilliseconds:F0} ms, interactive {interactiveTime.TotalMilliseconds:F0} ms");
+    }
+
+    [Fact]
+    public async Task HarnessStillAppliesAnimations()
+    {
+        var document = await LoadAsync("""
+            <style>
+                body { margin: 0 }
+                @keyframes fade { from { background-color: rgb(255, 0, 0) } to { background-color: rgb(0, 0, 255) } }
+                #a { width: 50px; height: 50px; background-color: rgb(0, 255, 0); animation: fade 1s linear forwards }
+            </style>
+            <div id=a></div>
+            """);
+        var harness = document.Context.GetDomHarness();
+        harness.AdvanceTime(TimeSpan.FromSeconds(2));
+
+        using var rendered = SKBitmap.Decode(Render(document));
+
+        Assert.Equal(new SKColor(0, 0, 255), rendered.GetPixel(25, 25));
+    }
+
+    [Fact]
+    public async Task InputValuePropertyIsPainted()
+    {
+        var empty = await LoadAsync("<input id=i>");
+        var typed = await LoadAsync("<input id=i>");
+        ((IHtmlInputElement)typed.GetElementById("i")!).Value = "Hello";
+
+        Assert.NotEqual(Render(empty), Render(typed));
+    }
+
+    [Fact]
+    public async Task InputValuePropertyBeatsAttribute()
+    {
+        var attribute = await LoadAsync("<input id=i value=Hello>");
+        var property = await LoadAsync("<input id=i value=Hello>");
+        ((IHtmlInputElement)property.GetElementById("i")!).Value = "";
+
+        Assert.NotEqual(Render(attribute), Render(property));
+    }
+
+    [Fact]
+    public async Task CheckedPropertyIsPainted()
+    {
+        var unchecked_ = await LoadAsync("<input id=c type=checkbox>");
+        var checked_ = await LoadAsync("<input id=c type=checkbox>");
+        ((IHtmlInputElement)checked_.GetElementById("c")!).IsChecked = true;
+
+        Assert.NotEqual(Render(unchecked_), Render(checked_));
+    }
+
+    [Fact]
+    public async Task SelectedPropertyIsPainted()
+    {
+        const string html = "<select id=s><option>First</option><option id=o>Second option</option></select>";
+        var first = await LoadAsync(html);
+        var second = await LoadAsync(html);
+        ((IHtmlOptionElement)second.GetElementById("o")!).IsSelected = true;
+
+        Assert.NotEqual(Render(first), Render(second));
+    }
+
+    [Fact]
+    public async Task TextAreaValuePropertyIsPainted()
+    {
+        var empty = await LoadAsync("<textarea id=t></textarea>");
+        var typed = await LoadAsync("<textarea id=t></textarea>");
+        ((IHtmlTextAreaElement)typed.GetElementById("t")!).Value = "Hello";
+
+        Assert.NotEqual(Render(empty), Render(typed));
+    }
+
+    [Fact]
+    public async Task BodyPaddingIsApplied()
+    {
+        var document = await LoadAsync("<style>body { margin: 0; padding: 100px 0 0 50px }</style><p id=p>Text</p>");
+
+        var rect = document.GetElementById("p")!.GetBoundingClientRect();
+
+        Assert.Equal(100d + 16d, rect.Top, 1);
+        Assert.Equal(50d, rect.Left, 1);
+    }
+
+    [Fact]
+    public async Task BodyBoxIsLaidOut()
+    {
+        var document = await LoadAsync("<style>body { margin: 10px auto; max-width: 400px; padding: 20px; border: 2px solid black }</style><div id=d>Text</div>");
+
+        var body = document.Body!.GetBoundingClientRect();
+        var div = document.GetElementById("d")!.GetBoundingClientRect();
+
+        Assert.Equal(444d, body.Width, 1);
+        Assert.Equal((800d - 444d) / 2d, body.Left, 1);
+        Assert.Equal(10d, body.Top, 1);
+        Assert.Equal(400d, div.Width, 1);
+        Assert.Equal(body.Left + 22d, div.Left, 1);
+        Assert.Equal(32d, div.Top, 1);
+    }
+
+    [Fact]
+    public async Task RootBackgroundPaintsCanvas()
+    {
+        var document = await LoadAsync("<style>html { background: rgb(0, 128, 0) }</style><p>Text</p>");
+
+        using var bitmap = SKBitmap.Decode(Render(document));
+
+        Assert.Equal(new SKColor(0, 128, 0), bitmap.GetPixel(2, 590));
+    }
+
+    [Fact]
+    public async Task BodyBackgroundPropagatesToCanvasWhenRootHasNone()
+    {
+        var document = await LoadAsync("<style>body { background: rgb(0, 0, 128); height: 10px }</style><p>Text</p>");
+
+        using var bitmap = SKBitmap.Decode(Render(document));
+
+        Assert.Equal(new SKColor(0, 0, 128), bitmap.GetPixel(2, 590));
+    }
+
+    [Fact]
+    public async Task BodyBackgroundPaintsItsBoxWhenRootHasOne()
+    {
+        var document = await LoadAsync("<style>html { background: rgb(0, 128, 0) } body { background: rgb(0, 0, 128); margin: 20px; height: 100px }</style>");
+
+        using var bitmap = SKBitmap.Decode(Render(document));
+
+        Assert.Equal(new SKColor(0, 128, 0), bitmap.GetPixel(5, 5));
+        Assert.Equal(new SKColor(0, 0, 128), bitmap.GetPixel(50, 50));
+        Assert.Equal(new SKColor(0, 128, 0), bitmap.GetPixel(50, 300));
+    }
+
+    [Theory]
+    [InlineData("200px")]
+    [InlineData("12.5em")]
+    public async Task MaxWidthWithAutoMarginsCenters(string maxWidth)
+    {
+        var document = await LoadAsync($"<style>body {{ margin: 0 }}</style><div id=d style='max-width: {maxWidth}; margin: 0 auto'>Text</div>");
+
+        var rect = document.GetElementById("d")!.GetBoundingClientRect();
+
+        Assert.Equal(200d, rect.Width, 1);
+        Assert.Equal((800d - 200d) / 2d, rect.Left, 1);
+    }
+
+    [Fact]
+    public async Task FloatsLineUpHorizontally()
+    {
+        var document = await LoadAsync("<div id=a style='float: left'>A</div><div id=b style='float: left'>B</div>");
+
+        var a = document.GetElementById("a")!.GetBoundingClientRect();
+        var b = document.GetElementById("b")!.GetBoundingClientRect();
+
+        Assert.True(b.Left >= a.Right - 0.5, $"a.Right {a.Right}, b.Left {b.Left}");
+        Assert.Equal(a.Top, b.Top, 1);
+    }
+
+    [Fact]
+    public async Task FloatedInlineListItemsLineUpHorizontally()
+    {
+        var document = await LoadAsync("<ul><li id=a style='display: inline; float: left'><a href='#'>A</a></li><li id=b style='display: inline; float: left'><a href='#'>B</a></li></ul>");
+
+        var a = document.GetElementById("a")!.GetBoundingClientRect();
+        var b = document.GetElementById("b")!.GetBoundingClientRect();
+
+        Assert.True(b.Left >= a.Right - 0.5, $"a.Right {a.Right}, b.Left {b.Left}");
+        Assert.Equal(a.Top, b.Top, 1);
+    }
+
+    [Fact]
+    public async Task PlaceholderIsPainted()
+    {
+        var without = Render(await LoadAsync("<input>"));
+        var with = Render(await LoadAsync("<input placeholder='Your name'>"));
+
+        Assert.NotEqual(without, with);
+    }
+
+    [Fact]
+    public async Task PlaceholderIsHiddenByValue()
+    {
+        var value = Render(await LoadAsync("<input value='Hi'>"));
+        var both = Render(await LoadAsync("<input value='Hi' placeholder='Your name'>"));
+
+        Assert.Equal(value, both);
+    }
+}
diff --git a/src/AngleSharp.Renderer.Tests/FontFallbackTests.cs b/src/AngleSharp.Renderer.Tests/FontFallbackTests.cs
index 19b1642..b013b98 100644
--- a/src/AngleSharp.Renderer.Tests/FontFallbackTests.cs
+++ b/src/AngleSharp.Renderer.Tests/FontFallbackTests.cs
@@ -117,6 +117,36 @@ public async Task MissingFamily_RendersIdenticallyToItsFallback()
         return null;
     }
 
+    // ♔ is in DejaVu Sans and DejaVu Sans Mono, but not in DejaVu Serif.
+    private const string SerifLacks = "\u2654";
+
+    [Fact]
+    public void MissingGlyph_FallsBackToABundledFontThatHasIt()
+    {
+        var serif = Width(SerifLacks, "serif");
+
+        Assert.Equal(Width(SerifLacks, "sans-serif"), serif, tolerance: 0.01f);
+    }
+
+    [Fact]
+    public void MissingGlyph_FallsBackAlongTheFamilyListFirst()
+    {
+        Assert.Equal(Width(SerifLacks, "monospace"), Width(SerifLacks, "serif, monospace"), tolerance: 0.01f);
+        Assert.True(Math.Abs(Width(SerifLacks, "monospace") - Width(SerifLacks, "sans-serif")) > 0.01f,
+            "Expected the monospace glyph to differ from the sans-serif one.");
+    }
+
+    [Fact]
+    public void MissingGlyph_FallbackOnlyAffectsThatCharacter()
+    {
+        var mixed = Width("ab" + SerifLacks + "cd", "serif");
+
+        Assert.Equal(Width("ab", "serif") + Width(SerifLacks, "sans-serif") + Width("cd", "serif"), mixed, tolerance: 0.05f);
+    }
+
+    private static float Width(string text, string fontFamily) =>
+        Measurer.MeasureWidth(text, new RenderFont(fontFamily, 20f, 400f, false, 0f));
+
     private static float Width(string fontFamily) =>
         Measurer.MeasureWidth(Sample, new RenderFont(fontFamily, 20f, 400f, false, 0f));
 
diff --git a/src/AngleSharp.Renderer.Tests/FormControlTests.cs b/src/AngleSharp.Renderer.Tests/FormControlTests.cs
index a727483..9678f92 100644
--- a/src/AngleSharp.Renderer.Tests/FormControlTests.cs
+++ b/src/AngleSharp.Renderer.Tests/FormControlTests.cs
@@ -125,6 +125,29 @@ public async Task AccentColorAuto_UsesTheDefault()
         Assert.Contains(displayList.Commands.OfType<FillRectCommand>(), command => command.Color.Equals(DefaultAccent));
     }
 
+    [Theory]
+    [InlineData("<input placeholder=\"Name\">")]
+    [InlineData("<textarea placeholder=\"Name\"></textarea>")]
+    public async Task Placeholder_TakesTheDefaultPlaceholderStyle(string control)
+    {
+        var displayList = await LayoutAsync($"<div style=\"color:#00ff00\">{control}</div>");
+
+        var text = Assert.Single(displayList.Commands.OfType<DrawTextCommand>(), command => command.Text == "Name");
+        Assert.Equal(new RenderColor(169, 169, 169), text.Color);
+    }
+
+    [Theory]
+    [InlineData("<input placeholder=\"Name\">")]
+    [InlineData("<textarea placeholder=\"Name\"></textarea>")]
+    public async Task Placeholder_TakesAuthoredPlaceholderRules(string control)
+    {
+        var displayList = await LayoutAsync($"<style>::placeholder {{ color: rgb(1, 2, 3); font-size: 20px }}</style>{control}");
+
+        var text = Assert.Single(displayList.Commands.OfType<DrawTextCommand>(), command => command.Text == "Name");
+        Assert.Equal(new RenderColor(1, 2, 3), text.Color);
+        Assert.Equal(20f, text.FontSize, precision: 2);
+    }
+
     private static async Task<DisplayList> LayoutAsync(string body)
     {
         var context = BrowsingContext.New(Configuration.Default.WithCss());
diff --git a/src/AngleSharp.Renderer.Tests/HtmlRendererTests.cs b/src/AngleSharp.Renderer.Tests/HtmlRendererTests.cs
index cba7e6c..27d3097 100644
--- a/src/AngleSharp.Renderer.Tests/HtmlRendererTests.cs
+++ b/src/AngleSharp.Renderer.Tests/HtmlRendererTests.cs
@@ -8939,7 +8939,7 @@ public async Task BuildDisplayList_BracketsAreMirroredInRightToLeftText()
     {
         var context = BrowsingContext.New(configuration ?? Configuration.Default.WithCss());
 
-        return await context.OpenAsync(request =>
+        var document = await context.OpenAsync(request =>
         {
             if (!string.IsNullOrWhiteSpace(address))
             {
@@ -8948,6 +8948,14 @@ public async Task BuildDisplayList_BracketsAreMirroredInRightToLeftText()
 
             request.Content(html);
         });
+
+        // The expectations here are in page coordinates without the UA sheet's `body { margin:
+        // 8px }`. As the first sheet, any body margin a test sets itself still wins.
+        var resetStyle = document.CreateElement("style");
+        resetStyle.TextContent = "body { margin: 0 }";
+        document.Head?.Prepend(resetStyle);
+
+        return document;
     }
 
     private sealed class SingleResponseImageRequester : BaseRequester
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test01-box-model.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test01-box-model.png
index 520a477..f0d4d09 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test01-box-model.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test01-box-model.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test02-typography-inline.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test02-typography-inline.png
index 35fc19f..be8cbcb 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test02-typography-inline.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test02-typography-inline.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test03-flexbox.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test03-flexbox.png
index 2ffe759..e183657 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test03-flexbox.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test03-flexbox.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test04-grid.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test04-grid.png
index a0c1656..d75a134 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test04-grid.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test04-grid.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test05-positioning-stacking.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test05-positioning-stacking.png
index bb397d9..67d1dd4 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test05-positioning-stacking.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test05-positioning-stacking.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test06-overflow-visuals.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test06-overflow-visuals.png
index 3d5da66..caa6eab 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test06-overflow-visuals.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test06-overflow-visuals.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test07-replaced-elements.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test07-replaced-elements.png
index d8ecb68..7309f92 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test07-replaced-elements.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test07-replaced-elements.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test08-torture.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test08-torture.png
index 51e4064..781cdb5 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test08-torture.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test08-torture.png differ
diff --git a/src/AngleSharp.Renderer.Tests/rendered-cases/test09-writing-modes.png b/src/AngleSharp.Renderer.Tests/rendered-cases/test09-writing-modes.png
index 4952291..2615061 100644
Binary files a/src/AngleSharp.Renderer.Tests/rendered-cases/test09-writing-modes.png and b/src/AngleSharp.Renderer.Tests/rendered-cases/test09-writing-modes.png differ
diff --git a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.linux.png b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.linux.png
index eb0fe26..2026afa 100644
Binary files a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.linux.png and b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.linux.png differ
diff --git a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.macos.png b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.macos.png
index 7380330..e6f631a 100644
Binary files a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.macos.png and b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.macos.png differ
diff --git a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.windows.png b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.windows.png
index 4b6447c..cb5ea6f 100644
Binary files a/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.windows.png and b/src/AngleSharp.Renderer.Tests/verification-assets/web-safe-font-families.windows.png differ
diff --git a/src/AngleSharp.Renderer/AngleSharp.Renderer.csproj b/src/AngleSharp.Renderer/AngleSharp.Renderer.csproj
index f19d49e..2ae59d8 100644
--- a/src/AngleSharp.Renderer/AngleSharp.Renderer.csproj
+++ b/src/AngleSharp.Renderer/AngleSharp.Renderer.csproj
@@ -20,8 +20,8 @@
     <EmbedUntrackedSources>true</EmbedUntrackedSources>
     <IncludeSymbols>true</IncludeSymbols>
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
-    <AngleSharpVersion Condition=" '$(AngleSharpVersion)' == '' ">1.8.1</AngleSharpVersion>
-    <AngleSharpCssVersion Condition=" '$(AngleSharpCssVersion)' == '' ">1.2.0</AngleSharpCssVersion>
+    <AngleSharpVersion Condition=" '$(AngleSharpVersion)' == '' ">1.8.5</AngleSharpVersion>
+    <AngleSharpCssVersion Condition=" '$(AngleSharpCssVersion)' == '' ">1.2.1</AngleSharpCssVersion>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/src/AngleSharp.Renderer/HtmlRenderer.Inline.cs b/src/AngleSharp.Renderer/HtmlRenderer.Inline.cs
index e8f5149..4c7d6a9 100644
--- a/src/AngleSharp.Renderer/HtmlRenderer.Inline.cs
+++ b/src/AngleSharp.Renderer/HtmlRenderer.Inline.cs
@@ -199,11 +199,6 @@ private static FlowChildKind ClassifyFlowChild(IRenderNode child, LayoutContext
             return FlowChildKind.OutOfFlow;
         }
 
-        if (IsFloated(styleMap))
-        {
-            return FlowChildKind.Block;
-        }
-
         return IsInlineLevelElement(element, styleMap) ? FlowChildKind.Inline : FlowChildKind.Block;
     }
 
@@ -464,7 +459,7 @@ private void CollectElement(ElementRenderNode element, RenderTextStyle parentSty
                 return;
             }
 
-            if (IsFloated(styleMap) || !IsInlineLevelElement(element, styleMap))
+            if (!IsInlineLevelElement(element, styleMap))
             {
                 Pieces.Add(new InlinePiece { Kind = InlinePieceKind.BlockInInline, Style = parentStyle, Box = parentBox, Element = element });
                 _previousWasCollapsibleSpace = true;
@@ -2241,7 +2236,7 @@ void AccumulateInline(IRenderNode node, RenderTextStyle style)
                         break;
                     }
 
-                    var isInline = IsInlineLevelElement(child, childStyleMap) && !IsFloated(childStyleMap);
+                    var isInline = IsInlineLevelElement(child, childStyleMap);
 
                     if (isInline && !IsAtomicInlineElement(child, childStyleMap))
                     {
diff --git a/src/AngleSharp.Renderer/HtmlRenderer.WritingModes.cs b/src/AngleSharp.Renderer/HtmlRenderer.WritingModes.cs
index c7753cd..6b1cd2c 100644
--- a/src/AngleSharp.Renderer/HtmlRenderer.WritingModes.cs
+++ b/src/AngleSharp.Renderer/HtmlRenderer.WritingModes.cs
@@ -110,6 +110,11 @@ private static void ResolveWritingModeSystems(IRenderNode node, WritingModeKind
     private static WritingModeKind GetContentSystem(IElement element, LayoutContext context) =>
         context.ContentSystems.TryGetValue(element, out var system) ? system : WritingModeKind.HorizontalTb;
 
+    /// <summary>Whether an element's content runs orthogonally to the system its box sits in.</summary>
+    private static bool IsOrthogonalFlow(IElement element, LayoutContext context) =>
+        IsVerticalMode(GetContentSystem(element, context)) !=
+        IsVerticalMode(context.BoxSystems.TryGetValue(element, out var boxSystem) ? boxSystem : WritingModeKind.HorizontalTb);
+
     /// <summary>
     /// The inline size of an orthogonal flow: the box's (logical) height when it has one, else
     /// shrink-to-fit against the viewport's extent along the flow's inline axis.
diff --git a/src/AngleSharp.Renderer/HtmlRenderer.cs b/src/AngleSharp.Renderer/HtmlRenderer.cs
index c899a2c..08cb6d3 100644
--- a/src/AngleSharp.Renderer/HtmlRenderer.cs
+++ b/src/AngleSharp.Renderer/HtmlRenderer.cs
@@ -14,6 +14,7 @@ namespace AngleSharp.Renderer;
 using AngleSharp.Css.RenderTree;
 using AngleSharp.Css.Values;
 using AngleSharp.Dom;
+using AngleSharp.Html.Dom;
 using AngleSharp.Io;
 using AngleSharp.Renderer.Rendering;
 using AngleSharp.Renderer.Skia;
@@ -75,7 +76,6 @@ internal readonly record struct ElementLayoutMetrics(
     private readonly record struct LayoutContext(
         int Width,
         int Height,
-        RenderColor BackgroundColor,
         RenderColor TextColor,
         float Padding,
         string FontFamily,
@@ -216,7 +216,6 @@ private static LayoutContext CreateLayoutContext(IDocument document, IRenderDevi
         var defaultFontFamily = "sans-serif";
         var defaultLineHeight = 1.35f;
         var defaultTextColor = RenderColor.Black;
-        var defaultBackgroundColor = RenderColor.White;
 
         var rootElement = document.Body ?? document.DocumentElement;
         if (rootElement is not null)
@@ -228,7 +227,6 @@ private static LayoutContext CreateLayoutContext(IDocument document, IRenderDevi
                 : defaultFontFamily;
             defaultLineHeight = ParseLineHeight(styleMap, defaultLineHeight);
             defaultTextColor = ParseColor(styleMap.TryGetValue("color", out var colorValue) ? colorValue : null, defaultTextColor);
-            defaultBackgroundColor = ParseColor(styleMap.TryGetValue("background-color", out var backgroundValue) ? backgroundValue : null, defaultBackgroundColor);
         }
 
         // Built once per render and reused for every element (see GetExplicitDeclarations) rather
@@ -250,7 +248,6 @@ private static LayoutContext CreateLayoutContext(IDocument document, IRenderDevi
         return new LayoutContext(
             Width: width,
             Height: height,
-            BackgroundColor: defaultBackgroundColor,
             TextColor: defaultTextColor,
             Padding: 0f,
             FontFamily: defaultFontFamily,
@@ -373,7 +370,7 @@ private static float ResolveRootScrollOffsetY(IDocument document)
     private static DisplayList BuildDisplayList(IDocument document, RenderViewport viewport, LayoutContext context, IRenderDevice renderDevice, float scrollOffsetY = 0f, bool measureFullExtent = false)
     {
         var displayList = new DisplayList { Fonts = context.Fonts };
-        displayList.FillRect(new RenderRect(0f, 0f, viewport.Width, viewport.Height), context.BackgroundColor);
+        displayList.FillRect(new RenderRect(0f, 0f, viewport.Width, viewport.Height), RenderColor.White);
 
         var window = document.DefaultView;
         if (window is null)
@@ -397,6 +394,8 @@ private static DisplayList BuildDisplayList(IDocument document, RenderViewport v
 
         var body = document.Body;
         var root = body is null ? renderTree : renderTree.Find(body) ?? renderTree;
+        var rootElementNode = document.DocumentElement is { } documentElement ? renderTree.Find(documentElement) as ElementRenderNode : null;
+        var canvasBackground = PropagateToViewport(rootElementNode, root as ElementRenderNode, context);
 
         var contentX = context.Padding;
         // A positive scroll offset moves the page's content up relative to the fixed viewport
@@ -452,8 +451,10 @@ private static DisplayList BuildDisplayList(IDocument document, RenderViewport v
         }
         else
         {
+            // The root element is laid out as an ordinary block (so are <body>'s margins,
+            // padding, border and width); without one, the body's children fill the page.
             LayoutFlowChildren(
-                OrderChildrenForPainting(root.Children, context).ToList(),
+                rootElementNode is not null && GeneratesBoxes(rootElementNode) ? [rootElementNode] : OrderChildrenForPainting(root.Children, context).ToList(),
                 contentX,
                 contentY,
                 contentWidth,
@@ -481,35 +482,97 @@ private static DisplayList BuildDisplayList(IDocument document, RenderViewport v
             new RenderRect(contentX, contentY, contentWidth, Math.Max(cursorY, viewport.Height - context.Padding) - contentY),
             context);
 
-        // The page's own scrolling elements (<html>/<body>) are never laid out as boxes of their
-        // own - the loop above only ever lays out *their children* directly onto the page canvas -
-        // so neither ever gets an ordinary RecordLayoutMetrics call the way a normal descendant
-        // does. Synthesizing one here, sized to the full stacked content height, is what lets
-        // GetScrollHeight()/GetMaxScrollTop() (via ElementCssomViewExtensions.GetScrollExtents,
-        // which reads exactly this metrics map) treat the document as scrollable at all. This is a
-        // no-op outside of CaptureLayoutMetrics, since RecordLayoutMetrics itself only does
-        // anything while that capture is active.
-        if (body is not null)
-        {
-            // The synthesized box represents the *client* (viewport) area, not the total content
-            // height - GetScrollExtents (ElementCssomViewExtensions) separately walks this map for
-            // every actual descendant (each already carrying its own, normally-recorded metrics)
-            // to work out how far content actually extends past this box, exactly the way it
-            // already does for any other scrollable element. Recording the full content height
-            // here instead would make the client and scroll heights identical, so nothing would
-            // ever look scrollable.
-            var clientHeight = Math.Max(0f, viewport.Height - (2f * context.Padding));
+        // The canvas background (CSS Backgrounds 3 §2.11.2) paints under everything, over the whole
+        // canvas: the viewport, or the content where it extends further down.
+        if (canvasBackground is { } propagated)
+        {
+            var canvasBuffer = new DisplayList();
+            var canvasHeight = Math.Max(viewport.Height + scrollOffsetY, cursorY + scrollOffsetY);
+            PaintBoxBackground(canvasBuffer, propagated.StyleMap, propagated.Box, 0f, -scrollOffsetY, viewport.Width, canvasHeight, default, default);
+            displayList.InsertRange(1, canvasBuffer.Commands);
+        }
+
+        // The viewport is the document's scroll container, so the scrolling element (<html>)
+        // reports the viewport as its client area; GetScrollExtents (ElementCssomViewExtensions)
+        // measures how far its descendants extend past it. Recording its laid-out box instead
+        // would make the client and scroll heights identical, so nothing would ever look
+        // scrollable. Only a page without a laid-out root synthesizes <body>'s box the same way.
+        // This is a no-op outside of CaptureLayoutMetrics.
+        var clientHeight = Math.Max(0f, viewport.Height - (2f * context.Padding));
+
+        if (body is not null && (rootElementNode is null || IsVerticalMode(pageSystem)))
+        {
             RecordLayoutMetrics(body, contentX, contentY, contentWidth, clientHeight, 0f, 0f, 0f, 0f, 0f, 0f, 0f, 0f);
+        }
 
-            if (document.DocumentElement is not null)
-            {
-                RecordLayoutMetrics(document.DocumentElement, contentX, contentY, contentWidth, clientHeight, 0f, 0f, 0f, 0f, 0f, 0f, 0f, 0f);
-            }
+        if (document.DocumentElement is not null)
+        {
+            RecordLayoutMetrics(document.DocumentElement, contentX, contentY, contentWidth, clientHeight, 0f, 0f, 0f, 0f, 0f, 0f, 0f, 0f);
         }
 
         return displayList;
     }
 
+    /// <summary>
+    /// What the root element and <c>&lt;body&gt;</c> hand to the viewport. Their background
+    /// becomes the canvas background (CSS Backgrounds 3 §2.11.2): the root's, or the body's when
+    /// the root has none, which the element it came from then no longer paints itself. Likewise
+    /// their `overflow` applies to the viewport (CSS Overflow 3 §3.3), which already clips to its
+    /// bounds and does not scroll by itself, so the boxes simply never clip.
+    /// </summary>
+    private static (Dictionary<string, string> StyleMap, BoxStyle Box)? PropagateToViewport(ElementRenderNode? rootNode, ElementRenderNode? bodyNode, LayoutContext context)
+    {
+        if (rootNode is null)
+        {
+            return null;
+        }
+
+        var rootStyle = GetOrCreateStyleMap(context, rootNode.Ref, rootNode.ComputedStyle);
+        var bodyStyle = bodyNode is not null && !ReferenceEquals(bodyNode, rootNode) &&
+                        string.Equals(bodyNode.Ref.LocalName, "body", StringComparison.OrdinalIgnoreCase)
+            ? GetOrCreateStyleMap(context, bodyNode.Ref, bodyNode.ComputedStyle)
+            : null;
+
+        var rootOverflowVisible = IsOverflowVisible(rootStyle);
+        RemoveOverflow(rootStyle);
+
+        if (bodyStyle is not null && rootOverflowVisible)
+        {
+            RemoveOverflow(bodyStyle);
+        }
+
+        var rootBox = ResolveBoxStyle(rootStyle, rootNode.Ref);
+        var (sourceStyle, sourceBox) = HasBackground(rootBox) || bodyStyle is null
+            ? (rootStyle, rootBox)
+            : (bodyStyle, ResolveBoxStyle(bodyStyle, bodyNode!.Ref));
+
+        if (!HasBackground(sourceBox))
+        {
+            return null;
+        }
+
+        // The canvas keeps its own copy; the box it came from paints no background of its own.
+        var canvasStyle = new Dictionary<string, string>(sourceStyle);
+        sourceStyle.Remove("background-color");
+        sourceStyle.Remove("background-image");
+
+        return (canvasStyle, sourceBox);
+
+        static bool HasBackground(BoxStyle box) => box.BackgroundColor.A > 0 || box.BackgroundLayers is { Count: > 0 };
+
+        static bool IsOverflowVisible(Dictionary<string, string> styleMap) =>
+            new[] { "overflow", "overflow-x", "overflow-y" }.All(key =>
+                !styleMap.TryGetValue(key, out var value) || string.IsNullOrWhiteSpace(value) ||
+                value.Trim().Equals("visible", StringComparison.OrdinalIgnoreCase));
+
+        static void RemoveOverflow(Dictionary<string, string> styleMap)
+        {
+            styleMap.Remove("overflow");
+            styleMap.Remove("overflow-x");
+            styleMap.Remove("overflow-y");
+        }
+    }
+
     private static void LayoutNode(
         IRenderNode node,
         float containingX,
@@ -620,7 +683,9 @@ private static void LayoutElement(
         }
 
         // Atomic inlines and flex items lay out their own contents as a block, whatever their
-        // inline display value (flex items are blockified).
+        // inline display value. Floats and absolutely positioned boxes arrive blockified in the
+        // computed `display` (CSS Display 3 §2.7); flex items are not, as AngleSharp.Css does not
+        // know about the formatting context they participate in.
         if (!renderAsBlock && (isInlineBlock || isAtomicInline || isFlexItem || IsAtomicInlineDisplay(computedStyle)))
         {
             renderAsBlock = true;
@@ -697,6 +762,9 @@ private static void LayoutElement(
         var marginLeft = ParseLength(styleMap, "margin-left", flowContainingWidth, box.Margin.Left, allowAuto: true);
         var marginRight = ParseLength(styleMap, "margin-right", flowContainingWidth, box.Margin.Right, allowAuto: true);
 
+        // The parent already took this box's top margin (and those collapsing through it) as its own.
+        var topMarginAbsorbed = suppressNextBlockTopMargin;
+
         if (suppressNextBlockTopMargin)
         {
             marginTop = 0f;
@@ -737,11 +805,13 @@ private static void LayoutElement(
         // A box with its own formatting context never collapses margins with its children.
         var collapseWithFirstChild = borderTop <= 0f && paddingTop <= 0f && !establishesContext;
         var effectiveMarginTop = marginTop;
+        var collapsesWithFirstChild = false;
 
         if (collapseWithFirstChild &&
             TryGetFirstCollapsibleChildTopMargin(node, flowContainingWidth, context, out var firstChildTopMargin))
         {
-            effectiveMarginTop = CollapseMargins(marginTop, firstChildTopMargin);
+            effectiveMarginTop = topMarginAbsorbed ? 0f : CollapseMargins(marginTop, firstChildTopMargin);
+            collapsesWithFirstChild = true;
         }
 
         var specifiedContentWidth = ResolveFlexibleContentDimension(
@@ -999,7 +1069,7 @@ private static void LayoutElement(
         // A table cell's content is shifted within the cell by its `vertical-align`.
         var childCursorY = contentY + contentOffsetY;
         var childPreviousBlockMarginBottom = 0f;
-        var childSuppressNextBlockTopMargin = collapseWithFirstChild && !float.Equals(effectiveMarginTop, marginTop);
+        var childSuppressNextBlockTopMargin = collapsesWithFirstChild;
         var childFloats = establishesContext ? new FloatArea() : floats;
         var negativeZIndexRanges = new List<(int StartIndex, int Count)>();
 
@@ -1020,7 +1090,8 @@ private static void LayoutElement(
         // single synthetic text child below rather than being emptied out like the real <svg> root is.
         var orderedChildren = element is not IPseudoElement &&
                                (string.Equals(tagName, "svg", StringComparison.OrdinalIgnoreCase) ||
-                               formControlKind is FormControlKind.Select or FormControlKind.Button)
+                               formControlKind is FormControlKind.Select or FormControlKind.Button ||
+                               (formControlKind == FormControlKind.TextArea && ResolveChangedTextAreaValue(element) is not null))
             ? []
             : OrderChildrenForPainting(node.Children, context).ToList();
         if (IsFlexContainer(styleMap))
@@ -4715,7 +4786,17 @@ public bool TryGetRawLength(string propertyName, out CssLengthValue value)
     /// </summary>
     private static void AddLengthProperty(StyleMap map, ICssStyleDeclaration style, string propertyName, ICssStyleDeclaration? explicitDeclarations = null)
     {
-        var property = explicitDeclarations?.GetProperty(propertyName) ?? style.GetProperty(propertyName);
+        // The explicit declaration is only needed for percentages (which `.Compute()` resolves
+        // against the viewport); any other unit (`em`, `rem`, `vw`, ...) needs the computed value.
+        var explicitProperty = explicitDeclarations?.GetProperty(propertyName);
+
+        if (explicitProperty?.RawValue?.CssText is not { } explicitText || !explicitText.Contains('%'))
+        {
+            explicitDeclarations = null;
+            explicitProperty = null;
+        }
+
+        var property = explicitProperty ?? style.GetProperty(propertyName);
 
         if (property?.RawValue is CssLengthValue length)
         {
@@ -5023,7 +5104,7 @@ private static Dictionary<string, string> CreateStyleMap(ICssStyleDeclaration st
             ? ReadExplicitOrComputed(explicitDeclarations, style, "word-wrap")
             : style.GetPropertyValue("word-wrap"));
 
-        ApplyActiveTransitionAndAnimationOverrides(map, element);
+        ApplyActiveTransitionAndAnimationOverrides(map, style, element);
 
         return map;
     }
@@ -5038,13 +5119,18 @@ private static Dictionary<string, string> CreateStyleMap(ICssStyleDeclaration st
     // property both are currently affecting - a reasonable simplification of the CSS cascade's own
     // "animations, then transitions" ordering (transitions technically animate on top of whatever
     // the animation produces, which this renderer does not attempt to layer precisely).
-    private static void ApplyActiveTransitionAndAnimationOverrides(Dictionary<string, string> map, IElement? element)
+    private static void ApplyActiveTransitionAndAnimationOverrides(Dictionary<string, string> map, ICssStyleDeclaration style, IElement? element)
     {
         if (element?.Owner is null || !element.Owner.Context.TryGetDomHarness(out var harness) || harness is null)
         {
             return;
         }
 
+        // Looking up an animated value runs the element's cascade again (per property), so it is
+        // only done for elements whose computed style declares an animation at all.
+        var isAnimated = SplitTopLevelCommaList(style.GetPropertyValue("animation-name"))
+            .Any(name => !string.IsNullOrWhiteSpace(name) && !name.Trim().Equals("none", StringComparison.OrdinalIgnoreCase));
+
         // Iterates the full interpolatable whitelist, not just map.Keys - a property that only
         // ever appears inside a @keyframes block (never as a base/inherited declaration, e.g.
         // `opacity` set solely by an animation) would otherwise have no key in the map at all for
@@ -5053,7 +5139,7 @@ private static void ApplyActiveTransitionAndAnimationOverrides(Dictionary<string
 
         foreach (var property in CssValueInterpolation.InterpolatableProperties.Keys)
         {
-            var animatedValue = harness.GetAnimatedValue(element, property);
+            var animatedValue = isAnimated ? harness.GetAnimatedValue(element, property) : null;
 
             if (animatedValue is not null)
             {
@@ -5193,14 +5279,38 @@ private static bool TryGetFirstCollapsibleChildTopMargin(ElementRenderNode node,
                 continue;
             }
 
-            if (!ShouldRenderAsBlock(childElement.ComputedStyle))
+            var childStyle = GetOrCreateStyleMap(context, childElement.Ref, childElement.ComputedStyle);
+            var isFloat = IsFloated(childStyle);
+            var isOutOfFlow = IsOutOfFlowPositioned(childStyle);
+
+            // Floats and absolutely positioned boxes take no part in margin collapsing.
+            if (isFloat || isOutOfFlow)
+            {
+                continue;
+            }
+
+            // Inline-level content (atomic inlines included) starts a line, which separates the margins.
+            if (ClassifyFlowChild(childElement, context) != FlowChildKind.Block)
             {
                 marginTop = 0f;
                 return false;
             }
 
-            var childStyle = GetOrCreateStyleMap(context, childElement.Ref, childElement.ComputedStyle);
             marginTop = ParseLength(childStyle, "margin-top", containingWidth, 0f, allowAuto: false);
+
+            // The child's margin itself collapses through to its own first child when nothing
+            // separates them, so a whole chain of first children shares one margin.
+            var childBox = ResolveBoxStyle(childStyle, childElement.Ref);
+
+            if (childBox.BorderWidth.Top <= 0f &&
+                ParseLength(childStyle, "padding-top", containingWidth, childBox.Padding.Top, allowAuto: false) <= 0f &&
+                !EstablishesBlockFormattingContext(childStyle, isFloat, isOutOfFlow, isAtomicInline: false, isFlexItem: false) &&
+                !IsOrthogonalFlow(childElement.Ref, context) &&
+                TryGetFirstCollapsibleChildTopMargin(childElement, containingWidth, context, out var grandchildMarginTop))
+            {
+                marginTop = CollapseMargins(marginTop, grandchildMarginTop);
+            }
+
             return true;
         }
 
@@ -6135,15 +6245,30 @@ private static bool TryLoadImageResource(IElement element, string? source, out C
                 response = null;
             }
 
-            if (response?.Content is not null)
+            // AngleSharp disposes the response once it has been processed; WithRendering()'s image
+            // service keeps its bytes. Without that service the stream may already be closed, and
+            // the image then counts as missing rather than failing the whole paint.
+            if (response is not null && ImageResourceService.TryGetCaptured(response, out var capturedBytes, out var capturedMimeType))
             {
-                using var sourceStream = response.Content;
-                using var memoryStream = new MemoryStream();
-                sourceStream.CopyTo(memoryStream);
-                bytes = memoryStream.ToArray();
-                mimeType = response.Headers?.TryGetValue("Content-Type", out var contentType) == true && !string.IsNullOrWhiteSpace(contentType)
-                    ? contentType
-                    : "image/unknown";
+                bytes = capturedBytes;
+                mimeType = capturedMimeType;
+            }
+            else if (response?.Content is not null)
+            {
+                try
+                {
+                    using var sourceStream = response.Content;
+                    using var memoryStream = new MemoryStream();
+                    sourceStream.CopyTo(memoryStream);
+                    bytes = memoryStream.ToArray();
+                    mimeType = response.Headers?.TryGetValue("Content-Type", out var contentType) == true && !string.IsNullOrWhiteSpace(contentType)
+                        ? contentType
+                        : "image/unknown";
+                }
+                catch (Exception exception) when (exception is ObjectDisposedException or NotSupportedException or IOException)
+                {
+                    bytes = null;
+                }
             }
         }
 
@@ -6682,7 +6807,7 @@ private static string ResolveFormControlLabel(FormControlKind kind, IElement ele
                     return text.Length > 0 ? text : "Button";
                 }
 
-                var value = element.GetAttribute("value");
+                var value = ResolveInputValue(element);
 
                 if (!string.IsNullOrWhiteSpace(value))
                 {
@@ -6700,7 +6825,7 @@ private static string ResolveFormControlLabel(FormControlKind kind, IElement ele
 
             case FormControlKind.TextLike:
             {
-                var value = element.GetAttribute("value") ?? string.Empty;
+                var value = ResolveInputValue(element);
 
                 // A password field's own value never paints as plain text, matching the one
                 // input type where masking is part of the type's defining behavior rather than an
@@ -6712,16 +6837,16 @@ private static string ResolveFormControlLabel(FormControlKind kind, IElement ele
 
             case FormControlKind.Select:
             {
-                // The DOM's own last-`selected`-wins semantics (mirroring how a real <select>
-                // resolves multiple `selected` attributes) - falling back to the first <option> when
-                // none is marked selected, exactly like a browser's own initial-selection default.
+                // The options' live selectedness (initially their `selected` attribute), last one
+                // wins as for multiple `selected` attributes - falling back to the first <option>
+                // when none is selected, exactly like a browser's own initial-selection default.
                 var options = element.Children.Where(child => string.Equals(child.LocalName, "option", StringComparison.OrdinalIgnoreCase)).ToList();
-                var selected = options.LastOrDefault(option => option.HasAttribute("selected")) ?? options.FirstOrDefault();
+                var selected = options.LastOrDefault(IsOptionSelected) ?? options.FirstOrDefault();
                 return selected is not null ? NormalizeWhitespace(selected.TextContent ?? string.Empty) : string.Empty;
             }
 
             case FormControlKind.DateTime:
-                return FormatDateTimeInputValue(element.GetAttribute("type")?.Trim().ToLowerInvariant() ?? "date", element.GetAttribute("value"));
+                return FormatDateTimeInputValue(element.GetAttribute("type")?.Trim().ToLowerInvariant() ?? "date", ResolveInputValue(element));
 
             case FormControlKind.File:
                 // No filename-tracking model (this renderer does not simulate a real file picker
@@ -6804,6 +6929,11 @@ private static void PaintFormControl(
                     }
                 }
 
+                else if (kind == FormControlKind.TextLike && ResolvePlaceholder(element) is { } placeholder)
+                {
+                    DrawStyledText(context, displayList, placeholder, contentX, baselineY, ResolvePlaceholderTextStyle(element, textStyle, context), decorate: false);
+                }
+
                 if (kind == FormControlKind.TextLike)
                 {
                     PaintFormControlCaret(displayList, element, textStyle, contentX + labelWidth, baselineY);
@@ -6822,7 +6952,7 @@ private static void PaintFormControl(
 
             case FormControlKind.Checkbox:
             {
-                if (element.HasAttribute("checked"))
+                if (IsInputChecked(element))
                 {
                     // Sized off the box's own smaller dimension so a checkbox whose width and
                     // height default to the same font-relative size (the common case) still gets a
@@ -6840,7 +6970,7 @@ private static void PaintFormControl(
 
             case FormControlKind.Radio:
             {
-                if (element.HasAttribute("checked"))
+                if (IsInputChecked(element))
                 {
                     var size = Math.Max(0f, Math.Min(contentWidth, contentHeight) * 0.5f);
                     var insetX = (contentWidth - size) / 2f;
@@ -6863,7 +6993,7 @@ private static void PaintFormControl(
                 // padding, size) goes through the ordinarily-overridable box model. It fills the
                 // entire content box (rather than a fixed line-height-tall rect within it) so it is
                 // always centered regardless of how tall the box's own content height ends up being.
-                var color = ParseColor(element.GetAttribute("value"), RenderColor.Black);
+                var color = ParseColor(ResolveInputValue(element), RenderColor.Black);
                 displayList.FillRect(new RenderRect(contentX, contentY, contentWidth, contentHeight), color);
                 break;
             }
@@ -6882,7 +7012,10 @@ private static void PaintFormControl(
                     max = min + 1d;
                 }
 
-                var value = Math.Clamp(ParseRangeAttribute(element, "value", (min + max) / 2d), min, max);
+                var value = Math.Clamp(
+                    double.TryParse(ResolveInputValue(element), NumberStyles.Float, CultureInfo.InvariantCulture, out var parsedValue) ? parsedValue : (min + max) / 2d,
+                    min,
+                    max);
                 var fraction = (float)((value - min) / (max - min));
 
                 var trackHeight = Math.Max(2f, contentHeight * 0.2f);
@@ -6910,14 +7043,51 @@ private static void PaintFormControl(
                 // ends up ending on. Reproduces the exact same wrapping the real content is laid
                 // out with (same text, same `white-space`-aware splitting, same content width) so
                 // the caret never drifts out of sync with what is actually painted.
-                if (!element.IsFocused)
+                // A value changed by script or input no longer matches the child text, so it is
+                // painted here instead (its children are not laid out, see LayoutElement).
+                var changedValue = ResolveChangedTextAreaValue(element);
+
+                if (changedValue is null && !element.IsFocused && ResolvePlaceholder(element) is null)
                 {
                     break;
                 }
 
-                var normalizedText = NormalizeWhitespace(element.TextContent ?? string.Empty, textStyle.WhiteSpace);
+                var normalizedText = NormalizeWhitespace(changedValue ?? element.TextContent ?? string.Empty, textStyle.WhiteSpace);
                 var lines = WrapTextRespectingWhiteSpace(context, normalizedText, contentWidth, textStyle);
                 var lineHeight = textStyle.FontSize * textStyle.LineHeightMultiplier;
+
+                if (normalizedText.Length == 0 && ResolvePlaceholder(element) is { } placeholder)
+                {
+                    var placeholderStyle = ResolvePlaceholderTextStyle(element, textStyle, context);
+                    var placeholderLines = WrapTextRespectingWhiteSpace(context, NormalizeWhitespace(placeholder, textStyle.WhiteSpace), contentWidth, textStyle);
+                    displayList.PushClip(new RenderRect(contentX, contentY, contentWidth, contentHeight), RenderCornerRadii.Zero);
+
+                    for (var lineIndex = 0; lineIndex < placeholderLines.Count; lineIndex++)
+                    {
+                        var lineBaselineY = contentY + (lineIndex * lineHeight) + ResolveTextBaselineOffset(lineHeight, textStyle.FontSize) + textStyle.VerticalAlignOffset;
+                        DrawStyledText(context, displayList, placeholderLines[lineIndex], contentX, lineBaselineY, placeholderStyle, decorate: false);
+                    }
+
+                    displayList.PopClip();
+                }
+                else if (changedValue is not null)
+                {
+                    displayList.PushClip(new RenderRect(contentX, contentY, contentWidth, contentHeight), RenderCornerRadii.Zero);
+
+                    for (var lineIndex = 0; lineIndex < lines.Count; lineIndex++)
+                    {
+                        var lineBaselineY = contentY + (lineIndex * lineHeight) + ResolveTextBaselineOffset(lineHeight, textStyle.FontSize) + textStyle.VerticalAlignOffset;
+                        DrawStyledText(context, displayList, lines[lineIndex], contentX, lineBaselineY, textStyle, decorate: false);
+                    }
+
+                    displayList.PopClip();
+                }
+
+                if (!element.IsFocused)
+                {
+                    break;
+                }
+
                 var lastLineIndex = Math.Max(0, lines.Count - 1);
                 var lastLine = lines.Count > 0 ? lines[^1] : string.Empty;
                 var lastLineWidth = lastLine.Length > 0 ? MeasureTextWidth(context, lastLine, textStyle) : 0f;
@@ -6930,6 +7100,54 @@ private static void PaintFormControl(
     }
 
 
+    /// <summary>
+    /// An input's live value (<see cref="IHtmlInputElement.Value"/>, which starts out as the
+    /// `value` attribute), so what script or user input set is what is shown.
+    /// </summary>
+    private static string ResolveInputValue(IElement element) =>
+        element is IHtmlInputElement input ? input.Value ?? string.Empty : element.GetAttribute("value") ?? string.Empty;
+
+    /// <summary>
+    /// The `placeholder` of a text field or textarea (null when absent or empty). Line breaks in
+    /// an input's placeholder are stripped, as the HTML spec requires.
+    /// </summary>
+    private static string? ResolvePlaceholder(IElement element)
+    {
+        var placeholder = element.GetAttribute("placeholder");
+
+        if (string.IsNullOrEmpty(placeholder))
+        {
+            return null;
+        }
+
+        return element is IHtmlInputElement ? placeholder.Replace("\r", string.Empty).Replace("\n", string.Empty) : placeholder;
+    }
+
+    /// <summary>
+    /// The style placeholder text paints with: the computed `::placeholder` style (inheriting from
+    /// the control; its default look, `color: darkgray`, comes from the UA sheet). Without a style
+    /// collection (no window) it is the control's own text style.
+    /// </summary>
+    private static RenderTextStyle ResolvePlaceholderTextStyle(IElement element, RenderTextStyle textStyle, LayoutContext context) =>
+        context.StyleCollection is { } styleCollection
+            ? ResolveTextStyle(CreateStyleMap(styleCollection.ComputeDeclarations(element, "::placeholder")), textStyle)
+            : textStyle;
+
+    private static bool IsInputChecked(IElement element) =>
+        element is IHtmlInputElement input ? input.IsChecked : element.HasAttribute("checked");
+
+    private static bool IsOptionSelected(IElement option) =>
+        option is IHtmlOptionElement htmlOption ? htmlOption.IsSelected : option.HasAttribute("selected");
+
+    /// <summary>
+    /// A <c>&lt;textarea&gt;</c>'s live value when it no longer matches its child text (null
+    /// otherwise, and the child text keeps flowing as ordinary content).
+    /// </summary>
+    private static string? ResolveChangedTextAreaValue(IElement element) =>
+        element is IHtmlTextAreaElement textArea && !string.Equals(textArea.Value, textArea.DefaultValue, StringComparison.Ordinal)
+            ? textArea.Value ?? string.Empty
+            : null;
+
     private static double ParseRangeAttribute(IElement element, string attributeName, double defaultValue)
     {
         var raw = element.GetAttribute(attributeName);
diff --git a/src/AngleSharp.Renderer/Rendering/ImageResourceService.cs b/src/AngleSharp.Renderer/Rendering/ImageResourceService.cs
new file mode 100644
index 0000000..83f6e87
--- /dev/null
+++ b/src/AngleSharp.Renderer/Rendering/ImageResourceService.cs
@@ -0,0 +1,89 @@
+namespace AngleSharp.Renderer.Rendering;
+
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using AngleSharp.Dom;
+using AngleSharp.Io;
+using AngleSharp.Media;
+using SkiaSharp;
+
+/// <summary>
+/// Buffers image responses while AngleSharp's request processor still owns them. The processor
+/// disposes a response (closing its content stream and clearing its headers) right after
+/// processing it, so an <c>&lt;img&gt;</c>'s <c>CurrentDownload</c> can no longer be read when the
+/// document is painted later; the renderer looks the bytes up here by the response instead.
+/// </summary>
+internal sealed class ImageResourceService : IResourceService<IImageInfo>
+{
+    private static readonly ConditionalWeakTable<IResponse, CapturedImage> s_captured = new();
+
+    public static ImageResourceService Instance { get; } = new();
+
+    private ImageResourceService()
+    {
+    }
+
+    public bool SupportsType(string mimeType) =>
+        mimeType?.StartsWith("image/", StringComparison.OrdinalIgnoreCase) == true;
+
+    public async Task<IImageInfo> CreateAsync(IResponse response, CancellationToken cancel)
+    {
+        using var buffer = new MemoryStream();
+
+        if (response.Content is not null)
+        {
+            await response.Content.CopyToAsync(buffer, cancel).ConfigureAwait(false);
+        }
+
+        var bytes = buffer.ToArray();
+        var mimeType = response.Headers?.TryGetValue("Content-Type", out var contentType) == true && !string.IsNullOrWhiteSpace(contentType)
+            ? contentType
+            : "image/unknown";
+        s_captured.AddOrUpdate(response, new CapturedImage(bytes, mimeType));
+
+        var width = 0;
+        var height = 0;
+
+        using (var data = SKData.CreateCopy(bytes))
+        using (var codec = SKCodec.Create(data))
+        {
+            if (codec is not null)
+            {
+                width = codec.Info.Width;
+                height = codec.Info.Height;
+            }
+        }
+
+        return new ImageInfo { Source = response.Address, Width = width, Height = height };
+    }
+
+    /// <summary>
+    /// The bytes and content type of a response this service processed.
+    /// </summary>
+    public static bool TryGetCaptured(IResponse response, out byte[] bytes, out string mimeType)
+    {
+        if (s_captured.TryGetValue(response, out var captured))
+        {
+            bytes = captured.Bytes;
+            mimeType = captured.MimeType;
+            return true;
+        }
+
+        bytes = [];
+        mimeType = string.Empty;
+        return false;
+    }
+
+    private sealed record CapturedImage(byte[] Bytes, string MimeType);
+
+    private sealed class ImageInfo : IImageInfo
+    {
+        public required Url Source { get; set; }
+
+        public int Width { get; init; }
+
+        public int Height { get; init; }
+    }
+}
diff --git a/src/AngleSharp.Renderer/Rendering/RenderingConfigurationExtensions.cs b/src/AngleSharp.Renderer/Rendering/RenderingConfigurationExtensions.cs
index 8bee4dd..2e235a7 100644
--- a/src/AngleSharp.Renderer/Rendering/RenderingConfigurationExtensions.cs
+++ b/src/AngleSharp.Renderer/Rendering/RenderingConfigurationExtensions.cs
@@ -1,6 +1,8 @@
 namespace AngleSharp;
 
 using AngleSharp.Media.Dom;
+using AngleSharp.Renderer.Rendering;
+using System.Linq;
 
 /// <summary>
 /// Configuration extensions for registering canvas rendering services.
@@ -17,12 +19,17 @@ public static IConfiguration WithRendering(this IConfiguration configuration)
     }
 
     /// <summary>
-    /// Registers a custom rendering service with the configuration.
+    /// Registers a custom rendering service with the configuration, plus the image service that
+    /// keeps loaded <c>&lt;img&gt;</c> data available for painting.
     /// </summary>
     public static IConfiguration WithRendering(this IConfiguration configuration, Func<IBrowsingContext, IRenderingService> factory)
     {
         ArgumentNullException.ThrowIfNull(configuration);
         ArgumentNullException.ThrowIfNull(factory);
-        return configuration.WithOnly(factory);
+        configuration = configuration.WithOnly(factory);
+
+        return configuration.Services.OfType<ImageResourceService>().Any()
+            ? configuration
+            : configuration.With(ImageResourceService.Instance);
     }
 }
diff --git a/src/AngleSharp.Renderer/Skia/SkiaRenderBackend.cs b/src/AngleSharp.Renderer/Skia/SkiaRenderBackend.cs
index 3c3dbd8..435b90d 100644
--- a/src/AngleSharp.Renderer/Skia/SkiaRenderBackend.cs
+++ b/src/AngleSharp.Renderer/Skia/SkiaRenderBackend.cs
@@ -915,7 +915,7 @@ private static void DrawText(SKCanvas canvas, DrawTextCommand command, FontFaceS
         using var paint = SkiaTextShaping.CreateTextPaint(font);
         paint.Color = ToSkColor(command.Color);
 
-        DrawTextWithLetterSpacing(canvas, paint, command.Text, command.X, command.Y, command.LetterSpacing);
+        SkiaTextShaping.DrawText(canvas, paint, command.Text, command.X, command.Y, command.LetterSpacing, font);
 
         if (command.Underline || command.StrikeThrough)
         {
@@ -927,7 +927,7 @@ private static void DrawText(SKCanvas canvas, DrawTextCommand command, FontFaceS
                 StrokeWidth = Math.Max(1f, command.FontSize / 14f),
             };
 
-            var textWidth = SkiaTextShaping.MeasureTextWidth(paint, command.Text, command.LetterSpacing);
+            var textWidth = SkiaTextShaping.MeasureTextWidth(paint, command.Text, command.LetterSpacing, font);
 
             if (command.Underline)
             {
@@ -963,7 +963,7 @@ private static void DrawTextShadow(SKCanvas canvas, DrawTextShadowCommand comman
             paint.MaskFilter = SKMaskFilter.CreateBlur(SKBlurStyle.Normal, command.BlurRadius / 2f);
         }
 
-        DrawTextWithLetterSpacing(canvas, paint, command.Text, command.X, command.Y, command.LetterSpacing);
+        SkiaTextShaping.DrawText(canvas, paint, command.Text, command.X, command.Y, command.LetterSpacing, font);
     }
 
     private static void DrawDecorationLine(SKCanvas canvas, SKPaint paint, float x, float y, float width, RenderTextDecorationStyle style)
@@ -1017,24 +1017,6 @@ private static void DrawPatternedLine(SKCanvas canvas, SKPaint paint, float x, f
         }
     }
 
-    private static void DrawTextWithLetterSpacing(SKCanvas canvas, SKPaint paint, string text, float x, float y, float letterSpacing)
-    {
-        if (letterSpacing <= 0f)
-        {
-            canvas.DrawText(text, x, y, paint);
-            return;
-        }
-
-        var cursorX = x;
-
-        foreach (var character in text)
-        {
-            var glyph = character.ToString();
-            canvas.DrawText(glyph, cursorX, y, paint);
-            cursorX += paint.MeasureText(glyph) + letterSpacing;
-        }
-    }
-
     private static SKColor ToSkColor(RenderColor color) => new(color.R, color.G, color.B, color.A);
 
 }
\ No newline at end of file
diff --git a/src/AngleSharp.Renderer/Skia/SkiaTextMeasurer.cs b/src/AngleSharp.Renderer/Skia/SkiaTextMeasurer.cs
index 8688368..60b8703 100644
--- a/src/AngleSharp.Renderer/Skia/SkiaTextMeasurer.cs
+++ b/src/AngleSharp.Renderer/Skia/SkiaTextMeasurer.cs
@@ -27,7 +27,7 @@ public float MeasureWidth(string text, RenderFont font)
             return 0f;
         }
 
-        return SkiaTextShaping.MeasureTextWidth(GetPaint(font), text, font.LetterSpacing);
+        return SkiaTextShaping.MeasureTextWidth(GetPaint(font), text, font.LetterSpacing, font);
     }
 
     private static SKPaint GetPaint(RenderFont font)
diff --git a/src/AngleSharp.Renderer/Skia/SkiaTextShaping.cs b/src/AngleSharp.Renderer/Skia/SkiaTextShaping.cs
index f2658cf..b9d25eb 100644
--- a/src/AngleSharp.Renderer/Skia/SkiaTextShaping.cs
+++ b/src/AngleSharp.Renderer/Skia/SkiaTextShaping.cs
@@ -3,6 +3,7 @@ namespace AngleSharp.Renderer.Skia;
 using System.Collections.Concurrent;
 using System.Linq;
 using System.Runtime.CompilerServices;
+using System.Text;
 using System.Threading;
 
 using AngleSharp.Renderer.Rendering;
@@ -57,6 +58,9 @@ internal static class SkiaTextShaping
 
     private static readonly ConcurrentDictionary<SystemTypefaceKey, SKTypeface?> ResolvedSystemTypefaces = new();
 
+    // What the host offers for a character no declared or bundled font has, per style.
+    private static readonly ConcurrentDictionary<(int Codepoint, int Weight, int Width, SKFontStyleSlant Slant), SKTypeface?> CharacterFallbacks = new();
+
     // Decoding a font file is expensive and a face outlives a single render, so the typeface is
     // kept alongside the face itself rather than rebuilt per paint.
     private static readonly ConcurrentDictionary<byte[], SKTypeface?> EmbeddedTypefaces = new(ReferenceEqualityComparer.Instance);
@@ -132,36 +136,196 @@ public static SKTypeface CreateTypeface(string fontFamily, SKFontStyle fontStyle
 
         foreach (var family in families)
         {
-            var normalized = family.Trim('\'', '"', ' ');
+            if (TryResolveFamily(family, fontStyle, faces, requestedWeight, out var typeface))
+            {
+                return typeface;
+            }
+        }
+
+        return GetDefaultTypeface(isBold);
+    }
+
+    /// <summary>
+    /// Resolves one entry of a <c>font-family</c> list, or reports that it is unavailable.
+    /// </summary>
+    private static bool TryResolveFamily(string family, SKFontStyle fontStyle, FontFaceSet faces, float requestedWeight, out SKTypeface typeface)
+    {
+        var normalized = family.Trim('\'', '"', ' ');
+        var isBold = fontStyle.Weight >= (int)SKFontStyleWeight.Bold;
+        var isItalic = fontStyle.Slant != SKFontStyleSlant.Upright;
+
+        if (string.IsNullOrWhiteSpace(normalized))
+        {
+            typeface = null!;
+            return false;
+        }
+
+        // Generic names are keywords, so they always mean the bundled fonts and cannot be
+        // taken over by an @font-face declaration.
+        if (GenericFontMappings.TryGetValue(normalized, out var bundledFamilyKey) &&
+            BundledFonts.Value.TryGetValue(bundledFamilyKey, out var bundledFamily))
+        {
+            typeface = isBold ? bundledFamily.Bold : bundledFamily.Regular;
+            return true;
+        }
+
+        // A declared face takes precedence over an installed font of the same name.
+        if (!faces.IsEmpty &&
+            faces.TryMatch(normalized, requestedWeight, isItalic, out var face) &&
+            TryResolveFaceTypeface(face, fontStyle, out typeface))
+        {
+            return true;
+        }
+
+        return TryResolveSystemTypeface(normalized, fontStyle, out typeface);
+    }
+
+    /// <summary>
+    /// The typeface that draws a character the font's own typeface has no glyph for (CSS Fonts 4
+    /// §5.1): the next entry of the <c>font-family</c> list that has it, then the bundled fonts,
+    /// then whatever the host offers for it. Only the last step depends on the installed fonts,
+    /// and only for characters none of the bundled fonts cover.
+    /// </summary>
+    private static SKTypeface ResolveFallbackTypeface(RenderFont font, SKTypeface primary, int codepoint)
+    {
+        var fontStyle = CreateFontStyle(font.FontWeight, font.IsItalic, font.FontStretch);
+        var faces = font.Faces ?? FontFaceSet.Empty;
 
-            if (string.IsNullOrWhiteSpace(normalized))
+        foreach (var family in font.FontFamily.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            if (TryResolveFamily(family, fontStyle, faces, font.FontWeight, out var typeface) && HasGlyph(typeface, codepoint))
             {
-                continue;
+                return typeface;
             }
+        }
+
+        var isBold = fontStyle.Weight >= (int)SKFontStyleWeight.Bold;
+
+        foreach (var bundledFamily in BundledFonts.Value.Values)
+        {
+            var typeface = isBold ? bundledFamily.Bold : bundledFamily.Regular;
 
-            // Generic names are keywords, so they always mean the bundled fonts and cannot be
-            // taken over by an @font-face declaration.
-            if (GenericFontMappings.TryGetValue(normalized, out var bundledFamilyKey) &&
-                BundledFonts.Value.TryGetValue(bundledFamilyKey, out var bundledFamily))
+            if (HasGlyph(typeface, codepoint))
             {
-                return isBold ? bundledFamily.Bold : bundledFamily.Regular;
+                return typeface;
             }
+        }
+
+        var hostFallback = CharacterFallbacks.GetOrAdd((codepoint, fontStyle.Weight, fontStyle.Width, fontStyle.Slant), static key =>
+        {
+            var match = SKFontManager.Default.MatchCharacter(null, new SKFontStyle(key.Weight, key.Width, key.Slant), null, key.Codepoint);
+            return match is not null && HasGlyph(match, key.Codepoint) ? match : null;
+        });
+
+        return hostFallback ?? primary;
+    }
+
+    private static bool HasGlyph(SKTypeface typeface, int codepoint) => typeface.GetGlyph(codepoint) != 0;
+
+    /// <summary>
+    /// Splits text into runs that each draw with one typeface: the paint's own where it has the
+    /// glyphs, a fallback (<see cref="ResolveFallbackTypeface"/>) where it does not. Returns
+    /// <see langword="null"/> when the paint's typeface covers the whole text, the common case.
+    /// </summary>
+    private static List<(string Text, SKTypeface Typeface)>? SplitFallbackRuns(SKPaint paint, string text, RenderFont? font)
+    {
+        var primary = paint.Typeface;
+
+        if (font is null || primary is null || primary.ContainsGlyphs(text))
+        {
+            return null;
+        }
+
+        var runs = new List<(string Text, SKTypeface Typeface)>();
+        var builder = new StringBuilder();
+        SKTypeface? current = null;
+
+        foreach (var rune in text.EnumerateRunes())
+        {
+            // Spaces and controls stay with the run they are in rather than splitting it.
+            var typeface = current is not null && (Rune.IsWhiteSpace(rune) || Rune.IsControl(rune)) ? current :
+                HasGlyph(primary, rune.Value) || Rune.IsWhiteSpace(rune) || Rune.IsControl(rune) ? primary :
+                ResolveFallbackTypeface(font.Value, primary, rune.Value);
 
-            // A declared face takes precedence over an installed font of the same name.
-            if (!faces.IsEmpty &&
-                faces.TryMatch(normalized, requestedWeight, isItalic, out var face) &&
-                TryResolveFaceTypeface(face, fontStyle, out var faceTypeface))
+            if (current is not null && !ReferenceEquals(typeface, current))
             {
-                return faceTypeface;
+                runs.Add((builder.ToString(), current));
+                builder.Clear();
             }
 
-            if (TryResolveSystemTypeface(normalized, fontStyle, out var typeface))
+            current = typeface;
+            builder.Append(rune.ToString());
+        }
+
+        if (current is not null)
+        {
+            runs.Add((builder.ToString(), current));
+        }
+
+        return runs;
+    }
+
+    /// <summary>
+    /// A copy of <paramref name="paint"/> drawing with another typeface, slanted synthetically
+    /// when the font asks for italics the typeface does not have.
+    /// </summary>
+    private static SKPaint CreateFallbackPaint(SKPaint paint, SKTypeface typeface, RenderFont font)
+    {
+        var fallbackPaint = paint.Clone();
+        fallbackPaint.Typeface = typeface;
+        fallbackPaint.TextSkewX = font.IsItalic && typeface.FontSlant == SKFontStyleSlant.Upright ? -0.25f : 0f;
+        return fallbackPaint;
+    }
+
+    /// <summary>
+    /// Draws text the way <see cref="MeasureTextWidth"/> measures it: per fallback run, and
+    /// character by character when letter spacing is in play.
+    /// </summary>
+    public static void DrawText(SKCanvas canvas, SKPaint paint, string text, float x, float y, float letterSpacing, RenderFont? font = null)
+    {
+        if (SplitFallbackRuns(paint, text, font) is not { } runs)
+        {
+            DrawSingleTypefaceText(canvas, paint, text, x, y, letterSpacing);
+            return;
+        }
+
+        var cursorX = x;
+
+        foreach (var (runText, typeface) in runs)
+        {
+            var runPaint = ReferenceEquals(typeface, paint.Typeface) ? paint : CreateFallbackPaint(paint, typeface, font!.Value);
+
+            try
             {
-                return typeface;
+                DrawSingleTypefaceText(canvas, runPaint, runText, cursorX, y, letterSpacing);
+                cursorX += MeasureSingleTypefaceText(runPaint, runText, letterSpacing) + (letterSpacing > 0f ? letterSpacing : 0f);
+            }
+            finally
+            {
+                if (!ReferenceEquals(runPaint, paint))
+                {
+                    runPaint.Dispose();
+                }
             }
         }
+    }
 
-        return GetDefaultTypeface(isBold);
+    private static void DrawSingleTypefaceText(SKCanvas canvas, SKPaint paint, string text, float x, float y, float letterSpacing)
+    {
+        if (letterSpacing <= 0f)
+        {
+            canvas.DrawText(text, x, y, paint);
+            return;
+        }
+
+        var cursorX = x;
+
+        foreach (var character in text)
+        {
+            var glyph = character.ToString();
+            canvas.DrawText(glyph, cursorX, y, paint);
+            cursorX += paint.MeasureText(glyph) + letterSpacing;
+        }
     }
 
     /// <summary>
@@ -269,7 +433,34 @@ private static IReadOnlyDictionary<string, string> CreateSystemFontFamilyIndex()
     /// Measures the advance width, mirroring how the backend lays glyphs out when letter
     /// spacing is in play.
     /// </summary>
-    public static float MeasureTextWidth(SKPaint paint, string text, float letterSpacing)
+    public static float MeasureTextWidth(SKPaint paint, string text, float letterSpacing, RenderFont? font = null)
+    {
+        if (SplitFallbackRuns(paint, text, font) is not { } runs)
+        {
+            return MeasureSingleTypefaceText(paint, text, letterSpacing);
+        }
+
+        var width = 0f;
+
+        foreach (var (runText, typeface) in runs)
+        {
+            if (ReferenceEquals(typeface, paint.Typeface))
+            {
+                width += MeasureSingleTypefaceText(paint, runText, letterSpacing);
+            }
+            else
+            {
+                using var runPaint = CreateFallbackPaint(paint, typeface, font!.Value);
+                width += MeasureSingleTypefaceText(runPaint, runText, letterSpacing);
+            }
+
+            width += letterSpacing > 0f ? letterSpacing : 0f;
+        }
+
+        return letterSpacing > 0f ? width - letterSpacing : width;
+    }
+
+    private static float MeasureSingleTypefaceText(SKPaint paint, string text, float letterSpacing)
     {
         if (letterSpacing <= 0f)
         {
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
index 6bb8870..2c4e38d 100644
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@@ -2,7 +2,7 @@
   <PropertyGroup>
     <Description>Adds rendering functionality to the core AngleSharp library.</Description>
     <Product>AngleSharp.Renderer</Product>
-    <Version>0.7.0</Version>
+    <Version>0.8.1</Version>
     <Nullable>enable</Nullable>
     <LangVersion>latest</LangVersion>
     <SignAssembly>true</SignAssembly>