--- a/plugins/single_plugins/meson.build
+++ b/plugins/single_plugins/meson.build
@@ -2,7 +2,7 @@
   'move', 'resize', 'command', 'autostart', 'vswipe', 'wrot', 'expo',
   'switcher', 'fast-switcher', 'oswitch', 'place', 'invert',
   'zoom', 'alpha', 'idle', 'extra-gestures', 'preserve-output',
-  'wsets', 'xkb-bindings',
+  'wsets', 'xkb-bindings', 'output-control',
 ]
 
 all_include_dirs = [wayfire_api_inc, wayfire_conf_inc, plugins_common_inc, vswitch_inc, wobbly_inc, grid_inc, ipc_include_dirs]
--- a/metadata/meson.build
+++ b/metadata/meson.build
@@ -24,6 +24,7 @@
 install_data('move.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
 install_data('oswitch.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
 install_data('output.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
+install_data('output-control.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
 install_data('place.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
 install_data('preserve-output.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
 install_data('resize.xml', install_dir: conf_data.get('PLUGIN_XML_DIR'))
--- a/plugins/grid/grid.cpp
+++ b/plugins/grid/grid.cpp
@@ -1,6 +1,8 @@
 #include <wayfire/per-output-plugin.hpp>
 #include <wayfire/output.hpp>
 #include <wayfire/output-stitch.hpp>
+#include <wayfire/output-layout.hpp>
+#include <wayfire/config-backend.hpp>
 #include <wayfire/seat.hpp>
 #include <wayfire/core.hpp>
 #include <wayfire/view.hpp>
@@ -118,9 +120,23 @@
                         // Inset each physical region, including the internal seams.
                         // Clamp independently so even a small region stays usable.
                         auto& g = zone.geometry;
-                        double gx = std::clamp<double>(zone_gap, 0,
+                        int gap = zone_gap;
+                        for (auto& [head, state] : wf::get_core().output_layout->get_current_configuration())
+                        {
+                            if (name == head->name)
+                            {
+                                auto section = wf::get_core().config_backend->get_output_section(head);
+                                if (auto opt = section->get_option_or("zone_gap"))
+                                {
+                                    int local_gap = std::stoi(opt->get_value_str());
+                                    if (local_gap >= 0) gap = local_gap;
+                                }
+                                break;
+                            }
+                        }
+                        double gx = std::clamp<double>(gap, 0,
                             std::max(0.0, std::floor((g.width - 1) / 2)));
-                        double gy = std::clamp<double>(zone_gap, 0,
+                        double gy = std::clamp<double>(gap, 0,
                             std::max(0.0, std::floor((g.height - 1) / 2)));
                         g.x += gx;
                         g.y += gy;
--- a/metadata/output.xml
+++ b/metadata/output.xml
@@ -7,6 +7,13 @@
     </option>
     <option name="position" type="output::position">
       <default>auto</default>
+    </option>
+    <option name="zone_gap" type="int">
+      <_short>Physical monitor zone gap</_short>
+      <_long>Outer gap for Grid windows constrained to this monitor inside a combined output. -1 inherits grid/zone_gap. Does not affect ordinary maximize or fullscreen.</_long>
+      <default>-1</default>
+      <min>-1</min>
+      <max>1000</max>
     </option>
     <option name="masked" type="bool">
       <_short>Hide from desktop, keep signal active</_short>
--- /dev/null
+++ b/plugins/single_plugins/output-control.cpp
@@ -0,0 +1,507 @@
+// Display settings transactions for WCM. The compositor owns the timeout;
+// unconfirmed settings are never written to disk.
+#include <wayfire/plugin.hpp>
+#include <wayfire/core.hpp>
+#include <wayfire/output.hpp>
+#include <wayfire/output-layout.hpp>
+#include <wayfire/output-stitch.hpp>
+#include <wayfire/config-backend.hpp>
+#include <wayfire/config/config-manager.hpp>
+#include <wayfire/signal-definitions.hpp>
+#include <wayfire/util.hpp>
+#include <wayfire/plugins/common/shared-core-data.hpp>
+#include <wayfire/plugins/ipc/ipc-method-repository.hpp>
+#include <wayfire/plugins/ipc/ipc-helpers.hpp>
+#include <wayfire/nonstd/wlroots-full.hpp>
+#include <fstream>
+#include <sstream>
+#include <set>
+#include <map>
+#include <chrono>
+#include <filesystem>
+#include <sys/stat.h>
+#include <sys/random.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+namespace
+{
+using values_t = std::map<std::string, std::string>;
+std::string trim(std::string s)
+{
+    auto b = s.find_first_not_of(" \t\r\n");
+    return b == s.npos ? "" : s.substr(b, s.find_last_not_of(" \t\r\n") - b + 1);
+}
+
+std::string read_file(const std::string& path)
+{
+    std::ifstream f(path);
+    if (!f) throw std::runtime_error("Cannot read Wayfire configuration: " + path);
+    return {std::istreambuf_iterator<char>(f), {}};
+}
+
+// Preserve comments, unrelated sections, and options owned by other tools.
+std::string patch_ini(const std::string& text, values_t pending)
+{
+    std::istringstream input(text);
+    std::string section, line, result;
+    auto flush = [&] ()
+    {
+        for (auto it = pending.begin(); it != pending.end();)
+        {
+            auto slash = it->first.find('/');
+            if (it->first.substr(0, slash) == section)
+            {
+                result += it->first.substr(slash + 1) + " = " + it->second + "\n";
+                it = pending.erase(it);
+            } else ++it;
+        }
+    };
+    std::set<std::string> seen;
+    while (std::getline(input, line))
+    {
+        auto stripped = trim(line);
+        if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']')
+        {
+            flush();
+            section = stripped.substr(1, stripped.size() - 2);
+        } else if (!stripped.empty() && stripped[0] != '#' && stripped[0] != ';')
+        {
+            auto eq = line.find('=');
+            if (eq != line.npos)
+            {
+                auto key = section + "/" + trim(line.substr(0, eq));
+                if (!seen.insert(key).second) throw std::runtime_error("Duplicate option in configuration: " + key);
+                auto it = pending.find(key);
+                if (it != pending.end())
+                {
+                    line = trim(line.substr(0, eq)) + " = " + it->second;
+                    pending.erase(it);
+                }
+            }
+        }
+        result += line + "\n";
+    }
+    flush();
+    while (!pending.empty())
+    {
+        section = pending.begin()->first.substr(0, pending.begin()->first.find('/'));
+        result += "\n[" + section + "]\n";
+        flush();
+    }
+    return result;
+}
+
+void save_atomic(const std::string& path, const std::string& original, const std::string& text)
+{
+    struct stat st;
+    if (lstat(path.c_str(), &st) || !S_ISREG(st.st_mode) || st.st_uid != getuid())
+        throw std::runtime_error("Configuration must be a regular file owned by this user");
+    std::string tmp = path + ".displays-XXXXXX";
+    int fd = mkstemp(tmp.data());
+    if (fd < 0) throw std::runtime_error("Cannot create configuration temporary file");
+    try
+    {
+        if (fchmod(fd, st.st_mode & 0777)) throw std::runtime_error("Cannot preserve configuration permissions");
+        size_t offset = 0;
+        while (offset < text.size())
+        {
+            auto n = write(fd, text.data() + offset, text.size() - offset);
+            if (n < 0 && errno == EINTR) continue;
+            if (n <= 0) throw std::runtime_error("Cannot write configuration");
+            offset += n;
+        }
+        if (fsync(fd)) throw std::runtime_error("Cannot sync configuration");
+        if (read_file(path) != original) throw std::runtime_error("Configuration changed in another application; refresh and try again");
+        if (rename(tmp.c_str(), path.c_str())) throw std::runtime_error("Cannot replace configuration");
+        close(fd);
+        int dir = open(std::filesystem::path(path).parent_path().c_str(), O_DIRECTORY | O_RDONLY | O_CLOEXEC);
+        if (dir >= 0) { fsync(dir); close(dir); }
+    } catch (...) { close(fd); unlink(tmp.c_str()); throw; }
+}
+}
+
+class output_control_t : public wf::plugin_interface_t
+{
+    wf::shared_data::ref_ptr_t<wf::ipc::method_repository_t> repository;
+    wf::wl_timer<false> timer;
+    values_t before, candidate;
+    std::string token, original_file, config_path;
+    std::set<std::string> original_heads;
+    std::chrono::steady_clock::time_point deadline;
+    const std::vector<std::string> globals = {"core/stitch_enabled", "core/stitch_outputs",
+        "core/default_output", "grid/zone_gap", "grid/zone_shift", "grid/zone_maximize", "move/activate_zone"};
+    const std::vector<std::string> head_options = {"mode", "position", "scale", "transform", "masked", "vrr", "hdr", "depth", "zone_gap"};
+
+    auto option(const std::string& name) { return wf::get_core().config->get_option(name); }
+    std::string get(const std::string& name)
+    {
+        auto p = option(name);
+        if (!p) throw std::runtime_error("Missing display metadata for " + name + "; install the matching Wayfire package");
+        return p->get_value_str();
+    }
+    std::string value(const values_t& changes, const std::string& name)
+    {
+        auto it = changes.find(name); return it == changes.end() ? get(name) : it->second;
+    }
+
+    bool is_virtual(wlr_output *head)
+    {
+        auto output = wf::get_core().output_layout->find_output(head);
+        return output && output->get_data<wf::output_stitch_layout_t>();
+    }
+
+    std::map<std::string, wlr_output*> heads()
+    {
+        std::map<std::string, wlr_output*> result;
+        for (auto& [head, state] : wf::get_core().output_layout->get_current_configuration())
+            if (!is_virtual(head)) result[head->name] = head;
+        return result;
+    }
+
+    std::string prefix(wlr_output *head)
+    {
+        auto section = wf::get_core().config_backend->get_output_section(head);
+        // A live metadata upgrade must also populate existing output sections.
+        if (!section->get_option_or("zone_gap"))
+        {
+            auto prototype = wf::get_core().config->get_section("output")->get_option_or("zone_gap");
+            if (prototype) section->register_new_option(prototype->clone_option());
+        }
+        return section->get_name() + "/";
+    }
+
+    values_t settings()
+    {
+        values_t result;
+        for (auto& key : globals) result[key] = get(key);
+        for (auto& [name, head] : heads())
+            for (auto& key : head_options) result[prefix(head) + key] = get(prefix(head) + key);
+        return result;
+    }
+
+    std::string revision()
+    {
+        std::string text;
+        for (auto& [k, v] : settings()) text += k + "=" + v + "\n";
+        for (auto& [name, head] : heads())
+            text += name + ":" + std::to_string(head->width) + ":" + std::to_string(head->height) +
+                ":" + std::to_string(head->refresh) + ":" + std::to_string(head->enabled) + "\n";
+        text += read_file(config_path);
+        return std::to_string(std::hash<std::string>{}(text));
+    }
+
+    wf::json_t snapshot()
+    {
+        wf::json_t result = wf::ipc::json_ok();
+        result["version"] = 1;
+        result["revision"] = revision();
+        result["config_file"] = config_path;
+        result["pending"] = !token.empty();
+        result["seconds_left"] = token.empty() ? 0 : std::max(0, (int)std::chrono::duration_cast<std::chrono::seconds>(deadline - std::chrono::steady_clock::now()).count());
+        wf::json_t opts;
+        for (auto& [k, v] : settings()) opts[k] = v;
+        result["options"] = opts;
+        auto physical = wf::json_t::array();
+        for (auto& [name, head] : heads())
+        {
+            wf::json_t item;
+            item["name"] = name;
+            item["description"] = head->description ? head->description : name.c_str();
+            item["prefix"] = prefix(head);
+            item["enabled"] = head->enabled;
+            item["width"] = head->width; item["height"] = head->height; item["refresh"] = head->refresh;
+            auto modes = wf::json_t::array();
+            wlr_output_mode *mode;
+            wl_list_for_each(mode, &head->modes, link)
+            {
+                wf::json_t m;
+                m["width"] = mode->width; m["height"] = mode->height; m["refresh"] = mode->refresh;
+                modes.append(m);
+            }
+            item["modes"] = modes;
+            physical.append(item);
+        }
+        result["physical"] = physical;
+        auto desktops = wf::json_t::array();
+        auto configured = wf::get_core().output_layout->get_current_configuration();
+        for (auto output : wf::get_core().output_layout->get_outputs())
+        {
+            // NOOP can coexist briefly during transitions; it is an internal
+            // fallback, not a selectable desktop or a physical monitor.
+            if (!configured.count(output->handle)) continue;
+            wf::json_t item;
+            item["name"] = output->handle->name;
+            auto g = output->get_layout_geometry();
+            item["x"] = g.x; item["y"] = g.y; item["width"] = g.width; item["height"] = g.height;
+            auto members = wf::json_t::array();
+            if (auto group = output->get_data<wf::output_stitch_layout_t>())
+                for (auto& zone : group->zones) members.append(zone.name);
+            item["members"] = members;
+            desktops.append(item);
+        }
+        result["desktops"] = desktops;
+        return result;
+    }
+
+    std::vector<std::string> members(const values_t& changes)
+    {
+        std::vector<std::string> result;
+        if (value(changes, "core/stitch_enabled") == "true")
+        {
+            std::istringstream input(value(changes, "core/stitch_outputs")); std::string name;
+            while (input >> name) result.push_back(name);
+        }
+        return result;
+    }
+
+    // Validation is compositor-side, before touching runtime options. The
+    // backend also tests every physical state through the existing layout API.
+    wf::output_configuration_t validate(const values_t& changes)
+    {
+        if (get("workarounds/use_external_output_configuration") == "true")
+            throw std::runtime_error("Disable external output configuration before using Displays");
+        auto allowed = settings();
+        for (auto& [key, v] : changes)
+        {
+            if (!allowed.count(key) || v.find_first_of("\r\n") != v.npos)
+                throw std::runtime_error("Unsupported display setting: " + key);
+            auto p = option(key);
+            if (p->is_locked()) throw std::runtime_error("Another controller has locked " + key);
+            auto copy = p->clone_option();
+            if (!copy->set_value_str(v)) throw std::runtime_error("Invalid value for " + key);
+        }
+        auto config = wf::get_core().output_layout->get_current_configuration();
+        auto connected = heads();
+        auto group = members(changes);
+        std::set<std::string> selected(group.begin(), group.end());
+        if (value(changes, "core/stitch_enabled") == "true" && (group.size() < 2 || selected.size() != group.size()))
+            throw std::runtime_error("Select at least two different monitors to combine");
+        for (auto& name : selected) if (!connected.count(name)) throw std::runtime_error("Monitor disconnected: " + name);
+        int desktop_count = 0, width = 0, height = 0, refresh = 0;
+        std::set<std::string> desktop_names;
+        for (auto& [name, head] : connected)
+        {
+            auto pre = prefix(head);
+            int local_gap = std::stoi(value(changes, pre + "zone_gap"));
+            if (local_gap < -1 || local_gap > 1000) throw std::runtime_error("Physical zone gaps must be -1 (inherit) or between 0 and 1000 pixels");
+            auto& state = config.at(head);
+            auto mode = wf::option_type::from_string<wf::output_config::mode_t>(value(changes, pre + "mode"));
+            if (!mode) throw std::runtime_error("Invalid display mode for " + name);
+            state.source = mode->get_type() == wf::output_config::MODE_OFF ? wf::OUTPUT_IMAGE_SOURCE_NONE :
+                value(changes, pre + "masked") == "true" ? wf::OUTPUT_IMAGE_SOURCE_MASKED : wf::OUTPUT_IMAGE_SOURCE_SELF;
+            if (mode->get_type() == wf::output_config::MODE_MIRROR)
+                throw std::runtime_error("Separate ordinary mirrors before editing them in Displays");
+            if (mode->get_type() == wf::output_config::MODE_RESOLUTION)
+            {
+                wlr_output_mode *m, *found = nullptr;
+                wl_list_for_each(m, &head->modes, link)
+                    if (m->width == mode->get_width() && m->height == mode->get_height() &&
+                        (!mode->get_refresh() || std::abs(m->refresh - mode->get_refresh()) <= 500))
+                        if (!found || m->refresh > found->refresh) found = m;
+                if (found) state.mode = *found;
+                else if (wl_list_empty(&head->modes) && mode->get_width() > 0 && mode->get_height() > 0)
+                {
+                    state.mode.width = mode->get_width(); state.mode.height = mode->get_height();
+                    state.mode.refresh = mode->get_refresh() ?: 60000;
+                } else throw std::runtime_error("Mode is not advertised by " + name);
+            } else if (mode->get_type() != wf::output_config::MODE_OFF)
+            {
+                wlr_output_mode *m, *found = nullptr;
+                wl_list_for_each(m, &head->modes, link)
+                {
+                    if (!found) found = m;
+                    if (mode->get_type() == wf::output_config::MODE_AUTO && m->preferred) { found = m; break; }
+                    if (mode->get_type() == wf::output_config::MODE_HIGHRR && m->refresh > found->refresh) found = m;
+                    if (mode->get_type() == wf::output_config::MODE_HIGHRES && m->width * m->height > found->width * found->height) found = m;
+                }
+                if (found) state.mode = *found;
+            }
+            state.position = *wf::option_type::from_string<wf::output_config::position_t>(value(changes, pre + "position"));
+            state.scale = std::stod(value(changes, pre + "scale"));
+            if (!std::isfinite(state.scale) || state.scale < .25 || state.scale > 8) throw std::runtime_error("Scale must be between 0.25 and 8");
+            const std::map<std::string, wl_output_transform> transforms = {{"normal", WL_OUTPUT_TRANSFORM_NORMAL},
+                {"90", WL_OUTPUT_TRANSFORM_90}, {"180", WL_OUTPUT_TRANSFORM_180}, {"270", WL_OUTPUT_TRANSFORM_270},
+                {"flipped", WL_OUTPUT_TRANSFORM_FLIPPED}, {"flipped-90", WL_OUTPUT_TRANSFORM_FLIPPED_90},
+                {"flipped-180", WL_OUTPUT_TRANSFORM_FLIPPED_180}, {"flipped-270", WL_OUTPUT_TRANSFORM_FLIPPED_270}};
+            auto t = transforms.find(value(changes, pre + "transform"));
+            if (t == transforms.end()) throw std::runtime_error("Unknown transform for " + name);
+            state.transform = t->second;
+            state.vrr = value(changes, pre + "vrr") == "true";
+            state.hdr = value(changes, pre + "hdr") == "true";
+            state.depth = std::stoi(value(changes, pre + "depth"));
+            if (state.source == wf::OUTPUT_IMAGE_SOURCE_SELF) { ++desktop_count; if (!selected.count(name)) desktop_names.insert(name); }
+            if (selected.count(name))
+            {
+                if (state.source != wf::OUTPUT_IMAGE_SOURCE_SELF || state.scale != 1 || state.transform || state.vrr || state.hdr || state.depth != 8 ||
+                    (height && height != state.mode.height) || (refresh && std::abs(refresh - state.mode.refresh) > 500))
+                    throw std::runtime_error("Combined monitors need matching heights and refresh rates, scale 1, normal rotation, SDR/8-bit, and fixed refresh");
+                height = state.mode.height; refresh = refresh ?: state.mode.refresh;
+                int limit = std::stoi(get("workarounds/max_buffer_size"));
+                if (state.mode.width <= 0 || height <= 0 || refresh <= 0 || state.mode.width > limit - width || height > limit)
+                    throw std::runtime_error("Combined desktop exceeds the renderer's supported size");
+                width += state.mode.width;
+            }
+        }
+        if (!desktop_count) throw std::runtime_error("Keep at least one monitor available to the desktop");
+        if (!group.empty()) desktop_names.insert("VIRTUAL-1");
+        auto destination = value(changes, "core/default_output");
+        if (!destination.empty() && !desktop_names.count(destination)) throw std::runtime_error("Default window destination must be an active desktop output");
+        int gap = std::stoi(value(changes, "grid/zone_gap"));
+        if (gap < 0 || gap > 1000) throw std::runtime_error("Zone gaps must be between 0 and 1000 pixels");
+        // output_layout::test_state is a stub in this Wayfire release. Test
+        // physical heads directly instead of mistaking that stub for validation.
+        for (auto& [name, head] : connected)
+        {
+            auto& state = config.at(head);
+            wlr_output_state pending;
+            wlr_output_state_init(&pending);
+            bool enabled = state.source != wf::OUTPUT_IMAGE_SOURCE_NONE;
+            wlr_output_state_set_enabled(&pending, enabled);
+            if (enabled)
+            {
+                int limit = std::stoi(get("workarounds/max_buffer_size"));
+                if (state.mode.width <= 0 || state.mode.height <= 0 || state.mode.width > limit || state.mode.height > limit)
+                {
+                    wlr_output_state_finish(&pending);
+                    throw std::runtime_error("Mode exceeds the renderer's supported size: " + name);
+                }
+                wlr_output_mode *m, *found = nullptr;
+                wl_list_for_each(m, &head->modes, link)
+                    if (m->width == state.mode.width && m->height == state.mode.height && m->refresh == state.mode.refresh) found = m;
+                if (found) wlr_output_state_set_mode(&pending, found);
+                else wlr_output_state_set_custom_mode(&pending, state.mode.width, state.mode.height, state.mode.refresh);
+                wlr_output_state_set_scale(&pending, state.scale);
+                wlr_output_state_set_transform(&pending, state.transform);
+                wlr_output_state_set_adaptive_sync_enabled(&pending, state.vrr);
+            }
+            bool ok = wlr_output_test_state(head, &pending);
+            wlr_output_state_finish(&pending);
+            if (!ok) throw std::runtime_error("The display backend rejected the configuration for " + name);
+        }
+        return config;
+    }
+
+    void reload() { wf::reload_config_signal ev; wf::get_core().emit(&ev); }
+    void rollback()
+    {
+        if (token.empty()) return;
+        timer.disconnect();
+        for (auto& [key, v] : before) { option(key)->set_value_str(v); option(key)->set_locked(false); }
+        token.clear(); before.clear(); candidate.clear();
+        // Honor unrelated edits made by other tools during the preview.
+        wf::get_core().config_backend->reload_config(*wf::get_core().config);
+        reload();
+    }
+
+    wf::json_t begin(const wf::json_t& data)
+    {
+        if (!token.empty()) throw std::runtime_error("A display preview is already awaiting confirmation");
+        if (wf::ipc::json_get_string(data, "revision") != revision()) throw std::runtime_error("Displays or configuration changed; refresh before applying");
+        wf::json_t changes = data["options"];
+        if (!changes.is_object() || changes.get_member_names().empty()) throw std::runtime_error("No display settings to apply");
+        values_t requested;
+        for (auto& key : changes.get_member_names()) requested[key] = wf::ipc::json_get_string(changes, key);
+        auto expected = validate(requested);
+        // A topology change may destroy the old virtual wlr_output. Never keep
+        // that pointer across reload; only physical heads survive this call.
+        for (auto it = expected.begin(); it != expected.end();)
+            if (is_virtual(it->first)) it = expected.erase(it); else ++it;
+        original_file = read_file(config_path);
+        // Check that serialization is possible before changing any outputs.
+        patch_ini(original_file, requested);
+        original_heads.clear(); for (auto& [name, head] : heads()) original_heads.insert(name);
+        uint64_t random;
+        if (getrandom(&random, sizeof random, 0) != sizeof random) throw std::runtime_error("Cannot create transaction token");
+        token = std::to_string(random);
+        candidate = requested;
+        for (auto& [key, v] : requested) { before[key] = get(key); option(key)->set_locked(true); option(key)->set_value_str(v); }
+        deadline = std::chrono::steady_clock::now() + std::chrono::seconds(20);
+        timer.set_timeout(20000, [this] () { rollback(); });
+        reload();
+        // Core can reject group buffer allocation or a physical commit. Verify
+        // the realized result before offering Keep Changes.
+        auto now = wf::get_core().output_layout->get_current_configuration();
+        for (auto& [head, state] : expected)
+        {
+            if (!original_heads.count(head->name)) continue;
+            if (!now.count(head) || (state.source != wf::OUTPUT_IMAGE_SOURCE_NONE &&
+                (head->width != state.mode.width || head->height != state.mode.height || std::abs(head->refresh - state.mode.refresh) > 500)))
+                throw std::runtime_error("A monitor did not accept the requested mode; reverted");
+        }
+        auto wanted_members = members(requested);
+        auto virtual_output = wf::get_core().output_layout->find_output("VIRTUAL-1");
+        if (!wanted_members.empty())
+        {
+            auto layout = virtual_output ? virtual_output->get_data<wf::output_stitch_layout_t>() : nullptr;
+            std::vector<std::string> actual;
+            if (layout) for (auto& zone : layout->zones) actual.push_back(zone.name);
+            if (actual != wanted_members) throw std::runtime_error("The combined desktop could not be created as requested; reverted");
+        } else if (virtual_output && virtual_output->get_data<wf::output_stitch_layout_t>())
+            throw std::runtime_error("The desktop could not be separated; reverted");
+        for (auto& [head, state] : expected)
+        {
+            auto actual = now.at(head).source;
+            if ((state.source == wf::OUTPUT_IMAGE_SOURCE_NONE && head->enabled) ||
+                (state.source == wf::OUTPUT_IMAGE_SOURCE_MASKED && (actual != wf::OUTPUT_IMAGE_SOURCE_MASKED || !head->enabled)) ||
+                (state.source == wf::OUTPUT_IMAGE_SOURCE_SELF && actual != wf::OUTPUT_IMAGE_SOURCE_SELF &&
+                    !(actual == wf::OUTPUT_IMAGE_SOURCE_MIRROR && std::find(wanted_members.begin(), wanted_members.end(), head->name) != wanted_members.end())))
+                throw std::runtime_error("A monitor did not accept its requested desktop role; reverted");
+        }
+        auto result = wf::ipc::json_ok(); result["token"] = token; result["timeout"] = 20; return result;
+    }
+
+    wf::json_t confirm(const wf::json_t& data)
+    {
+        if (token.empty() || wf::ipc::json_get_string(data, "token") != token) throw std::runtime_error("Display preview expired or belongs to another window");
+        std::set<std::string> current; for (auto& [name, head] : heads()) current.insert(name);
+        if (current != original_heads) throw std::runtime_error("Monitors changed during preview; reverted");
+        for (auto& [k, v] : candidate)
+        {
+            auto copy = option(k)->clone_option(); copy->set_value_str(v);
+            if (get(k) != copy->get_value_str()) throw std::runtime_error("Display settings changed during preview; reverted");
+        }
+        save_atomic(config_path, original_file, patch_ini(original_file, candidate));
+        timer.disconnect();
+        for (auto& [k, v] : before) option(k)->set_locked(false);
+        token.clear(); before.clear(); candidate.clear();
+        return snapshot();
+    }
+
+  public:
+    void init() override
+    {
+        config_path = getenv("WAYFIRE_CONFIG_FILE") ?: "";
+        for (auto method : {"get", "apply", "confirm", "revert"})
+        {
+            std::string name = method;
+            repository->register_method("displays/" + name, [this, name] (wf::json_t data)
+            {
+                bool was_pending = !token.empty();
+                try
+                {
+                    if (name == "get") return snapshot();
+                    if (name == "apply") return begin(data);
+                    if (name == "confirm") return confirm(data);
+                    if (token.empty() || wf::ipc::json_get_string(data, "token") != token) throw std::runtime_error("No matching display preview");
+                    rollback(); return snapshot();
+                } catch (const std::exception& error)
+                {
+                    if (name == "apply" && !was_pending && !token.empty()) rollback();
+                    // A rejected request must not cancel another client's preview.
+                    if ((name == "confirm" || name == "revert") && data.has_member("token") &&
+                        data["token"].is_string() && data["token"].as_string() == token) rollback();
+                    return wf::ipc::json_error(error.what());
+                }
+            });
+        }
+    }
+
+    void fini() override
+    {
+        rollback();
+        for (auto method : {"get", "apply", "confirm", "revert"}) repository->unregister_method(std::string("displays/") + method);
+    }
+};
+
+DECLARE_WAYFIRE_PLUGIN(output_control_t);
--- /dev/null
+++ b/metadata/output-control.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<wayfire>
+  <plugin name="output-control">
+    <_short>Display configuration</_short>
+    <_long>Display management for WCM with compositor-owned timed rollback.</_long>
+    <category>General</category>
+  </plugin>
+</wayfire>