diff --git a/CHANGELOG.md b/CHANGELOG.md
index db2ddee..56ef6e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.1
+
+**New**
+
+- Spread attributes in markup, `<button {...rest}>` and `<Inner {...rest} />`, lowered to Solid's spread and `merge`:
+  later attributes override, and each field keeps updating (07 §4, S-surface-5).
+
 ## 0.3.0
 
 `@reactivescript/compiler`, `@reactivescript/runtime`, `@reactivescript/language-server` and the editor extension,
diff --git a/compiler/Cargo.lock b/compiler/Cargo.lock
index a90b32d..3b40829 100644
--- a/compiler/Cargo.lock
+++ b/compiler/Cargo.lock
@@ -988,7 +988,7 @@ dependencies = [
 
 [[package]]
 name = "reactivescript"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "indexmap",
  "napi",
diff --git a/compiler/Cargo.toml b/compiler/Cargo.toml
index cd8e5eb..8ac3e98 100644
--- a/compiler/Cargo.toml
+++ b/compiler/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "reactivescript"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 description = "ReactiveScript's compiler (spec/11): parse, check, resolve, and lower through Solid's solidjs-compiler"
 license = "MIT"
diff --git a/compiler/npm/darwin-arm64/package.json b/compiler/npm/darwin-arm64/package.json
index fa5849f..4b6ff03 100644
--- a/compiler/npm/darwin-arm64/package.json
+++ b/compiler/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-darwin-arm64",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "cpu": [
     "arm64"
   ],
diff --git a/compiler/npm/darwin-x64/package.json b/compiler/npm/darwin-x64/package.json
index 9413979..4270539 100644
--- a/compiler/npm/darwin-x64/package.json
+++ b/compiler/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-darwin-x64",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "cpu": [
     "x64"
   ],
diff --git a/compiler/npm/linux-arm64-gnu/package.json b/compiler/npm/linux-arm64-gnu/package.json
index 484f678..f32f11e 100644
--- a/compiler/npm/linux-arm64-gnu/package.json
+++ b/compiler/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-linux-arm64-gnu",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "cpu": [
     "arm64"
   ],
diff --git a/compiler/npm/linux-x64-gnu/package.json b/compiler/npm/linux-x64-gnu/package.json
index 0f40104..c5f566e 100644
--- a/compiler/npm/linux-x64-gnu/package.json
+++ b/compiler/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-linux-x64-gnu",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "cpu": [
     "x64"
   ],
diff --git a/compiler/npm/wasm32-wasi/package.json b/compiler/npm/wasm32-wasi/package.json
index 55017fd..eb0b61c 100644
--- a/compiler/npm/wasm32-wasi/package.json
+++ b/compiler/npm/wasm32-wasi/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-wasm32-wasi",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "main": "compiler.wasi.cjs",
   "browser": "compiler.wasi-browser.js",
   "files": [
diff --git a/compiler/npm/win32-x64-msvc/package.json b/compiler/npm/win32-x64-msvc/package.json
index 7c7f2b9..2c6f108 100644
--- a/compiler/npm/win32-x64-msvc/package.json
+++ b/compiler/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/compiler-win32-x64-msvc",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "cpu": [
     "x64"
   ],
diff --git a/compiler/package-lock.json b/compiler/package-lock.json
index ecceeb3..55c169d 100644
--- a/compiler/package-lock.json
+++ b/compiler/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@reactivescript/compiler",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@reactivescript/compiler",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "devDependencies": {
         "@emnapi/core": "^1.11.3",
diff --git a/compiler/package.json b/compiler/package.json
index 508db4f..fb156d9 100644
--- a/compiler/package.json
+++ b/compiler/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@reactivescript/compiler",
   "description": "ReactiveScript's compiler, in process through Node-API, and its front end for @solidjs/vite-plugin",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",
diff --git a/compiler/src/check.rs b/compiler/src/check.rs
index 2878a30..25a4c71 100644
--- a/compiler/src/check.rs
+++ b/compiler/src/check.rs
@@ -346,6 +346,16 @@ fn snapshot_reads<'a>(n: Node<'a>, caught: bool, locals: &mut HashSet<String>, o
     }
 }
 /// AC-3a: the submit buttons of a form's markup (a `<button>` without `type`, or `type="submit"`), not through components.
+/// 07 §4: a spread attribute (`{...e}`) passes every field: "*"
+fn field_of(name: &str) -> String {
+    if name == "..." { "*".into() } else { name.to_string() }
+}
+
+/// an argument as a message shows it: `x={…}`, or `{...…}` for a spread
+fn arg_show(field: &str) -> String {
+    if field == "*" { "{...…}".into() } else { format!("{field}={{…}}") }
+}
+
 fn submit_buttons<'a>(ms: &'a [Markup], out: &mut Vec<&'a [Attr]>) {
     for m in ms {
         match &m.kind {
@@ -2713,14 +2723,15 @@ impl<'a> Checker<'a> {
     fn retained(&mut self) {
         let targets = |this: &Self, c: RId, field: &str| -> Vec<String> {
             if let Some(sig) = &this.regions[c].sig {
-                let mut v: Vec<String> = sig.stored.get(field).cloned().unwrap_or_default();
+                // a spread ("*") goes wherever any field goes
+                let mut v: Vec<String> = if field == "*" { sig.stored.values().flatten().cloned().collect() } else { sig.stored.get(field).cloned().unwrap_or_default() };
                 if field != "*" {
                     v.extend(sig.stored.get("*").cloned().unwrap_or_default());
                 }
                 return v.into_iter().map(|t| if t == "module" { "d:0".to_string() } else { format!("p:{}", t) }).collect();
             }
             let Some(m) = this.retains.get(&c) else { return vec![] };
-            let mut v: Vec<String> = m.get(field).map(|x| x.iter().cloned().collect()).unwrap_or_default();
+            let mut v: Vec<String> = if field == "*" { m.values().flatten().cloned().collect() } else { m.get(field).map(|x| x.iter().cloned().collect()).unwrap_or_default() };
             if field != "*" {
                 v.extend(m.get("*").map(|x| x.iter().cloned().collect::<Vec<_>>()).unwrap_or_default());
             }
@@ -2750,8 +2761,8 @@ impl<'a> Checker<'a> {
                                 "REGION_ESCAPE",
                                 "O-3",
                                 format!(
-                                    "<{} {}={{…}}>: the closure passed captures {} (declared in a region that ends sooner), and {} stores {} (itself, or through a component it passes it to) where it outlives it",
-                                    atag, field, ln, atag, field
+                                    "<{} {}>: the closure passed captures {} (declared in a region that ends sooner), and {} stores {} (itself, or through a component it passes it to) where it outlives it",
+                                    atag, arg_show(&field), ln, atag, if field == "*" { "a field of it" } else { field.as_str() }
                                 ),
                             );
                         }
@@ -2829,7 +2840,7 @@ impl<'a> Checker<'a> {
                         }
                         if is_comp {
                             let cr = self.syms[s.unwrap()].comp_region.unwrap();
-                            self.apps.push(AppRec { comp: cr, site: region, line: self.line, tag: tag.clone(), args: attrs.iter().filter(|a| !is_handler(&a.name)).map(|a| (a.name.clone(), &a.e, env)).collect(), passed: attrs.iter().map(|a| (a.name.clone(), &a.e, env)).collect() });
+                            self.apps.push(AppRec { comp: cr, site: region, line: self.line, tag: tag.clone(), args: attrs.iter().filter(|a| !is_handler(&a.name)).map(|a| (field_of(&a.name), &a.e, env)).collect(), passed: attrs.iter().map(|a| (field_of(&a.name), &a.e, env)).collect() });
                             let kids = self.region(Some(region), "children", false, Some(tag.clone()));
                             self.regions[kids].kids = Some((cr, region));
                             let kenv = self.env(Some(env), kids);
@@ -4113,10 +4124,14 @@ impl<'a> Checker<'a> {
     /// Where a component's prop field goes once read — up to its root, or out of an action.
     fn pf(&mut self, g: RId, field: &str) -> Vec<PFEntry> {
         if let Some(sig) = &self.regions[g].sig {
-            let Some(s) = sig.props.get(field).or_else(|| sig.props.get("*")) else { return vec![] };
-            let mut out = vec![PFEntry { chain: vec![Step { f: Some(s.f.clone()), p: Some(s.p.clone()) }], term: None }];
-            if let Some((af, an)) = &s.action {
-                out.push(PFEntry { chain: vec![Step { f: Some(af.clone()), p: None }], term: Some((-1, an.clone())) });
+            // a spread ("*") goes wherever any field goes
+            let ss: Vec<_> = if field == "*" { sig.props.values().collect() } else { sig.props.get(field).or_else(|| sig.props.get("*")).into_iter().collect() };
+            let mut out = vec![];
+            for s in ss {
+                out.push(PFEntry { chain: vec![Step { f: Some(s.f.clone()), p: Some(s.p.clone()) }], term: None });
+                if let Some((af, an)) = &s.action {
+                    out.push(PFEntry { chain: vec![Step { f: Some(af.clone()), p: None }], term: Some((-1, an.clone())) });
+                }
             }
             return out;
         }
@@ -4131,7 +4146,7 @@ impl<'a> Checker<'a> {
         let mut out = vec![];
         let occ = self.occ.clone();
         for o in &occ {
-            if o.comp == g && (o.field == field || o.field == "*") {
+            if o.comp == g && (o.field == field || o.field == "*" || field == "*") {
                 for v in self.via(&o.via) {
                     let mut c = o.pre.clone();
                     c.extend(v.chain);
@@ -4208,7 +4223,7 @@ impl<'a> Checker<'a> {
                         esc_p(&ch, HOLD)
                     })
                 {
-                    push_r(&mut res, &mut seen, Req { name: HOLD.into(), line: aline, what: format!("<{} {}={{…}}>, read in {},", atag, field, atag) });
+                    push_r(&mut res, &mut seen, Req { name: HOLD.into(), line: aline, what: format!("<{} {}>, read in {},", atag, arg_show(&field), atag) });
                     break;
                 }
             }
@@ -4255,7 +4270,7 @@ impl<'a> Checker<'a> {
                         ch.extend(q.iter().cloned());
                         esc_f(&ch, cl)
                     }) {
-                        push_f(&mut res, &mut seen, Item { cls: cl.clone(), line: aline, what: format!("<{} {}={{…}}>", atag, field) });
+                        push_f(&mut res, &mut seen, Item { cls: cl.clone(), line: aline, what: format!("<{} {}>", atag, arg_show(&field)) });
                         break;
                     }
                 }
diff --git a/compiler/src/emit.rs b/compiler/src/emit.rs
index fa74de2..ffc44a3 100644
--- a/compiler/src/emit.rs
+++ b/compiler/src/emit.rs
@@ -530,7 +530,7 @@ impl<'p> Gen<'p> {
                         let kind = if tag.as_bytes()[0].is_ascii_lowercase() { ElementKind::Native(tag.clone()) } else { ElementKind::Component };
                         let attributes = attrs
                             .iter()
-                            .filter(|a| !is_handler(&a.name))
+                            .filter(|a| !is_handler(&a.name) && a.name != "...")
                             .map(|a| Attribute {
                                 name: a.name.clone(),
                                 value: match &a.e.k {
@@ -541,7 +541,7 @@ impl<'p> Gen<'p> {
                             })
                             .collect();
                         let kids = flatten(tree(g, children));
-                        out.push(Item::El(Element { id: g.style_ids, kind, attributes, has_spread: false, children: kids }));
+                        out.push(Item::El(Element { id: g.style_ids, kind, attributes, has_spread: attrs.iter().any(|a| a.name == "..."), children: kids }));
                     }
                     MarkupKind::Mif { t, f, .. } => {
                         out.push(Item::Container(tree(g, t)));
diff --git a/compiler/src/oxc.rs b/compiler/src/oxc.rs
index eaeb4d9..d7bd6bd 100644
--- a/compiler/src/oxc.rs
+++ b/compiler/src/oxc.rs
@@ -397,6 +397,10 @@ impl<'a> Build<'a> {
         let Jsx::El { name, attrs, children, self_closing, .. } = j else { unreachable!() };
         let attrs = self.vec(attrs.iter().map(|(n, v)| {
             let start = self.open();
+            // 07 §4: `{...e}`, Solid's spread
+            if let ("...", AttrValue::Expr(e)) = (n.as_str(), v) {
+                return JSXAttributeItem::new_spread_attribute(self.close(start), self.expr(e), b);
+            }
             let name = match n.split_once(':') {
                 Some((ns, local)) => JSXAttributeName::new_namespaced_name(SPAN, JSXIdentifier::new(SPAN, self.s(ns), b), JSXIdentifier::new(SPAN, self.s(local), b), b),
                 None => JSXAttributeName::new_identifier(SPAN, self.s(n), b),
diff --git a/compiler/src/parse.rs b/compiler/src/parse.rs
index d88aa09..45660c1 100644
--- a/compiler/src/parse.rs
+++ b/compiler/src/parse.rs
@@ -2189,6 +2189,22 @@ fn parse_element(c: &mut Cursor) -> R<Markup> {
             break;
         }
         let a0 = c.i;
+        // 07 §4: a spread attribute, `{...e}`: every field of e, in order with the named ones
+        if c.starts_with("{") {
+            c.eat("{");
+            c.ws(true);
+            let d0 = c.i;
+            if !c.eat("...") {
+                return c.fail("attr: an attribute in braces is a spread, `{...props}`");
+            }
+            let span = Span::new(d0, c.i);
+            c.ws(true);
+            let e = parse_expr(c)?;
+            attrs.push(Attr { name: "...".into(), e, span });
+            c.ws(true);
+            c.expect("}")?;
+            continue;
+        }
         let Some(name) = c.tag_name() else { return c.fail("attr") };
         let span = Span::new(a0, c.i);
         c.ws(false);
diff --git a/compiler/src/project.rs b/compiler/src/project.rs
index 537eb0c..062a2a3 100644
--- a/compiler/src/project.rs
+++ b/compiler/src/project.rs
@@ -900,6 +900,11 @@ impl Proj<'_> {
                 let tag_at = (!sp.is_none() && sp.text(self.src)[1..].starts_with(tag.as_str())).then_some(sp.start as usize + 1);
                 let mut a = Code::new();
                 for at in attrs {
+                    // 07 §4: a spread, as JSX's
+                    if at.name == "..." {
+                        a = a.t(" {...").c(self.expr(&at.e, false, None)).t("}");
+                        continue;
+                    }
                     let name_at = (!at.span.is_none() && at.span.text(self.src) == at.name).then_some(at.span.start as usize);
                     a = a.t(" ").at(&at.name, name_at);
                     if !matches!(at.e.k, ExprKind::Lit(Lit::Bool(true))) {
diff --git a/guide/language.md b/guide/language.md
index 743efcf..ca5f7f2 100644
--- a/guide/language.md
+++ b/guide/language.md
@@ -122,7 +122,8 @@ component Card(props: { title: string; children: View }) {
 ```
 
 `props.x` stays live: don't copy it into a source unless you mean a one-time seed (`source draft := peek(props.x)`).
-Destructured props stay live too: `component Card({ title, open = false })` or `{ title } = props` (RG-4b).
+Destructured props stay live too: `component Card({ title, open = false })` or `{ title } = props` (RG-4b). Pass
+the rest on with a spread, `<button {...rest}>` or `<Inner {...rest} />`: later attributes override it, as in JSX.
 
 A prop that takes a handler is named `on…` and typed as a function: `props: { onPick: (id: number) => void }`, passed
 as `<Row onPick={id => { selected := id }} />` and called from the component's own handlers (`props.onPick(id)`).
diff --git a/ref/compile/emit.ts b/ref/compile/emit.ts
index a6922c5..3419107 100644
--- a/ref/compile/emit.ts
+++ b/ref/compile/emit.ts
@@ -205,7 +205,7 @@ class Gen {
         case "read": return "{0}";
         case "el": {
           if (m.tag === "") return `<>${tree(m.children)}</>`;
-          const attrs = m.attrs.filter(a => !isHandler(a.name)).map(a => a.e.k === "lit" && typeof a.e.v === "string" ? ` ${a.name}="${esc(a.e.v)}"` : a.e.k === "lit" && a.e.v === true ? ` ${a.name}` : ` ${a.name}={0}`).join("");
+          const attrs = m.attrs.filter(a => !isHandler(a.name) && a.name !== "...").map(a => a.e.k === "lit" && typeof a.e.v === "string" ? ` ${a.name}="${esc(a.e.v)}"` : a.e.k === "lit" && a.e.v === true ? ` ${a.name}` : ` ${a.name}={0}`).join("") + (m.attrs.some(a => a.name === "...") ? " {...0}" : "");
           return VOID_TAGS.has(m.tag) ? `<${m.tag}${attrs} />` : `<${m.tag}${attrs}>${tree(m.children)}</${m.tag}>`;
         }
         case "mif": return `{(<>${tree(m.t)}</>)}{(<>${tree(m.f)}</>)}`;
@@ -555,7 +555,7 @@ class Gen {
     return `(${param}) => {\n${pre}${this.block(decls, view, inner, ind + 1)}\n${pad}}`;
   }
   private region(decls: Decl[], view: Markup[], env: Env, ind: number): string { return `{(${this.regionFn(decls, view, env, ind)})()}`; }
-  private attr(name: string, e: Expr, env: Env): string { return `${name}={${this.expr(e, env, { imp: isHandler(name) })}}`; }
+  private attr(name: string, e: Expr, env: Env): string { return name === "..." ? `{...${this.expr(e, env, { imp: false })}}` : `${name}={${this.expr(e, env, { imp: isHandler(name) })}}`; }   // 07 §4: a spread is Solid's
   private child(m: Markup, env: Env, ind: number): string {
     const re: Ctx = { imp: false };
     const pad = " ".repeat((ind + 1) * 2);
diff --git a/ref/oracle/lower.ts b/ref/oracle/lower.ts
index f4f6acc..85063b2 100644
--- a/ref/oracle/lower.ts
+++ b/ref/oracle/lower.ts
@@ -10,7 +10,7 @@ import { Show, For, Loading, Errored } from "solid-js";
 import { getObserver } from "@solidjs/signals";
 import {
   createSignal, createMemo, createEffect, createOptimistic, createOptimisticStore, createStore, createProjection, createDeferred,
-  createRoot, createRenderEffect, flush, untrack, latest, isPending, action, refresh, affects, until, onSettled, onFlush, NotReadyError, resetErrorHalt, createContext, getContext, setContext, getOwner, runWithOwner, $TARGET, createErrorBoundary, omit
+  createRoot, createRenderEffect, flush, untrack, latest, isPending, action, refresh, affects, until, onSettled, onFlush, NotReadyError, resetErrorHalt, createContext, getContext, setContext, getOwner, runWithOwner, $TARGET, createErrorBoundary, omit, merge
 } from "@solidjs/signals";
 
 const noFlight = (v: unknown) => { if (v instanceof Flight || v instanceof Promise) throw new Unsupported("`await` not in tail position (the oracle lowers a tail `await` to the memo's result)"); };
@@ -620,13 +620,18 @@ export class Oracle {
         if (/^[A-Z]/.test(m.tag)) {
           const b = scope.lookup(m.tag); if (!b || b.k !== "comp") throw new Error(`unknown component ${m.tag}`);
           const comp = b.decl, home = b.home;
-          const props: Record<string, unknown> = {};
-          for (const a of m.attrs) Object.defineProperty(props, a.name, { enumerable: true, get: () => this.ev(a.e, scope) });
-          Object.defineProperty(props, "children", { enumerable: true, get: () => this.fragment(m.children, scope) });
+          const parts: unknown[] = []; let run: Record<string, unknown> | null = null;    // 07 §4: a spread is a function source of Solid's merge, between runs of named props
+          for (const a of m.attrs) {
+            if (a.name === "...") { run = null; parts.push(() => this.ev(a.e, scope)); continue; }
+            if (!run) { run = {}; parts.push(run); }
+            Object.defineProperty(run, a.name, { enumerable: true, get: () => this.ev(a.e, scope) });
+          }
+          const kids = {}; Object.defineProperty(kids, "children", { enumerable: true, get: () => this.fragment(m.children, scope) }); parts.push(kids);
+          const props = parts.length === 1 ? kids : (merge as (...xs: unknown[]) => Record<string, unknown>)(...parts);
           return R.createComponent((p: any) => { const s2 = new Scope(home); s2.vars.set(comp.props, { k: "const", value: p }); return this.region(comp.decls, comp.view, s2); }, props);
         }
         const el = R.createElement(m.tag);
-        for (const a of m.attrs) { if (/^on[A-Z:]/.test(a.name)) { const h = untrack(() => { this.imperative++; try { return this.ev(a.e, scope); } finally { this.imperative--; } }); R.setProp(el, a.name, h); } else R.effect(() => this.ev(a.e, scope), v => { R.setProp(el, a.name, v); }); }   // 07 §5: a handler is an imperative closure
+        for (const a of m.attrs) { if (a.name === "...") { R.effect(() => this.ev(a.e, scope), (v: any) => { for (const k of v && typeof v === "object" ? Object.keys(v) : []) R.setProp(el, k, v[k]); }); continue; } if (/^on[A-Z:]/.test(a.name)) { const h = untrack(() => { this.imperative++; try { return this.ev(a.e, scope); } finally { this.imperative--; } }); R.setProp(el, a.name, h); } else R.effect(() => this.ev(a.e, scope), v => { R.setProp(el, a.name, v); }); }   // 07 §5: a handler is an imperative closure
         for (const item of (untrack(() => this.fragment(m.children, scope, true)) as unknown[]).flat(Infinity)) { const marker = R.createTextNode(""); R.insertNode(el, marker); R.insert(el, item as never, marker); }
         return el;
       }
diff --git a/ref/src/check.ts b/ref/src/check.ts
index 6d36e97..73e0375 100644
--- a/ref/src/check.ts
+++ b/ref/src/check.ts
@@ -1064,8 +1064,8 @@ class Checker {
    *  stored. A provision's place is found from the site; a prop passed on (`x={props.y}`) is stored by this component too. */
   private retained() {
     const targets = (C: Region, field: string): string[] => {
-      if (C.sig) return [...(C.sig.stored?.[field] ?? []), ...(field !== "*" ? C.sig.stored?.["*"] ?? [] : [])].map(t => t === "module" ? "d:0" : `p:${t}`);
-      const m = this.retains.get(C); return m ? [...(m.get(field) ?? []), ...(field !== "*" ? m.get("*") ?? [] : [])] : [];
+      if (C.sig) return (field === "*" ? Object.values(C.sig.stored ?? {}).flat() : [...(C.sig.stored?.[field] ?? []), ...(C.sig.stored?.["*"] ?? [])]).map(t => t === "module" ? "d:0" : `p:${t}`);   // a spread ("*") goes wherever any field goes
+      const m = this.retains.get(C); return m ? (field === "*" ? [...m.values()].flat() : [...(m.get(field) ?? []), ...(m.get("*") ?? [])]) : [];
     };
     for (let changed = true; changed;) {
       changed = false;
@@ -1075,7 +1075,7 @@ class Checker {
         for (const t of ts) {
           const limit = t.startsWith("d:") ? +t.slice(2) : this.provAnchor(a.site, t.slice(2));
           const leak = cap.find(c => !c.propOf && c.region.depth > limit);
-          if (leak) { this.line = a.line; this.err("REGION_ESCAPE", "O-3", `<${a.tag} ${x.field}={…}>: the closure passed captures ${leak.name} (declared in a region that ends sooner), and ${a.tag} stores ${x.field} (itself, or through a component it passes it to) where it outlives it`); }
+          if (leak) { this.line = a.line; this.err("REGION_ESCAPE", "O-3", `<${a.tag} ${x.field === "*" ? "{...…}" : `${x.field}={…}`}>: the closure passed captures ${leak.name} (declared in a region that ends sooner), and ${a.tag} stores ${x.field === "*" ? "a field of it" : x.field} (itself, or through a component it passes it to) where it outlives it`); }
           for (const c of cap) if (c.propOf && limit < c.propOf.comp.depth && this.retain(c.propOf.comp, c.propOf.field, t)) changed = true;
         }
       }
@@ -1112,7 +1112,7 @@ class Checker {
             for (const a of m.attrs) this.comp(isHandler(a.name) ? "handler" : "prop", env, { at: `${m.tag} ${a.name}` }, () => this.expr(a.e, env, { scope: isHandler(a.name) ? "imperative" : "reactive" }));   // R-2: an argument is read where the component reads it
             if (s?.kind === "comp") {
               s.compRegion!.appSites.push(env.region);
-              this.apps.push({ comp: s.compRegion!, site: env.region, line: this.line, tag: m.tag, args: m.attrs.filter(a => !isHandler(a.name)).map(a => ({ field: a.name, e: a.e, env })), passed: m.attrs.map(a => ({ field: a.name, e: a.e, env })) });   // R-2: passing is not reading — checked where the component reads it
+              this.apps.push({ comp: s.compRegion!, site: env.region, line: this.line, tag: m.tag, args: m.attrs.filter(a => !isHandler(a.name)).map(a => ({ field: a.name === "..." ? "*" : a.name, e: a.e, env })), passed: m.attrs.map(a => ({ field: a.name === "..." ? "*" : a.name, e: a.e, env })) });   // a spread is every field: "*"   // R-2: passing is not reading — checked where the component reads it
               const kids = this.region(env.region, "children", { provParent: s.compRegion!, name: m.tag });              // RG-4c: children are named by the caller, owned where the component reads them
               kids.kids = { comp: s.compRegion!, site: env.region };
               this.markup(m.children, new Env(env, kids));
@@ -1388,14 +1388,14 @@ class Checker {
     const pfMemo = new Map<string, PFEntry[]>(); const pfBusy = new Set<string>();
     const PF = (G: Region, field: string): PFEntry[] => {
       if (G.sig) {                                                                           // MO-3: an imported component's summary
-        const s = G.sig.props[field] ?? G.sig.props["*"]; if (!s) return [];
-        const out: PFEntry[] = [{ chain: [{ f: s.f, p: s.p }], term: null }];
-        if (s.action) out.push({ chain: [{ f: s.action.f }], term: { line: -1, name: s.action.name } });
+        const ss = field === "*" ? Object.values(G.sig.props) : [G.sig.props[field] ?? G.sig.props["*"]];   // a spread ("*") goes wherever any field goes
+        const out: PFEntry[] = [];
+        for (const s of ss) { if (!s) continue; out.push({ chain: [{ f: s.f, p: s.p }], term: null }); if (s.action) out.push({ chain: [{ f: s.action.f }], term: { line: -1, name: s.action.name } }); }
         return out;
       }
       const k = `${G.id}:${field}`; if (pfMemo.has(k)) return pfMemo.get(k)!; if (pfBusy.has(k)) return []; pfBusy.add(k);
       const out: PFEntry[] = [];
-      for (const o of occ) if (o.comp === G && (o.field === field || o.field === "*")) for (const v of o.via()) out.push({ chain: [...o.pre, ...v.chain], term: v.term });
+      for (const o of occ) if (o.comp === G && (o.field === field || o.field === "*" || field === "*")) for (const v of o.via()) out.push({ chain: [...o.pre, ...v.chain], term: v.term });
       const res = dedupe(out); pfBusy.delete(k); pfMemo.set(k, res); return res;
     };
     // what escapes each component's root (and the program's): failures and provisions
@@ -1409,7 +1409,7 @@ class Checker {
       const pushR = (it: Req) => { const k = `R${it.name}@${it.line}:${it.what}`; if (!seen.has(k)) { seen.add(k); reqs.push(it); } };
       for (const r of readerF) if (compOf(r.region) === C) for (const cls of r.f.cls) if (routes(r.region).some(q => escF(q, cls))) pushF({ cls, line: r.line, what: show(r.e) });
       for (const u of this.uses) if (compOf(u.region) === C) if (routes(u.region).some(q => escP(q, u.name))) pushR({ name: u.name, line: u.line, what: u.name === HOLD ? `a reader of ${u.display}` : `use ${u.display}` });
-      for (const a of argR) if (compOf(a.app.site) === C) for (const p of PF(a.app.comp, a.field)) if (!p.term && routes(a.app.site).some(q => escP([...p.chain, ...q], HOLD))) { pushR({ name: HOLD, line: a.app.line, what: `<${a.app.tag} ${a.field}={…}>, read in ${a.app.tag},` }); break; }   // SV-7b through a prop
+      for (const a of argR) if (compOf(a.app.site) === C) for (const p of PF(a.app.comp, a.field)) if (!p.term && routes(a.app.site).some(q => escP([...p.chain, ...q], HOLD))) { pushR({ name: HOLD, line: a.app.line, what: `<${a.app.tag} ${a.field === "*" ? "{...…}" : `${a.field}={…}`}>, read in ${a.app.tag},` }); break; }   // SV-7b through a prop
       for (const a of this.apps) if (compOf(a.site) === C) {
         const e = esc(a.comp);
         for (const it of e.fails) if (routes(a.site).some(q => escF(q, it.cls))) pushF({ ...it, line: it.line < 0 ? a.line : it.line, what: `${it.what} (in <${a.tag}>)` });
@@ -1417,7 +1417,7 @@ class Checker {
       }
       for (const a of argF) if (compOf(a.app.site) === C) for (const cls of a.f.cls) for (const p of PF(a.app.comp, a.field)) {
         if (p.term) { if (escF(p.chain, cls)) { this.line = a.app.line; this.err("UNCAUGHT_ACTION_FAILURE", "R-f-6", `action ${p.term.name} in <${a.app.tag}> reads props.${a.field}, which can fail with ${cls} here (line ${a.app.line}), and does not catch it`); } continue; }
-        if (routes(a.app.site).some(q => escF([...p.chain, ...q], cls))) { pushF({ cls, line: a.app.line, what: `<${a.app.tag} ${a.field}={…}>` }); break; }
+        if (routes(a.app.site).some(q => escF([...p.chain, ...q], cls))) { pushF({ cls, line: a.app.line, what: `<${a.app.tag} ${a.field === "*" ? "{...…}" : `${a.field}={…}`}>` }); break; }
       }
       const res = { fails, reqs }; escBusy.delete(C); escMemo.set(C, res); return res;
     };
diff --git a/ref/src/parse.ts b/ref/src/parse.ts
index e3affce..69cb7c9 100644
--- a/ref/src/parse.ts
+++ b/ref/src/parse.ts
@@ -724,6 +724,10 @@ function parseElement(c: Cursor): Markup {
     c.ws();
     if (c.eat("/>")) return { k: "el", tag, attrs, children: [] };
     if (c.eat(">")) break;
+    if (c.startsWith("{")) {                                            // 07 §4: a spread attribute, `{...e}`: every field of e, in order with the named ones
+      c.eat("{"); c.ws(); if (!c.eat("...")) c.fail("attr: an attribute in braces is a spread, `{...props}`"); c.ws();
+      attrs.push({ name: "...", e: parseExpr(c) }); c.ws(); c.expect("}"); continue;
+    }
     const name = c.tagName() ?? c.fail("attr"); c.ws(false);
     if (!c.eat("=")) { attrs.push({ name, e: { k: "lit", v: true } }); continue; }   // boolean attribute
     c.ws();
diff --git a/ref/src/runtime.ts b/ref/src/runtime.ts
index 40f4471..4aae833 100644
--- a/ref/src/runtime.ts
+++ b/ref/src/runtime.ts
@@ -1192,8 +1192,21 @@ export class Runtime {
           const b = region.lookup(m.tag);
           if (!b || !("comp" in b)) throw new RuleError("SCOPE", `unknown component ${m.tag}`);
           const comp = b.comp; const r = new Region(region, this, region.boundary, b.home);   // owned at the application, names from the declaration (RG-7a, MO-6)
-          const props: Record<string, unknown> = {};
-          for (const a of m.attrs) { const node = this.mkNode("eq", `${m.tag}.${a.name}`, region, rt => rt.evalExpr(a.e, region)); Object.defineProperty(props, a.name, { enumerable: true, get: () => this.readNode(node) }); }   // a prop read is a read of the argument's node: taint, lanes, serving (found by S-fail-2)
+          const parts = m.attrs.map(a => ({ name: a.name, node: this.mkNode("eq", `${m.tag}.${a.name}`, region, rt => rt.evalExpr(a.e, region)) }));
+          let props: Record<string, unknown> = {};
+          if (!parts.some(p => p.name === "...")) for (const p of parts) Object.defineProperty(props, p.name, { enumerable: true, get: () => this.readNode(p.node) });   // a prop read is a read of the argument's node: taint, lanes, serving (found by S-fail-2)
+          else {                                                                                  // 07 §4: a spread gives every field of its value; the last part that has a field wins, as Solid's merge
+            const obj = (v: unknown) => v != null && typeof v === "object" ? v as Record<string, unknown> : {};
+            const find = (k: string) => { for (let i = parts.length - 1; i >= 0; i--) { const p = parts[i]; if (p.name === k) return { p, spread: false }; if (p.name === "..." && k in obj(this.readNode(p.node))) return { p, spread: true }; } return null; };
+            const read = (k: string) => { const f = find(k); return !f ? undefined : f.spread ? obj(this.readNode(f.p.node))[k] : this.readNode(f.p.node); };
+            const keys = () => [...new Set(parts.flatMap(p => p.name === "..." ? Object.keys(obj(this.readNode(p.node))) : [p.name]))].filter(k => k !== "children");
+            props = new Proxy(props, {
+              get: (t, k) => typeof k !== "string" || k === "children" ? Reflect.get(t, k) : read(k),
+              has: (t, k) => typeof k !== "string" || k === "children" ? Reflect.has(t, k) : !!find(k),
+              ownKeys: t => [...keys(), ...Reflect.ownKeys(t)],
+              getOwnPropertyDescriptor: (t, k) => typeof k === "string" && k !== "children" ? (find(k) ? { enumerable: true, configurable: true, value: read(k) } : undefined) : Reflect.getOwnPropertyDescriptor(t, k),
+            });
+          }
           let children: ViewValue | null = null;                   // RG-4c: instantiated where first read — owned by the reader's region, named by the caller's
           Object.defineProperty(props, "children", { enumerable: true, get: () => { if (!children) { const owner = this.tracking?.region ?? region; const cr = new Region(owner, this, owner.boundary, region); children = new ViewValue(cr, m.children.map(c => this.inst1(c, cr))); } return children; } });
           r.scope.set(comp.props, { constant: props });
diff --git a/ref/types/project.ts b/ref/types/project.ts
index 927756b..4cded7c 100644
--- a/ref/types/project.ts
+++ b/ref/types/project.ts
@@ -299,7 +299,7 @@ class Proj {
       case "read": this.w.emit(`${ind}{${this.expr(m.e, false)}}`, line); return;
       case "el": {
         if (m.tag === "") { this.w.emit(`${ind}<>`, line); for (const c of m.children) this.child(c, ind + "  "); this.w.emit(`${ind}</>`, line); return; }
-        const attrs = m.attrs.map(a => a.e.k === "lit" && a.e.v === true ? ` ${a.name}` : ` ${a.name}={${this.expr(a.e, isHandler(a.name))}}`).join("");
+        const attrs = m.attrs.map(a => a.name === "..." ? ` {...${this.expr(a.e, false)}}` : a.e.k === "lit" && a.e.v === true ? ` ${a.name}` : ` ${a.name}={${this.expr(a.e, isHandler(a.name))}}`).join("");
         if (!m.children.length) { this.w.emit(`${ind}<${m.tag}${attrs} />`, line); return; }
         this.w.emit(`${ind}<${m.tag}${attrs}>`, line); for (const c of m.children) this.child(c, ind + "  "); this.w.emit(`${ind}</${m.tag}>`, line);
         void VOID_TAGS; return;
diff --git a/runtime/package-lock.json b/runtime/package-lock.json
index 07dc6a9..ff782af 100644
--- a/runtime/package-lock.json
+++ b/runtime/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@reactivescript/runtime",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@reactivescript/runtime",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "devDependencies": {
         "@solidjs/signals": "2.0.0-rc.21",
diff --git a/runtime/package.json b/runtime/package.json
index 673f4cb..735d836 100644
--- a/runtime/package.json
+++ b/runtime/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@reactivescript/runtime",
   "description": "ReactiveScript's runtime (spec/11 CP-4a): createApp and the __rt helpers compiled .rx calls, over Solid, for the browser and the server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",
diff --git a/scenarios/S-surface-5.md b/scenarios/S-surface-5.md
new file mode 100644
index 0000000..4ee62ad
--- /dev/null
+++ b/scenarios/S-surface-5.md
@@ -0,0 +1,68 @@
+# S-surface-5 — a spread attribute, `{...e}`
+
+Rules: 07 §4 (Markup), RG-4, RG-4b.
+
+`{...e}` among an element's attributes gives it every field of `e`, as JSX
+does. Parts merge in order and the last one that has a field wins, as
+Solid's `merge`: an attribute after the spread overrides it, one before it
+is a default. Each field keeps updating, as a named attribute does; on a
+component, the spread is read where the component reads a field of it.
+
+## Program
+
+```rx
+component Badge({ label, tone = "info", ...rest }) {
+  <span>{label}:{tone}:{rest.count}:{rest.title}</span>
+  <button {...rest}>open</button>
+}
+
+export default component App() {
+  source extra: { count: number; tone?: string; title: string } := { count: 1, tone: "warn", title: "a" }
+
+  <Badge label="x" {...extra} title="fixed" />
+  <Badge tone="calm" {...extra} label="y" />
+}
+```
+
+The first badge's `title` comes after the spread, so it is `fixed` whatever
+`extra` holds; its `tone` comes from `extra`. In the second, `tone="calm"`
+comes before the spread, so `extra.tone` wins while it has one.
+
+## Frames
+
+| instant | action                                         | frame                                  |
+| ------- | ---------------------------------------------- | -------------------------------------- |
+| 0       | mount                                          | `x:warn:1:fixedopeny:warn:1:aopen`     |
+| 1       | handler `extra := { count: 2, title: "b" }`    | `x:info:2:fixedopeny:calm:2:bopen`     |
+
+Instant 1: `extra` no longer has `tone`, so the first badge falls back to
+its default and the second to the attribute before the spread.
+
+## Rejected variants
+
+```rx
+-- reject: PARSE
+export default component App() {
+  source extra := { title: "a" }
+  <p {extra}>hi</p>
+}
+```
+
+An attribute in braces is a spread: `{...extra}`.
+
+```rx
+-- reject: UNHANDLED_FAILURE
+component Card(props: { title: string }) {
+  <h1>{props.title}</h1>
+}
+
+export default component App() {
+  info = await fetch("info")
+  loading fallback { <p>…</p> } {
+    <Card {...info} />
+  }
+}
+```
+
+A spread passes `info`'s failure on with its fields: `Card` reads `title`,
+so the read can fail with `Error`, and nothing above it catches.
diff --git a/site/index.html b/site/index.html
index 73dea7a..e372f05 100644
--- a/site/index.html
+++ b/site/index.html
@@ -103,15 +103,15 @@ <h2>Mistakes of shape become errors</h2>
 <pre class="err"><code>counter.rx:5:3 - error WRITE_TO_NON_SOURCE: double is an equation: only sources are written (W-1)</code></pre>
 
   <h2>Destructure props, keep them live</h2>
-  <p>In Solid, destructuring props reads them once and the component stops updating. In .rx, destructure them right in the parameter list: every name follows its prop, defaults and rest included.</p>
-<pre><span class="fname">inbox.rx</span><code><span class="k">component</span> Badge({ label, tone = <span class="s">"info"</span>, ...rest }: { label: string; tone?: string; count: number }) {
-  &lt;span class={tone}&gt;{label}: {rest.count}&lt;/span&gt;
+  <p>In Solid, destructuring props reads them once and the component stops updating. In .rx, destructure them right in the parameter list: every name follows its prop, defaults and rest included, and the rest spreads onto an element as in JSX.</p>
+<pre><span class="fname">inbox.rx</span><code><span class="k">component</span> Badge({ label, tone = <span class="s">"info"</span>, ...rest }: { label: string; tone?: string; title?: string }) {
+  &lt;span class={tone} {...rest}&gt;{label}&lt;/span&gt;
 }
 
 <span class="k">export default component</span> Inbox() {
   <span class="w">source</span> user := { name: <span class="s">"Ada"</span>, unread: <span class="t">3</span> }
 
-  &lt;Badge label={user.name} count={user.unread} /&gt;   <span class="c">// Badge updates when user changes</span>
+  &lt;Badge label={`${user.unread} unread`} title={user.name} /&gt;   <span class="c">// Badge updates when user changes</span>
   &lt;button onClick={() =&gt; { user := { ...user, unread: <span class="t">0</span> } }}&gt;Mark read&lt;/button&gt;
 }</code></pre>
 
diff --git a/spec/07-surface.md b/spec/07-surface.md
index 4f13591..06027bc 100644
--- a/spec/07-surface.md
+++ b/spec/07-surface.md
@@ -169,6 +169,14 @@ attributes are equations, children are readers, components are applied as
   element and bare at block level. `portal to(e) { … }` renders into `e`
   (RG-8). Each block is a region: declarations, then markup
   (RG-1, RG-2, RG-5). `if x { … }` narrows `x` inside (RG-1c).
+- `{...e}` among the attributes is a spread, as JSX's: every field of `e`.
+  Parts merge in order and the last one that has a field wins (Solid's
+  `merge`), so an attribute after the spread overrides it and one before
+  it is a default. A spread is an equation like any attribute: its fields
+  keep updating. On a component it is passed, not read: its fields are
+  read where the component reads its props, and its failures and holds go
+  where any of those reads go (R-2, R-f-5). On an HTML element it is read
+  where the element is (S-surface-5).
 - `for x in e` keys rows by identity, or by the collection's `key` (ST-4b).
 - Text follows JSX: whitespace that contains a line break is not text, a
   line's leading and trailing whitespace is not text, and text that runs
diff --git a/tooling/rx-language-server/package-lock.json b/tooling/rx-language-server/package-lock.json
index 2abe140..2c38883 100644
--- a/tooling/rx-language-server/package-lock.json
+++ b/tooling/rx-language-server/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@reactivescript/language-server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@reactivescript/language-server",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "dependencies": {
         "@volar/language-core": "2.4.30",
diff --git a/tooling/rx-language-server/package.json b/tooling/rx-language-server/package.json
index 2b35163..7059607 100644
--- a/tooling/rx-language-server/package.json
+++ b/tooling/rx-language-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@reactivescript/language-server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The .rx language server (spec/11 CP-8): Volar over the crate's TSX projection, TypeScript's answers mapped back onto .rx, the crate's own diagnostics; rx-tsc type-checks .rx from the command line.",
   "license": "MIT",
   "repository": {
diff --git a/tooling/vscode-rx/README.md b/tooling/vscode-rx/README.md
index 9446f3a..7f5990c 100644
--- a/tooling/vscode-rx/README.md
+++ b/tooling/vscode-rx/README.md
@@ -27,7 +27,7 @@ artifact of a run of the repository's `editor` workflow, or build one (below),
 then run **Extensions: Install from VSIX…** in the command palette, or
 
 ```sh
-code --install-extension reactivescript-0.3.0.vsix
+code --install-extension reactivescript-0.3.1.vsix
 ```
 
 The project needs a `tsconfig.json` with Solid's JSX (`"jsx": "preserve"`,
diff --git a/tooling/vscode-rx/package-lock.json b/tooling/vscode-rx/package-lock.json
index 08c5218..9eae14a 100644
--- a/tooling/vscode-rx/package-lock.json
+++ b/tooling/vscode-rx/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "reactivescript",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "reactivescript",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "dependencies": {
         "highlight.js": "^11.11.1",
diff --git a/tooling/vscode-rx/package.json b/tooling/vscode-rx/package.json
index 2d11377..9566816 100644
--- a/tooling/vscode-rx/package.json
+++ b/tooling/vscode-rx/package.json
@@ -2,7 +2,7 @@
   "name": "reactivescript",
   "displayName": "ReactiveScript",
   "description": "ReactiveScript (.rx, .d.rx): highlighting, and TypeScript's types, hover, go to definition, completion and errors through the .rx language server, with the compiler's own diagnostics; ```rx blocks highlighted in Markdown.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "publisher": "solidjs",
   "license": "MIT",
   "icon": "icon.png",