@@ -19,6 +19,7 @@ the per-type sanitising follow from it.
 * Group fields into tabs and sections, saving one tab without touching others
 * Read and write a value by name, without knowing how the option is shaped
 * Sanitise per field type, rather than writing a callback for each
+* Refuse a value that is missing or malformed, and say which field
 * Encrypt a field, so an API key is not stored in the clear
 * Export, import and reset from Screen Options
 * Show a field only when another is set
@@ -58,6 +59,22 @@ $name = get_setting_field_value( 'my_plugin', 'site_name' );
 Field types come from `arraypress/wp-field-kit`, so anything it renders can go
 in a settings page.
 
+## Validation
+
+Sanitising coerces; it does not refuse. A field that must hold something says
+`'required' => true`, and one that must hold a particular shape names a rule
+with `validate` — `email`, `url`, `numeric`, `integer`, `slug`, `alphanumeric`,
+or a callable returning `true`, a message or a `WP_Error`:
+
+```php
+'contact' => [ 'type' => 'text', 'label' => __( 'Contact', 'my-plugin' ), 'required' => true, 'validate' => 'email' ],
+```
+
+A value that fails is not stored. The field keeps what it held, every other
+field on the tab is saved, and after the redirect the message appears as an
+error notice at the top of the page — in place of "Settings saved." — and
+again under the field itself.
+
 ## Requirements
 
 * PHP 8.3 or later
 
@@ -426,7 +426,48 @@ public function sanitize( mixed $input ): array {
 		// eaten by the save that stores it.
 		$set->save( wp_slash( $input ) );
 
-		return $this->ordered_like_stored( $collector->values() );
+		return $this->ordered_like_stored( $this->with_refused( $set, $collector->values() ) );
+	}
+
+	/**
+	 * Report each field the set refused, and keep what it held.
+	 *
+	 * The messages go to the Settings API under this page's option name,
+	 * which is where options.php looks once every option is updated: it adds
+	 * "Settings saved." only when nothing has been registered, carries
+	 * whatever has into the transient the next load reads, and
+	 * settings_errors() prints them at the top of the page. A refused email
+	 * address is therefore reported as such rather than announced as saved.
+	 * Guarded, because the Settings API is admin-only and this gate also
+	 * runs for a write from cron or a webhook, where there is no page to
+	 * report to.
+	 *
+	 * The stored value is put back by hand for the write that would
+	 * otherwise lose it. A form save seeds the collector with everything
+	 * stored and the set leaves a failing field alone, so it survives on its
+	 * own; a whole-value write seeds no field at all, and without this the
+	 * value would be dropped — which is the one thing the kit promises a
+	 * refused value is not.
+	 *
+	 * @param FieldSet             $set    The set that just saved.
+	 * @param array<string, mixed> $values What it collected.
+	 *
+	 * @return array<string, mixed>
+	 */
+	private function with_refused( FieldSet $set, array $values ): array {
+		$stored = $this->options->values();
+
+		foreach ( $set->errors() as $key => $message ) {
+			if ( array_key_exists( $key, $stored ) ) {
+				$values[ $key ] = $stored[ $key ];
+			}
+
+			if ( function_exists( 'add_settings_error' ) ) {
+				add_settings_error( (string) $this->config['option_name'], (string) $key, $message, 'error' );
+			}
+		}
+
+		return $values;
 	}
 
 	/**
@@ -618,7 +659,9 @@ public function render_page(): void {
 		echo '<div class="wrap field-kit__settings">';
 
 		// No argument: core adds its own "Settings saved." under the `general`
-		// slug, and asking for this page's slug alone would hide it.
+		// slug, and asking for this page's slug alone would hide it. A field
+		// the last save refused is printed here as well, and again under the
+		// field itself.
 		settings_errors();
 
 		printf( '<form method="post" action="%s">', esc_url( admin_url( 'options.php' ) ) );
@@ -634,7 +677,7 @@ public function render_page(): void {
 			esc_attr( $tab )
 		);
 
-		$this->render_sections( $tab );
+		$this->render_sections( $tab, $this->field_errors() );
 
 		if ( $this->config['submit_button'] ) {
 			submit_button();
@@ -643,14 +686,41 @@ public function render_page(): void {
 		echo '</form></div>';
 	}
 
+	/**
+	 * The messages the last save registered against this page's fields.
+	 *
+	 * Read back from the Settings API rather than from the set that saved,
+	 * because that set belonged to the previous request: options.php saves,
+	 * stores what was registered in a transient and redirects, and
+	 * get_settings_errors() is what reads that transient on the load that
+	 * follows. Only codes that name a field are kept — the import and reset
+	 * notices are registered under the same slug and are not about a field.
+	 *
+	 * @return array<string, string> Keyed by field.
+	 */
+	private function field_errors(): array {
+		$errors = [];
+
+		foreach ( (array) get_settings_errors( (string) $this->config['option_name'] ) as $error ) {
+			$code = (string) ( $error['code'] ?? '' );
+
+			if ( 'error' === (string) ( $error['type'] ?? '' ) && isset( $this->fields[ $code ] ) ) {
+				$errors[ $code ] = (string) ( $error['message'] ?? '' );
+			}
+		}
+
+		return $errors;
+	}
+
 	/**
 	 * Render one tab's sections and fields.
 	 *
-	 * @param string $tab Tab slug.
+	 * @param string                $tab    Tab slug.
+	 * @param array<string, string> $errors Messages from the last save, keyed by field.
 	 *
 	 * @return void
 	 */
-	private function render_sections( string $tab ): void {
+	private function render_sections( string $tab, array $errors ): void {
 		$set    = $this->set( $tab );
 		$fields = $set->fields();
 		$shown  = [];
@@ -680,15 +750,15 @@ private function render_sections( string $tab ): void {
 				printf( '<p class="description">%s</p>', wp_kses_post( (string) $section['description'] ) );
 			}
 
-			$this->render_table( $set, $in_section, (string) $slug );
+			$this->render_table( $set, $in_section, (string) $slug, $errors );
 		}
 
 		// A field no section claimed still has to appear, or a typo in a
 		// section name silently removes it from the page.
 		$loose = array_diff_key( $fields, array_flip( $shown ) );
 
 		if ( [] !== $loose ) {
-			$this->render_table( $set, $loose, '' );
+			$this->render_table( $set, $loose, '', $errors );
 		}
 	}
 
@@ -699,10 +769,11 @@ private function render_sections( string $tab ): void {
 	 * @param Field[]  $fields The fields to render.
 	 * @param string   $scope  The section these belong to, or empty for the
 	 *                         fields no section claimed.
+	 * @param array<string, string> $errors Messages from the last save, keyed by field.
 	 *
 	 * @return void
 	 */
-	private function render_table( FieldSet $set, array $fields, string $scope ): void {
+	private function render_table( FieldSet $set, array $fields, string $scope, array $errors ): void {
 		$layout = Sections::split( $fields );
 
 		if ( [] !== $layout ) {
@@ -712,13 +783,13 @@ private function render_table( FieldSet $set, array $fields, string $scope ): vo
 			// first one's panels.
 			$sections = Sections::render(
 				$layout,
-				function ( array $group ) use ( $set ): string {
+				function ( array $group ) use ( $set, $errors ): string {
 					if ( [] === $group ) {
 						return '';
 					}
 
 					ob_start();
-					$this->render_rows( $set, $group );
+					$this->render_rows( $set, $group, $errors );
 
 					return (string) ob_get_clean();
 				},
@@ -730,18 +801,19 @@ function ( array $group ) use ( $set ): string {
 			return;
 		}
 
-		$this->render_rows( $set, $fields );
+		$this->render_rows( $set, $fields, $errors );
 	}
 
 	/**
 	 * A set of fields as one settings table.
 	 *
-	 * @param FieldSet $set    The field set.
-	 * @param Field[]  $fields The fields to render.
+	 * @param FieldSet              $set    The field set.
+	 * @param Field[]               $fields The fields to render.
+	 * @param array<string, string> $errors Messages from the last save, keyed by field.
 	 *
 	 * @return void
 	 */
-	private function render_rows( FieldSet $set, array $fields ): void {
+	private function render_rows( FieldSet $set, array $fields, array $errors ): void {
 		echo '<table class="form-table" role="presentation"><tbody>';
 
 		foreach ( $fields as $field ) {
@@ -793,7 +865,7 @@ private function render_rows( FieldSet $set, array $fields ): void {
 				// The header cell is the visible heading here, so the kit
 				// draws none: a group keeps its legend, hidden, so the
 				// grouping is still announced without appearing twice.
-				$set->render_field( $field, '', false ) // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- the kit escapes as it builds.
+				$set->render_field( $field, $errors[ $field->key() ] ?? '', false ) // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- the kit escapes as it builds.
 			);
 		}
 
 
@@ -1133,6 +1133,168 @@ public function test_the_email_bridge_speaks_the_shape_compose_reads(): void {
 		$this->assertSame( [ 'subject' => 'Only this' ], get_setting_fields_email( 'sf_demo', 'receipt' ) );
 	}
 
+	/**
+	 * A required field left empty is refused, and keeps what it held.
+	 *
+	 * `required` used to be an HTML attribute and nothing more: a crafted
+	 * request walked past it and the stored value was deleted. The set now
+	 * refuses it, and this library's part is to say so through the Settings
+	 * API — under the option name, keyed by the field — where options.php
+	 * will find it.
+	 */
+	public function test_a_required_field_left_empty_is_refused_and_kept(): void {
+		$page = $this->validated_page();
+
+		$this->submit( $page, 'one', [ 'first' => 'kept' ] );
+		$this->submit( $page, 'one', [ 'first' => '' ] );
+
+		$this->assertSame( 'kept', $page->get_value( 'first' ) );
+		$this->assertSame(
+			[
+				[
+					'setting' => 'sf_demo',
+					'code'    => 'first',
+					'message' => 'First is required.',
+					'type'    => 'error',
+				],
+			],
+			get_settings_errors( 'sf_demo' )
+		);
+	}
+
+	/**
+	 * After the redirect, the refused field is marked and explained.
+	 *
+	 * The set that refused it belonged to the request that saved.
+	 * options.php stored what was registered in a transient and redirected,
+	 * so the page has to read it back through the Settings API and hand the
+	 * message to the field — which is the difference between a notice at
+	 * the top and a field the user can find.
+	 */
+	public function test_the_page_marks_the_refused_field_after_the_redirect(): void {
+		$page = $this->validated_page();
+
+		$this->submit( $page, 'one', [ 'first' => '' ] );
+		$this->redirect_back();
+
+		$html = $this->render( $page );
+
+		// Once in the notice at the top, once under the field.
+		$this->assertSame( 2, substr_count( $html, 'First is required.' ) );
+		$this->assertStringContainsString( 'notice-error', $html );
+		$this->assertStringContainsString( 'field-kit__error', $html );
+		$this->assertStringContainsString( 'aria-invalid="true"', $html );
+
+		// And not announced as saved: core adds that only when nothing was
+		// registered, which is what registering the error is for.
+		$this->assertStringNotContainsString( 'Settings saved.', $html );
+	}
+
+	/**
+	 * A save that refuses nothing is still announced as saved.
+	 */
+	public function test_a_clean_save_is_announced_as_saved(): void {
+		$page = $this->validated_page();
+
+		$this->submit(
+			$page,
+			'one',
+			[
+				'first'   => 'fine',
+				'contact' => 'dev@example.test',
+			]
+		);
+		$this->redirect_back();
+
+		$html = $this->render( $page );
+
+		$this->assertStringContainsString( 'Settings saved.', $html );
+		$this->assertStringNotContainsString( 'field-kit__error', $html );
+	}
+
+	/**
+	 * A refused value in a write that is not a submission is kept too.
+	 *
+	 * A form save seeds the collector with everything stored, so the set
+	 * leaving a failing field alone is enough. A whole-value write seeds no
+	 * field at all, and the value has to be put back by hand — or a plugin
+	 * calling update_option() with one bad address would drop the good one.
+	 */
+	public function test_a_refused_value_survives_a_whole_value_write(): void {
+		$page = $this->validated_page();
+
+		$this->submit(
+			$page,
+			'one',
+			[
+				'first'   => 'kept',
+				'contact' => 'dev@example.test',
+			]
+		);
+
+		$_POST = [];
+
+		update_option(
+			'sf_demo',
+			[
+				'first'   => 'changed',
+				'contact' => 'not-an-address',
+			]
+		);
+
+		$this->assertSame( 'changed', $page->get_value( 'first' ) );
+		$this->assertSame( 'dev@example.test', $page->get_value( 'contact' ) );
+		$this->assertSame( 'contact', get_settings_errors( 'sf_demo' )[0]['code'] );
+	}
+
+	/**
+	 * A page with a required field and a validated one.
+	 *
+	 * @return SettingFields
+	 */
+	private function validated_page(): SettingFields {
+		return $this->page(
+			[
+				'fields' => [
+					'first'   => [
+						'type'     => 'text',
+						'label'    => 'First',
+						'tab'      => 'one',
+						'required' => true,
+					],
+					'contact' => [
+						'type'     => 'text',
+						'label'    => 'Contact',
+						'tab'      => 'one',
+						'validate' => 'email',
+					],
+				],
+			]
+		);
+	}
+
+	/**
+	 * What options.php does once every option is updated, then the next load.
+	 *
+	 * Modelled rather than stubbed because the decision is core's and the
+	 * point is to pin what this library feeds it: "Settings saved." is added
+	 * only when nothing has been registered, and everything registered rides
+	 * the transient to the load that follows, which carries settings-updated.
+	 *
+	 * @return void
+	 */
+	private function redirect_back(): void {
+		if ( ! count( get_settings_errors() ) ) {
+			add_settings_error( 'general', 'settings_updated', 'Settings saved.', 'success' );
+		}
+
+		set_transient( 'settings_errors', get_settings_errors(), 30 );
+
+		// The next request: a fresh global, and the argument the redirect carries.
+		$GLOBALS['sf_errors']     = [];
+		$_GET['settings-updated'] = 'true';
+	}
+
 	/**
 	 * Render the page and return what it printed.
 	 *