diff --git a/src/Views/layout.php b/src/Views/layout.php
new file mode 100644
index 0000000..d8addef
--- /dev/null
+++ b/src/Views/layout.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+use BattleForge\Http\Escape;
+
+/**
+ * Render the shared document chrome around a body closure.
+ *
+ * @param callable(): void $body     Emits the template's body content.
+ * @param string $csrf               The pre-issued CSRF token (HMAC-verified by the front controller).
+ * @param string $title              Page title; HTML-escaped by the layout.
+ * @param string $extraHead          Optional extra `<head>` content (e.g. a per-template script tag).
+ */
+function render_layout(callable $body, string $csrf, string $title, string $extraHead = ''): void
+{
+    $e = static fn (string $v): string => Escape::html($v);
+    $a = static fn (string $v): string => Escape::attr($v);
+    ?><!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title><?= $e($title) ?></title>
+    <link rel="stylesheet" href="<?= $a('/assets/styles.css') ?>">
+    <meta name="csrf-token" content="<?= $a($csrf) ?>">
+    <?= $extraHead /* trusted raw HTML for the optional extra-head block */ ?>
+</head>
+<body>
+    <?php $body(); ?>
+</body>
+</html>
+    <?php
+}
