Fix #903: Reselect repeats a Same command after Deselect

Select › Reselect repeated the last selection command, but a Select Same
command needs a selected object to compare with, so after Deselect it
failed with "nothing selected". Reselect now remembers the objects that
were selected when the command ran and, with nothing selected, takes the
reference from those still in the document.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/affinity-corpus.yml

@@ -0,0 +1,37 @@
+name: Affinity 3 corpus
+
+on:
+  push:
+    branches: [main]
+    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
+  pull_request:
+    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: affinity-corpus-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  affinity3:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      AFFINITY_CORPUS_REQUIRED: "1"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.95"
+      - name: Fetch pinned and checksum-verified corpus
+        run: cargo xtask corpus --affinity
+      - name: Parse every file and freeze actual Affinity 3 feature retention
+        run: cargo test -p vectorcraft-affinity --all-features -- --nocapture
+      - name: Check every artboard, native save, SVG, PDF and PSD exports
+        run: cargo test -p vectorcraft-engine --test affinity_artboards --test affinity_text --test affinity_corpus -- --nocapture

.github/workflows/freebsd.yml

@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 300
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # The optional craft-fonts build input (Japanese fonts), so the tests that need it run here
       # rather than skip. Pinned; bump deliberately (craftrules standards/fonts.md).
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -67,10 +67,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 150
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
       # Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -97,7 +97,7 @@ jobs:
             for want in '/bin/vectorcraft$' '/bin/vectorcraft-cli$' '/share/applications/.*\.desktop$' '/share/icons/hicolor/' '/share/doc/vectorcraft/NOTICE$' '/share/doc/vectorcraft/OFL-.*\.txt$'; do
               grep -Eq "$want" /var/tmp/contents.txt || { echo "missing from the package: $want"; exit 1; }
             done
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: freebsd-package
           path: dist/release/*

.github/workflows/packaging-lint.yml

@@ -23,7 +23,7 @@ jobs:
     env:
       ACTIONLINT_VERSION: 1.7.12
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install tools
         run: |
           sudo apt-get update
@@ -46,7 +46,7 @@ jobs:
           }
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
-          xmllint --noout packaging/windows/vectorcraft.wxs packaging/macos/*.plist* packaging/linux/*.xml*
+          xmllint --noout packaging/windows/vectorcraft.wxs packaging/windows/vectorcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
           # Windows Installer needs Icon ids ending in .ico or .exe, or shortcuts show a blank icon.
           if grep -oE '<Icon Id="[^"]*"' packaging/windows/vectorcraft.wxs | grep -vE '\.(ico|exe)"$'; then
             echo "::error::Icon Id must end in .ico or .exe"; exit 1
@@ -54,4 +54,13 @@ jobs:
           desktop-file-validate packaging/linux/ai.storyteller.vectorcraft.desktop
           sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.vectorcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
           appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.vectorcraft.yml')); assert m['id'] == 'ai.storyteller.vectorcraft' and m['command'] == 'vectorcraft'"
+          python3 - <<'EOF'
+          import yaml
+          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.yml"))
+          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml"))
+          for m in (src, bundle):
+              assert m["id"] == "ai.storyteller.vectorcraft" and m["command"] == "vectorcraft", m["id"]
+          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
+              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
+          print("Flatpak manifests ok")
+          EOF

.github/workflows/release.yml

@@ -1,9 +1,11 @@
 # Release pipeline: every push to `release` builds signed installers for every platform and
 # creates or updates the draft GitHub Release "VectorCraft v<version>". See docs/releasing.md.
 #
-# All jobs run in the `release` environment (restricted to the `release` branch), which holds
-# the signing secrets. Every secret is optional: missing ones produce unsigned artifacts and a
-# warning, never a failed build.
+# Jobs that sign (macOS, Windows) and the job that creates the release run in the `release`
+# environment (restricted to the `release` branch), which holds the signing secrets. Every secret
+# is optional: missing ones produce unsigned artifacts and a warning, never a failed build. The
+# other jobs sign nothing and get no environment, so a `workflow_dispatch` on any branch is a dry
+# run: they build and upload artifacts, the signed jobs are refused, and no release is drafted.
 name: Release
 
 on:
@@ -35,13 +37,13 @@ jobs:
   version:
     name: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     outputs:
       version: ${{ steps.v.outputs.version }}
       date: ${{ steps.v.outputs.date }}
       prerelease: ${{ steps.v.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - id: v
         name: Resolve version
         run: |
@@ -63,16 +65,16 @@ jobs:
   macos:
     name: macOS universal
     needs: version
-    runs-on: macos-15
+    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
     environment: release
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
       # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -100,7 +102,7 @@ jobs:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
         run: packaging/macos/package.sh --arch universal
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-macos
           path: dist/release/*
@@ -128,10 +130,10 @@ jobs:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
       # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -148,7 +150,9 @@ jobs:
         run: cargo xtask version set "$VECTORCRAFT_VERSION"
       - name: Install WiX
         shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build, sign, package
         shell: pwsh
         env:
@@ -163,7 +167,7 @@ jobs:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
         run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-windows-${{ matrix.arch }}
           path: dist/release/*
@@ -175,7 +179,7 @@ jobs:
     # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
     # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
     runs-on: ${{ matrix.runner }}
-    environment: release
+    # No `environment: release`: Linux packages are not signed (checksums in SHA256SUMS.txt).
     strategy:
       fail-fast: false
       matrix:
@@ -187,10 +191,10 @@ jobs:
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
       NFPM_VERSION: 2.47.0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
       # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -200,7 +204,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml
+            desktop-file-utils appstream python3-yaml zsync
           curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
             "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
           sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
@@ -225,28 +229,73 @@ jobs:
           for appimage in dist/release/*.AppImage; do
             chmod +x "$appimage"
             APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
+            # Update information is embedded, and the .zsync for delta updates sits beside it.
+            # No APPIMAGE_EXTRACT_AND_RUN here: with it the runtime passes --appimage-* flags on
+            # to the app instead of answering them itself.
+            "$appimage" --appimage-updateinformation \
+              | grep -F "gh-releases-zsync|${GITHUB_REPOSITORY%%/*}|${GITHUB_REPOSITORY#*/}|latest|vectorcraft-*-linux-${{ matrix.arch }}.AppImage.zsync"
+            test -s "$appimage.zsync"
           done
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/release/*
           if-no-files-found: error
 
-  freebsd:
-    name: FreeBSD x86_64
-    needs: version
-    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM (same image as freebsd.yml).
-    runs-on: ubuntu-latest
-    timeout-minutes: 150
-    environment: release
+  flatpak:
+    name: Flatpak ${{ matrix.arch }}
+    needs: [version, linux]
+    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
+    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
+    runs-on: ${{ matrix.runner }}
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-24.04 }
+          - { arch: aarch64, runner: ubuntu-24.04-arm }
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      - name: Install flatpak-builder
+        run: |
+          sudo apt-get update
+          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
+          # `appstreamcli compose`, which renders the scalable icon and fails without it.
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
+          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build the Flatpak bundle
+        run: packaging/linux/flatpak-bundle.sh "dist/linux/vectorcraft-$VECTORCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-flatpak-${{ matrix.arch }}
+          path: dist/release/*.flatpak
+          if-no-files-found: error
+
+  freebsd:
+    name: FreeBSD x86_64
+    needs: version
+    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM (same image and packages as
+    # freebsd.yml).
+    runs-on: ubuntu-latest
+    timeout-minutes: 150
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
+    env:
+      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
       # Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -262,6 +311,7 @@ jobs:
         with:
           release: "14.3"
           usesh: true
+          cpu: 4
           mem: 12288
           # Passed through by name; never templated into the script.
           envs: "VECTORCRAFT_VERSION VECTORCRAFT_BUILD_DATE VECTORCRAFT_BUILD_SHA"
@@ -276,7 +326,9 @@ jobs:
             export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
             export CARGO_TARGET_DIR=/var/tmp/vectorcraft-target CARGO_BUILD_JOBS=4
             bash packaging/freebsd/package.sh
-      - uses: actions/upload-artifact@v4
+            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz \
+              | grep -E '/bin/vectorcraft$|/bin/vectorcraft-cli$|/share/applications/ai\.storyteller\.vectorcraft\.desktop$'
+      - uses: actions/upload-artifact@v7
         with:
           name: release-freebsd
           path: dist/release/*
@@ -286,16 +338,16 @@ jobs:
     name: Web (wasm)
     needs: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
       TRUNK_VERSION: 0.21.14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
       # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: abb83316d96aa59c1cf64784289e378fe9fa5695
@@ -319,7 +371,7 @@ jobs:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
         run: packaging/web/package.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-web
           path: dist/release/*
@@ -327,7 +379,9 @@ jobs:
 
   release:
     name: Draft GitHub Release
-    needs: [version, macos, windows, linux, freebsd, web]
+    # Needs the signed jobs, so a branch dry run (where the environment refuses them) never
+    # drafts a release.
+    needs: [version, macos, windows, linux, flatpak, freebsd, web]
     runs-on: ubuntu-latest
     environment: release
     permissions:
@@ -338,7 +392,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GH_REPO: ${{ github.repository }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: release-*
           path: artifacts

.github/workflows/windows-arm64.yml

@@ -1,7 +1,7 @@
 # Windows on ARM: package the ARM64 release the way release.yml does (cross-compiled on an x64
 # runner, unsigned here), then install that MSI on a Windows 11 ARM64 runner, check the installed
 # binaries are ARM64, run the CLI natively, and uninstall. (A native ARM64 `cargo test` job is left
-# out for now: PrintCraft saw an intermittent access violation in egui UI tests there.)
+# out for now: PdfCraft saw an intermittent access violation in egui UI tests there.)
 name: Windows ARM64
 
 on:
@@ -36,8 +36,8 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: aarch64-pc-windows-msvc
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
@@ -45,13 +45,15 @@ jobs:
           key: windows-arm64-package
       - name: Install WiX
         shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build and package (unsigned)
         shell: pwsh
         env:
           DIST: ${{ github.workspace }}\dist\arm64
         run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: vectorcraft-windows-arm64
           path: dist/arm64/*
@@ -64,7 +66,7 @@ jobs:
     runs-on: windows-11-arm
     timeout-minutes: 30
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: vectorcraft-windows-arm64
           path: dist

.github/workflows/windows7.yml

@@ -0,0 +1,43 @@
+# Experimental, unsupported Windows 7 SP1 x64 portable build (docs/windows7.md). It runs by hand and
+# weekly, so ordinary PRs never wait on it, and the weekly run shows when a dependency update starts
+# importing a post-Windows-7 API. packaging/windows/windows7.ps1 does the work: it is the only build
+# that uses the patched vendor/windows-link. A modern Windows runner proves compilation and host
+# smoke tests only: run the checklist in docs/windows7.md on actual Windows 7 before claiming support.
+name: Windows 7 x64 compatibility
+
+on:
+  schedule:
+    - cron: "23 5 * * 1" # weekly
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  build:
+    runs-on: windows-2022
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+        with:
+          arch: x64
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
+        with:
+          toolchain: nightly-2026-10-01
+          components: rust-src
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows7-x64
+      - name: Build, check and test the portable package
+        shell: pwsh
+        run: ./packaging/windows/windows7.ps1 -Test
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: vectorcraft-windows7-x64-portable
+          path: dist/release/vectorcraft-windows7-x64-portable.zip
+          if-no-files-found: error

AGENTS.md

@@ -1,18 +1,24 @@
 # VectorCraft — instructions for agents
 
-VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../printcraft` (Acrobat-class); same conventions.
+VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../pdfcraft` (Acrobat-class); same conventions.
 
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,5 +59,23 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.
+
+## Contributor credits (About window)
+
+- About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
+  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  themselves). See `docs/contributors.md`.
+- **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
+  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
+  whether they want to be credited by more than their username: a real name, a display name, and/or
+  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
+  (copy the template at the top of the file, or run
+  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  and include it in their PR, committed as them. If no, change nothing: they are credited as
+  `@username` anyway.
+- Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
+  GitHub profiles). Never hand-edit `contributors.json`.
+- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
+  re-verifies who wrote each `people.toml` entry; `--check` only verifies).

ASSETS.md

@@ -37,6 +37,9 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/app-icon/vectorcraft.icns` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.ico` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.svg` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
+| `packaging/macos/dmg/background.svg` | Xus Badia (contributed in #493) | Original artwork for VectorCraft's DMG window; links the app icon `assets/app-icon/vectorcraft-small.svg` | MIT OR Apache-2.0 (licensed by the contributor under the project licence) | DMG background source. Text in Inter and JetBrains Mono (OFL-1.1, `assets/fonts`), not embedded; paper grain generated by an SVG `feTurbulence` filter |
+| `packaging/macos/dmg/background.tiff` | Xus Badia (contributed in #493) | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | 1x + 2x DMG background; includes the app icon (see its rows), text rendered from OFL-1.1 fonts and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
+| `packaging/macos/dmg/DS_Store` | Xus Badia (layout, #493) | Written by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | Finder view settings for the DMG (window, icon size and positions, background alias); no machine data |
 | `assets/fonts/Inter-Medium.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-Regular.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-SemiBold.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
@@ -90,6 +93,7 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-alignto-key.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-alignto-selection.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-anchor.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-anchor-smooth.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-appearance.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arc.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arrow-down.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -166,11 +170,11 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-para-justify-left.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-justify-right.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-left.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-para-ltr.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-right.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-para-rtl.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-path-eraser.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pathfinder.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-pen-add.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-pen-delete.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-perspective.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pf-crop.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pf-divide.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -263,6 +267,8 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/paintbrush.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/palette.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pen-tool.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
+| `assets/icons/pen-tool-add.svg` | Lucide Icons and Contributors; badge by VectorCraft contributors | https://lucide.dev (lucide-static v1.49.0 `pen-tool`; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) | Lucide's pen-tool with a plus badge |
+| `assets/icons/pen-tool-delete.svg` | Lucide Icons and Contributors; badge by VectorCraft contributors | https://lucide.dev (lucide-static v1.49.0 `pen-tool`; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) | Lucide's pen-tool with a minus badge |
 | `assets/icons/pencil.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pilcrow.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pin.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
@@ -314,6 +320,7 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `docs/images/shot-2-ribbons.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/ribbons.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/shot-3-sheet.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/feature-sheet.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/shot-4-bezier.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/feature-sheet.vectorcraft` | MIT OR Apache-2.0 |  |
+| `docs/images/shot-5-perspective.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/perspective-city.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-neon-drive.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/neon-drive.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-ribbons.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/ribbons.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-pathfinder.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/feature-sheet.vectorcraft` (artboard 1) | MIT OR Apache-2.0 |  |
@@ -323,3 +330,4 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `examples/neon-drive.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
 | `examples/ribbons.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
 | `examples/feature-sheet.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
+| `examples/perspective-city.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |

CLAUDE.md

@@ -1,18 +1,24 @@
 # VectorCraft — instructions for agents
 
-VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../printcraft` (Acrobat-class); same conventions.
+VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../pdfcraft` (Acrobat-class); same conventions.
 
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,5 +59,5 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.

Cargo.lock

@@ -145,6 +145,21 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -202,6 +217,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "windows-sys 0.60.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -509,6 +525,27 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -916,6 +953,7 @@ dependencies = [
  "egui-wgpu",
  "egui-winit",
  "egui_glow",
+ "glow",
  "glutin",
  "glutin-winit",
  "image",
@@ -1205,6 +1243,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -1650,6 +1694,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
 dependencies = [
+ "brotli",
  "hayro-postscript",
 ]
 
@@ -2238,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "9a7b000cca0783af26837fe2ebd9ddf1c42279463c085b97622ee1d2f444b89e"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -2249,7 +2294,6 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
  "png 0.18.1",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
@@ -2329,6 +2373,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2500,6 +2553,15 @@ dependencies = [
  "objc2-foundation 0.2.2",
 ]
 
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -2716,6 +2778,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -2776,6 +2848,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -3386,6 +3469,15 @@ dependencies = [
  "unicode-script",
 ]
 
+[[package]]
+name = "ruzstd"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -4029,6 +4121,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "ttf-parser"
 version = "0.25.1"
@@ -4038,6 +4141,12 @@ dependencies = [
  "core_maths",
 ]
 
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -4211,9 +4320,10 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "arboard",
+ "block2 0.6.2",
  "clipboard-win",
  "eframe",
  "egui",
@@ -4222,18 +4332,35 @@ dependencies = [
  "muda",
  "objc2 0.6.4",
  "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-core-text",
+ "objc2-foundation 0.3.2",
  "rfd",
  "serde_json",
  "vectorcraft-engine",
+ "vectorcraft-text",
  "vectorcraft-ui-egui",
  "webbrowser",
+ "windows",
  "winit",
  "winresource",
+ "winsafe",
+]
+
+[[package]]
+name = "vectorcraft-affinity"
+version = "0.8.0"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "image",
+ "proptest",
+ "ruzstd",
 ]
 
 [[package]]
 name = "vectorcraft-brush"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde",
@@ -4245,7 +4372,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cad"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4261,8 +4388,11 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cli"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
+ "log",
+ "objc2-core-foundation",
+ "objc2-core-text",
  "serde_json",
  "vectorcraft-color",
  "vectorcraft-doc",
@@ -4273,11 +4403,13 @@ dependencies = [
  "vectorcraft-render",
  "vectorcraft-svg",
  "vectorcraft-testkit",
+ "vectorcraft-text",
+ "windows",
 ]
 
 [[package]]
 name = "vectorcraft-color"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "kurbo 0.13.1",
  "moxcms",
@@ -4289,21 +4421,24 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-doc"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
+ "jpeg-encoder",
  "kurbo 0.13.1",
  "proptest",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
+ "tiff",
  "vectorcraft-color",
  "vectorcraft-geom",
+ "zune-jpeg",
 ]
 
 [[package]]
 name = "vectorcraft-effects"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde_json",
@@ -4317,16 +4452,19 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-engine"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
+ "crc32fast",
  "flate2",
  "image",
  "kurbo 0.13.1",
  "log",
  "proptest",
+ "ruzstd",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
+ "vectorcraft-affinity",
  "vectorcraft-brush",
  "vectorcraft-cad",
  "vectorcraft-color",
@@ -4349,16 +4487,18 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-eps"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "flate2",
  "image",
  "kurbo 0.13.1",
+ "ruzstd",
  "vectorcraft-brush",
  "vectorcraft-color",
  "vectorcraft-doc",
  "vectorcraft-effects",
  "vectorcraft-geom",
+ "vectorcraft-metafile",
  "vectorcraft-render",
  "vectorcraft-testkit",
  "vectorcraft-text",
@@ -4366,7 +4506,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-format"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4380,7 +4520,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-geom"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "kurbo 0.13.1",
  "proptest",
@@ -4392,7 +4532,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-mcp"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "log",
@@ -4411,7 +4551,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-metafile"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4425,7 +4565,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pathops"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "kurbo 0.13.1",
  "linesweeper",
@@ -4437,13 +4577,14 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pdf"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "aes",
  "flate2",
  "hayro-interpret",
  "hayro-syntax",
  "image",
+ "jpeg-encoder",
  "krilla",
  "kurbo 0.13.1",
  "log",
@@ -4451,6 +4592,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
+ "skrifa 0.47.0",
  "smallvec",
  "thiserror 2.0.21",
  "vectorcraft-brush",
@@ -4464,7 +4606,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-plugins"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4478,7 +4620,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-render"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "flate2",
  "gif",
@@ -4503,7 +4645,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-svg"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "flate2",
  "image",
@@ -4527,7 +4669,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-testkit"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4544,20 +4686,25 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-text"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "harfrust 0.13.3",
  "kurbo 0.13.1",
  "log",
  "skrifa 0.47.0",
  "subsetter",
+ "unicode-bidi",
+ "unicode-general-category",
+ "unicode-script",
  "vectorcraft-doc",
  "vectorcraft-geom",
+ "windows-registry",
+ "write-fonts",
 ]
 
 [[package]]
 name = "vectorcraft-tools"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4572,7 +4719,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-trace"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4585,7 +4732,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "egui",
  "egui_extras",
@@ -4593,6 +4740,8 @@ dependencies = [
  "log",
  "serde",
  "serde_json",
+ "toml",
+ "vectorcraft-brush",
  "vectorcraft-cad",
  "vectorcraft-color",
  "vectorcraft-doc",
@@ -4613,7 +4762,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-web"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4622,6 +4771,7 @@ dependencies = [
  "rfd",
  "vectorcraft-engine",
  "vectorcraft-format",
+ "vectorcraft-text",
  "vectorcraft-ui-egui",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -5323,6 +5473,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -5585,12 +5746,36 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"
@@ -5687,7 +5872,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.3.1"
+version = "0.8.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.8.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -33,6 +33,7 @@ vectorcraft-cad = { path = "crates/cad" }
 vectorcraft-eps = { path = "crates/eps" }
 vectorcraft-metafile = { path = "crates/metafile" }
 vectorcraft-plugins = { path = "crates/plugins" }
+vectorcraft-affinity = { path = "crates/affinity" }
 
 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -42,6 +43,7 @@ serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 proptest = "1"
+crc32fast = "1.5"
 # tests: a TCP port bound without listening (connections to it are refused)
 socket2 = "0.6"
 # Sandboxed WebAssembly plug-ins: a pure-Rust interpreter (MIT OR Apache-2.0) that builds for wasm32
@@ -52,7 +54,7 @@ wasmi = { version = "2.0.0", default-features = false, features = ["std", "valid
 wat = "1.228"
 
 # rendering / formats
-vello_cpu = "0.2"
+vello_cpu = { version = "0.2", features = ["f32_pipeline"] }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
 usvg = "0.48"
 krilla = "0.8"
@@ -60,8 +62,14 @@ skrifa = "0.47"
 harfrust = "0.13"
 linesweeper = "0.4"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+# Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
+ruzstd = { version = "0.9", default-features = false, features = ["std"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
+# CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG
+# decoders, read directly (the image crate converts CMYK to RGB).
+tiff = "0.11"
+zune-jpeg = "0.5"
 
 # ui
 egui = "0.36"

NOTICE

@@ -30,7 +30,45 @@ based in part on the work of the Independent JPEG Group.
 WebAssembly plug-ins run in the wasmi interpreter (MIT OR Apache-2.0); its wasmparser dependency is
 under the Apache License 2.0 with the LLVM exception.
 
+The experimental Windows 7 build (packaging/windows/windows7.ps1) compiles a modified copy of the
+windows-link crate 0.2.1 (vendor/windows-link; Microsoft, MIT OR Apache-2.0) that binds CoTaskMemFree
+through ole32.dll. Its license texts are in vendor/windows-link and ship in that build's ZIP; every
+other build uses the unmodified crate from crates.io.
+
 Builds made with craft-fonts (the CRAFT_FONTS_DIR build option; all official releases) embed the
-fonts listed in https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (today BIZ
-UDPGothic, Shippori Mincho and BIZ UDMincho; web builds BIZ UDPGothic Regular only) under the SIL
+fonts listed in https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic,
+Shippori Mincho, BIZ UDMincho, Noto Sans CJK SC and Noto Sans Arabic in the current manifest;
+web builds BIZ UDPGothic Regular only) under the SIL
 Open Font License 1.1. Their license texts ship with the release packages as OFL-<family>.txt.
+
+PDF import decodes CJK text with Adobe's CMap resources (https://github.com/adobe-type-tools/cmap-resources),
+compiled into the app through the hayro-cmap crate under the BSD 3-Clause License:
+
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -40,7 +40,7 @@
 <br>
 
 <p align="center">
-  <img src="docs/images/shot-1-neon.png" alt="VectorCraft editing the Neon Drive poster: the title is selected, the Appearance panel shows its live Outer Glow, and the Properties panel shows its character settings" width="100%">
+  <img src="docs/images/shot-1-neon.png" alt="VectorCraft editing the Neon Drive poster: the title is selected, the Appearance panel shows the settings of its live Outer Glow, and the Properties panel shows its character settings" width="100%">
   <br><sub><b>Neon Drive</b>: a Pathfinder-cut sun, live Outer Glow on the type and grid, and clipping masks · <code>examples/neon-drive.vectorcraft</code></sub>
 </p>
 
@@ -54,6 +54,7 @@
   <a href="#why-vectorcraft">Why VectorCraft</a> ·
   <a href="#quick-start">Quick start</a> ·
   <a href="#status">Status</a> ·
+  <a href="#downloads">Downloads</a> ·
   <a href="#the-crafting-apps">The Crafting Apps</a> ·
   <a href="#license-and-credits">License</a>
 </p>
@@ -63,8 +64,8 @@
 <table>
 <tr>
 <td width="50%" valign="top">
-  <img src="docs/images/shot-2-ribbons.png" alt="Three live blend ribbons of 55 to 70 steps with smooth colour, clipped to the artboard, with the Layers panel open" width="100%">
-  <p align="center"><sub><b>Live Blends</b>: editable key paths and smooth colour, clipped to the artboard</sub></p>
+  <img src="docs/images/shot-2-ribbons.png" alt="Three live blend ribbons clipped to the artboard, one selected with its key paths showing; the Layers panel lists the clip group, the blends and the selected blend's two key paths" width="100%">
+  <p align="center"><sub><b>Live Blends and Layers</b>: editable key paths, smooth colour, every object a row</sub></p>
 </td>
 <td width="50%" valign="top">
   <img src="docs/images/shot-4-bezier.png" alt="Direct Selection tool showing anchor points and Bézier handles on a crescent built with Pathfinder, with the contextual task bar below it" width="100%">
@@ -72,7 +73,11 @@
 </td>
 </tr>
 <tr>
-<td colspan="2" valign="top">
+<td width="50%" valign="top">
+  <img src="docs/images/shot-5-perspective.png" alt="Two lit building facades drawn on the left and right planes of a two-point perspective grid at sunset, with the Perspective Selection tool and the Plane Switching Widget" width="100%">
+  <p align="center"><sub><b>Perspective Grid</b>: art attached to its planes stays editable in perspective · <code>examples/perspective-city.vectorcraft</code></sub></p>
+</td>
+<td width="50%" valign="top">
   <img src="docs/images/shot-3-sheet.png" alt="Four artboards in the light UI theme: Pathfinder, Gradient Mesh, radial Repeat and Envelope Distort" width="100%">
   <p align="center"><sub><b>Multiple artboards, light theme</b>: Pathfinder · Gradient Mesh · live radial Repeat · Envelope Distort · <code>examples/feature-sheet.vectorcraft</code></sub></p>
 </td>
@@ -158,6 +163,21 @@ Japanese fonts come from [storytold/craft-fonts](https://github.com/storytold/cr
 build input (releases always use it): `CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo run --release -p vectorcraft` (an absolute path).
 Without it, Japanese text uses the installed system fonts. See [`docs/development.md`](docs/development.md#fonts-craft-fonts-optional-build-input).
 
+On machines with two graphics processors, VectorCraft renders on the power-saving (integrated) one by default on
+Windows and macOS, and on the one the desktop runs on under Linux. To choose, use **Preferences › Performance ›
+Graphics Processor** and restart. If a graphics processor can't show the window, VectorCraft starts again on the
+next one. To pick one when starting the app, set `WGPU_POWER_PREF=high` (or `low`), or `WGPU_ADAPTER_NAME` to part of
+its name, such as `WGPU_ADAPTER_NAME=nvidia` (see [`docs/development.md`](docs/development.md#desktop-graphics-processor)).
+
+On native Wayland, winit 0.30 does not deliver dropped files. To open an SVG, use File › Open;
+to place artwork in the current document, copy and paste the file in a file manager; or run
+under XWayland (`WAYLAND_DISPLAY= vectorcraft`) for file drag-and-drop
+(see [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
+
+On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
+respond to it yet (#491). Start the app under XWayland instead: `WAYLAND_DISPLAY= vectorcraft` (see
+[`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
+
 ### Use it from Claude Code and other agents
 
 Register the MCP server with Claude Code:
@@ -168,15 +188,27 @@ claude mcp add vectorcraft -- /path/to/vectorcraft-cli mcp
 
 The details are in [`docs/mcp.md`](docs/mcp.md) and [`docs/control-protocol.md`](docs/control-protocol.md).
 
+For the experimental, unsupported 64-bit Windows 7 build, see [Windows 7 instructions](docs/windows7.md).
+
 ## Status
 
 VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) covers what ships today, the
 milestones, and honest time-to-parity estimates.
 
-**Where we are (2026-10-06):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
+**Where we are (2026-10-09):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
-Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles and threading, and
-files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The scores are
+Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
+files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package).
+Affinity documents (`.af` from Affinity 3, `.afdesign`, `.afpub` and, by their content, `.afphoto` from Affinity 1 and 2) open
+and place natively: layers, groups, artboards and pages, curves and shapes, fills, gradients and strokes, clipping
+and masks, text and images, with what didn't come in (effects, adjustments, brushes, master pages…) listed in the
+import warning; a file whose native data can't be read opens as its embedded preview, saying why. VectorCraft
+doesn't write Affinity files. Current `.af` validation includes 33 pinned files, native save/reload
+and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
+[Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
+The interface
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish, French, Italian, Russian and Ukrainian (and Czech and Brazilian Portuguese in the menus).
+The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 
 **What's missing:**
@@ -200,6 +232,51 @@ Agent and contributor rules (clean-room, the asset policy, no panics in shipped
 explains how VectorCraft avoids crashing, and [`docs/releasing.md`](docs/releasing.md) how releases are built,
 signed and published. Every bundled asset is listed with its licence in [`ASSETS.md`](ASSETS.md).
 
+## Downloads
+
+**New to VectorCraft?** Download it from the [VectorCraft page on getartcraft.com](https://getartcraft.com/apps/vectorcraft). That's the easiest way to install it.
+
+**Want a specific build or format?** On GitHub, the [latest release](https://github.com/storytold/vectorcraft/releases/latest) has every build listed below, and [all releases](https://github.com/storytold/vectorcraft/releases) has earlier versions and their notes. `<ver>` in the file names is the version number, and `SHA256SUMS.txt` lists a checksum for every file.
+
+### Windows
+
+| Build | Installer | Portable |
+|---|---|---|
+| x64 (64-bit Intel/AMD) | `vectorcraft-<ver>-windows-x64.msi` | `vectorcraft-<ver>-windows-x64-portable.zip` |
+| arm64 (Snapdragon and other ARM PCs) | `vectorcraft-<ver>-windows-arm64.msi` | `vectorcraft-<ver>-windows-arm64-portable.zip` |
+| x86 (32-bit) | `vectorcraft-<ver>-windows-x86.msi` | `vectorcraft-<ver>-windows-x86-portable.zip` |
+
+Installers and executables are code-signed.
+
+### macOS
+
+| Build | File | Notes |
+|---|---|---|
+| App, universal (Apple silicon + Intel) | `vectorcraft-<ver>-macos-universal.dmg` | Signed and notarized |
+| Command-line tool, universal | `vectorcraft-cli-<ver>-macos-universal.zip` | Signed and notarized |
+
+### Linux
+
+| Format | x86_64 | aarch64 (ARM64) | Notes |
+|---|---|---|---|
+| AppImage | `vectorcraft-<ver>-linux-x86_64.AppImage` | `vectorcraft-<ver>-linux-aarch64.AppImage` | Runs anywhere; updates itself with [AppImageUpdate](https://github.com/AppImageCommunity/AppImageUpdate) (`.zsync` files) |
+| Flatpak | `vectorcraft-<ver>-linux-x86_64.flatpak` | `vectorcraft-<ver>-linux-aarch64.flatpak` | Sandboxed; `flatpak install --user <file>` |
+| Debian/Ubuntu | `vectorcraft-<ver>-linux-x86_64.deb` | `vectorcraft-<ver>-linux-aarch64.deb` | |
+| Fedora/RHEL/openSUSE | `vectorcraft-<ver>-linux-x86_64.rpm` | `vectorcraft-<ver>-linux-aarch64.rpm` | |
+| Tarball | `vectorcraft-<ver>-linux-x86_64.tar.gz` | `vectorcraft-<ver>-linux-aarch64.tar.gz` | Unpack anywhere |
+
+### FreeBSD
+
+| Build | File |
+|---|---|
+| x86_64 | `vectorcraft-<ver>-freebsd-x86_64.tar.gz` |
+
+### Web (WebAssembly)
+
+| Build | File | Notes |
+|---|---|---|
+| Static site | `vectorcraft-web-<ver>.zip` | Runs in a modern browser; host it on any static server |
+
 ## The Crafting Apps
 
 VectorCraft is one of the **Crafting Apps**: free, open-source creative tools from the
@@ -212,7 +289,7 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/vectorcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.vectorcraft.png" alt="" width="32" height="32"> | **VectorCraft** | **Vector illustration · you are here** | [GitHub](https://github.com/storytold/vectorcraft) | [Website](https://getartcraft.com/apps/vectorcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/filmcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.filmcraft.png" alt="" width="32" height="32"> | **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/lightcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.lightcraft.png" alt="" width="32" height="32"> | **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/printcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.printcraft.png" alt="" width="32" height="32"> | **PrintCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/printcraft) | [Website](https://getartcraft.com/apps/printcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
 
@@ -240,6 +317,10 @@ And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video stud
   <a href="https://getartcraft.com/apps/vectorcraft">VectorCraft</a>
 </p>
 
+## Star history
+
+[![Star History Chart](https://api.star-history.com/svg?repos=storytold/vectorcraft&type=Date&legend=top-left)](https://www.star-history.com/?repos=storytold%2Fvectorcraft&type=date&legend=top-left)
+
 ## License and credits
 
 VectorCraft is dual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option.
@@ -247,8 +328,8 @@ Copyright (c) 2026 ArtCraft Team and the VectorCraft contributors. Required noti
 
 Bundled fonts, icons, images and other assets keep their own open licenses; each one is listed
 with its author, source and license in [ASSETS.md](ASSETS.md). Release builds also embed the
-Japanese fonts of [craft-fonts](https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md)
-(SIL Open Font License 1.1).
+fonts of [craft-fonts](https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md) (Japanese,
+Simplified Chinese and Arabic faces; SIL Open Font License 1.1).
 
 The app icon (an engraved dragon on VectorCraft red, `#e8573f`) is the owner's original artwork; its
 palette and files are in [`assets/app-icon/`](assets/app-icon/README.md).

apps/vectorcraft-cli/Cargo.toml

@@ -22,7 +22,20 @@ vectorcraft-geom = { workspace = true }
 vectorcraft-svg = { workspace = true }
 vectorcraft-mcp = { workspace = true }
 vectorcraft-render = { workspace = true }
+vectorcraft-text = { workspace = true }
 serde_json = { workspace = true }
+log = { workspace = true }
+
+# DirectWrite's system font collection (the desktop app's src/system_fonts.rs, shared): fonts that
+# font services such as Adobe Fonts load in place (#579). MIT OR Apache-2.0.
+[target.'cfg(all(windows, not(target_vendor = "win7")))'.dependencies]
+windows = { version = "0.62", features = ["Win32_Graphics_DirectWrite"] }
+
+# CoreText's font manager (the desktop app's src/mac_fonts.rs, shared): fonts that apps and font
+# managers register from their own folders (#579). Zlib OR Apache-2.0 OR MIT.
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2-core-foundation = { version = "0.3", default-features = false, features = ["std", "CFArray", "CFString", "CFURL"] }
+objc2-core-text = { version = "0.3", default-features = false, features = ["std", "CTFontManager"] }
 
 [dev-dependencies]
 vectorcraft-testkit = { workspace = true }

apps/vectorcraft-cli/src/main.rs

@@ -4,12 +4,14 @@
 //! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless]
 //! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}']]... [--export out.svg]... [--scale 2]
 //! vectorcraft-cli commands
-//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text]
+//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text] [--replace-lossy]
 //! vectorcraft-cli info FILE
 //! vectorcraft-cli bench FILE [--size 2880x1800] [--iters 5]
 //! vectorcraft-cli perf [--paths 50000]
 //! ```
-#![forbid(unsafe_code)]
+// Denied, not forbidden: the font listers shared with the desktop app allow it for their
+// DirectWrite (Windows) and CoreText (macOS) calls, and nothing else may.
+#![deny(unsafe_code)]
 
 use std::io::Write;
 use std::process::ExitCode;
@@ -34,7 +36,18 @@ macro_rules! out {
     }};
 }
 
+/// The desktop app's CoreText font lister, shared: exports and MCP find the same fonts.
+#[cfg(target_os = "macos")]
+#[path = "../../vectorcraft/src/mac_fonts.rs"]
+mod mac_fonts;
 mod perf;
+/// The desktop app's settings folder, shared: exports and MCP read the same Fonts folder.
+#[path = "../../vectorcraft/src/prefs_dir.rs"]
+mod prefs_dir;
+/// The desktop app's DirectWrite font lister, shared: exports and MCP find the same fonts.
+#[cfg(all(windows, not(target_vendor = "win7")))]
+#[path = "../../vectorcraft/src/system_fonts.rs"]
+mod system_fonts;
 
 use serde_json::{Value, json};
 use vectorcraft_mcp::{Backend, DEFAULT_ADDR, Headless, Remote, Server};
@@ -65,14 +78,19 @@ USAGE:
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
-  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text]
+  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--replace-lossy]
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
       formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
-      Live effects are kept; --outline-text writes SVG text as paths.
+      Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
+      SVG's data-* attributes; --outline-text writes SVG text as paths. OUT may not be IN when reading
+      IN left things out (hidden text, art or layers it could not read; the notes say which) unless
+      --replace-lossy is given.
 
   vectorcraft-cli info FILE
-      Print a JSON summary: title, colour mode, units, artboards, object counts by kind, fonts.
+      Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
+      read from its preview and why), title, colour mode, units, artboards, object counts by
+      kind, fonts.
 
   vectorcraft-cli bench FILE [--size WxH] [--iters N]
       Render FILE (any readable format) fitted to WxH (default 2880x1800) and print ms per frame
@@ -90,6 +108,12 @@ fn usage() -> String {
 }
 
 fn main() -> ExitCode {
+    // Before any font lookup: the fonts font services load (#579).
+    #[cfg(all(windows, not(target_vendor = "win7")))]
+    system_fonts::install();
+    #[cfg(target_os = "macos")]
+    mac_fonts::install();
+    prefs_dir::install_fonts();
     let args: Vec<String> = std::env::args().skip(1).collect();
     let r = match args.first().map(String::as_str) {
         Some("mcp") => mcp(&args[1..]),
@@ -161,7 +185,7 @@ fn commands() -> Result<(), String> {
 
 fn convert(args: &[String]) -> Result<(), String> {
     let mut files = vec![];
-    let (mut scale, mut artboard, mut range, mut outline_text) = (1.0f64, None::<u64>, None::<String>, false);
+    let (mut scale, mut artboard, mut range, mut outline_text, mut replace_lossy) = (1.0f64, None::<u64>, None::<String>, false, false);
     let mut it = args.iter();
     while let Some(a) = it.next() {
         match a.as_str() {
@@ -169,18 +193,17 @@ fn convert(args: &[String]) -> Result<(), String> {
             "--artboard" | "-a" => artboard = Some(it.next().and_then(|v| v.parse().ok()).ok_or("--artboard needs an index")?),
             "--range" | "-r" => range = Some(it.next().cloned().ok_or("--range needs artboards such as 1-3,5")?),
             "--outline-text" => outline_text = true,
+            "--replace-lossy" => replace_lossy = true,
             f => files.push(f.to_string()),
         }
     }
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
     let mut h = Headless::new();
     h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
-    let r = h
-        .call(
-            "engine.execute",
-            json!({"command": "document.export", "params": {"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text}}),
-        )
-        .map_err(|e| format!("export {output}: {e}"))?;
+    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
+    // PSD).
+    let params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
+    let r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     outln!("{r}");
     Ok(())
 }
@@ -188,7 +211,7 @@ fn convert(args: &[String]) -> Result<(), String> {
 fn info(args: &[String]) -> Result<(), String> {
     let file = args.first().ok_or("info needs a FILE")?;
     let mut h = Headless::new();
-    h.call("app.open", json!({"path": file})).map_err(|e| format!("open {file}: {e}"))?;
+    let opened = h.call("app.open", json!({"path": file})).map_err(|e| format!("open {file}: {e}"))?;
     let base = h.call("engine.execute", json!({"command": "file.info", "params": {}}))?;
     let doc = h.session.doc().map_err(|e| e.to_string())?.doc.clone();
     let mut kinds: std::collections::BTreeMap<&'static str, usize> = Default::default();
@@ -196,7 +219,8 @@ fn info(args: &[String]) -> Result<(), String> {
     let fonts = h.call("engine.execute", json!({"command": "text.fonts", "params": {}})).unwrap_or(Value::Null);
     let artboards: Vec<Value> =
         doc.artboards.iter().map(|a| json!({"name": a.name, "rect": [a.rect.x0, a.rect.y0, a.rect.width(), a.rect.height()]})).collect();
-    let v = json!({"file": file, "info": base, "artboards": artboards, "kinds": kinds, "fonts": fonts});
+    // What didn't come in as it was (an EPS read from its preview says why).
+    let v = json!({"file": file, "warnings": opened["warnings"], "info": base, "artboards": artboards, "kinds": kinds, "fonts": fonts});
     outln!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
     Ok(())
 }
@@ -245,17 +269,23 @@ fn run(args: &[String]) -> Result<(), String> {
     } else if !matches!(steps.first(), Some(Step::Cmd(id, _)) if id == "file.new") {
         h.ensure_document();
     }
+    // Each step's result, for later steps to refer to (`"$1.id"`, see `vectorcraft_engine::steps`).
+    let mut results = vec![];
     for step in steps {
-        match step {
+        let r = match step {
             Step::Cmd(id, params) => {
+                let params = vectorcraft_engine::steps::resolve(&params, &results).map_err(|e| format!("{id}: {e}"))?;
                 let r = h.call("engine.execute", json!({"command": id, "params": params})).map_err(|e| format!("{id}: {e}"))?;
                 emit(json!({"step": "cmd", "command": id, "result": r}))?;
+                r
             }
             Step::Export(path) => {
                 let r = h.call("app.export", json!({"path": path, "scale": scale})).map_err(|e| format!("export {path}: {e}"))?;
                 emit(json!({"step": "export", "result": r}))?;
+                r
             }
-        }
+        };
+        results.push(r);
     }
     Ok(())
 }

apps/vectorcraft-cli/src/perf.rs

@@ -70,6 +70,49 @@ fn load_average() -> Option<f64> {
     text.split_whitespace().map(|t| t.trim_matches(|c| c == '{' || c == '}')).find_map(|t| t.parse().ok())
 }
 
+/// Milliseconds per pointer move of a Direct Selection drag of a handle, then of a segment, of a
+/// 5,000-anchor wave of smooth anchors added on top of the synthetic `n`-path document.
+fn edit_drags(n: usize) -> Result<(f64, f64), String> {
+    use vectorcraft_engine::tools::{Mods, PointerEvent, PointerKind};
+    use vectorcraft_geom::{Anchor, PathData, SubPath, Vec2};
+    let mut doc = synthetic(n)?;
+    let l = doc.layers.first().map(|l| l.id);
+    let id = doc.alloc_id();
+    // Anchors 2 pt apart, up and down by 20 pt, their handles 0.6 pt long.
+    let anchor = |i: usize| {
+        let p = Point::new(i as f64 * 2.0, if i.is_multiple_of(2) { 500.0 } else { 520.0 });
+        Anchor::smooth(p, p + Vec2::new(0.6, 0.0))
+    };
+    let path = PathData::single(SubPath::new((0..5000).map(anchor).collect(), false));
+    doc.insert(l, usize::MAX, Node::path(id, path, Appearance::default_art())).map_err(|e| e.to_string())?;
+    let mut s = vectorcraft_engine::Session::new();
+    s.add_document(doc, None);
+    let view = vectorcraft_engine::ViewInfo { zoom: 8.0, ..Default::default() };
+    let err = |e: vectorcraft_engine::EngineError| e.to_string();
+    let mut drag = |down: Point| -> Result<f64, String> {
+        let ev = |kind, y: f64| PointerEvent { kind, pos: down + Vec2::new(0.0, y), mods: Mods::default(), pressure: 1.0 };
+        s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 400]]})).map_err(err)?;
+        s.select_tool("directSelection", view).map_err(err)?;
+        let undo = s.doc().map_err(err)?.history.undo.len();
+        s.pointer(&ev(PointerKind::Down, 0.0), view).map_err(err)?;
+        let mut y = 0.0;
+        let ms = median_ms(9, || {
+            y += 3.0;
+            // A failed move shows as the missing undo step below.
+            let _ = s.pointer(&ev(PointerKind::Drag, y), view);
+        });
+        s.pointer(&ev(PointerKind::Up, y), view).map_err(err)?;
+        if s.doc().map_err(err)?.history.undo.len() != undo + 1 {
+            return Err(format!("the drag from {down:?} made no undo step"));
+        }
+        Ok(ms)
+    };
+    // Anchor 400 is at (800, 500): its outgoing handle's end, then its segment to anchor 401.
+    let handle = drag(Point::new(800.6, 500.0))?;
+    let segment = drag(Point::new(801.0, 510.0))?;
+    Ok((handle, segment))
+}
+
 pub fn run(args: &[String]) -> Result<(), String> {
     let mut n = 50_000usize;
     let mut it = args.iter();
@@ -145,6 +188,15 @@ pub fn run(args: &[String]) -> Result<(), String> {
         }
     });
     rows.push(("Pathfinder Unite, 1,000 paths", unite, 150.0));
+
+    // Path editing: one pointer move of a Direct Selection drag (the tool event and the preview it
+    // applies), on a 5,000-anchor path among the synthetic paths.
+    let (handle, segment) = edit_drags(n).unwrap_or_else(|e| {
+        failed = Some(e);
+        (0.0, 0.0)
+    });
+    rows.push(("handle drag, 5,000-anchor path (per move)", handle, 8.0));
+    rows.push(("segment drag, 5,000-anchor path (per move)", segment, 8.0));
     if let Some(e) = failed {
         return Err(e);
     }

apps/vectorcraft-cli/tests/cli.rs

@@ -83,6 +83,155 @@ fn mcp_headless_over_stdio() {
     assert_eq!(replies[3]["result"]["content"][0]["type"], "image");
 }
 
+/// End-to-end protocol sweep over stdio against the compiled binary. The in-process
+/// tests drive `Server::handle_line` directly, so the binary's own wiring (argument
+/// parsing, logger install, stdout pollution, notification order) is untested: this
+/// drives the real `mcp --headless` process through prompts, completions, resource
+/// templates, logging and the error taxonomy instead.
+#[test]
+fn mcp_protocol_over_stdio() {
+    use std::io::{BufRead, BufReader};
+    let mut child =
+        Command::new(BIN).args(["mcp", "--headless"]).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut lines = BufReader::new(child.stdout.take().unwrap()).lines();
+    let mut notes = vec![];
+
+    fn send(stdin: &mut std::process::ChildStdin, v: Value) {
+        writeln!(stdin, "{v}").unwrap();
+    }
+    // Next reply with this id; notifications (no id) are stashed for later.
+    fn recv(lines: &mut std::io::Lines<BufReader<std::process::ChildStdout>>, notes: &mut Vec<Value>, id: u64) -> Value {
+        loop {
+            let line = lines.next().unwrap().unwrap();
+            let v: Value = serde_json::from_str(&line).unwrap();
+            assert_eq!(v["jsonrpc"], "2.0", "{v}");
+            if v.get("id").and_then(|i| i.as_u64()) == Some(id) {
+                return v;
+            }
+            notes.push(v);
+        }
+    }
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"0"}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 1);
+    assert_eq!(r["result"]["serverInfo"]["name"], "vectorcraft");
+    assert!(r["result"]["capabilities"]["prompts"].is_object(), "{r}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","method":"notifications/initialized"}));
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":2,"method":"prompts/list","params":{}}));
+    let r = recv(&mut lines, &mut notes, 2);
+    assert!(r["result"]["prompts"].as_array().is_some_and(|p| !p.is_empty()), "{r}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":3,"method":"prompts/get","params":{"name":"poster","arguments":{"brief":"a jazz festival"}}}));
+    let r = recv(&mut lines, &mut notes, 3);
+    assert!(r["result"]["messages"][0]["content"]["text"].as_str().is_some_and(|t| t.contains("a jazz festival")), "{r}");
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":4,"method":"completion/complete","params":{"ref":{"type":"ref/prompt","name":"export-set"},"argument":{"name":"formats","value":"sv"}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 4);
+    assert!(r["result"]["completion"]["values"].as_array().is_some_and(|v| v.contains(&json!("svg"))), "{r}");
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":5,"method":"resources/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 3));
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":6,"method":"resources/templates/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 6)["result"]["resourceTemplates"].as_array().is_some_and(|v| v.len() >= 4));
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":7,"method":"tools/call","params":{"name":"draw_shape","arguments":{"shape":"rectangle","x":10,"y":10,"width":60,"height":40}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 7);
+    assert_eq!(r["result"]["isError"], false, "{r}");
+    let id: i64 = serde_json::from_str::<Value>(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap()["id"].as_i64().unwrap();
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":8,"method":"resources/read","params":{"uri": format!("vectorcraft://object/{id}")}}));
+    let r = recv(&mut lines, &mut notes, 8);
+    let body: Value = serde_json::from_str(r["result"]["contents"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(body["id"].as_i64(), Some(id), "{body}");
+
+    // Unknown resources (-32002) and bad template values (-32602) stay apart.
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":9,"method":"resources/read","params":{"uri":"vectorcraft://nope" }}));
+    assert_eq!(recv(&mut lines, &mut notes, 9)["error"]["code"], -32002);
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":10,"method":"resources/read","params":{"uri":"vectorcraft://object/"}}));
+    assert_eq!(recv(&mut lines, &mut notes, 10)["error"]["code"], -32602);
+
+    // Large containers slice through run_command document.node: a truncated level reports
+    // childCount, and a bad limit is a tool error, not a crash or a full read.
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":20,"method":"tools/call","params":{"name":"draw_shape","arguments":{"shape":"ellipse","x":90,"y":10,"width":30,"height":30}}}),
+    );
+    assert_eq!(recv(&mut lines, &mut notes, 20)["result"]["isError"], false);
+    let run = |id: u64, command: &str, params: Value| json!({"jsonrpc":"2.0","id":id,"method":"tools/call","params":{"name":"run_command","arguments":{"command":command,"params":params}}});
+    send(&mut stdin, run(21, "select.all", json!({})));
+    recv(&mut lines, &mut notes, 21);
+    send(&mut stdin, run(22, "object.group", json!({})));
+    let r = recv(&mut lines, &mut notes, 22);
+    let group = serde_json::from_str::<Value>(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap()["id"].clone();
+    send(&mut stdin, run(23, "document.node", json!({"id": group, "summary": true, "childLimit": 1})));
+    let r = recv(&mut lines, &mut notes, 23);
+    let sliced: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(sliced["children"].as_array().map(Vec::len), Some(1), "{sliced}");
+    assert_eq!(sliced["childCount"], 2, "{sliced}");
+    send(&mut stdin, run(24, "document.node", json!({"id": group, "summary": true, "depth": -1})));
+    assert_eq!(recv(&mut lines, &mut notes, 24)["result"]["isError"], true);
+
+    // Skeleton then drill: a depth-0 inspect is the layer skeleton with counts, and
+    // document.find locates nodes without dumping the tree.
+    send(&mut stdin, run(25, "document.inspect", json!({"depth": 0})));
+    let r = recv(&mut lines, &mut notes, 25);
+    let skel: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert!(skel["layers"][0].get("children").is_none(), "{skel}");
+    assert!(skel["artboards"].as_array().is_some_and(|a| !a.is_empty()), "{skel}");
+    send(&mut stdin, run(26, "document.find", json!({"kind": "ellipse"})));
+    let r = recv(&mut lines, &mut notes, 26);
+    let found: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(found["total"], 1, "{found}");
+    assert!(found["matches"][0]["path"].as_array().is_some_and(|p| !p.is_empty()), "{found}");
+    send(&mut stdin, run(27, "document.find", json!({})));
+    assert_eq!(recv(&mut lines, &mut notes, 27)["result"]["isError"], true);
+
+    // The binary installed its logger: records arrive as notifications/message, and only
+    // after the client asked for them.
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":11,"method":"logging/setLevel","params":{"level":"debug"}}));
+    assert!(recv(&mut lines, &mut notes, 11).get("error").is_none());
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":12,"method":"tools/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 12)["result"]["tools"].as_array().is_some_and(|v| !v.is_empty()));
+
+    // Malformed input is a parse error, and the server keeps serving afterwards.
+    stdin.write_all(b"{not json\n").unwrap();
+    let parse_err: Value = loop {
+        let line = lines.next().unwrap().unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        if v.get("error").is_some() {
+            break v;
+        }
+        notes.push(v);
+    };
+    assert_eq!(parse_err["error"]["code"], -32700);
+    assert!(parse_err["id"].is_null(), "{parse_err}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":13,"method":"ping","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 13).get("error").is_none());
+    drop(stdin);
+    // Drain whatever the debug window queued; every line off the protocol stream parses.
+    for line in lines.by_ref() {
+        let line = line.unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        assert_eq!(v["jsonrpc"], "2.0", "{v}");
+        notes.push(v);
+    }
+    let out = child.wait_with_output().unwrap();
+    assert!(out.status.success());
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("panicked"));
+    let messages = notes.iter().filter(|n| n["method"] == "notifications/message").count();
+    assert!(messages > 0, "no log records after logging/setLevel: {notes:?}");
+}
+
 /// `vectorcraft-cli commands | head -1` panicked with "failed printing to
 /// stdout: Broken pipe (os error 32)" and exit status 101.
 #[test]

apps/vectorcraft-cli/tests/fileio.rs

@@ -82,3 +82,14 @@ fn help_lists_readable_formats() {
     let out = ok(&["--help"]);
     assert!(out.contains("Readable formats: .vectorcraft") && out.contains(".ait") && out.contains(".webp"), "{out}");
 }
+
+/// `info` reports the import warnings: an EPS read only up to an error names it.
+#[test]
+fn info_reports_why_an_eps_read_partly() {
+    let eps = tmp("partial.eps");
+    std::fs::write(&eps, "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n0 0 10 10 rectfill frobnicate\n%%EOF\n").unwrap();
+    let v = info(&eps);
+    let w = v["warnings"][0].as_str().unwrap_or_default();
+    assert!(w.contains("`frobnicate`"), "{v}");
+    assert_eq!(v["kinds"]["Path"], 1, "{v}");
+}

apps/vectorcraft-web/Cargo.toml

@@ -17,6 +17,7 @@ path = "src/main.rs"
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
 vectorcraft-format = { workspace = true }
+vectorcraft-text = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
 
@@ -27,4 +28,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator", "RequestInit", "Response", "AbortController", "AbortSignal"] }

apps/vectorcraft-web/Trunk.toml

@@ -8,3 +8,11 @@ filehash = true
 [serve]
 addresses = ["127.0.0.1"]
 port = 8766
+
+# Copy the craft-fonts faces web builds fetch (crates/text/web-fonts.txt) into the site's fonts/
+# folder; a no-op without CRAFT_FONTS_DIR. Runs for `trunk serve` and `trunk build`, through cargo so
+# it needs no shell (xtask/src/web_fonts.rs).
+[[hooks]]
+stage = "post_build"
+command = "cargo"
+command_arguments = ["xtask", "web-fonts"]

apps/vectorcraft-web/src/fonts.rs

@@ -0,0 +1,109 @@
+//! Craft-fonts faces served beside the wasm (`fonts/<sha16>/…`, copied by
+//! `cargo xtask web-fonts`) instead of embedded: [`load_startup_fonts`] fetches the `startup`
+//! ones before the app starts, [`spawn_background_fonts`] the rest once it runs. The browser checks
+//! each file against its SHA-256 (Subresource Integrity). A face that fails is logged and skipped:
+//! the app runs without it. With `WEB_FONTS` empty (built without craft-fonts) both do nothing.
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+use vectorcraft_text::{FontDb, WEB_FONTS, WebFont};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen_futures::JsFuture;
+
+/// Per startup face: the page shows its loading text meanwhile.
+const STARTUP_TIMEOUT_MS: i32 = 20_000;
+/// Per background face.
+const BACKGROUND_TIMEOUT_MS: i32 = 120_000;
+/// Background fetches at once, leaving the connection to the app's own requests.
+const BACKGROUND_PARALLEL: usize = 4;
+
+thread_local! {
+    /// The background fetch runs once per page, though a graphics restart creates the app again.
+    static BACKGROUND_STARTED: Cell<bool> = const { Cell::new(false) };
+}
+
+/// Fetch and register the `startup` faces (one after the other). Returns how many loaded.
+pub async fn load_startup_fonts() -> usize {
+    let mut loaded = 0;
+    for f in WEB_FONTS.iter().filter(|f| f.startup) {
+        if load(f, STARTUP_TIMEOUT_MS).await {
+            loaded += 1;
+        }
+    }
+    loaded
+}
+
+/// Fetch and register the `background` faces, [`BACKGROUND_PARALLEL`] at a time, asking `ctx` for
+/// a frame after each so the font menus and the canvas pick it up. Only the first call does
+/// anything.
+pub fn spawn_background_fonts(ctx: egui::Context) {
+    if BACKGROUND_STARTED.with(|s| s.replace(true)) {
+        return;
+    }
+    let queue: Rc<Vec<&'static WebFont>> = Rc::new(WEB_FONTS.iter().filter(|f| !f.startup).collect());
+    let next = Rc::new(Cell::new(0usize));
+    for _ in 0..BACKGROUND_PARALLEL.min(queue.len()) {
+        let (queue, next, ctx) = (queue.clone(), next.clone(), ctx.clone());
+        wasm_bindgen_futures::spawn_local(async move {
+            loop {
+                let i = next.get();
+                next.set(i + 1);
+                let Some(f) = queue.get(i) else { break };
+                if load(f, BACKGROUND_TIMEOUT_MS).await {
+                    ctx.request_repaint();
+                }
+            }
+        });
+    }
+}
+
+/// Fetch one face and add it to the font database. False (and a console warning) on failure.
+async fn load(f: &WebFont, timeout_ms: i32) -> bool {
+    let bytes = match fetch(f.url, f.integrity, timeout_ms).await {
+        Ok(bytes) => bytes,
+        Err(e) => {
+            log::warn!("web font {} {}: {e}", f.family, f.style);
+            return false;
+        }
+    };
+    if FontDb::global().add_font(bytes) == 0 {
+        log::warn!("web font {} {}: not a font, or already loaded", f.family, f.style);
+        return false;
+    }
+    true
+}
+
+/// GET `url` (relative to the page) with Subresource Integrity `integrity`, aborted after
+/// `timeout_ms`.
+async fn fetch(url: &str, integrity: &str, timeout_ms: i32) -> Result<Vec<u8>, String> {
+    let window = web_sys::window().ok_or("no window")?;
+    let abort = web_sys::AbortController::new().map_err(js)?;
+    let init = web_sys::RequestInit::new();
+    init.set_method("GET");
+    init.set_integrity(integrity);
+    init.set_signal(Some(&abort.signal()));
+    let on_timeout = {
+        let abort = abort.clone();
+        Closure::<dyn FnMut()>::new(move || abort.abort())
+    };
+    let timer = window.set_timeout_with_callback_and_timeout_and_arguments_0(on_timeout.as_ref().unchecked_ref(), timeout_ms).map_err(js)?;
+    let result = async {
+        let response: web_sys::Response = JsFuture::from(window.fetch_with_str_and_init(url, &init)).await.map_err(js)?.dyn_into().map_err(js)?;
+        if !response.ok() {
+            return Err(format!("HTTP {} for {url}", response.status()));
+        }
+        let buffer = JsFuture::from(response.array_buffer().map_err(js)?).await.map_err(js)?;
+        Ok(js_sys::Uint8Array::new(&buffer).to_vec())
+    }
+    .await;
+    window.clear_timeout_with_handle(timer);
+    // Kept alive until the timer can no longer fire.
+    drop(on_timeout);
+    result
+}
+
+fn js(e: wasm_bindgen::JsValue) -> String {
+    format!("{e:?}")
+}

apps/vectorcraft-web/src/locks.rs

@@ -0,0 +1,122 @@
+//! The browser's Web Locks (`navigator.locks`), which tell Data Recovery whether another tab still
+//! runs ([`vectorcraft_engine::cmd::recovery::RecoveryStore::announce`]). A tab holds a lock named
+//! after its recovery area for as long as it lives; the browser releases it only when the tab is
+//! gone (closed, crashed or reloaded), not while its timers are paused in the background, which a
+//! heartbeat can't tell apart.
+//!
+//! web-sys has Web Locks only as an unstable API, so they are reached through `js_sys::Reflect`.
+//! Pages that aren't secure (plain `http://` other than localhost) and older browsers have none:
+//! heartbeats alone decide there.
+
+use std::cell::RefCell;
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::{Arc, Mutex};
+
+use js_sys::{Function, Promise, Reflect};
+use vectorcraft_engine::cmd::recovery::Hold;
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+
+/// How often the snapshot of the locks held is refreshed (ms).
+const REFRESH_MS: i32 = 10_000;
+/// How old a snapshot may be and still be trusted (ms). A lock asked for after the snapshot was
+/// taken comes with a heartbeat, which stays fresh for at least three minutes, so anything under
+/// that is safe; an older snapshot counts every area as held.
+const FRESH_MS: f64 = 60_000.0;
+
+thread_local! {
+    /// What releases each lock this tab holds, by name: it resolves the promise the lock is held
+    /// by (wasm runs on one thread).
+    static RELEASE: RefCell<BTreeMap<String, Function>> = const { RefCell::new(BTreeMap::new()) };
+}
+
+/// The locks of the page, named `<prefix><area>`.
+#[derive(Clone)]
+pub struct WebLocks {
+    prefix: &'static str,
+    /// The areas whose locks were held at the last snapshot, and when it was asked for (ms since
+    /// the epoch). `navigator.locks.query()` is asynchronous, so the snapshot is refreshed every
+    /// [`REFRESH_MS`] and read from here.
+    seen: Arc<Mutex<(f64, BTreeSet<String>)>>,
+}
+
+/// `navigator.locks`, if the browser has it here.
+fn manager() -> Option<JsValue> {
+    let locks = Reflect::get(&web_sys::window()?.navigator(), &"locks".into()).ok()?;
+    locks.is_object().then_some(locks)
+}
+
+/// Method `name` of `obj`.
+fn method(obj: &JsValue, name: &str) -> Option<Function> {
+    Reflect::get(obj, &name.into()).ok()?.dyn_into().ok()
+}
+
+impl WebLocks {
+    /// The page's Web Locks with a first snapshot of them, kept fresh from then on; `None` when
+    /// the browser has none or won't say which are held (heartbeats alone decide then).
+    pub async fn start(prefix: &'static str) -> Option<Self> {
+        let locks = Self { prefix, seen: Arc::new(Mutex::new((f64::NEG_INFINITY, BTreeSet::new()))) };
+        locks.refresh().await?;
+        let again = locks.clone();
+        let tick = Closure::<dyn FnMut()>::new(move || {
+            let locks = again.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                // A failed refresh leaves the snapshot to age, and every area counts as held.
+                let _ = locks.refresh().await;
+            });
+        });
+        web_sys::window()?.set_interval_with_callback_and_timeout_and_arguments_0(tick.as_ref().unchecked_ref(), REFRESH_MS).ok()?;
+        // The timer lives as long as the page.
+        tick.forget();
+        Some(locks)
+    }
+
+    /// Take a new snapshot of the locks held.
+    async fn refresh(&self) -> Option<()> {
+        let m = manager()?;
+        let asked = js_sys::Date::now();
+        let query: Promise = method(&m, "query")?.call0(&m).ok()?.dyn_into().ok()?;
+        let snapshot = wasm_bindgen_futures::JsFuture::from(query).await.ok()?;
+        let held = js_sys::Array::from(&Reflect::get(&snapshot, &"held".into()).ok()?);
+        let areas = held
+            .iter()
+            .filter_map(|l| Reflect::get(&l, &"name".into()).ok()?.as_string())
+            .filter_map(|n| n.strip_prefix(self.prefix).map(str::to_string))
+            .collect();
+        *self.seen.lock().unwrap_or_else(|e| e.into_inner()) = (asked, areas);
+        Some(())
+    }
+
+    /// Does a tab hold `area`'s lock? Yes when the last snapshot is too old to tell.
+    pub fn held(&self, area: &str) -> bool {
+        let seen = self.seen.lock().unwrap_or_else(|e| e.into_inner());
+        js_sys::Date::now() - seen.0 > FRESH_MS || seen.1.contains(area)
+    }
+
+    /// Hold `area`'s lock until the returned hold is dropped (or the page goes).
+    pub fn hold(&self, area: &str) -> Option<Hold> {
+        let m = manager()?;
+        let name = format!("{}{area}", self.prefix);
+        // The lock is held until this promise resolves: when the hold is dropped.
+        let mut release = None;
+        let until = Promise::new(&mut |resolve, _| release = Some(resolve));
+        let release = release?;
+        let granted = Closure::once_into_js(move |_lock: JsValue| until);
+        method(&m, "request")?.call2(&m, &name.clone().into(), &granted).ok()?;
+        RELEASE.with(|r| r.borrow_mut().insert(name.clone(), release));
+        Some(Box::new(LockHold(name)))
+    }
+}
+
+/// A lock this tab holds (by name), released when dropped.
+struct LockHold(String);
+
+impl Drop for LockHold {
+    fn drop(&mut self) {
+        if let Some(resolve) = RELEASE.with(|r| r.borrow_mut().remove(&self.0)) {
+            // Resolving can't fail in a way worth reporting: the lock goes with the page anyway.
+            let _ = resolve.call0(&JsValue::NULL);
+        }
+    }
+}

apps/vectorcraft-web/src/main.rs

@@ -11,8 +11,13 @@
 //! - Save / Export trigger a browser download;
 //! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox.
 //!
-//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
+//! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod fonts;
+#[cfg(target_arch = "wasm32")]
+mod locks;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/web.rs

@@ -1,76 +1,187 @@
-//! The browser shell: web `Services`, drag-and-drop, and the eframe web runner.
+//! The browser shell: web `Services`, drag-and-drop, pasted pictures and files, the eframe web
+//! runner, and starting again with new graphics when the page loses them (#369).
 
-use std::cell::Cell;
+use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 
 use vectorcraft_engine::Session;
+use vectorcraft_engine::cmd::clipboard::{FILE_HEAD, Flavour, PASTE_ORDER, file_flavour, is_address};
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_engine::cmd::recovery::RecoveryStore;
+use vectorcraft_engine::cmd::recovery::{self, Hold, RecoveryStore};
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
+use vectorcraft_ui_egui::i18n;
 use vectorcraft_ui_egui::place::{DropTarget, PlaceArrival, PlaceInbox};
 use vectorcraft_ui_egui::print::{PrintJob, PrintService, Printer};
 use vectorcraft_ui_egui::{Services, VectorcraftApp};
 use wasm_bindgen::JsCast as _;
 
+use crate::locks::WebLocks;
+
 type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
 type DragPos = Rc<Cell<Option<(f32, f32, bool)>>>;
 
+/// A picture or file pasted into the page, read and waiting for the next frame with the modifiers
+/// held at the paste, and the context to wake for it (the current runner's).
+#[derive(Default)]
+struct Pasted {
+    flavour: Option<(Flavour, egui::Modifiers)>,
+    ctx: Option<egui::Context>,
+}
+
 const CANVAS_ID: &str = "vectorcraft_canvas";
 const LOADING_ID: &str = "vectorcraft_loading";
 
+/// How many times the page starts again with new graphics after losing them before it gives up
+/// (a GPU that keeps failing).
+const MAX_RESTARTS: u32 = 3;
+
+/// What the page keeps while the app runs, across graphics restarts.
+#[derive(Clone)]
+struct Host {
+    runner: eframe::WebRunner,
+    inbox: Inbox,
+    place_inbox: PlaceInbox,
+    drag: DragPos,
+    pasted: Rc<RefCell<Pasted>>,
+    /// The page's Web Locks for Data Recovery, started once before the first frame: a graphics
+    /// restart keeps them, so the tab stays the owner of its recovery area.
+    locks: Option<WebLocks>,
+    /// Graphics restarts so far.
+    restarts: u32,
+}
+
 pub fn start() {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
-    wasm_bindgen_futures::spawn_local(async {
-        let Some(document) = web_sys::window().and_then(|w| w.document()) else {
-            log::error!("no document");
-            return;
+    let Some(canvas) = element(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
+        log::error!("missing <canvas id=\"{CANVAS_ID}\">");
+        return;
+    };
+    detect_language();
+    wasm_bindgen_futures::spawn_local(async move {
+        // Before the first frame, which looks for copies a crash left behind.
+        let locks = WebLocks::start(RECOVERY_PREFIX).await;
+        // Fallback fonts the first frame needs (Noto Sans Arabic), fetched while the loading text
+        // shows; the rest load in the background once the app runs.
+        crate::fonts::load_startup_fonts().await;
+        let host = Host {
+            runner: eframe::WebRunner::new(),
+            inbox: Arc::default(),
+            place_inbox: Arc::default(),
+            drag: DragPos::default(),
+            pasted: Rc::default(),
+            locks,
+            restarts: 0,
         };
-        let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
-            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
-            return;
-        };
-        let drag = track_drag(&canvas);
-        let mut options = eframe::WebOptions::default();
-        if query().contains("webgl")
-            && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
-        {
-            create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
-        }
-        let result = eframe::WebRunner::new()
-            .start(
-                canvas,
-                options,
-                Box::new(move |cc| {
-                    if let Some(rs) = &cc.wgpu_render_state {
-                        log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+        track_paste(&host.pasted);
+        run(host, canvas, None).await;
+    });
+}
+
+/// An app whose graphics were lost, on its way to new ones.
+struct Moving {
+    app: VectorcraftApp,
+    /// Its unsaved changes are kept in recovery copies ([`VectorcraftApp::graphics_lost`]).
+    kept: bool,
+}
+
+/// Run the app on `canvas`: the `moving` one when starting again after losing the graphics, else
+/// a new one.
+async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Moving>) {
+    track_drag(&canvas, &host.drag);
+    let kept = moving.as_ref().map(|m| m.kept);
+    // The app until the new runner takes it (still here if starting fails before).
+    let slot = Rc::new(RefCell::new(moving.map(|m| m.app)));
+    let (runner, taken, page) = (host.runner.clone(), slot.clone(), canvas.clone());
+    let result = runner
+        .start(
+            canvas,
+            web_options(),
+            Box::new(move |cc| {
+                let ctx = &cc.egui_ctx;
+                crate::fonts::spawn_background_fonts(ctx.clone());
+                let loss = GraphicsLoss::default();
+                watch_canvas(&page, &loss, ctx);
+                if let Some(rs) = &cc.wgpu_render_state {
+                    log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+                    let (loss, ctx) = (loss.clone(), ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                host.pasted.borrow_mut().ctx = Some(ctx.clone());
+                let services = services(host.inbox.clone(), host.place_inbox.clone(), ctx.clone(), host.locks.clone());
+                let app = match taken.borrow_mut().take() {
+                    Some(mut app) => {
+                        // The old services asked the old context for frames.
+                        app.services = services;
+                        app.status("The graphics were lost and have been restarted");
+                        app
                     }
-                    let inbox: Inbox = Arc::default();
-                    let place_inbox: PlaceInbox = Arc::default();
-                    let app = VectorcraftApp::new(Session::new(), services(inbox.clone(), place_inbox.clone(), cc.egui_ctx.clone()));
-                    Ok(Box::new(WebShell { app, inbox, place_inbox, drag }))
-                }),
-            )
-            .await;
-        if let Some(el) = document.get_element_by_id(LOADING_ID) {
-            match result {
-                Ok(()) => el.remove(),
-                Err(e) => el.set_inner_html(&format!("<p>VectorCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>")),
+                    None => VectorcraftApp::new(Session::new(), services),
+                };
+                Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
+            }),
+        )
+        .await;
+    match (result, kept) {
+        (Ok(()), _) => {
+            if let Some(el) = element(LOADING_ID) {
+                el.remove();
             }
         }
-    });
+        (Err(e), None) => notice(&[&format!("VectorCraft failed to start: {}", js_err(e)), "A browser with WebGPU or WebGL2 is required."]),
+        (Err(e), Some(kept)) => {
+            log::error!("vectorcraft-web: couldn't restart the graphics: {}", js_err(e));
+            give_up(slot.borrow_mut().take(), kept);
+        }
+    }
+}
+
+/// The runner's options: wgpu (WebGPU where available, else WebGL2; `?webgl` forces WebGL2).
+fn web_options() -> eframe::WebOptions {
+    let mut options = eframe::WebOptions::default();
+    if query().contains("webgl")
+        && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
+    {
+        create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
+    }
+    options
+}
+
+/// Tell the UI the browser's languages (`?lang=es` in the address first, as `VECTORCRAFT_LOCALE`
+/// does on the desktop) before the first frame, so the Automatic interface language follows the
+/// browser; and show the loading text in that language.
+fn detect_language() {
+    let mut tags: Vec<String> = query_param("lang").into_iter().collect();
+    if let Some(navigator) = web_sys::window().map(|w| w.navigator()) {
+        tags.extend(navigator.languages().iter().filter_map(|v| v.as_string()));
+        tags.extend(navigator.language());
+    }
+    i18n::set_system_locales(tags.as_slice());
+    if let Some(el) = element(LOADING_ID) {
+        el.set_text_content(Some(i18n::message(i18n::system_lang(), "Loading VectorCraft…").as_str()));
+    }
+}
+
+/// The value of `name=` in the address's query, if given.
+fn query_param(name: &str) -> Option<String> {
+    let query = query();
+    query.trim_start_matches('?').split('&').find_map(|kv| kv.strip_prefix(name)?.strip_prefix('=').map(str::to_string)).filter(|v| !v.is_empty())
 }
 
 fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
-/// Follow file drags over the canvas: drag events carry the pointer position, which egui doesn't
-/// get during a drag.
-fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
-    let pos = DragPos::default();
+fn element(id: &str) -> Option<web_sys::Element> {
+    web_sys::window()?.document()?.get_element_by_id(id)
+}
+
+/// Follow file drags over `canvas` into `pos`: drag events carry the pointer position, which egui
+/// doesn't get during a drag.
+fn track_drag(canvas: &web_sys::HtmlCanvasElement, pos: &DragPos) {
     let p = pos.clone();
     let on_drag = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::DragEvent)>::new(move |e: web_sys::DragEvent| {
         p.set(Some((e.offset_x() as f32, e.offset_y() as f32, e.shift_key())));
@@ -80,36 +191,180 @@ fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
             log::error!("couldn't follow {kind} events: {e:?}");
         }
     }
-    // The listener lives as long as the page.
+    // The listener lives as long as the canvas.
     on_drag.forget();
-    pos
+}
+
+/// Take pictures and files pasted into the page (egui reads a paste's text only): a paste without
+/// text hands the first of its files that is art (a bitmap, SVG, PDF, a metafile) to the next
+/// frame. Text, SVG markup among it, is left to egui.
+fn track_paste(pasted: &Rc<RefCell<Pasted>>) {
+    let Some(window) = web_sys::window() else { return };
+    let pasted = pasted.clone();
+    let on_paste = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::ClipboardEvent)>::new(move |e: web_sys::ClipboardEvent| {
+        let Some(data) = e.clipboard_data() else { return };
+        let Some(files) = data.files().filter(|f| f.length() > 0) else { return };
+        // Text is egui's, but for the address a browser's Copy Image puts next to the picture.
+        if data.get_data("text").is_ok_and(|t| !t.is_empty() && !is_address(&t)) {
+            return;
+        }
+        e.prevent_default();
+        let held = pasted.borrow().ctx.as_ref().map(|c| c.input(|i| i.modifiers)).unwrap_or_default();
+        let files: Vec<web_sys::File> = (0..files.length()).filter_map(|i| files.get(i)).collect();
+        let pasted = pasted.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            for file in files {
+                let bytes = match wasm_bindgen_futures::JsFuture::from(file.array_buffer()).await {
+                    Ok(buf) => js_sys::Uint8Array::new(&buf).to_vec(),
+                    Err(e) => {
+                        log::error!("couldn't read the pasted file {}: {}", file.name(), js_err(e));
+                        continue;
+                    }
+                };
+                if let Some(mime) = file_flavour(&file.name(), bytes.get(..FILE_HEAD).unwrap_or(&bytes), &PASTE_ORDER) {
+                    let mut p = pasted.borrow_mut();
+                    p.flavour = Some((Flavour { mime, data: bytes }, held));
+                    if let Some(ctx) = &p.ctx {
+                        ctx.request_repaint();
+                    }
+                    return;
+                }
+            }
+        });
+    });
+    // Captured before eframe's own listener, which stops the event.
+    if let Err(e) = window.add_event_listener_with_callback_and_bool("paste", on_paste.as_ref().unchecked_ref(), true) {
+        log::error!("couldn't follow paste events: {e:?}");
+    }
+    // The listener lives as long as the page.
+    on_paste.forget();
+}
+
+/// Report the loss of `canvas`'s WebGL context to `loss` (WebGPU devices report theirs through
+/// wgpu).
+fn watch_canvas(canvas: &web_sys::HtmlCanvasElement, loss: &GraphicsLoss, ctx: &egui::Context) {
+    let (loss, ctx) = (loss.clone(), ctx.clone());
+    let on_lost = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::Event)>::new(move |_: web_sys::Event| {
+        loss.report(&ctx, "the WebGL context was lost");
+    });
+    if let Err(e) = canvas.add_event_listener_with_callback("webglcontextlost", on_lost.as_ref().unchecked_ref()) {
+        log::error!("couldn't watch for a lost WebGL context: {e:?}");
+    }
+    // The listener lives as long as the canvas.
+    on_lost.forget();
+}
+
+/// A new canvas in place of `old`, whose graphics were lost (a canvas whose WebGL context is lost
+/// can't get another).
+fn fresh_canvas(old: &web_sys::HtmlCanvasElement) -> Result<web_sys::HtmlCanvasElement, String> {
+    let new: web_sys::HtmlCanvasElement = old.clone_node().map_err(js_err)?.dyn_into().map_err(|_| "not a canvas")?;
+    old.replace_with_with_node_1(&new).map_err(js_err)?;
+    Ok(new)
+}
+
+/// The graphics are lost for good: the dead canvas goes (it would show a stale picture), the app
+/// (if still here) lets go of its recovery copies so the reloaded page offers them at once, and
+/// the page says what to do.
+fn give_up(app: Option<VectorcraftApp>, kept: bool) {
+    if let Some(mut app) = app {
+        recovery::leave(&mut app.session);
+    }
+    if let Some(canvas) = element(CANVAS_ID) {
+        canvas.remove();
+    }
+    notice(&[
+        "The graphics were lost and couldn't be restarted.",
+        if kept {
+            "Your unsaved changes are kept in this browser: reload the page to get them back."
+        } else {
+            "Reload the page to go on (changes not saved yet may be lost)."
+        },
+    ]);
+}
+
+/// Show `lines` in the middle of the page (where the loading message was).
+fn notice(lines: &[&str]) {
+    let Some(document) = web_sys::window().and_then(|w| w.document()) else { return };
+    let el = match document.get_element_by_id(LOADING_ID) {
+        Some(el) => el,
+        None => {
+            let Ok(el) = document.create_element("div") else { return };
+            el.set_id(LOADING_ID);
+            let Some(body) = document.body() else { return };
+            if let Err(e) = body.append_child(&el) {
+                log::error!("couldn't show a message: {e:?}");
+            }
+            el
+        }
+    };
+    el.set_text_content(None);
+    for line in lines {
+        if let Ok(p) = document.create_element("p") {
+            p.set_text_content(Some(i18n::message(i18n::system_lang(), line).as_str()));
+            // Best effort: the log has the message too.
+            el.append_child(&p).ok();
+        }
+    }
 }
 
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
 /// and feed them through the inboxes: placed where they were dropped on the canvas, else opened.
+/// When the graphics are lost it hands the app to a new runner on a new canvas.
 struct WebShell {
-    app: VectorcraftApp,
-    inbox: Inbox,
-    place_inbox: PlaceInbox,
-    drag: DragPos,
+    /// `None` once handed on.
+    app: Option<VectorcraftApp>,
+    host: Host,
+    canvas: web_sys::HtmlCanvasElement,
+    loss: GraphicsLoss,
+}
+
+impl WebShell {
+    /// The graphics were lost (`why`): keep recovery copies, then start again on a new canvas
+    /// with the same app once this frame is over (the runner is busy with it until then).
+    fn restart(&mut self, why: &str) {
+        let Some(mut app) = self.app.take() else { return };
+        let kept = app.graphics_lost(why);
+        let mut host = self.host.clone();
+        host.restarts += 1;
+        let canvas =
+            if host.restarts > MAX_RESTARTS { Err(format!("the graphics were lost {MAX_RESTARTS} times")) } else { fresh_canvas(&self.canvas) };
+        match canvas {
+            Ok(canvas) => wasm_bindgen_futures::spawn_local(run(host, canvas, Some(Moving { app, kept }))),
+            Err(e) => {
+                log::error!("vectorcraft-web: giving up on the graphics: {e}");
+                let runner = host.runner;
+                wasm_bindgen_futures::spawn_local(async move { runner.destroy() });
+                give_up(Some(app), kept);
+            }
+        }
+    }
 }
 
 impl eframe::App for WebShell {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if let Some(why) = self.loss.take() {
+            self.restart(&why);
+        }
+        let Some(app) = &mut self.app else { return };
+        let pasted = self.host.pasted.borrow_mut().flavour.take();
+        if let Some((f, held)) = pasted {
+            app.paste_from_host(ctx, f, held);
+        }
         let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
         if !dropped.is_empty() {
-            let at = self.drag.take();
+            let at = self.host.drag.take();
             let z = ctx.zoom_factor();
-            let target = self.app.drop_target(at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
+            let (pos, shift) = (at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
             for f in dropped {
-                let (inbox, place_inbox, ctx) = (self.inbox.clone(), self.place_inbox.clone(), ctx.clone());
+                let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
+                let target = app.drop_target(&name, pos, shift);
+                let (inbox, place_inbox, ctx) = (self.host.inbox.clone(), self.host.place_inbox.clone(), ctx.clone());
                 wasm_bindgen_futures::spawn_local(async move {
-                    let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
                     match f.bytes_async().await {
                         Ok(bytes) => {
                             match target {
-                                DropTarget::Place { at, embed } => {
-                                    place_inbox.lock().unwrap_or_else(|e| e.into_inner()).push(PlaceArrival { name, bytes, drop: Some((at, embed)) })
+                                DropTarget::Place(d) => {
+                                    place_inbox.lock().unwrap_or_else(|e| e.into_inner()).push(PlaceArrival { name, bytes, drop: Some(d) })
                                 }
                                 DropTarget::Open => inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes)),
                             }
@@ -120,19 +375,23 @@ impl eframe::App for WebShell {
                 });
             }
         }
-        self.app.logic(ctx);
+        app.logic(ctx);
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.app.raw_input_hook(raw);
+        if let Some(app) = &mut self.app {
+            app.raw_input_hook(raw);
+        }
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.app.ui(ui);
+        if let Some(app) = &mut self.app {
+            app.ui(ui);
+        }
     }
 }
 
-fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Services {
+fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Option<WebLocks>) -> Services {
     let open_inbox = inbox.clone();
     let picked = place_inbox.clone();
     let place_ctx = ctx.clone();
@@ -174,7 +433,7 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
             }
         })),
         inbox: Some(inbox),
-        recovery_store: Some(Arc::new(BrowserStore)),
+        recovery_store: Some(Arc::new(BrowserStore { locks })),
         // File → Print: the browser's print dialog.
         print: Some(Box::new(BrowserPrint)),
         ..Default::default()
@@ -183,8 +442,12 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
 
 /// Data Recovery's store on the web: the browser's local storage (kept across visits and shared by
 /// the site's tabs), each entry as base64 under [`RECOVERY_PREFIX`]`<area>/<name>`. It has no
-/// locks: each tab holds its area with a heartbeat, judged by the browser's clock.
-struct BrowserStore;
+/// locks: each tab holds its area with a heartbeat, judged by the browser's clock, and with a Web
+/// Lock named after it where the browser has them (`locks`), which a tab whose timers are paused
+/// in the background keeps.
+struct BrowserStore {
+    locks: Option<WebLocks>,
+}
 
 const RECOVERY_PREFIX: &str = "vectorcraft-recovery/";
 
@@ -220,6 +483,12 @@ impl RecoveryStore for BrowserStore {
     fn now(&self) -> Option<i64> {
         Some((js_sys::Date::now() / 1000.0) as i64)
     }
+    fn announce(&self, area: &str) -> Option<Hold> {
+        self.locks.as_ref()?.hold(area)
+    }
+    fn announced(&self, area: &str) -> Option<bool> {
+        self.locks.as_ref().map(|l| l.held(area))
+    }
 }
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.

apps/vectorcraft/Cargo.toml

@@ -9,17 +9,26 @@ default-run = "vectorcraft"
 [lints]
 workspace = true
 
+[features]
+default = ["wgpu", "accessibility"]
+wgpu = ["eframe/wgpu", "dep:winsafe"]
+accessibility = ["eframe/accesskit"]
+# Build with --no-default-features --features windows7 and the win7 Rust target.
+windows7 = ["eframe/glow"]
+
 [dependencies]
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
+vectorcraft-text = { workspace = true }
+eframe = { workspace = true, features = ["default_fonts", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+# wayland-data-control: native Wayland clipboard (Linux; X11 through XWayland only sees what X11 apps copied).
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
 image = { workspace = true }
 webbrowser = { workspace = true }
 # The window's monitors, size and position (the same winit eframe runs on).
@@ -27,11 +36,30 @@ winit = { version = "0.30", default-features = false }
 
 [target.'cfg(windows)'.dependencies]
 clipboard-win = { workspace = true }
+# Which GPU drives which display (EnumDisplayDevices, src/gpu.rs), so the window is drawn on the
+# GPU that shows it: drawing on a GPU without a monitor reset the display driver. Safe wrappers over
+# Win32 (MIT); the `user` feature is User32.dll only. Only the wgpu renderer chooses an adapter.
+winsafe = { version = "0.0.29", default-features = false, features = ["user"], optional = true }
+
+# DirectWrite's system font collection (src/system_fonts.rs): fonts that font services such as
+# Adobe Fonts load in place (#579). MIT OR Apache-2.0, already in the build through accesskit.
+[target.'cfg(all(windows, not(target_vendor = "win7")))'.dependencies]
+windows = { version = "0.62", features = ["Win32_Graphics_DirectWrite"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
-muda = { version = "0.21", default-features = false }
+# The macOS menu bar (src/mac_menu.rs): Tauri's menu crate, AppKit menus behind a safe API (no GTK
+# with default features off). Pinned exactly: review the diff before bumping.
+muda = { version = "=0.21.1", default-features = false }
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSTextInputContext"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSMenu", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
+# Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+block2 = "0.6"
+# CoreText's font manager (src/mac_fonts.rs): fonts that apps and font managers register from their
+# own folders (#579). Zlib OR Apache-2.0 OR MIT; objc2-core-foundation already comes with
+# objc2-foundation.
+objc2-core-foundation = { version = "0.3", default-features = false, features = ["std", "CFArray", "CFString", "CFURL"] }
+objc2-core-text = { version = "0.3", default-features = false, features = ["std", "CTFontManager"] }
 
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.

apps/vectorcraft/src/clipboard.rs

@@ -2,13 +2,20 @@
 //! (`Services::system_clipboard`).
 //!
 //! - Windows: text, SVG, PDF, PNG and an opaque bitmap (for apps that don't read PNG) in one go;
-//!   Paste reads each of them.
+//!   Paste reads each of them, a bitmap as PNG, else as the device-independent bitmap that
+//!   screenshots and most apps copy (`CF_DIBV5`, `CF_DIB`; the system makes them of a `CF_BITMAP`).
 //! - macOS and Linux: one format at a time, the text (a type-only copy's text or the SVG markup),
-//!   else the PNG as a bitmap; Paste reads text and bitmaps.
+//!   else the PNG as a bitmap; Paste reads text and bitmaps (on macOS the pasteboard's PNG or TIFF
+//!   as they are, as screenshots copy them). On Wayland, arboard's data-control
+//!   backend reads the compositor's clipboard (X11 through XWayland only sees what X11 apps
+//!   copied), falling back to X11 where the compositor lacks the protocol.
+//! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, a
+//!   metafile or a bitmap), before the clipboard's other formats (the files' paths as text).
 
-use std::io::Cursor;
+use std::io::{Cursor, Read};
+use std::path::PathBuf;
 
-use vectorcraft_engine::cmd::clipboard::{BITMAP, Flavour, PNG, TEXT};
+use vectorcraft_engine::cmd::clipboard::{BITMAP, FILE_HEAD, Flavour, PNG, TEXT, file_flavour};
 use vectorcraft_ui_egui::SystemClipboard;
 
 /// This platform's system clipboard.
@@ -25,10 +32,96 @@ fn text_of(flavours: &[Flavour]) -> Option<String> {
     flavours.iter().find(|f| f.mime == TEXT).map(|f| String::from_utf8_lossy(&f.data).into_owned())
 }
 
+/// Most pixels a side of a bitmap another app put on the clipboard (untrusted data).
+const MAX_SIDE: u32 = 32_768;
+
 fn decode_png(png: &[u8]) -> Option<image::RgbaImage> {
     Some(image::load_from_memory_with_format(png, image::ImageFormat::Png).ok()?.to_rgba8())
 }
 
+/// `img` as a PNG flavour.
+fn png_flavour(img: &image::RgbaImage) -> Option<Flavour> {
+    let mut data = vec![];
+    img.write_to(&mut Cursor::new(&mut data), image::ImageFormat::Png).ok()?;
+    Some(Flavour { mime: PNG, data })
+}
+
+/// A Windows device-independent bitmap (`CF_DIB`, `CF_DIBV5`: a BITMAPINFO header, the colour
+/// masks of a BITMAPINFOHEADER, the colour table, then the pixels) as a BMP file, whose header
+/// says where the pixels start. `None` when the header is cut short or out of range.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_file(dib: &[u8]) -> Option<Vec<u8>> {
+    const BI_BITFIELDS: u32 = 3;
+    const BI_ALPHABITFIELDS: u32 = 6;
+    let u16_at = |i: usize| Some(u16::from_le_bytes(dib.get(i..i + 2)?.try_into().ok()?));
+    let u32_at = |i: usize| Some(u32::from_le_bytes(dib.get(i..i + 4)?.try_into().ok()?));
+    let header = u32_at(0)?;
+    // BITMAPCOREHEADER has 16-bit fields and 3-byte colours; the others 32-bit fields, 4-byte
+    // colours and a count of them (0: all a palette of the depth has), the 40-byte one its masks
+    // after it.
+    let (bits, used, entry, masks) = match header {
+        12 => (u16_at(10)?, 0, 3, 0),
+        _ => {
+            let masks = match (header, u32_at(16)?) {
+                (40, BI_BITFIELDS) => 12,
+                (40, BI_ALPHABITFIELDS) => 16,
+                _ => 0,
+            };
+            (u16_at(14)?, u32_at(32)?, 4, masks)
+        }
+    };
+    let colours = match used {
+        0 if bits <= 8 => 1 << bits,
+        n if n <= 256 => n,
+        _ => return None,
+    };
+    let offset = [header, masks, colours * entry].into_iter().try_fold(14u32, u32::checked_add)?;
+    let size = u32::try_from(dib.len()).ok()?.checked_add(14)?;
+    if offset > size {
+        return None;
+    }
+    let mut bmp = Vec::with_capacity(dib.len() + 14);
+    bmp.extend_from_slice(b"BM");
+    bmp.extend_from_slice(&size.to_le_bytes());
+    bmp.extend_from_slice(&[0; 4]);
+    bmp.extend_from_slice(&offset.to_le_bytes());
+    bmp.extend_from_slice(dib);
+    Some(bmp)
+}
+
+/// A device-independent bitmap as an image, at most [`MAX_SIDE`] pixels a side. It is opaque when
+/// its alpha is zero throughout: screenshots and most apps leave the fourth byte of a 32-bit pixel
+/// at zero, even under an alpha mask.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_image(dib: &[u8]) -> Option<image::RgbaImage> {
+    let mut reader = image::ImageReader::with_format(Cursor::new(dib_file(dib)?), image::ImageFormat::Bmp);
+    let mut limits = image::Limits::default();
+    (limits.max_image_width, limits.max_image_height) = (Some(MAX_SIDE), Some(MAX_SIDE));
+    reader.limits(limits);
+    let mut img = reader.decode().ok()?.into_rgba8();
+    if img.pixels().all(|p| p.0[3] == 0) {
+        img.pixels_mut().for_each(|p| p.0[3] = u8::MAX);
+    }
+    Some(img)
+}
+
+/// The first of `paths` (files copied in a file manager) that pastes as one of `mimes`, read
+/// whole. Only its first bytes are read to tell, so other files cost little.
+fn copied_file(paths: Vec<PathBuf>, mimes: &[&'static str]) -> Option<Flavour> {
+    paths.into_iter().find_map(|path| {
+        // text/uri-list lines end in CRLF (RFC 2483), but arboard splits them on LF only.
+        let path = match path.to_str() {
+            Some(p) if p.ends_with('\r') => PathBuf::from(p.trim_end_matches('\r')),
+            _ => path,
+        };
+        let mut head = Vec::with_capacity(FILE_HEAD);
+        std::fs::File::open(&path).ok()?.take(FILE_HEAD as u64).read_to_end(&mut head).ok()?;
+        let mime = file_flavour(&path.to_string_lossy(), &head, mimes)?;
+        let data = std::fs::read(&path).ok()?;
+        (!data.is_empty()).then_some(Flavour { mime, data })
+    })
+}
+
 #[cfg(windows)]
 mod win {
     use std::num::NonZeroU32;
@@ -49,6 +142,10 @@ mod win {
         }
     }
 
+    /// The device-independent bitmaps, the one that carries alpha first. Each is there whenever the
+    /// other or a `CF_BITMAP` is: the system converts between them.
+    const DIBS: [u32; 2] = [formats::CF_DIBV5, formats::CF_DIB];
+
     fn formats_of(mime: &str) -> impl Iterator<Item = u32> {
         names(mime).iter().filter_map(|n| raw::register_format(n)).map(NonZeroU32::get)
     }
@@ -123,16 +220,26 @@ mod win {
         }
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
-            let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
-            mimes.iter().find_map(|m| read_one(m))
+            let mut files = vec![];
+            {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                // None copied when the clipboard holds no file list.
+                let _ = raw::get_file_list_path(&mut files);
+            }
+            // The files are read with the clipboard closed again, not keeping other apps waiting.
+            copied_file(files, mimes).or_else(|| {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                mimes.iter().find_map(|m| read_one(m))
+            })
         }
 
         fn has(&mut self, mimes: &[&'static str]) -> bool {
-            mimes.iter().any(|m| match *m {
-                TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
-                BITMAP => raw::is_format_avail(formats::CF_BITMAP) || formats_of(PNG).any(raw::is_format_avail),
-                m => formats_of(m).any(raw::is_format_avail),
-            })
+            raw::is_format_avail(formats::CF_HDROP)
+                || mimes.iter().any(|m| match *m {
+                    TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
+                    BITMAP => DIBS.into_iter().chain(formats_of(PNG)).any(raw::is_format_avail),
+                    m => formats_of(m).any(raw::is_format_avail),
+                })
         }
     }
 
@@ -150,9 +257,11 @@ mod win {
         let mime = match mime {
             BITMAP if read_registered(PNG, &mut data) => PNG,
             BITMAP => {
-                data.clear();
-                raw::get_bitmap(&mut data).ok()?;
-                "image/bmp"
+                return DIBS.into_iter().find_map(|id| {
+                    data.clear();
+                    raw::get_vec(id, &mut data).ok()?;
+                    png_flavour(&dib_image(&data)?)
+                });
             }
             TEXT => {
                 raw::get_string(&mut data).ok()?;
@@ -178,13 +287,6 @@ mod portable {
 
     use super::*;
 
-    /// `img` as PNG bytes.
-    fn encode_png(img: &image::RgbaImage) -> Option<Vec<u8>> {
-        let mut out = vec![];
-        img.write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).ok()?;
-        Some(out)
-    }
-
     /// What our last write put on the clipboard.
     enum Ours {
         Text(String),
@@ -245,20 +347,203 @@ mod portable {
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
             let cb = self.cb().ok()?;
+            if let Some(f) = cb.get().file_list().ok().and_then(|paths| copied_file(paths, mimes)) {
+                return Some(f);
+            }
             mimes.iter().find_map(|m| match *m {
                 TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
                 BITMAP => {
+                    #[cfg(target_os = "macos")]
+                    if let Some(f) = super::mac::bitmap() {
+                        return Some(f);
+                    }
                     let img = cb.get_image().ok()?;
                     let rgba = image::RgbaImage::from_raw(u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?, img.bytes.into_owned())?;
-                    encode_png(&rgba).map(|data| Flavour { mime: PNG, data })
+                    png_flavour(&rgba)
                 }
                 _ => None,
             })
         }
 
-        /// Text only: reading a bitmap costs as much as pasting it.
+        /// Text, and on macOS a bitmap (by the pasteboard's types). Linux has no cheap way to ask
+        /// for a bitmap (reading one costs as much as pasting it): the paste keys take it, the
+        /// menu item waits for text.
         fn has(&mut self, mimes: &[&'static str]) -> bool {
+            #[cfg(target_os = "macos")]
+            if mimes.contains(&BITMAP) && super::mac::has_bitmap() {
+                return true;
+            }
             mimes.contains(&TEXT) && self.cb().is_ok_and(|cb| cb.get_text().is_ok_and(|t| !t.is_empty()))
         }
     }
 }
+
+/// The macOS pasteboard's bitmaps as they are (arboard reads TIFF only, and decodes it).
+#[cfg(target_os = "macos")]
+mod mac {
+    use objc2::rc::autoreleasepool;
+    use objc2_app_kit::NSPasteboard;
+    use objc2_foundation::{NSArray, NSString};
+
+    use super::*;
+
+    /// The bitmap types Paste reads, best first (the values of `NSPasteboardTypePNG` and
+    /// `NSPasteboardTypeTIFF`), with their MIME types.
+    const TYPES: [(&str, &str); 2] = [("public.png", PNG), ("public.tiff", "image/tiff")];
+
+    /// Does the pasteboard hold a bitmap? Asks for its types only.
+    pub fn has_bitmap() -> bool {
+        autoreleasepool(|_| {
+            let types = TYPES.map(|(t, _)| NSString::from_str(t));
+            let types: Vec<&NSString> = types.iter().map(|t| &**t).collect();
+            NSPasteboard::generalPasteboard().availableTypeFromArray(&NSArray::from_slice(&types)).is_some()
+        })
+    }
+
+    /// The pasteboard's bitmap, PNG before TIFF.
+    pub fn bitmap() -> Option<Flavour> {
+        autoreleasepool(|_| {
+            let pasteboard = NSPasteboard::generalPasteboard();
+            TYPES.into_iter().find_map(|(t, mime)| {
+                let data = pasteboard.dataForType(&NSString::from_str(t))?.to_vec();
+                (!data.is_empty()).then_some(Flavour { mime, data })
+            })
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use vectorcraft_engine::cmd::clipboard::{PASTE_ORDER, SVG};
+
+    use super::*;
+
+    fn dir(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("vectorcraft-clipboard-{name}-{}", std::process::id()));
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    fn png(w: u32, h: u32) -> Vec<u8> {
+        let mut out = vec![];
+        image::RgbaImage::new(w, h).write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).unwrap();
+        out
+    }
+
+    #[test]
+    fn the_first_copied_file_that_is_art_pastes() {
+        let d = dir("art");
+        let (notes, red, art) = (d.join("notes.txt"), d.join("red image.png"), d.join("art.svg"));
+        std::fs::write(&notes, "not art").unwrap();
+        std::fs::write(&red, png(3, 2)).unwrap();
+        std::fs::write(&art, "<svg xmlns=\"http://www.w3.org/2000/svg\"/>").unwrap();
+        // Missing files, folders and text are skipped.
+        let f = copied_file(vec![d.join("gone.png"), d.clone(), notes.clone(), red.clone(), art.clone()], &PASTE_ORDER).unwrap();
+        assert_eq!((f.mime, f.data), (PNG, png(3, 2)));
+        assert_eq!(copied_file(vec![art.clone(), red.clone()], &PASTE_ORDER).map(|f| f.mime), Some(SVG));
+        // Only what Paste asks for.
+        assert_eq!(copied_file(vec![art, red.clone()], &[BITMAP]).map(|f| f.mime), Some(PNG));
+        assert!(copied_file(vec![red], &[TEXT]).is_none());
+        assert!(copied_file(vec![notes], &PASTE_ORDER).is_none());
+        assert!(copied_file(vec![], &PASTE_ORDER).is_none());
+    }
+
+    #[test]
+    fn a_crlf_left_by_the_uri_list_is_ignored() {
+        let red = dir("crlf").join("red.png");
+        std::fs::write(&red, png(2, 2)).unwrap();
+        let with_cr = PathBuf::from(format!("{}\r", red.display()));
+        assert_eq!(copied_file(vec![with_cr], &PASTE_ORDER).map(|f| f.mime), Some(PNG));
+    }
+
+    /// A DIB of `w`×`h` pixels (top row first when `h` is negative): a `header`-byte header (40,
+    /// or 124 for a BITMAPV5HEADER with BGRA masks), `extra` (the masks after a 40-byte header, a
+    /// colour table), then `rows`, each padded to 4 bytes.
+    fn dib(header: u32, w: i32, h: i32, bits: u16, compression: u32, extra: &[u8], rows: &[u8]) -> Vec<u8> {
+        let mut d = vec![];
+        d.extend(header.to_le_bytes());
+        d.extend(w.to_le_bytes());
+        d.extend(h.to_le_bytes());
+        d.extend(1u16.to_le_bytes());
+        d.extend(bits.to_le_bytes());
+        d.extend(compression.to_le_bytes());
+        d.extend((rows.len() as u32).to_le_bytes());
+        // 96 ppi, every colour of the table used.
+        d.extend([3780u32, 3780, 0, 0].iter().flat_map(|v| v.to_le_bytes()));
+        if header == 124 {
+            d.extend([0x00FF_0000u32, 0xFF00, 0xFF, 0xFF00_0000, 0x7352_4742].iter().flat_map(|v| v.to_le_bytes()));
+            d.resize(124, 0);
+        }
+        d.extend_from_slice(extra);
+        d.extend_from_slice(rows);
+        d
+    }
+
+    /// 32-bit BGRA rows of `px` (top row first).
+    fn bgra(px: &[[u8; 4]]) -> Vec<u8> {
+        px.iter().flat_map(|[r, g, b, a]| [*b, *g, *r, *a]).collect()
+    }
+
+    const RED: [u8; 4] = [255, 0, 0, 255];
+    const BLUE: [u8; 4] = [0, 0, 255, 255];
+
+    fn pixels(img: &image::RgbaImage) -> Vec<[u8; 4]> {
+        img.pixels().map(|p| p.0).collect()
+    }
+
+    #[test]
+    fn a_screenshot_dib_pastes_opaque_and_upright() {
+        // CF_DIB as screenshots copy it: 32-bit BI_RGB, bottom row first, the fourth byte zero.
+        let rows = bgra(&[[0, 0, 255, 0], [0, 0, 255, 0], [255, 0, 0, 0], [255, 0, 0, 0]]);
+        let img = dib_image(&dib(40, 2, 2, 32, 0, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [RED, RED, BLUE, BLUE]);
+        // The same bitmap with an alpha mask (CF_DIBV5), alpha still zero throughout: opaque too.
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &bgra(&[[255, 0, 0, 0]; 4]))).unwrap();
+        assert_eq!(pixels(&img), [RED; 4]);
+    }
+
+    #[test]
+    fn a_dibv5_keeps_its_alpha_top_down() {
+        // A negative height: top row first.
+        let rows = bgra(&[[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], [0, 0, 255, 255]]);
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], BLUE]);
+    }
+
+    #[test]
+    fn masks_and_colour_tables_come_before_the_pixels() {
+        // BI_BITFIELDS after a 40-byte header: three masks between it and the pixels.
+        let masks: Vec<u8> = [0x00FF_0000u32, 0xFF00, 0xFF].iter().flat_map(|v| v.to_le_bytes()).collect();
+        let img = dib_image(&dib(40, 1, 1, 32, 3, &masks, &bgra(&[[0, 0, 255, 0]]))).unwrap();
+        assert_eq!(pixels(&img), [BLUE]);
+        // 8-bit, two colours used, rows padded to 4 bytes, bottom row first.
+        let mut table = bgra(&[RED, BLUE]);
+        table[3] = 0;
+        let mut d = dib(40, 3, 2, 8, 0, &table, &[1, 1, 1, 0, 0, 1, 0, 0]);
+        d[32..36].copy_from_slice(&2u32.to_le_bytes());
+        assert_eq!(pixels(&dib_image(&d).unwrap()), [RED, BLUE, RED, BLUE, BLUE, BLUE]);
+        // 24-bit, rows padded.
+        let img = dib_image(&dib(40, 1, 2, 24, 0, &[], &[255, 0, 0, 0, 0, 0, 255, 0])).unwrap();
+        assert_eq!(pixels(&img), [RED, BLUE]);
+    }
+
+    #[test]
+    fn untrusted_dibs_are_refused_not_trusted() {
+        let one = bgra(&[RED]);
+        // Too large a side (the pixels aren't even there), cut short, a header or a colour count
+        // out of range, no pixels.
+        assert!(dib_image(&dib(40, MAX_SIDE as i32 + 1, 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 1, -(MAX_SIDE as i32) - 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 4096, 4096, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&[40, 0, 0]).is_none());
+        assert!(dib_image(&[]).is_none());
+        let mut d = dib(40, 1, 1, 32, 0, &[], &one);
+        d[0..4].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_image(&d).is_none());
+        let mut d = dib(40, 1, 1, 8, 0, &[], &[0; 4]);
+        d[32..36].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_file(&d).is_none());
+        assert!(dib_image(&dib(40, 1, 1, 32, 0, &[], &[])).is_none());
+        assert!(dib_image(&dib(40, 0, 0, 32, 0, &[], &[])).is_none());
+    }
+}

apps/vectorcraft/src/gpu.rs

@@ -0,0 +1,924 @@
+//! Which graphics adapter the window renders with (#306, #502), and what happens when it can't
+//! show the window.
+//!
+//! The canvas is rasterized on the CPU; the GPU only composites it and draws the UI, so any
+//! adapter that can present to the window will do. [`adapter_order`] ranks the adapters: those that
+//! can't present to the window's surface never, then the one `WGPU_ADAPTER_NAME` names, hardware
+//! before software, the native backends (Vulkan, Metal, DX12) before OpenGL, the GPU that drives a
+//! display and the one that drives the primary display ([`display_gpus`]), the power preference
+//! ([`power_preference`]) among the rest, and a GPU's DX12 adapter before its Vulkan one (#545).
+//! eframe is handed [`selector`], which takes the first of that order.
+//!
+//! A GPU without a monitor is the wrong one even when it can present: on a desktop whose monitors
+//! all hang off the discrete GPU, power saving picked the Ryzen's integrated GPU, Windows had to
+//! present every frame across adapters, and the integrated GPU's driver reset under that, which
+//! lost the graphics device, or took the desktop's compositor and every monitor down for minutes
+//! (pdfcraft#378). So, when Preferences say Automatic, the GPU that drives the display the user
+//! looks at comes first, and the power preference only orders the rest. Windows says which adapter
+//! drives which display (`EnumDisplayDevices`), Linux through sysfs; elsewhere, or when nothing
+//! matches, the order is the power preference's as before. Power Saving and High Performance,
+//! chosen by the user, order by kind as they always did.
+//!
+//! An adapter can report that it presents to the window and still fail once it does: on a hybrid
+//! Linux desktop under Wayland, the compositor runs on one GPU and may refuse the frame buffers
+//! another GPU allocates, which kills the window's Wayland connection; egui-wgpu then panics while
+//! configuring the surface (#502). Nothing in the process can show a window after that, so when
+//! the graphics fail while the window is starting up, [`finish`] starts the app again without
+//! that adapter, as the next one in the order would be tried. Each restart leaves out one more
+//! adapter, so it ends when none is left.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, OnceLock};
+
+use eframe::egui_wgpu::NativeAdapterSelectorMethod;
+use eframe::wgpu::{self, Backend, Backends, DeviceType, PowerPreference};
+
+/// The adapters a restart leaves out, those the window failed on, as comma-separated [`key`]s
+/// (`Vulkan:1002:164e`, `Metal:Intel Iris Pro Graphics`). Set by the app itself when it starts
+/// again.
+pub const SKIP_ENV: &str = "VECTORCRAFT_GPU_SKIP";
+
+/// wgpu's variable for choosing an adapter by (part of) its name, any case.
+const NAME_ENV: &str = "WGPU_ADAPTER_NAME";
+
+/// Where to read how to choose another adapter, for the error that ends the app.
+const HELP: &str =
+    "to choose a graphics adapter, see https://github.com/storytold/vectorcraft/blob/main/docs/development.md#desktop-graphics-processor";
+
+/// Frames the UI ran before the failure, below which it was still starting up. The failure in
+/// #502 came on the first or second frame; later, the adapter has proved itself, and a lost
+/// window is something else (such as the compositor restarting).
+pub const STARTUP_FRAMES: u64 = 10;
+
+/// The preference used when Preferences say Automatic. Windows and macOS show frames from any GPU
+/// (the integrated one avoids the flicker of #306). Elsewhere, the system's own order: Mesa's
+/// device-select layer puts the GPU the desktop runs on first (the integrated one on hybrid
+/// laptops), and a Wayland compositor may not show frames from another GPU (#502).
+pub const AUTOMATIC: PowerPreference = if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None };
+
+/// The power preference that orders the adapters: the `WGPU_POWER_PREF` environment variable
+/// (`low`, `high`, `none`) when set, otherwise Preferences › Performance › Graphics Processor
+/// (`gpuPreference`). Automatic, and any value this version doesn't know (0.5.0's default
+/// `powerSaving`, a newer or damaged preference file), is [`AUTOMATIC`].
+pub fn power_preference(pref: Option<&str>, env: Option<PowerPreference>) -> PowerPreference {
+    match (env, pref) {
+        (Some(p), _) => p,
+        (None, Some("highPerformance")) => PowerPreference::HighPerformance,
+        (None, Some("lowPower")) => PowerPreference::LowPower,
+        (None, _) => AUTOMATIC,
+    }
+}
+
+/// Whether the adapter is the app's to choose: neither `WGPU_POWER_PREF` nor Preferences name a
+/// kind of GPU (the arguments of [`power_preference`]). Then the GPU that drives the display comes
+/// first ([`display_gpus`]); a user's own choice is kept as it is.
+pub fn automatic(pref: Option<&str>, env: Option<PowerPreference>) -> bool {
+    env.is_none() && !matches!(pref, Some("highPerformance" | "lowPower"))
+}
+
+/// The GPUs to rank first: those that drive a display, when the choice is [`automatic`].
+pub fn preferred_displays(pref: Option<&str>, env: Option<PowerPreference>) -> Vec<DisplayGpu> {
+    if automatic(pref, env) { display_gpus() } else { Vec::new() }
+}
+
+/// The graphics backends the window starts with: on Windows Direct3D 12, falling back to OpenGL,
+/// unless `WGPU_BACKEND` names others (`env_set`; `default` then holds them). Creating a Vulkan
+/// instance loads every installed Vulkan driver into the process, and a faulty one (Intel's
+/// `igvk64.dll`, #806) crashed the app before its window appeared. DX12 is Windows' own backend,
+/// as in PdfCraft. Elsewhere, `default`.
+pub fn backends(default: Backends, env_set: bool) -> Backends {
+    if cfg!(windows) && !env_set { Backends::DX12 | Backends::GL } else { default }
+}
+
+/// One adapter, as [`adapter_order`] sees it.
+#[derive(Clone, Debug)]
+pub struct Candidate {
+    /// Identifies the adapter across a restart ([`key`]).
+    pub key: String,
+    pub name: String,
+    pub backend: Backend,
+    pub device_type: DeviceType,
+    /// PCI vendor and device ids, to match a [`DisplayGpu`]; zero where the backend reports none
+    /// (Metal, and OpenGL's device id).
+    pub pci: (u32, u32),
+    /// Reports that it can present to the window's surface.
+    pub presents: bool,
+}
+
+impl Candidate {
+    fn new(adapter: &wgpu::Adapter, surface: Option<&wgpu::Surface<'_>>) -> Self {
+        let info = adapter.get_info();
+        Self {
+            key: key(info.backend, info.vendor, info.device, &info.name),
+            presents: surface.is_none_or(|s| adapter.is_surface_supported(s)),
+            name: info.name,
+            backend: info.backend,
+            device_type: info.device_type,
+            pci: (info.vendor, info.device),
+        }
+    }
+
+    /// Whether it drives one of `displays`, and whether that is the primary one.
+    fn drives(&self, displays: &[DisplayGpu]) -> (bool, bool) {
+        let shown = displays.iter().find(|g| g.pci == self.pci);
+        (shown.is_some(), shown.is_some_and(|g| g.primary))
+    }
+}
+
+/// A GPU with a monitor attached, as the system reports it ([`display_gpus`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct DisplayGpu {
+    /// PCI `(vendor, device)` ids, as wgpu's `AdapterInfo` reports them.
+    pub pci: (u32, u32),
+    /// Drives the display the user most likely looks at: on Windows the primary display, on Linux
+    /// a built-in panel (`eDP`, `LVDS` or `DSI`).
+    pub primary: bool,
+}
+
+impl std::fmt::Display for DisplayGpu {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:04x}:{:04x}{}", self.pci.0, self.pci.1, if self.primary { " (primary)" } else { "" })
+    }
+}
+
+/// The GPUs that drive a display, each once. Windows enumerates its display devices
+/// (`EnumDisplayDevices`: those attached to the desktop, and the primary one); Linux reads the
+/// connected connectors in `/sys/class/drm`. macOS and the rest report nothing, so the power
+/// preference decides as before; so does a system whose GPUs report no PCI ids.
+pub fn display_gpus() -> Vec<DisplayGpu> {
+    #[cfg(windows)]
+    {
+        windows_display_gpus()
+    }
+    #[cfg(target_os = "linux")]
+    {
+        linux_display_gpus(std::path::Path::new("/sys/class/drm"))
+    }
+    #[cfg(not(any(windows, target_os = "linux")))]
+    {
+        Vec::new()
+    }
+}
+
+/// Record that the GPU `pci` drives a display, merging it with its other displays.
+fn add_display_gpu(gpus: &mut Vec<DisplayGpu>, pci: (u32, u32), primary: bool) {
+    match gpus.iter_mut().find(|g| g.pci == pci) {
+        Some(gpu) => gpu.primary |= primary,
+        None => gpus.push(DisplayGpu { pci, primary }),
+    }
+}
+
+/// Windows' display devices: one per GPU output; those `ATTACHED_TO_DESKTOP` show a monitor, one
+/// of them the `PRIMARY_DEVICE`. The registry doesn't tell a user which adapter drives a display,
+/// and WMI reports a resolution for a GPU without a monitor, so this is the way.
+#[cfg(windows)]
+fn windows_display_gpus() -> Vec<DisplayGpu> {
+    use winsafe::co::DISPLAY_DEVICE as Flags;
+    let mut gpus = Vec::new();
+    // A machine has a handful of display devices; the cap only bounds a runaway enumeration.
+    for device in winsafe::EnumDisplayDevices(None, None).take(256) {
+        let device = match device {
+            Ok(d) => d,
+            // The enumeration ends with "no more items" or, from a driver, with any other error.
+            Err(e) => {
+                log::debug!("display devices: {e}");
+                break;
+            }
+        };
+        if !device.StateFlags.has(Flags::ATTACHED_TO_DESKTOP) {
+            continue;
+        }
+        // Remote Desktop and other non-PCI devices (`ROOT\BasicDisplay\0000`) are left out.
+        let Some(pci) = pci_ids(&device.DeviceID()) else { continue };
+        add_display_gpu(&mut gpus, pci, device.StateFlags.has(Flags::PRIMARY_DEVICE));
+    }
+    gpus
+}
+
+/// The PCI `(vendor, device)` of a Windows device id such as
+/// `PCI\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1`, any case; `None` for anything else.
+fn pci_ids(device_id: &str) -> Option<(u32, u32)> {
+    let field = |key: &str| {
+        device_id.split(['\\', '&']).find_map(|part| {
+            let (name, hex) = part.split_at_checked(key.len())?;
+            if name.eq_ignore_ascii_case(key) { u32::from_str_radix(hex, 16).ok() } else { None }
+        })
+    };
+    Some((field("VEN_")?, field("DEV_")?))
+}
+
+/// Linux: every connector `cardN-CONNECTOR` under `drm` whose `status` is `connected`, with the
+/// PCI ids of its card (`cardN/device/{vendor,device}`). A built-in panel is the primary display.
+#[cfg(any(target_os = "linux", test))]
+fn linux_display_gpus(drm: &std::path::Path) -> Vec<DisplayGpu> {
+    let read_hex = |p: std::path::PathBuf| -> Option<u32> {
+        let s = std::fs::read_to_string(p).ok()?;
+        u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok()
+    };
+    let mut gpus = Vec::new();
+    let Ok(entries) = std::fs::read_dir(drm) else { return gpus };
+    // A machine has a handful of connectors; the cap only bounds a pathological sysfs.
+    for entry in entries.flatten().take(256) {
+        let name = entry.file_name();
+        let Some((card, connector)) = name.to_str().and_then(|n| n.split_once('-')) else { continue };
+        let connected = std::fs::read_to_string(entry.path().join("status")).is_ok_and(|s| s.trim() == "connected");
+        if !connected {
+            continue;
+        }
+        let device = drm.join(card).join("device");
+        let (Some(v), Some(d)) = (read_hex(device.join("vendor")), read_hex(device.join("device"))) else { continue };
+        add_display_gpu(&mut gpus, (v, d), is_internal_panel(connector));
+    }
+    gpus
+}
+
+/// A laptop's built-in panel: an embedded DisplayPort, LVDS or DSI connector.
+#[cfg(any(target_os = "linux", test))]
+fn is_internal_panel(connector: &str) -> bool {
+    ["eDP", "LVDS", "DSI"].iter().any(|kind| connector.starts_with(kind))
+}
+
+/// `backend:vendor:device`, e.g. `Vulkan:1002:164e` (PCI ids, as `MESA_VK_DEVICE_SELECT` takes them).
+/// Metal reports no ids (`0000:0000` for every GPU), so an adapter without them is `backend:name`
+/// (`Metal:Intel Iris Pro Graphics`): otherwise leaving out the one that failed would leave out
+/// every GPU of a dual-GPU Mac (#651). Commas, which separate [`SKIP_ENV`]'s keys, become spaces.
+fn key(backend: Backend, vendor: u32, device: u32, name: &str) -> String {
+    if vendor == 0 && device == 0 {
+        format!("{backend:?}:{}", name.replace(',', " ").trim())
+    } else {
+        format!("{backend:?}:{vendor:04x}:{device:04x}")
+    }
+}
+
+/// The order to try `candidates` in (their indices): only those that present to the window and
+/// aren't in `skip`; the one whose name contains `named` (any case) first; hardware before
+/// software; native backends before OpenGL; the GPUs that drive one of `displays`, the primary
+/// display's first; then by `power`; then DX12 before Vulkan, keeping the system's order among
+/// equals (all of it for [`PowerPreference::None`]). Windows lists each GPU under both, and Intel's
+/// Vulkan driver made the whole window flicker black where DX12 and OpenGL didn't (#545);
+/// elsewhere there is no DX12 adapter, so the order is unchanged.
+///
+/// With no `displays`, or none a candidate's PCI ids match (OpenGL reports no device id, Metal no
+/// ids at all), the order is the power preference's alone, as it was.
+pub fn adapter_order(candidates: &[Candidate], power: PowerPreference, displays: &[DisplayGpu], named: Option<&str>, skip: &[String]) -> Vec<usize> {
+    let named = named.map(str::to_lowercase).filter(|n| !n.is_empty());
+    let mut order: Vec<(usize, &Candidate)> = candidates.iter().enumerate().filter(|(_, c)| c.presents && !skip.contains(&c.key)).collect();
+    // Stable, so equals keep the system's order.
+    order.sort_by_key(|(_, c)| {
+        let unnamed = named.as_ref().is_some_and(|n| !c.name.to_lowercase().contains(n));
+        let (drives_display, drives_primary) = c.drives(displays);
+        (
+            unnamed,
+            c.device_type == DeviceType::Cpu,
+            c.backend == Backend::Gl,
+            !drives_display,
+            !drives_primary,
+            power_rank(c.device_type, power),
+            c.backend == Backend::Vulkan,
+        )
+    });
+    order.into_iter().map(|(i, _)| i).collect()
+}
+
+/// wgpu's own ranking for a power preference: the preferred kind of GPU, the other kind, unknown,
+/// virtual, software.
+fn power_rank(t: DeviceType, power: PowerPreference) -> u8 {
+    match (power, t) {
+        (PowerPreference::None, _) => 0,
+        (PowerPreference::LowPower, DeviceType::IntegratedGpu) | (PowerPreference::HighPerformance, DeviceType::DiscreteGpu) => 0,
+        (_, DeviceType::IntegratedGpu | DeviceType::DiscreteGpu) => 1,
+        (_, DeviceType::Other) => 2,
+        (_, DeviceType::VirtualGpu) => 3,
+        (_, DeviceType::Cpu) => 4,
+    }
+}
+
+/// The adapters [`SKIP_ENV`] lists.
+pub fn skipped() -> Vec<String> {
+    std::env::var(SKIP_ENV).map(|v| parse_skip(&v)).unwrap_or_default()
+}
+
+fn parse_skip(v: &str) -> Vec<String> {
+    v.split(',').map(str::trim).filter(|k| !k.is_empty()).map(String::from).collect()
+}
+
+/// What the window's start-up leaves for [`finish`].
+#[derive(Default)]
+pub struct Startup {
+    /// The key of the adapter [`selector`] picked.
+    adapter: OnceLock<String>,
+    /// The UI's context, which counts the frames run.
+    ui: OnceLock<egui::Context>,
+}
+
+impl Startup {
+    /// The app was created on `ctx`.
+    pub fn created(&self, ctx: &egui::Context) {
+        // Set once; the window is created once.
+        let _ = self.ui.set(ctx.clone());
+    }
+}
+
+/// eframe's adapter choice: the first of [`adapter_order`] for `power`, the GPUs that drive a
+/// `displays`, `WGPU_ADAPTER_NAME` and the adapters a restart left out. Every adapter, the displays
+/// and the choice are logged: which GPU draws is the first question in every black-window report.
+pub fn selector(power: PowerPreference, displays: Vec<DisplayGpu>, startup: Arc<Startup>) -> NativeAdapterSelectorMethod {
+    let named = std::env::var(NAME_ENV).ok();
+    let skip = skipped();
+    Arc::new(move |adapters, surface| {
+        let candidates: Vec<Candidate> = adapters.iter().map(|a| Candidate::new(a, surface)).collect();
+        let order = adapter_order(&candidates, power, &displays, named.as_deref(), &skip);
+        let listed: Vec<String> = candidates
+            .iter()
+            .map(|c| {
+                let (drives_display, drives_primary) = c.drives(&displays);
+                let note = if !c.presents {
+                    ", can't show the window"
+                } else if skip.contains(&c.key) {
+                    ", failed before"
+                } else if drives_primary {
+                    ", drives the primary display"
+                } else if drives_display {
+                    ", drives a display"
+                } else {
+                    ""
+                };
+                format!("{} ({:?}, {:?}, {}{note})", c.name.trim(), c.backend, c.device_type, c.key)
+            })
+            .collect();
+        log::info!("graphics adapters: {}", listed.join("; "));
+        let first = order.first().and_then(|&i| adapters.get(i).zip(candidates.get(i)));
+        let Some((adapter, chosen)) = first else {
+            return Err(format!("no graphics adapter can show the window (power preference {power:?}, {} adapters)", adapters.len()));
+        };
+        let why = match chosen.drives(&displays) {
+            (_, true) => "it drives the primary display".to_string(),
+            (true, false) => "it drives a display".to_string(),
+            (false, false) if displays.is_empty() => format!("power preference {power:?}"),
+            (false, false) => format!("no adapter matches a display GPU, so power preference {power:?}"),
+        };
+        log::info!("drawing on {} ({:?}, {:?}): {why}", chosen.name.trim(), chosen.backend, chosen.device_type);
+        // Set once; eframe picks the adapter once.
+        let _ = startup.adapter.set(chosen.key.clone());
+        Ok(adapter.clone())
+    })
+}
+
+/// The last panic came from the graphics stack (see [`watch_panics`]).
+static GRAPHICS_PANIC: AtomicBool = AtomicBool::new(false);
+
+/// Note whether each panic comes from the graphics stack, so [`finish`] can tell a failing adapter
+/// from a bug. The default hook still prints it.
+pub fn watch_panics() {
+    let default = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        GRAPHICS_PANIC.store(info.location().is_some_and(|l| in_graphics_stack(l.file())), Ordering::Relaxed);
+        default(info);
+    }));
+}
+
+/// A source file of wgpu (`wgpu-core-30.0.1/src/…`, `wgpu-hal-…`), egui-wgpu or naga.
+fn in_graphics_stack(file: &str) -> bool {
+    file.split(['/', '\\']).any(|dir| ["wgpu-", "egui-wgpu-", "naga-"].iter().any(|p| dir.starts_with(p)))
+}
+
+/// The adapter to start again without: the one picked, when the graphics failed while the window
+/// was starting up and it wasn't already left out.
+fn restart_without<'a>(graphics_failed: bool, frames: u64, picked: Option<&'a str>, skip: &[String]) -> Option<&'a str> {
+    picked.filter(|p| graphics_failed && frames < STARTUP_FRAMES && !skip.iter().any(|s| s == p))
+}
+
+/// After the window's run: `Ok` when it closed normally or the app started again (see the module
+/// docs), otherwise why it failed. `outcome` is eframe's result, or the message of a panic that
+/// ended it.
+pub fn finish(outcome: Result<eframe::Result, String>, startup: &Startup) -> Result<(), String> {
+    let (why, graphics_failed) = match outcome {
+        Ok(Ok(())) => return Ok(()),
+        Ok(Err(e @ eframe::Error::Wgpu(_))) => (e.to_string(), true),
+        Ok(Err(e)) => (e.to_string(), false),
+        Err(panic) => (panic, GRAPHICS_PANIC.load(Ordering::Relaxed)),
+    };
+    let frames = startup.ui.get().map_or(0, egui::Context::cumulative_frame_nr);
+    let mut skip = skipped();
+    let Some(failed) = restart_without(graphics_failed, frames, startup.adapter.get().map(String::as_str), &skip) else {
+        return Err(if graphics_failed { format!("{why} ({HELP})") } else { why });
+    };
+    log::error!("the window failed on graphics adapter {failed} ({why}): starting again without it");
+    skip.push(failed.to_string());
+    restart(&skip.join(",")).map_err(|e| format!("{why}; starting again failed: {e}"))
+}
+
+/// Start the app again with the same arguments, leaving out the adapters in `skip`. On Unix the
+/// new app replaces this process (same process id, so an AppImage keeps its files mounted), and
+/// this returns only on failure; on Windows it starts beside this one, which then exits.
+fn restart(skip: &str) -> std::io::Result<()> {
+    log::logger().flush();
+    let mut c = std::process::Command::new(std::env::current_exe()?);
+    c.args(std::env::args_os().skip(1)).env(SKIP_ENV, skip);
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt as _;
+        Err(c.exec())
+    }
+    #[cfg(not(unix))]
+    c.spawn().map(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn gpu(name: &str, backend: Backend, device_type: DeviceType) -> Candidate {
+        Candidate { key: format!("{backend:?}:{name}"), name: name.into(), backend, device_type, pci: (0, 0), presents: true }
+    }
+
+    fn names(c: &[Candidate], order: &[usize]) -> Vec<String> {
+        order.iter().map(|&i| c[i].name.clone()).collect()
+    }
+
+    const NVIDIA_3090: (u32, u32) = (0x10de, 0x2204);
+    const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
+    const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
+    const WARP: (u32, u32) = (0x1414, 0x008c);
+
+    fn pci_gpu(name: &str, backend: Backend, device_type: DeviceType, pci: (u32, u32)) -> Candidate {
+        Candidate { key: key(backend, pci.0, pci.1, name), name: name.into(), backend, device_type, pci, presents: true }
+    }
+
+    fn monitor(pci: (u32, u32)) -> DisplayGpu {
+        DisplayGpu { pci, primary: false }
+    }
+
+    fn primary(pci: (u32, u32)) -> DisplayGpu {
+        DisplayGpu { pci, primary: true }
+    }
+
+    /// The desktop of pdfcraft#378 as wgpu lists it on Windows: a Ryzen's integrated GPU without a
+    /// monitor and an RTX 3090 driving both monitors, each under Vulkan and DX12, then WARP and
+    /// OpenGL (which reports no device id).
+    fn ryzen_desktop() -> Vec<Candidate> {
+        vec![
+            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Vulkan, DeviceType::DiscreteGpu, NVIDIA_3090),
+            pci_gpu("AMD Radeon(TM) Graphics", Backend::Vulkan, DeviceType::IntegratedGpu, AMD_IGPU),
+            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Dx12, DeviceType::DiscreteGpu, NVIDIA_3090),
+            pci_gpu("AMD Radeon(TM) Graphics", Backend::Dx12, DeviceType::IntegratedGpu, AMD_IGPU),
+            pci_gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu, WARP),
+            pci_gpu("NVIDIA GeForce RTX 3090/PCIe/SSE2", Backend::Gl, DeviceType::Other, (NVIDIA_3090.0, 0)),
+        ]
+    }
+
+    /// pdfcraft#378: power saving picked the integrated GPU, whose driver reset when Windows had to
+    /// present its frames on the monitors of the NVIDIA card. The GPU that drives the displays now
+    /// comes first, through DX12 (#545); the integrated GPU stays the fallback a restart reaches.
+    #[test]
+    fn a_desktop_draws_on_the_gpu_that_drives_its_monitors() {
+        let c = ryzen_desktop();
+        for displays in [vec![primary(NVIDIA_3090)], vec![monitor(NVIDIA_3090)]] {
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, &[]), [2, 0, 3, 1, 5, 4], "{displays:?}");
+            assert_eq!(adapter_order(&c, PowerPreference::None, &displays, None, &[]), [2, 0, 3, 1, 5, 4], "{displays:?}");
+        }
+        // Without the display information the order is power saving's, as before.
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[], None, &[]), [3, 1, 2, 0, 5, 4]);
+        // After the NVIDIA adapters failed, the integrated GPU is next.
+        let skip = vec![c[2].key.clone(), c[0].key.clone()];
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[primary(NVIDIA_3090)], None, &skip), [3, 1, 5, 4]);
+    }
+
+    /// A hybrid laptop: the panel (primary) on the integrated GPU, an external monitor on the
+    /// discrete one. Power saving and the display agree, in either enumeration order.
+    #[test]
+    fn a_hybrid_laptop_draws_on_the_integrated_gpu_that_drives_its_panel() {
+        let c = ryzen_desktop();
+        for displays in [vec![primary(AMD_IGPU), monitor(NVIDIA_3090)], vec![monitor(NVIDIA_3090), primary(AMD_IGPU)], vec![primary(AMD_IGPU)]] {
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, &[]), [3, 1, 2, 0, 5, 4], "{displays:?}");
+        }
+        // Linux names no primary unless there is a built-in panel: a monitor on each GPU keeps the
+        // system's order among them (Mesa puts the compositor's GPU first), and a GPU without one
+        // comes after both.
+        let linux = vec![
+            pci_gpu("AMD Radeon Graphics (RADV RAPHAEL_MENDOCINO)", Backend::Vulkan, DeviceType::IntegratedGpu, AMD_IGPU),
+            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Vulkan, DeviceType::DiscreteGpu, NVIDIA_3090),
+            pci_gpu("Intel(R) Arc(TM) A380", Backend::Vulkan, DeviceType::DiscreteGpu, INTEL_IGPU),
+            pci_gpu("llvmpipe (LLVM 20.1.8, 256 bits)", Backend::Vulkan, DeviceType::Cpu, (0x10005, 0)),
+        ];
+        let both = [monitor(AMD_IGPU), monitor(NVIDIA_3090)];
+        assert_eq!(adapter_order(&linux, PowerPreference::None, &both, None, &[]), [0, 1, 2, 3]);
+        assert_eq!(adapter_order(&linux, PowerPreference::None, &[monitor(INTEL_IGPU)], None, &[]), [2, 0, 1, 3]);
+        assert_eq!(adapter_order(&linux, PowerPreference::None, &[monitor(NVIDIA_3090), primary(AMD_IGPU)], None, &[]), [0, 1, 2, 3]);
+    }
+
+    /// A Windows desktop with a monitor on each GPU: the window opens on the primary display, so
+    /// its GPU draws, whichever kind it is.
+    #[test]
+    fn the_primary_display_decides_between_gpus_that_both_drive_a_monitor() {
+        let c = ryzen_desktop();
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[monitor(AMD_IGPU), primary(NVIDIA_3090)], None, &[]), [2, 0, 3, 1, 5, 4]);
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[primary(AMD_IGPU), monitor(NVIDIA_3090)], None, &[]), [3, 1, 2, 0, 5, 4]);
+        // The displays only matter among adapters that can show the window; a GPU driving no
+        // display still loses to one that does.
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[monitor(AMD_IGPU), monitor(INTEL_IGPU)], None, &[]), [3, 1, 2, 0, 5, 4]);
+    }
+
+    /// Display GPUs none of the adapters match (another driver's ids, OpenGL's missing device id,
+    /// Metal's zeros) change nothing: power saving's order, the old behaviour.
+    #[test]
+    fn displays_no_adapter_matches_leave_the_power_preference_in_charge() {
+        let c = ryzen_desktop();
+        let low = adapter_order(&c, PowerPreference::LowPower, &[], None, &[]);
+        for displays in [vec![monitor(INTEL_IGPU)], vec![primary((0x8086, 0x1234)), monitor((0x8086, 0x5678))], vec![primary((0, 0))]] {
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, &[]), low, "{displays:?}");
+        }
+        assert_eq!(names(&c, &adapter_order(&c, PowerPreference::HighPerformance, &[monitor(INTEL_IGPU)], None, &[]))[0], "NVIDIA GeForce RTX 3090");
+        // The #502 machine's adapters report no ids in these tests: the primary display never matches.
+        let c = issue_502();
+        assert_eq!(
+            adapter_order(&c, PowerPreference::None, &[primary(NVIDIA_3090)], None, &[]),
+            adapter_order(&c, PowerPreference::None, &[], None, &[])
+        );
+        assert!(adapter_order(&[], PowerPreference::LowPower, &[primary(NVIDIA_3090)], None, &[]).is_empty());
+    }
+
+    /// `WGPU_ADAPTER_NAME` and "can't present" still come before the displays.
+    #[test]
+    fn a_named_adapter_comes_before_the_one_driving_the_display() {
+        let mut c = ryzen_desktop();
+        let displays = [primary(NVIDIA_3090)];
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, Some("radeon"), &[]), [3, 1, 2, 0, 5, 4]);
+        c[2].presents = false;
+        c[0].presents = false;
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, &[]), [3, 1, 5, 4]);
+    }
+
+    /// A user's own choice (Preferences or `WGPU_POWER_PREF`) is kept as it is; only Automatic
+    /// looks at the displays.
+    #[test]
+    fn only_automatic_considers_which_gpu_drives_the_display() {
+        assert!(automatic(None, None));
+        assert!(automatic(Some("automatic"), None));
+        assert!(automatic(Some("powerSaving"), None));
+        assert!(!automatic(Some("lowPower"), None));
+        assert!(!automatic(Some("highPerformance"), None));
+        assert!(!automatic(None, Some(PowerPreference::None)));
+        assert!(!automatic(Some("automatic"), Some(PowerPreference::LowPower)));
+        assert!(preferred_displays(Some("lowPower"), None).is_empty());
+        assert!(preferred_displays(None, Some(PowerPreference::HighPerformance)).is_empty());
+        // Automatic reports whatever this machine has (nothing on macOS, in CI, or under Remote Desktop).
+        assert_eq!(preferred_displays(None, None), display_gpus());
+    }
+
+    #[test]
+    fn pci_ids_come_from_windows_device_ids() {
+        assert_eq!(pci_ids("PCI\\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1"), Some(NVIDIA_3090));
+        assert_eq!(pci_ids("PCI\\VEN_1002&DEV_164E&SUBSYS_88771043&REV_C1"), Some(AMD_IGPU));
+        assert_eq!(pci_ids("pci\\ven_1002&dev_164e"), Some(AMD_IGPU));
+        // Remote Desktop and other non-PCI display devices, and malformed ids.
+        assert_eq!(pci_ids("ROOT\\BasicDisplay\\0000"), None);
+        assert_eq!(pci_ids("PCI\\VEN_10DE&SUBSYS_40421458"), None);
+        assert_eq!(pci_ids("PCI\\VEN_10DE&DEV_ZZZZ"), None);
+        assert_eq!(pci_ids("VEN_&DEV_"), None);
+        assert_eq!(pci_ids(""), None);
+    }
+
+    /// Whatever this machine has: every GPU listed is a PCI device, at most one drives the primary
+    /// display, and none is listed twice. (A headless CI runner may list none.)
+    #[cfg(windows)]
+    #[test]
+    fn windows_lists_each_gpu_with_a_monitor_once() {
+        let gpus = windows_display_gpus();
+        assert!(gpus.iter().filter(|g| g.primary).count() <= 1, "{gpus:?}");
+        for (i, g) in gpus.iter().enumerate() {
+            assert_ne!(g.pci.0, 0, "{gpus:?}");
+            assert!(!gpus[..i].iter().any(|h| h.pci == g.pci), "{gpus:?}");
+        }
+    }
+
+    #[test]
+    fn internal_panels_are_edp_lvds_and_dsi_connectors() {
+        for name in ["eDP-1", "LVDS-1", "DSI-1"] {
+            assert!(is_internal_panel(name), "{name}");
+        }
+        for name in ["DP-3", "HDMI-A-1", "DVI-D-1", "VGA-1", "Writeback-1", ""] {
+            assert!(!is_internal_panel(name), "{name}");
+        }
+    }
+
+    /// A sysfs like a hybrid laptop's with an external monitor: the panel and a disconnected port
+    /// on the integrated GPU (card0), the monitor on the discrete one (card1), and a card without
+    /// PCI ids. Each GPU is listed once, the one with the panel as primary.
+    #[test]
+    fn linux_display_gpus_come_from_the_connected_connectors() -> std::io::Result<()> {
+        let dir = std::env::temp_dir().join(format!("vectorcraft-drm-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let card = |name: &str, (vendor, device): (u32, u32)| -> std::io::Result<()> {
+            std::fs::create_dir_all(dir.join(name).join("device"))?;
+            std::fs::write(dir.join(name).join("device/vendor"), format!("{vendor:#06x}\n"))?;
+            std::fs::write(dir.join(name).join("device/device"), format!("{device:#06x}\n"))
+        };
+        let connector = |name: &str, status: &str| -> std::io::Result<()> {
+            std::fs::create_dir_all(dir.join(name))?;
+            std::fs::write(dir.join(name).join("status"), format!("{status}\n"))
+        };
+        card("card0", AMD_IGPU)?;
+        card("card1", NVIDIA_3090)?;
+        std::fs::create_dir_all(dir.join("card2"))?;
+        connector("card0-eDP-1", "connected")?;
+        connector("card0-HDMI-A-1", "disconnected")?;
+        connector("card1-DP-1", "connected")?;
+        connector("card1-DP-2", "connected")?;
+        connector("card2-Virtual-1", "connected")?;
+        std::fs::write(dir.join("renderD128"), "")?;
+        let mut gpus = linux_display_gpus(&dir);
+        gpus.sort_by_key(|g| g.pci);
+        assert_eq!(gpus, [primary(AMD_IGPU), monitor(NVIDIA_3090)]);
+        assert!(linux_display_gpus(&dir.join("no such dir")).is_empty());
+        std::fs::remove_dir_all(&dir)
+    }
+
+    #[test]
+    fn display_gpus_are_logged_as_pci_ids() {
+        assert_eq!(primary(NVIDIA_3090).to_string(), "10de:2204 (primary)");
+        assert_eq!(monitor(AMD_IGPU).to_string(), "1002:164e");
+        let mut gpus = vec![];
+        add_display_gpu(&mut gpus, NVIDIA_3090, false);
+        add_display_gpu(&mut gpus, NVIDIA_3090, true);
+        add_display_gpu(&mut gpus, AMD_IGPU, false);
+        assert_eq!(gpus, [primary(NVIDIA_3090), monitor(AMD_IGPU)]);
+    }
+
+    /// The machine of #502 as Vulkan lists it with Mesa's device-select layer: the GPU KDE's
+    /// compositor runs on (NVIDIA) first, then the Ryzen's integrated GPU, Mesa's software
+    /// renderer, and OpenGL.
+    fn issue_502() -> Vec<Candidate> {
+        vec![
+            gpu("NVIDIA GeForce RTX 5070", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("llvmpipe (LLVM 20.1.8, 256 bits)", Backend::Vulkan, DeviceType::Cpu),
+            gpu("NVIDIA GeForce RTX 5070/PCIe/SSE2", Backend::Gl, DeviceType::Other),
+        ]
+    }
+
+    #[test]
+    fn automatic_keeps_the_systems_order_on_linux_and_saves_power_elsewhere() {
+        let c = issue_502();
+        let order = adapter_order(&c, power_preference(None, None), &[], None, &[]);
+        let first = &c[order[0]].name;
+        if cfg!(any(windows, target_os = "macos")) {
+            assert_eq!(first, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        } else {
+            // #502: the integrated GPU couldn't show frames to a compositor on the NVIDIA GPU.
+            assert_eq!(first, "NVIDIA GeForce RTX 5070");
+        }
+    }
+
+    #[test]
+    fn each_preference_orders_the_adapters_then_falls_back_to_opengl_and_software() {
+        let c = issue_502();
+        let order = |power| names(&c, &adapter_order(&c, power, &[], None, &[]));
+        assert_eq!(
+            order(PowerPreference::None),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::LowPower),
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::HighPerformance),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    /// A restart leaves out the adapter the window failed on, so Power Saving on the machine of
+    /// #502 ends up on the NVIDIA GPU, and once every adapter failed there is nothing to try.
+    /// A dual-GPU Mac reports both GPUs under Metal with no PCI ids (#651): their keys still
+    /// differ, so when the integrated GPU fails, the restart renders on the discrete one.
+    #[test]
+    fn gpus_without_pci_ids_are_told_apart_by_name() {
+        let mac = |name: &str, device_type| Candidate {
+            key: key(Backend::Metal, 0, 0, name),
+            name: name.into(),
+            backend: Backend::Metal,
+            device_type,
+            pci: (0, 0),
+            presents: true,
+        };
+        let c = vec![mac("NVIDIA GeForce GT 750M", DeviceType::DiscreteGpu), mac("Intel Iris Pro Graphics", DeviceType::IntegratedGpu)];
+        assert_eq!((c[0].key.as_str(), c[1].key.as_str()), ("Metal:NVIDIA GeForce GT 750M", "Metal:Intel Iris Pro Graphics"));
+        let first = adapter_order(&c, PowerPreference::LowPower, &[], None, &[]);
+        assert_eq!(names(&c, &first)[0], "Intel Iris Pro Graphics");
+        let skip = parse_skip(&c[first[0]].key);
+        assert_eq!(names(&c, &adapter_order(&c, PowerPreference::LowPower, &[], None, &skip)), ["NVIDIA GeForce GT 750M"]);
+        // A comma in a name can't split the list.
+        assert_eq!(parse_skip(&key(Backend::Gl, 0, 0, "Mesa, llvmpipe")), ["Gl:Mesa  llvmpipe"]);
+    }
+
+    #[test]
+    fn a_restart_tries_the_next_adapter() {
+        let c = issue_502();
+        let mut skip = vec![];
+        let mut tried = vec![];
+        while let Some(&i) = adapter_order(&c, PowerPreference::LowPower, &[], None, &skip).first() {
+            tried.push(c[i].name.clone());
+            skip.push(c[i].key.clone());
+        }
+        assert_eq!(
+            tried,
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    #[test]
+    fn adapters_that_cannot_present_to_the_window_are_never_tried() {
+        let mut c = issue_502();
+        c[0].presents = false;
+        c[3].presents = false;
+        for power in [PowerPreference::None, PowerPreference::LowPower, PowerPreference::HighPerformance] {
+            let order = adapter_order(&c, power, &[], None, &[]);
+            assert!(!order.contains(&0) && !order.contains(&3), "{power:?}: {order:?}");
+            assert_eq!(order.len(), 2);
+        }
+        for p in &mut c {
+            p.presents = false;
+        }
+        assert!(adapter_order(&c, PowerPreference::None, &[], None, &[]).is_empty());
+        assert!(adapter_order(&[], PowerPreference::HighPerformance, &[], None, &[]).is_empty());
+    }
+
+    #[test]
+    fn wgpu_adapter_name_picks_an_adapter_first_and_the_rest_stay_as_fallbacks() {
+        let c = issue_502();
+        let order = adapter_order(&c, PowerPreference::HighPerformance, &[], Some("radv"), &[]);
+        assert_eq!(c[order[0]].name, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        assert_eq!(order.len(), 4);
+        // Any case; every match comes before the rest, natively first.
+        let order = adapter_order(&c, PowerPreference::LowPower, &[], Some("GeForce"), &[]);
+        assert_eq!(names(&c, &order[..2]), ["NVIDIA GeForce RTX 5070", "NVIDIA GeForce RTX 5070/PCIe/SSE2"]);
+        // An empty name or one nothing matches changes nothing.
+        for named in ["", "no such gpu"] {
+            assert_eq!(
+                adapter_order(&c, PowerPreference::LowPower, &[], Some(named), &[]),
+                adapter_order(&c, PowerPreference::LowPower, &[], None, &[])
+            );
+        }
+        // A named adapter that failed is left out like any other.
+        let skip = vec![c[1].key.clone()];
+        assert_eq!(adapter_order(&c, PowerPreference::None, &[], Some("radv"), &skip)[0], 0);
+    }
+
+    /// A Windows machine lists every GPU twice (Vulkan and DX12): power saving still takes the
+    /// integrated GPU first, as wgpu's own choice did (#306), each GPU through DX12 first (#545).
+    #[test]
+    fn hybrid_laptop_on_windows_renders_on_the_integrated_gpu_with_power_saving() {
+        let c = vec![
+            gpu("Intel(R) Arc(TM) A370M", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("Intel(R) Arc(TM) A370M", Backend::Dx12, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
+            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
+        ];
+        let order = adapter_order(&c, PowerPreference::LowPower, &[], None, &[]);
+        assert_eq!(order, [3, 1, 2, 0, 4]);
+        assert_eq!(adapter_order(&c, PowerPreference::HighPerformance, &[], None, &[]), [2, 0, 3, 1, 4]);
+    }
+
+    /// The machine of #545: one Intel GPU, whose Vulkan driver made the window flicker black.
+    /// DX12 comes first whatever the preference; Vulkan stays a fallback, and `WGPU_ADAPTER_NAME`
+    /// or a restart leaving DX12 out still reach it.
+    #[test]
+    fn a_windows_gpu_renders_through_dx12_before_vulkan() {
+        let c = vec![
+            gpu("Intel(R) Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("Intel(R) Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
+            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
+            gpu("Intel(R) Graphics", Backend::Gl, DeviceType::Other),
+        ];
+        for power in [PowerPreference::LowPower, PowerPreference::HighPerformance, PowerPreference::None] {
+            assert_eq!(adapter_order(&c, power, &[], None, &[]), [1, 0, 3, 2], "{power:?}");
+        }
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[], None, &[c[1].key.clone()]), [0, 3, 2], "DX12 failed: Vulkan next");
+    }
+
+    #[test]
+    fn windows_never_loads_vulkan_drivers_unless_asked() {
+        let all = Backends::all();
+        let start = backends(all, false);
+        if cfg!(windows) {
+            assert_eq!(start, Backends::DX12 | Backends::GL, "#806");
+        } else {
+            assert_eq!(start, all);
+        }
+        assert_eq!(backends(Backends::VULKAN, true), Backends::VULKAN, "WGPU_BACKEND=vulkan still picks it");
+    }
+
+    #[test]
+    fn power_preference_follows_the_environment_then_the_preference() {
+        assert_eq!(power_preference(None, None), AUTOMATIC);
+        assert_eq!(power_preference(Some("automatic"), None), AUTOMATIC);
+        assert_eq!(power_preference(Some("lowPower"), None), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("highPerformance"), None), PowerPreference::HighPerformance);
+        // 0.5.0's default, and values this version doesn't know (a newer or damaged file).
+        for old in ["powerSaving", "turbo", ""] {
+            assert_eq!(power_preference(Some(old), None), AUTOMATIC, "{old}");
+        }
+        // WGPU_POWER_PREF wins over the preference, either way.
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::HighPerformance)), PowerPreference::HighPerformance);
+        assert_eq!(power_preference(Some("highPerformance"), Some(PowerPreference::LowPower)), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::None)), PowerPreference::None);
+        assert_eq!(AUTOMATIC, if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None });
+    }
+
+    /// The preference the engine saves is the one the app reads back before the window opens.
+    #[test]
+    fn the_saved_engine_preference_is_found() {
+        let mut prefs = vectorcraft_engine::Prefs::default();
+        let saved = prefs.to_json();
+        assert_eq!(saved.get("gpuPreference").and_then(serde_json::Value::as_str), Some("automatic"));
+        for (value, power) in [("lowPower", PowerPreference::LowPower), ("highPerformance", PowerPreference::HighPerformance)] {
+            prefs.gpu_preference = value.into();
+            let saved = prefs.to_json();
+            assert_eq!(power_preference(saved.get("gpuPreference").and_then(serde_json::Value::as_str), None), power);
+        }
+        // Every choice Preferences offer means something here.
+        for (value, _) in vectorcraft_engine::cmd::prefscmds::GPU_PREFERENCES {
+            assert!(["automatic", "lowPower", "highPerformance"].contains(value), "{value}");
+        }
+    }
+
+    #[test]
+    fn skipped_adapters_parse_from_a_comma_separated_list() {
+        assert_eq!(parse_skip("Vulkan:1002:164e, Gl:10de:2f04,,"), ["Vulkan:1002:164e", "Gl:10de:2f04"]);
+        assert!(parse_skip("").is_empty());
+        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e, "AMD Radeon"), "Vulkan:1002:164e");
+        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04, "NVIDIA"), "Gl:10de:2f04");
+    }
+
+    #[test]
+    fn panics_in_wgpu_egui_wgpu_and_naga_are_graphics_failures() {
+        for file in [
+            "/home/u/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/egui-wgpu-0.36.2/src/winit.rs",
+            r"C:\Users\u\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\wgpu-core-30.0.1\src\device\mod.rs",
+            "/rustc/deps/wgpu-hal-30.0.1/src/vulkan/adapter.rs",
+            "naga-30.0.0/src/back/spv/writer.rs",
+        ] {
+            assert!(in_graphics_stack(file), "{file}");
+        }
+        for file in [
+            "apps/vectorcraft/src/main.rs",
+            "/home/wgpu/vectorcraft/crates/ui-egui/src/lib.rs",
+            "egui-0.36.2/src/context.rs",
+            "winit-0.30.12/src/x.rs",
+        ] {
+            assert!(!in_graphics_stack(file), "{file}");
+        }
+    }
+
+    #[test]
+    fn only_a_graphics_failure_while_starting_up_restarts_without_the_adapter() {
+        let amd = Some("Vulkan:1002:164e");
+        assert_eq!(restart_without(true, 0, amd, &[]), amd);
+        assert_eq!(restart_without(true, STARTUP_FRAMES - 1, amd, &[]), amd);
+        // After start-up the adapter has shown frames; a lost window is something else.
+        assert_eq!(restart_without(true, STARTUP_FRAMES, amd, &[]), None);
+        // A bug outside the graphics, or no adapter picked: nothing another adapter would change.
+        assert_eq!(restart_without(false, 0, amd, &[]), None);
+        assert_eq!(restart_without(true, 0, None, &[]), None);
+        // Never the same adapter twice, so restarts end.
+        assert_eq!(restart_without(true, 0, amd, &["Vulkan:1002:164e".into()]), None);
+    }
+
+    #[test]
+    fn a_normal_exit_or_another_failure_does_not_restart() {
+        let startup = Startup::default();
+        assert_eq!(finish(Ok(Ok(())), &startup), Ok(()));
+        // No adapter was picked (none can show the window): the error is returned, nothing restarts.
+        let none =
+            eframe::Error::Wgpu(eframe::egui_wgpu::WgpuError::CustomNativeAdapterSelectionError("no graphics adapter can show the window".into()));
+        assert_eq!(
+            finish(Ok(Err(none)), &startup),
+            Err(format!("WGPU error: Adapter selection failed: no graphics adapter can show the window ({HELP})"))
+        );
+        let _ = startup.adapter.set("Vulkan:1002:164e".into());
+        GRAPHICS_PANIC.store(false, Ordering::Relaxed);
+        assert_eq!(finish(Err("a bug".into()), &startup), Err("a bug".into()));
+    }
+}

apps/vectorcraft/src/logging.rs

@@ -0,0 +1,582 @@
+//! The desktop app's logger: `log::` records go to standard error and to a log file.
+//!
+//! Without a logger every `log::warn!`/`log::error!` in the workspace (the graphics adapter, a
+//! lost graphics device, a panic the engine's guard recovered from) vanished. A launch from a desktop menu
+//! has no terminal, so the file is what a bug report can attach: `<settings dir>/logs/vectorcraft.log`,
+//! next to the preferences (`prefs_path` in `main.rs`). Each start moves the previous log to
+//! `vectorcraft.1.log` (and that one to `.2`), so the log of a run that crashed survives the next
+//! launch. Runs without preferences (`VECTORCRAFT_NO_PREFS`) log to standard error only.
+//!
+//! Levels: `info` for VectorCraft's own crates, `warn` for everything else (wgpu and naga are
+//! chatty). `RUST_LOG` replaces that with env_logger-style directives: `debug`,
+//! `warn,vectorcraft_render=trace`, `wgpu_core=info`. A directive ending in `*` matches every
+//! target that starts with it (`vectorcraft*=debug`).
+//!
+//! Records logged before the settings directory is known are kept (up to [`MAX_PENDING`]) and
+//! written once the file is attached. Writing never panics: a file that can't be created or
+//! written leaves standard error as the only sink.
+//!
+//! This is the desktop app's logger only. `vectorcraft-cli mcp` installs its own
+//! (`vectorcraft_mcp::logging`, MCP `notifications/message`); the two never share a process.
+
+use std::fs::File;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock, PoisonError};
+use std::time::SystemTime;
+
+use log::LevelFilter;
+
+/// The current log file's name inside the log directory.
+pub const LOG_FILE: &str = "vectorcraft.log";
+/// How many previous logs are kept (`vectorcraft.1.log` … `vectorcraft.<KEEP>.log`).
+pub const KEEP: usize = 2;
+/// The log file stops growing past this size (a runaway warning can't fill the disk).
+pub const MAX_FILE_BYTES: u64 = 16 * 1024 * 1024;
+/// Records kept in memory until the log file is attached.
+pub const MAX_PENDING: usize = 512;
+/// The built-in filter when `RUST_LOG` is unset or empty.
+pub const DEFAULT_FILTER: &str = "warn,vectorcraft*=info";
+
+/// Per-target level filter parsed from env_logger-style directives.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Filter {
+    default: LevelFilter,
+    directives: Vec<(String, LevelFilter)>,
+}
+
+impl Filter {
+    /// Parse `spec`; unknown levels and empty parts are skipped. Without a bare level, targets no
+    /// directive names log errors only.
+    pub fn parse(spec: &str) -> Filter {
+        let mut f = Filter { default: LevelFilter::Error, directives: Vec::new() };
+        for part in spec.split(',').map(str::trim).filter(|p| !p.is_empty()) {
+            match part.split_once('=') {
+                Some((name, level)) => {
+                    let name = name.trim();
+                    if let (false, Some(level)) = (name.is_empty(), parse_level(level)) {
+                        f.directives.push((name.to_owned(), level));
+                    }
+                }
+                None => match parse_level(part) {
+                    Some(level) => f.default = level,
+                    // A bare target name: everything from it (env_logger does the same).
+                    None => f.directives.push((part.to_owned(), LevelFilter::Trace)),
+                },
+            }
+        }
+        f
+    }
+
+    /// The level that applies to `target` (the most specific matching directive wins).
+    pub fn level_for(&self, target: &str) -> LevelFilter {
+        self.directives.iter().filter(|(name, _)| matches(name, target)).max_by_key(|(name, _)| name.len()).map_or(self.default, |(_, level)| *level)
+    }
+
+    /// The most verbose level any target can reach (for `log::set_max_level`).
+    pub fn max(&self) -> LevelFilter {
+        self.directives.iter().map(|(_, level)| *level).fold(self.default, Ord::max)
+    }
+}
+
+fn parse_level(s: &str) -> Option<LevelFilter> {
+    s.trim().parse().ok()
+}
+
+/// `name` matches `target` itself and its submodules (`a` matches `a` and `a::b`, not `ab`);
+/// `name*` matches every target starting with `name`.
+fn matches(name: &str, target: &str) -> bool {
+    match name.strip_suffix('*') {
+        Some(prefix) => target.starts_with(prefix),
+        None => target.strip_prefix(name).is_some_and(|rest| rest.is_empty() || rest.starts_with("::")),
+    }
+}
+
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+pub fn timestamp(t: SystemTime) -> String {
+    let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
+    let secs = since.as_secs();
+    let (days, rem) = (secs / 86_400, secs % 86_400);
+    let (y, m, d) = civil_from_days(days);
+    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
+}
+
+/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
+/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch). Saturating, so no clock
+/// value can overflow it.
+fn civil_from_days(days: u64) -> (u64, u64, u64) {
+    let z = days.saturating_add(719_468);
+    let era = z / 146_097;
+    let doe = z % 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
+    (y, m, d)
+}
+
+fn numbered(dir: &Path, n: usize) -> PathBuf {
+    if n == 0 { dir.join(LOG_FILE) } else { dir.join(format!("vectorcraft.{n}.log")) }
+}
+
+/// Shift the previous logs up one (`.log` → `.1.log` → … → `.<KEEP>.log`, the oldest dropped)
+/// and create a fresh, empty log file in `dir` (created if missing).
+pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
+    std::fs::create_dir_all(dir)?;
+    for n in (1..=KEEP).rev() {
+        match std::fs::rename(numbered(dir, n - 1), numbered(dir, n)) {
+            Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(e),
+            _ => {}
+        }
+    }
+    let path = numbered(dir, 0);
+    let file = File::create(&path)?;
+    Ok((path, file))
+}
+
+/// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
+pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
+    let message = message.strip_suffix('\n').unwrap_or(message);
+    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
+}
+
+/// Where formatted lines go besides standard error: kept in memory until a file is attached,
+/// then appended to it until it reaches its size cap.
+pub struct Sink {
+    file: Option<File>,
+    pending: Vec<String>,
+    dropped: usize,
+    written: u64,
+    max_bytes: u64,
+    capped: bool,
+}
+
+impl Sink {
+    pub fn new(max_bytes: u64) -> Sink {
+        Sink { file: None, pending: Vec::new(), dropped: 0, written: 0, max_bytes, capped: false }
+    }
+
+    /// Append `line` to the file, or keep it until [`Sink::attach`].
+    pub fn write(&mut self, line: &str) {
+        if self.file.is_none() {
+            if self.capped {
+                // No file is coming ([`Sink::no_file`]): standard error had the line.
+            } else if self.pending.len() < MAX_PENDING {
+                self.pending.push(line.to_owned());
+            } else {
+                self.dropped = self.dropped.saturating_add(1);
+            }
+            return;
+        }
+        self.append(line);
+    }
+
+    /// Start writing to `file` (a fresh one: the size cap starts over), first the lines kept so far.
+    pub fn attach(&mut self, file: File) {
+        self.file = Some(file);
+        self.written = 0;
+        self.capped = false;
+        for line in std::mem::take(&mut self.pending) {
+            self.append(&line);
+        }
+        if self.dropped > 0 {
+            let note = format!("{} earlier log lines were dropped before the log file was opened\n", self.dropped);
+            self.dropped = 0;
+            self.append(&note);
+        }
+    }
+
+    /// There will be no log file: forget the lines kept for it and keep no more.
+    pub fn no_file(&mut self) {
+        self.pending = Vec::new();
+        self.dropped = 0;
+        self.capped = true;
+    }
+
+    fn append(&mut self, line: &str) {
+        if self.capped {
+            return;
+        }
+        let Some(file) = self.file.as_mut() else { return };
+        let len = u64::try_from(line.len()).unwrap_or(u64::MAX);
+        let text = if self.written.saturating_add(len) > self.max_bytes {
+            self.capped = true;
+            format!("log file reached {} bytes; later records go to standard error only\n", self.max_bytes)
+        } else {
+            self.written = self.written.saturating_add(len);
+            line.to_owned()
+        };
+        // A full disk or a vanished file must not take the app down: drop the file sink.
+        if file.write_all(text.as_bytes()).is_err() {
+            self.file = None;
+            self.capped = true;
+        }
+    }
+}
+
+/// The installed logger: a [`Filter`], standard error and a [`Sink`].
+pub struct AppLogger {
+    filter: Filter,
+    stderr: bool,
+    sink: Mutex<Sink>,
+}
+
+impl AppLogger {
+    pub fn new(filter: Filter, stderr: bool) -> AppLogger {
+        AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)) }
+    }
+
+    /// Rotate the logs in `dir` and send records to the fresh file; returns its path. On an error
+    /// standard error stays the only sink.
+    pub fn attach_dir(&self, dir: &Path) -> Result<PathBuf, String> {
+        // A thread that panicked while logging leaves the sink usable: take it back.
+        let mut sink = self.sink.lock().unwrap_or_else(PoisonError::into_inner);
+        match rotate(dir) {
+            Ok((path, file)) => {
+                sink.attach(file);
+                Ok(path)
+            }
+            Err(e) => {
+                sink.no_file();
+                Err(format!("{}: {e}", dir.display()))
+            }
+        }
+    }
+
+    /// No log file for this run (runs without preferences): log to standard error only.
+    pub fn no_file(&self) {
+        self.sink.lock().unwrap_or_else(PoisonError::into_inner).no_file();
+    }
+}
+
+impl log::Log for AppLogger {
+    fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
+        metadata.level() <= self.filter.level_for(metadata.target())
+    }
+
+    fn log(&self, record: &log::Record<'_>) {
+        if !self.enabled(record.metadata()) {
+            return;
+        }
+        // Formatted before the sink is locked, so a message that logs while it is formatted can't deadlock.
+        let thread = std::thread::current();
+        let line =
+            format_line(&timestamp(SystemTime::now()), record.level(), thread.name().unwrap_or("?"), record.target(), &record.args().to_string());
+        if self.stderr {
+            // No terminal (a Windows GUI build, a closed pipe) is not an error worth reporting.
+            let _ = std::io::stderr().write_all(line.as_bytes());
+        }
+        self.sink.lock().unwrap_or_else(PoisonError::into_inner).write(&line);
+    }
+
+    fn flush(&self) {}
+}
+
+/// Install the logger (filter from `RUST_LOG`, else [`DEFAULT_FILTER`]); `None` when another
+/// logger was installed first. Call [`AppLogger::attach_dir`] once the settings directory is known.
+pub fn install() -> Option<&'static AppLogger> {
+    static LOGGER: OnceLock<AppLogger> = OnceLock::new();
+    let spec = std::env::var("RUST_LOG").ok().filter(|s| !s.trim().is_empty());
+    let filter = Filter::parse(spec.as_deref().unwrap_or(DEFAULT_FILTER));
+    let max = filter.max();
+    let logger = LOGGER.get_or_init(|| AppLogger::new(filter, true));
+    log::set_logger(logger).ok()?;
+    log::set_max_level(max);
+    Some(logger)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::time::{Duration, UNIX_EPOCH};
+
+    fn temp_dir(tag: &str) -> PathBuf {
+        static N: AtomicUsize = AtomicUsize::new(0);
+        let d = std::env::temp_dir().join(format!("vectorcraft-logging-{tag}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&d);
+        d
+    }
+
+    fn read(path: &Path) -> String {
+        std::fs::read_to_string(path).expect("read log")
+    }
+
+    #[test]
+    fn the_default_filter_shows_vectorcraft_info_and_other_crates_warnings() {
+        let f = Filter::parse(DEFAULT_FILTER);
+        assert_eq!(f.level_for("vectorcraft"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft::window"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft_engine::guard"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft_ui_egui::io"), LevelFilter::Info);
+        assert_eq!(f.level_for("wgpu_core::device"), LevelFilter::Warn);
+        assert_eq!(f.level_for("naga"), LevelFilter::Warn);
+        assert_eq!(f.max(), LevelFilter::Info);
+    }
+
+    #[test]
+    fn directives_follow_env_logger_and_the_most_specific_one_wins() {
+        let f = Filter::parse("info,wgpu_core=error,vectorcraft_render=trace,vectorcraft_render::tiles=off");
+        assert_eq!(f.level_for("eframe"), LevelFilter::Info);
+        assert_eq!(f.level_for("wgpu_core::instance"), LevelFilter::Error);
+        assert_eq!(f.level_for("vectorcraft_render::canvas"), LevelFilter::Trace);
+        assert_eq!(f.level_for("vectorcraft_render::tiles"), LevelFilter::Off);
+        assert_eq!(f.max(), LevelFilter::Trace);
+        // A module name is matched at `::` boundaries, not as a bare prefix.
+        assert_eq!(f.level_for("wgpu_core_extra"), LevelFilter::Info);
+        // A trailing `*` is a prefix.
+        assert_eq!(Filter::parse("vectorcraft*=debug").level_for("vectorcraft_text::shape"), LevelFilter::Debug);
+        assert_eq!(Filter::parse("vectorcraft*=debug").level_for("eframe"), LevelFilter::Error);
+        // A bare target name sets that target to the most verbose level, as env_logger does.
+        assert_eq!(Filter::parse("naga").level_for("naga::front"), LevelFilter::Trace);
+        assert_eq!(Filter::parse("naga").level_for("eframe"), LevelFilter::Error);
+        // Levels are case-insensitive and surrounding blanks are ignored.
+        assert_eq!(Filter::parse(" WARN , vectorcraft = Debug ").level_for("vectorcraft"), LevelFilter::Debug);
+        assert_eq!(Filter::parse(" WARN , vectorcraft = Debug ").level_for("eframe"), LevelFilter::Warn);
+    }
+
+    #[test]
+    fn hostile_specs_never_panic_and_fall_back_sensibly() {
+        let long = "x".repeat(100_000);
+        let many = "a=info,".repeat(10_000);
+        for spec in [
+            "",
+            ",,,",
+            "=",
+            "==",
+            "=debug",
+            "vectorcraft=",
+            "nonsense=loud",
+            "🦀=info",
+            "*",
+            "*=",
+            "=*",
+            "a=b=c",
+            "warn,,vectorcraft=DEBUG",
+            "\0",
+            "é::ü=trace",
+            &long,
+            &many,
+        ] {
+            let f = Filter::parse(spec);
+            for target in ["", "vectorcraft", "🦀", "a::b", "*"] {
+                let _ = f.level_for(target);
+            }
+            let _ = f.max();
+        }
+        assert_eq!(Filter::parse("warn,,vectorcraft=DEBUG").level_for("vectorcraft"), LevelFilter::Debug);
+        // An unknown level is skipped: that target keeps the default.
+        assert_eq!(Filter::parse("nonsense=loud").level_for("nonsense"), LevelFilter::Error);
+        assert_eq!(Filter::parse("vectorcraft=").level_for("vectorcraft"), LevelFilter::Error);
+        assert_eq!(Filter::parse("=debug").max(), LevelFilter::Error);
+        assert_eq!(Filter::parse("🦀=info").level_for("🦀::claw"), LevelFilter::Info);
+    }
+
+    #[test]
+    fn timestamps_are_utc_with_milliseconds() {
+        assert_eq!(timestamp(UNIX_EPOCH), "1970-01-01T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_millis(1_791_446_357_728)), "2026-10-08T07:59:17.728Z");
+        // Leap day, and the day after it.
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_164_800)), "2024-02-29T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_251_199)), "2024-02-29T23:59:59.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_251_200)), "2024-03-01T00:00:00.000Z");
+        // 2000 is a leap year (divisible by 400), 2100 is not.
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(951_782_400)), "2000-02-29T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
+        // Before the epoch (a clock set wrong) clamps instead of panicking.
+        assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+    }
+
+    #[test]
+    fn a_line_carries_time_level_thread_target_and_message() {
+        assert_eq!(
+            format_line("2026-10-08T07:59:17.728Z", log::Level::Info, "main", "vectorcraft", "rendering with Mesa (Vulkan, IntegratedGpu)"),
+            "2026-10-08T07:59:17.728Z INFO  [main] vectorcraft: rendering with Mesa (Vulkan, IntegratedGpu)\n"
+        );
+        // A multi-line message keeps its lines; the record still ends in one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
+    }
+
+    #[test]
+    fn rotation_keeps_the_previous_logs_and_starts_an_empty_file() {
+        let dir = temp_dir("rotate");
+        for run in 1..=4 {
+            let (path, _file) = rotate(&dir).expect("rotate");
+            assert_eq!(path, dir.join(LOG_FILE));
+            assert_eq!(read(&path), "");
+            std::fs::write(&path, format!("run {run}")).expect("write");
+        }
+        assert_eq!(read(&dir.join(LOG_FILE)), "run 4");
+        assert_eq!(read(&dir.join("vectorcraft.1.log")), "run 3");
+        assert_eq!(read(&dir.join("vectorcraft.2.log")), "run 2");
+        assert!(!dir.join("vectorcraft.3.log").exists(), "only {KEEP} old logs are kept");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn rotation_into_an_unusable_directory_is_an_error_not_a_panic() {
+        let dir = temp_dir("blocked");
+        std::fs::create_dir_all(dir.parent().expect("parent")).expect("tmp");
+        std::fs::write(&dir, "a file where the directory should be").expect("block");
+        assert!(rotate(&dir).is_err());
+        let _ = std::fs::remove_file(&dir);
+    }
+
+    #[test]
+    fn lines_logged_before_the_file_exists_are_written_when_it_is_attached() {
+        let dir = temp_dir("pending");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        sink.write("early 1\n");
+        sink.write("early 2\n");
+        sink.attach(file);
+        sink.write("late\n");
+        assert_eq!(read(&path), "early 1\nearly 2\nlate\n");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_pending_buffer_is_bounded_and_says_how_much_it_dropped() {
+        let dir = temp_dir("bounded");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        for i in 0..MAX_PENDING + 5 {
+            sink.write(&format!("line {i}\n"));
+        }
+        sink.attach(file);
+        let text = read(&path);
+        assert_eq!(text.lines().filter(|l| l.starts_with("line ")).count(), MAX_PENDING);
+        assert!(text.contains("5 earlier log lines were dropped"), "{text}");
+        assert!(text.contains("line 0\n") && !text.contains(&format!("line {MAX_PENDING}\n")));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn exactly_a_full_pending_buffer_drops_nothing() {
+        let dir = temp_dir("full");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        for i in 0..MAX_PENDING {
+            sink.write(&format!("line {i}\n"));
+        }
+        sink.attach(file);
+        let text = read(&path);
+        assert_eq!(text.lines().count(), MAX_PENDING);
+        assert!(!text.contains("dropped"), "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn without_a_file_nothing_is_kept_in_memory() {
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        sink.write("early\n");
+        sink.no_file();
+        sink.write("late\n");
+        assert!(sink.pending.is_empty() && sink.dropped == 0);
+    }
+
+    #[test]
+    fn the_file_stops_at_its_size_cap_with_one_note() {
+        let dir = temp_dir("cap");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(100);
+        sink.attach(file);
+        for i in 0..50 {
+            sink.write(&format!("line {i:02} with some padding\n"));
+        }
+        let text = read(&path);
+        assert_eq!(text.lines().filter(|l| l.starts_with("line ")).count(), 3, "{text}");
+        assert_eq!(text.matches("log file reached").count(), 1, "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_logger_filters_records_and_writes_them_to_the_attached_file() {
+        use log::Log;
+        let dir = temp_dir("logger");
+        let logger = AppLogger::new(Filter::parse(DEFAULT_FILTER), false);
+        let record = |level, target: &'static str, msg: &'static str| {
+            logger.log(&log::Record::builder().level(level).target(target).args(format_args!("{msg}")).build());
+        };
+        record(log::Level::Info, "vectorcraft", "before the settings directory");
+        record(log::Level::Info, "wgpu_core::device", "too chatty");
+        let path = logger.attach_dir(&dir).expect("attach");
+        assert_eq!(path, dir.join(LOG_FILE));
+        record(log::Level::Warn, "wgpu_hal::vulkan", "a real warning");
+        record(log::Level::Error, "vectorcraft_engine::guard", "recovered from a panic: boom");
+        record(log::Level::Debug, "vectorcraft", "below info");
+        let text = read(&path);
+        let lines: Vec<&str> = text.lines().collect();
+        assert_eq!(lines.len(), 3, "{text}");
+        assert!(lines[0].contains(" INFO  [") && lines[0].ends_with("vectorcraft: before the settings directory"), "{text}");
+        assert!(lines[1].ends_with("wgpu_hal::vulkan: a real warning"), "{text}");
+        assert!(lines[2].contains(" ERROR [") && lines[2].ends_with("vectorcraft_engine::guard: recovered from a panic: boom"), "{text}");
+        assert!(logger.enabled(&log::Metadata::builder().level(log::Level::Info).target("vectorcraft_ui_egui").build()));
+        assert!(!logger.enabled(&log::Metadata::builder().level(log::Level::Info).target("naga").build()));
+        // Attaching again rotates: the first log becomes `.1`.
+        logger.attach_dir(&dir).expect("attach again");
+        assert_eq!(read(&dir.join("vectorcraft.1.log")), text);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn records_from_many_threads_are_whole_lines() {
+        use log::Log;
+        let dir = temp_dir("threads");
+        let logger = std::sync::Arc::new(AppLogger::new(Filter::parse("info"), false));
+        let path = logger.attach_dir(&dir).expect("attach");
+        let workers: Vec<_> = (0..8)
+            .map(|t| {
+                let l = std::sync::Arc::clone(&logger);
+                std::thread::spawn(move || {
+                    for i in 0..100 {
+                        l.log(
+                            &log::Record::builder().level(log::Level::Info).target("vectorcraft").args(format_args!("thread {t} record {i}")).build(),
+                        );
+                    }
+                })
+            })
+            .collect();
+        for w in workers {
+            w.join().expect("worker");
+        }
+        let text = read(&path);
+        assert_eq!(text.lines().count(), 800);
+        assert!(text.lines().all(|l| l.contains(" vectorcraft: thread ")), "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn attaching_to_an_unusable_directory_reports_an_error_and_keeps_logging() {
+        use log::Log;
+        let dir = temp_dir("unusable");
+        std::fs::create_dir_all(dir.parent().expect("parent")).expect("tmp");
+        std::fs::write(&dir, "not a directory").expect("block");
+        let logger = AppLogger::new(Filter::parse("info"), false);
+        assert!(logger.attach_dir(&dir).is_err());
+        logger.log(&log::Record::builder().level(log::Level::Error).target("x").args(format_args!("still fine")).build());
+        // Nothing waits in memory for a file that won't come.
+        assert!(logger.sink.lock().expect("sink").pending.is_empty());
+        let _ = std::fs::remove_file(&dir);
+    }
+
+    #[test]
+    fn a_poisoned_sink_still_logs() {
+        use log::Log;
+        let dir = temp_dir("poison");
+        let logger = std::sync::Arc::new(AppLogger::new(Filter::parse("info"), false));
+        let l = std::sync::Arc::clone(&logger);
+        let _ = std::thread::spawn(move || {
+            let _guard = l.sink.lock().expect("lock");
+            panic!("poison the sink");
+        })
+        .join();
+        assert!(logger.sink.is_poisoned());
+        let path = logger.attach_dir(&dir).expect("attach");
+        logger.log(&log::Record::builder().level(log::Level::Warn).target("vectorcraft").args(format_args!("after the poison")).build());
+        assert!(read(&path).contains("vectorcraft: after the poison"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

apps/vectorcraft/src/mac_fonts.rs

@@ -0,0 +1,84 @@
+//! macOS: the font files CoreText's font manager lists, scanned with the font folders
+//! (`vectorcraft_text::set_platform_font_files`). The desktop app and `vectorcraft-cli` (exports,
+//! MCP) both install it; the CLI shares this file.
+//!
+//! Apps and font managers can register fonts with the font manager from files in any folder,
+//! outside the font folders
+//! (<https://developer.apple.com/documentation/coretext/ctfontmanagerregisterfontsforurl(_:_:_:)>).
+//! The font manager's list of available fonts holds them
+//! (<https://developer.apple.com/documentation/coretext/ctfontmanagercopyavailablefonturls()>), so
+//! VectorCraft lists them as it does on Windows (`system_fonts.rs`), reading the files in place
+//! (#579).
+//!
+//! CoreText is a C API with no safe binding, hence the scoped `unsafe_code` allowance.
+#![allow(unsafe_code)]
+
+use std::collections::BTreeSet;
+
+use objc2_core_foundation::{CFType, CFURL};
+use objc2_core_text::CTFontManagerCopyAvailableFontURLs;
+
+/// The most fonts read from the list (a system has a few thousand faces).
+const MAX_FONTS: usize = 1 << 16;
+
+/// Have the font scans read the font files CoreText lists.
+pub fn install() {
+    vectorcraft_text::set_platform_font_files(font_files);
+}
+
+/// The files of the fonts available to the app as CoreText lists them now (fonts registered since
+/// the last call included).
+fn font_files() -> Vec<String> {
+    // SAFETY: a CoreText call without arguments; it returns a new array.
+    let list = unsafe { CTFontManagerCopyAvailableFontURLs() };
+    // SAFETY: the array holds CF objects (CFURLs, as CoreText documents); each one is checked to be
+    // a CFURL before it is read.
+    let fonts = unsafe { list.cast_unchecked::<CFType>() };
+    // Faces of one file (a collection's) name it once.
+    let files: BTreeSet<String> = fonts
+        .iter()
+        .take(MAX_FONTS)
+        .filter_map(|f| f.downcast::<CFURL>().ok())
+        // Only file URLs, as in `open_documents.rs` (#433).
+        .filter(|u| u.scheme().is_some_and(|s| s.to_string().eq_ignore_ascii_case("file")))
+        .filter_map(|u| u.to_file_path()?.into_os_string().into_string().ok())
+        .collect();
+    files.into_iter().collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2_core_foundation::CFURL;
+    use objc2_core_text::{CTFontManagerRegisterFontsForURL, CTFontManagerScope, CTFontManagerUnregisterFontsForURL};
+
+    /// CoreText lists the installed fonts, by their files' full paths.
+    #[test]
+    fn coretext_lists_the_installed_font_files() {
+        let files = super::font_files();
+        assert!(files.iter().all(|f| std::path::Path::new(f).is_absolute()), "{:?}", files.first());
+        assert!(files.iter().any(|f| f.starts_with("/System/Library/Fonts/")), "{} files, {:?}", files.len(), files.first());
+    }
+
+    /// A font registered with CoreText from another folder, as apps and font managers register
+    /// fonts, is listed while it is registered.
+    #[test]
+    fn fonts_registered_from_other_folders_are_listed() {
+        let dir = std::env::temp_dir().join(format!("vectorcraft-mac-fonts-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        // A space in the name: the URL's escapes are decoded. The bundled serif isn't a font macOS
+        // installs.
+        let file = dir.join("Registered Font.ttf");
+        std::fs::copy(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/SourceSerif4-Regular.ttf"), &file).unwrap();
+        let want = std::fs::canonicalize(&file).unwrap();
+        let listed = || super::font_files().iter().any(|f| f.ends_with("/Registered Font.ttf") && std::fs::canonicalize(f).is_ok_and(|p| p == want));
+        assert!(!listed());
+        let url = CFURL::from_file_path(&file).unwrap();
+        // SAFETY: a file URL, a scope constant and no error out-parameter.
+        assert!(unsafe { CTFontManagerRegisterFontsForURL(&url, CTFontManagerScope::Process, std::ptr::null_mut()) });
+        let registered = listed();
+        // SAFETY: as above.
+        unsafe { CTFontManagerUnregisterFontsForURL(&url, CTFontManagerScope::Process, std::ptr::null_mut()) };
+        std::fs::remove_dir_all(&dir).unwrap();
+        assert!(registered);
+    }
+}

apps/vectorcraft/src/mac_menu.rs

@@ -0,0 +1,487 @@
+//! The macOS menu bar, through muda (Tauri's menu crate: AppKit menus behind a safe API, no GTK
+//! with default features off). The menus, their Mac layout and how their keys reach VectorCraft
+//! are in `vectorcraft_ui_egui::native_menu`; this file only builds and updates the `NSMenu`s.
+//!
+//! - Item ids are the items' places (`vc12`, depth first): one command can run from several items
+//!   (each language of VectorCraft › Language is `app.language` with its own code).
+//! - A structure change (a recent file added, the language or a shortcut changed) rebuilds the
+//!   menu; labels, enabled and checked are updated in place.
+//! - A chosen item is a click or a key equivalent: AppKit's current event says which. A key
+//!   equivalent goes back to egui as the key press that was made (the event's modifiers, not the
+//!   item's: AppKit may match ⌘R to a ⇧⌘R item), so VectorCraft's key rules still apply.
+//! - Hide and Hide Others are items of ours calling `NSApplication`: AppKit's own always take ⌘H
+//!   (View › Hide Edges) and ⌥⌘H.
+
+use std::sync::Once;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{Receiver, channel};
+
+use block2::RcBlock;
+
+use egui::{Key, KeyboardShortcut};
+use muda::accelerator::{Accelerator, Code, Modifiers};
+use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use objc2::MainThreadMarker;
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType, NSMenuDidBeginTrackingNotification, NSMenuDidEndTrackingNotification};
+use objc2_foundation::{NSNotification, NSNotificationCenter};
+use vectorcraft_ui_egui::VectorcraftApp;
+use vectorcraft_ui_egui::native_menu::{self, Backend, Event, MenuBar, MenuRole, Node, Standard};
+
+// AppKit can deliver window input while its system menu is still tracking (especially with
+// asynchronous menu presentation). Keep the native tracking state separate from egui popups.
+static TRACKING: AtomicBool = AtomicBool::new(false);
+
+fn observe_tracking(ctx: &egui::Context) {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        // SAFETY: AppKit initializes these immutable notification-name constants.
+        #[allow(unsafe_code)]
+        let notifications = unsafe { [(NSMenuDidBeginTrackingNotification, true), (NSMenuDidEndTrackingNotification, false)] };
+        for (name, tracking) in notifications {
+            let repaint = ctx.clone();
+            let block = RcBlock::new(move |_: std::ptr::NonNull<NSNotification>| {
+                TRACKING.store(tracking, Ordering::Relaxed);
+                // Apply any deferred menu updates as soon as the tracking session ends.
+                if !tracking {
+                    repaint.request_repaint();
+                }
+            });
+            // SAFETY: these are AppKit's notification names. The notification center retains
+            // the observer and block for the application's lifetime; callbacks update an atomic and request repaint.
+            #[allow(unsafe_code)]
+            unsafe {
+                NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(Some(name), None, None, &block);
+            }
+        }
+    });
+}
+
+fn cancel_tracking() {
+    if let Some(mtm) = MainThreadMarker::new()
+        && let Some(menu) = NSApplication::sharedApplication(mtm).mainMenu()
+    {
+        menu.cancelTracking();
+    }
+    TRACKING.store(false, Ordering::Relaxed);
+}
+
+/// A dismissing click belongs to the menu, so the canvas and panel controls must not see it.
+fn dismiss_input(raw: &mut egui::RawInput, tracking: bool) -> bool {
+    if !raw
+        .events
+        .iter()
+        .any(|e| matches!(e, egui::Event::PointerButton { pressed: true, .. } | egui::Event::Key { key: egui::Key::Escape, pressed: true, .. }))
+    {
+        return false;
+    }
+    if tracking {
+        raw.events.retain(|e| !matches!(e, egui::Event::PointerButton { .. } | egui::Event::Key { key: egui::Key::Escape, .. }));
+    }
+    true
+}
+
+/// Inspect real window input before native key equivalents and control events are added.
+pub fn raw_input_hook(raw: &mut egui::RawInput) {
+    // Asynchronous menu presentation may leave a displayed menu after its tracking notification.
+    // Still cancel it, but consume the dismissing input only during a reported tracking session.
+    if dismiss_input(raw, TRACKING.load(Ordering::Relaxed)) {
+        cancel_tracking();
+    }
+}
+
+enum Handle {
+    Plain(MenuItem),
+    Check(CheckMenuItem),
+}
+
+/// One native item, in the order of [`MenuBar::items`].
+struct Entry {
+    handle: Handle,
+    item: native_menu::Item,
+    /// Its shortcut, when it is a key equivalent.
+    chord: Option<KeyboardShortcut>,
+}
+
+/// How an item was chosen, read from AppKit's current event while it calls the handler.
+struct Chosen {
+    id: String,
+    /// A key press (not a mouse click), and the modifiers held: ⌘, ⌃, ⌥, ⇧.
+    key: bool,
+    mods: [bool; 4],
+}
+
+pub struct MacMenu {
+    menu: Option<Menu>,
+    entries: Vec<Entry>,
+    rx: Receiver<Chosen>,
+    structure: u64,
+    /// Latest menu state to apply after AppKit finishes tracking; item ids stay stable meanwhile.
+    pending: Option<MenuBar>,
+}
+
+impl MacMenu {
+    fn new(ctx: &egui::Context) -> MacMenu {
+        observe_tracking(ctx);
+        let (tx, rx) = channel();
+        let repaint = ctx.clone();
+        MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
+            // AppKit calls this on the main thread, from the event that chose the item: a key
+            // equivalent is a key-down, a click a mouse-up (or ↩ inside the open menu).
+            let event = MainThreadMarker::new().and_then(|mtm| NSApplication::sharedApplication(mtm).currentEvent());
+            let key = event.as_ref().is_some_and(|ev| ev.r#type() == NSEventType::KeyDown);
+            let flags = event.as_ref().map_or(NSEventModifierFlags::empty(), |ev| ev.modifierFlags());
+            let mods = [NSEventModifierFlags::Command, NSEventModifierFlags::Control, NSEventModifierFlags::Option, NSEventModifierFlags::Shift]
+                .map(|m| flags.contains(m));
+            // The receiver only goes away with the app.
+            let _ = tx.send(Chosen { id: e.id.0, key, mods });
+            // Wake egui, so the item runs now rather than on the next mouse move.
+            repaint.request_repaint();
+        }));
+        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0, pending: None }
+    }
+
+    /// Build the menus of `bar` and make them the app's, in place of the ones before.
+    fn build(&mut self, bar: &MenuBar) -> muda::Result<()> {
+        let mut entries = Vec::new();
+        let menu = Menu::new();
+        let mut special = Vec::new();
+        for m in &bar.menus {
+            let sub = Submenu::new(escape(&m.title), true);
+            append(&sub, &m.children, &mut entries)?;
+            menu.append(&sub)?;
+            if matches!(m.role, MenuRole::Window | MenuRole::Help) {
+                special.push((m.role, sub));
+            }
+        }
+        if let Some(old) = self.menu.take() {
+            old.remove_for_nsapp();
+        }
+        menu.init_for_nsapp();
+        // Only once the menu is the app's: muda looks the submenus up in the installed main menu.
+        for (role, sub) in special {
+            match role {
+                MenuRole::Window => sub.set_as_windows_menu_for_nsapp(),
+                _ => sub.set_as_help_menu_for_nsapp(),
+            }
+        }
+        self.menu = Some(menu);
+        self.entries = entries;
+        self.structure = native_menu::structure_key(bar);
+        Ok(())
+    }
+}
+
+fn append(sub: &Submenu, nodes: &[Node], entries: &mut Vec<Entry>) -> muda::Result<()> {
+    for n in nodes {
+        match n {
+            Node::Separator => sub.append(&PredefinedMenuItem::separator())?,
+            Node::Header(label) => sub.append(&MenuItem::new(escape(label), false, None))?,
+            Node::Submenu { label, children } => {
+                let s = Submenu::new(escape(label), !children.is_empty());
+                append(&s, children, entries)?;
+                sub.append(&s)?;
+            }
+            Node::Standard(item) => {
+                let text = Some(vectorcraft_ui_egui::i18n::t(item.label()));
+                let p = match item {
+                    Standard::Services => PredefinedMenuItem::services(text),
+                    Standard::ShowAll => PredefinedMenuItem::show_all(text),
+                    Standard::Zoom => PredefinedMenuItem::maximize(text),
+                    Standard::BringAllToFront => PredefinedMenuItem::bring_all_to_front(text),
+                };
+                sub.append(&p)?;
+            }
+            Node::Item(it) => {
+                let id = format!("vc{}", entries.len());
+                let chord = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok);
+                let accel = chord.as_ref().and_then(accelerator);
+                let handle = match it.checked {
+                    Some(c) => {
+                        let h = CheckMenuItem::with_id(id, escape(&it.label), it.enabled, c, accel);
+                        sub.append(&h)?;
+                        Handle::Check(h)
+                    }
+                    None => {
+                        let h = MenuItem::with_id(id, escape(&it.label), it.enabled, accel);
+                        sub.append(&h)?;
+                        Handle::Plain(h)
+                    }
+                };
+                entries.push(Entry { handle, item: it.clone(), chord });
+            }
+        }
+    }
+    Ok(())
+}
+
+impl Backend for MacMenu {
+    fn sync(&mut self, bar: &MenuBar) {
+        // Replacing or mutating an NSMenu during tracking can strand its displayed menu. Keep
+        // the latest state: the shared model considers this sync complete and may not resend it.
+        if TRACKING.load(Ordering::Relaxed) {
+            self.pending = Some(bar.clone());
+            return;
+        }
+        self.pending = None;
+        let items = bar.items();
+        if self.menu.is_none() || native_menu::structure_key(bar) != self.structure || items.len() != self.entries.len() {
+            if let Err(e) = self.build(bar) {
+                // The menus as they were stay up (a failed build changed nothing).
+                log::warn!("couldn't rebuild the macOS menu bar: {e}");
+            }
+            return;
+        }
+        for (e, it) in self.entries.iter_mut().zip(items) {
+            if e.item.label != it.label {
+                let text = escape(&it.label);
+                match &e.handle {
+                    Handle::Plain(h) => h.set_text(text),
+                    Handle::Check(h) => h.set_text(text),
+                }
+            }
+            if e.item.enabled != it.enabled {
+                match &e.handle {
+                    Handle::Plain(h) => h.set_enabled(it.enabled),
+                    Handle::Check(h) => h.set_enabled(it.enabled),
+                }
+            }
+            // Compare with AppKit's own state: muda toggles a check item when it's clicked.
+            if let (Handle::Check(h), Some(c)) = (&e.handle, it.checked)
+                && h.is_checked() != c
+            {
+                h.set_checked(c);
+            }
+            if e.item != *it {
+                e.item = it.clone();
+            }
+        }
+    }
+
+    fn drain(&mut self) -> Vec<Event> {
+        let mut out = Vec::new();
+        while let Ok(chosen) = self.rx.try_recv() {
+            cancel_tracking();
+            // Ids that aren't ours are AppKit's own items (Services, Zoom…), already handled.
+            let Some(e) = chosen.id.strip_prefix("vc").and_then(|n| n.parse::<usize>().ok()).and_then(|i| self.entries.get(i)) else { continue };
+            if let Some(command @ (native_menu::HIDE | native_menu::HIDE_OTHERS)) = e.item.command {
+                if let Some(mtm) = MainThreadMarker::new() {
+                    let app = NSApplication::sharedApplication(mtm);
+                    if command == native_menu::HIDE { app.hide(None) } else { app.hideOtherApplications(None) }
+                }
+                continue;
+            }
+            // A key-down chose it: its key equivalent, unless it was ↩ or Space inside the open
+            // menu (no ⌘ or ⌃ while the item's shortcut has one). The key is the item's (AppKit
+            // matched on it); the modifiers are the ones held.
+            let [cmd, ctrl, alt, shift] = chosen.mods;
+            let key = e
+                .chord
+                .filter(|c| {
+                    chosen.key && e.item.command != Some(native_menu::MINIMIZE) && (cmd || ctrl || !(c.modifiers.command || c.modifiers.ctrl))
+                })
+                .map(|c| KeyboardShortcut::new(egui::Modifiers { alt, ctrl, shift, mac_cmd: cmd, command: cmd }, c.logical_key));
+            out.push(match key {
+                Some(k) => Event::Key(k),
+                None => Event::Click(e.item.clone()),
+            });
+        }
+        // Drain against the old item ids before a deferred structure change replaces them.
+        if !TRACKING.load(Ordering::Relaxed)
+            && let Some(bar) = self.pending.take()
+        {
+            self.sync(&bar);
+        }
+        out
+    }
+}
+
+/// Install the menu bar (in eframe's creator closure, so winit's default menu doesn't stay up).
+/// `None` keeps the menus in the window: AppKit refused them (logged), never a crash.
+pub fn install(ctx: &egui::Context, app: &VectorcraftApp) -> Option<native_menu::NativeMenu> {
+    vectorcraft_ui_egui::i18n::set_current(app.ui_language());
+    let bar = native_menu::layout(app).bar;
+    let built = vectorcraft_engine::guard::catch_panic(|| {
+        let mut menu = MacMenu::new(ctx);
+        menu.build(&bar).map(|()| menu)
+    });
+    match built {
+        Ok(Ok(menu)) => Some(native_menu::NativeMenu::new(Box::new(menu))),
+        Ok(Err(e)) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+        Err(e) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+    }
+}
+
+/// `&` marks a mnemonic in muda labels: "Fill & Stroke" keeps its ampersand.
+fn escape(s: &str) -> String {
+    s.replace('&', "&&")
+}
+
+/// A key equivalent for AppKit. `Cmd` is ⌘ (`META`) and `Ctrl` is ⌃: never folded together.
+fn accelerator(c: &KeyboardShortcut) -> Option<Accelerator> {
+    let m = c.modifiers;
+    let mut mods = Modifiers::empty();
+    for (on, flag) in [(m.command || m.mac_cmd, Modifiers::META), (m.ctrl, Modifiers::CONTROL), (m.alt, Modifiers::ALT), (m.shift, Modifiers::SHIFT)]
+    {
+        if on {
+            mods |= flag;
+        }
+    }
+    Some(Accelerator::new(mods, code(c.logical_key)?))
+}
+
+/// The key code AppKit matches for an egui key.
+fn code(key: Key) -> Option<Code> {
+    Some(match key {
+        Key::A => Code::KeyA,
+        Key::B => Code::KeyB,
+        Key::C => Code::KeyC,
+        Key::D => Code::KeyD,
+        Key::E => Code::KeyE,
+        Key::F => Code::KeyF,
+        Key::G => Code::KeyG,
+        Key::H => Code::KeyH,
+        Key::I => Code::KeyI,
+        Key::J => Code::KeyJ,
+        Key::K => Code::KeyK,
+        Key::L => Code::KeyL,
+        Key::M => Code::KeyM,
+        Key::N => Code::KeyN,
+        Key::O => Code::KeyO,
+        Key::P => Code::KeyP,
+        Key::Q => Code::KeyQ,
+        Key::R => Code::KeyR,
+        Key::S => Code::KeyS,
+        Key::T => Code::KeyT,
+        Key::U => Code::KeyU,
+        Key::V => Code::KeyV,
+        Key::W => Code::KeyW,
+        Key::X => Code::KeyX,
+        Key::Y => Code::KeyY,
+        Key::Z => Code::KeyZ,
+        Key::Num0 => Code::Digit0,
+        Key::Num1 => Code::Digit1,
+        Key::Num2 => Code::Digit2,
+        Key::Num3 => Code::Digit3,
+        Key::Num4 => Code::Digit4,
+        Key::Num5 => Code::Digit5,
+        Key::Num6 => Code::Digit6,
+        Key::Num7 => Code::Digit7,
+        Key::Num8 => Code::Digit8,
+        Key::Num9 => Code::Digit9,
+        Key::F1 => Code::F1,
+        Key::F2 => Code::F2,
+        Key::F3 => Code::F3,
+        Key::F4 => Code::F4,
+        Key::F5 => Code::F5,
+        Key::F6 => Code::F6,
+        Key::F7 => Code::F7,
+        Key::F8 => Code::F8,
+        Key::F9 => Code::F9,
+        Key::F10 => Code::F10,
+        Key::F11 => Code::F11,
+        Key::F12 => Code::F12,
+        Key::F13 => Code::F13,
+        Key::F14 => Code::F14,
+        Key::F15 => Code::F15,
+        Key::F16 => Code::F16,
+        Key::F17 => Code::F17,
+        Key::F18 => Code::F18,
+        Key::F19 => Code::F19,
+        Key::F20 => Code::F20,
+        Key::F21 => Code::F21,
+        Key::F22 => Code::F22,
+        Key::F23 => Code::F23,
+        Key::F24 => Code::F24,
+        Key::OpenBracket => Code::BracketLeft,
+        Key::CloseBracket => Code::BracketRight,
+        Key::Backslash => Code::Backslash,
+        Key::Slash => Code::Slash,
+        // `+` is Shift+`=` on the keyboards AppKit matches by key: Zoom In shows ⌘=.
+        Key::Equals | Key::Plus => Code::Equal,
+        Key::Minus => Code::Minus,
+        Key::Quote => Code::Quote,
+        Key::Semicolon => Code::Semicolon,
+        Key::Comma => Code::Comma,
+        Key::Period => Code::Period,
+        Key::Backtick => Code::Backquote,
+        Key::Backspace => Code::Backspace,
+        Key::Delete => Code::Delete,
+        Key::Enter => Code::Enter,
+        Key::Tab => Code::Tab,
+        Key::Space => Code::Space,
+        Key::Escape => Code::Escape,
+        Key::ArrowLeft => Code::ArrowLeft,
+        Key::ArrowRight => Code::ArrowRight,
+        Key::ArrowUp => Code::ArrowUp,
+        Key::ArrowDown => Code::ArrowDown,
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every shortcut the Mac menu shows as a key equivalent has one AppKit can match.
+    #[test]
+    fn every_menu_shortcut_maps_to_a_key_equivalent() {
+        let app = VectorcraftApp::new(vectorcraft_engine::Session::new(), Default::default());
+        let bar = native_menu::layout(&app).bar;
+        let mut native = 0;
+        for it in bar.items() {
+            let Some(c) = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok) else { continue };
+            assert!(accelerator(&c).is_some(), "{:?} ({:?}) has no key equivalent", it.shortcut, it.command);
+            native += 1;
+        }
+        assert!(native > 70, "{native} key equivalents");
+    }
+
+    #[test]
+    fn control_and_command_stay_distinct() {
+        let parse = |s| vectorcraft_ui_egui::shortcuts::parse(s).and_then(|c| accelerator(&c));
+        assert_ne!(parse("Cmd+M"), parse("Ctrl+Cmd+M"));
+        assert!(parse("Cmd+M").is_some());
+    }
+
+    fn press() -> egui::Event {
+        egui::Event::PointerButton {
+            pos: egui::pos2(300.0, 200.0),
+            button: egui::PointerButton::Primary,
+            pressed: true,
+            modifiers: Default::default(),
+        }
+    }
+
+    #[test]
+    fn outside_press_dismisses_without_starting_a_canvas_gesture() {
+        let moved = egui::Event::PointerMoved(egui::pos2(300.0, 200.0));
+        let mut raw = egui::RawInput { events: vec![moved.clone(), press()], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert_eq!(raw.events, [moved]);
+        assert!(!dismiss_input(&mut raw, true));
+        raw.events.push(press());
+        assert!(dismiss_input(&mut raw, false));
+        assert_eq!(raw.events.len(), 2, "ordinary canvas presses still reach egui");
+    }
+
+    #[test]
+    fn escape_dismisses_without_reaching_the_active_tool() {
+        let escape = |pressed| egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed, repeat: false, modifiers: Default::default() };
+        let mut raw = egui::RawInput { events: vec![escape(true), escape(false)], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert!(raw.events.is_empty());
+    }
+
+    #[test]
+    fn moving_the_pointer_does_not_dismiss_a_tracking_menu() {
+        let mut raw = egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(300.0, 200.0))], ..Default::default() };
+        assert!(!dismiss_input(&mut raw, true));
+        assert_eq!(raw.events.len(), 1);
+    }
+}

apps/vectorcraft/src/main.rs

@@ -1,54 +1,129 @@
 //! VectorCraft desktop app.
 //!
-//! Usage: `vectorcraft [--control <port>] [files…]`
+//! Usage: `vectorcraft [--control <port>] [--in-window-menus] [files…]`
+//!
+//! `--in-window-menus` (or `VECTORCRAFT_IN_WINDOW_MENUS=1`) keeps the menus inside the window on
+//! macOS instead of the macOS menu bar (`mac_menu`).
 //!
 //! `--control <port>` (or `VECTORCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"ui.inspect","params":{}}` → `{"id":1,"ok":true,"result":…}`.
 //! See `vectorcraft_ui_egui::control` for the methods.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
+#[cfg(all(feature = "windows7", any(feature = "wgpu", feature = "accessibility")))]
+compile_error!("windows7 requires --no-default-features (wgpu and accessibility must be disabled)");
+#[cfg(all(windows, feature = "windows7", not(target_vendor = "win7")))]
+compile_error!("windows7 requires --target x86_64-win7-windows-msvc; the ordinary Windows target still imports newer APIs");
+#[cfg(all(target_vendor = "win7", not(feature = "windows7")))]
+compile_error!("the win7 target requires --no-default-features --features windows7");
+
 mod clipboard;
 mod control_server;
+#[cfg(feature = "wgpu")]
+mod gpu;
+mod logging;
 #[cfg(target_os = "macos")]
-mod native_menu;
+mod mac_fonts;
+#[cfg(target_os = "macos")]
+mod mac_menu;
+#[cfg(target_os = "macos")]
+mod open_documents;
+mod prefs_dir;
 mod printing;
+#[cfg(all(windows, not(target_vendor = "win7")))]
+mod system_fonts;
 mod window;
 
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_ui_egui::{FilePick, Services, VectorcraftApp};
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
+use vectorcraft_ui_egui::picks::PickRequest;
+use vectorcraft_ui_egui::{ClipboardProbeFactory, FilePick, Services, VectorcraftApp};
 
-struct App(VectorcraftApp, #[cfg(target_os = "macos")] Option<native_menu::NativeMenu>);
+struct App {
+    app: VectorcraftApp,
+    /// Reported by wgpu when the window's graphics device is lost (a driver reset).
+    graphics_loss: GraphicsLoss,
+    /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
+    graphics_lost: bool,
+    /// Frames the UI has run (see [`end_before_teardown`]).
+    frames: u64,
+}
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        #[cfg(target_os = "macos")]
-        {
-            if self.1.is_none() && std::env::var_os("VECTORCRAFT_NO_NATIVE_MENU").is_none() {
-                self.1 = Some(native_menu::NativeMenu::install(&mut self.0));
-            }
-            if let Some(m) = &mut self.1 {
-                m.poll(&mut self.0);
-            }
+        self.frames = ctx.cumulative_frame_nr();
+        if let Some(why) = self.graphics_loss.take() {
+            // eframe can't give a window a new device: the user saves and starts again.
+            self.graphics_lost = self.app.graphics_lost(&why);
+            self.app.status(if self.graphics_lost {
+                "The graphics device was lost: unsaved changes are kept for Data Recovery. Save your documents and restart VectorCraft"
+            } else {
+                "The graphics device was lost: save your documents and restart VectorCraft"
+            });
         }
-        self.0.logic(ctx);
-        window::track(ctx, &mut self.0.ui.window);
-        if self.0.ui.status == "quit" {
+        if self.graphics_lost && ctx.input(|i| i.viewport().close_requested()) {
+            // The window can't show the Save Changes question: it closes, and the next launch
+            // offers the changes back.
+            vectorcraft_ui_egui::background::wait_all(&mut self.app);
+            return;
+        }
+        #[cfg(target_os = "macos")]
+        open_files(&mut self.app, open_documents::take());
+        self.app.logic(ctx);
+        window::track(ctx, &mut self.app.ui.window);
+        if self.app.ui.status == "quit" {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+        #[cfg(target_os = "macos")]
+        if self.app.services.native_menu.is_some() {
+            mac_menu::raw_input_hook(raw);
+        }
+        self.app.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.0.ui(ui);
+        self.app.ui(ui);
         #[cfg(target_os = "macos")]
-        if self.0.take_ime_discard() {
+        if self.app.take_ime_discard() {
             discard_marked_text();
         }
     }
+    #[cfg(not(feature = "windows7"))]
     fn on_exit(&mut self) {
-        save_prefs(&self.0);
+        save_prefs(&self.app);
+        end_before_teardown(self.frames);
+    }
+    #[cfg(feature = "windows7")]
+    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        save_prefs(&self.app);
+    }
+}
+
+/// On macOS with accessibility, end the process once the app has saved what it keeps on quitting,
+/// before eframe tears the window down (#661). AccessKit then gives the window's content view back
+/// its own class, which AppKit's Touch Bar support was observing it under, and AppKit aborts the
+/// app as it quits on Macs with a Touch Bar. Nothing after the window is needed on a normal quit.
+/// Not while the window is still starting up (`frames` below [`gpu::STARTUP_FRAMES`]): a graphics
+/// failure then starts the app again on another adapter (#651).
+#[allow(unused_variables)]
+fn end_before_teardown(frames: u64) {
+    #[cfg(all(target_os = "macos", feature = "accessibility", feature = "wgpu"))]
+    if frames >= gpu::STARTUP_FRAMES {
+        log::info!("quitting");
+        log::logger().flush();
+        std::process::exit(0);
+    }
+}
+
+/// Open files handed to the app (command line, macOS Finder and Dock) as documents. A file that
+/// can't be opened is reported to the user and on stderr; the others still open.
+fn open_files(app: &mut VectorcraftApp, files: Vec<String>) {
+    for f in files {
+        if let Err(e) = vectorcraft_ui_egui::io::open_reporting(app, &f) {
+            eprintln!("vectorcraft: {f}: {e}");
+        }
     }
 }
 
@@ -66,27 +141,18 @@ fn discard_marked_text() {
 /// Where UI preferences live: ~/Library/Application Support/VectorCraft (macOS),
 /// %APPDATA%\VectorCraft (Windows), $XDG_CONFIG_HOME or ~/.config/vectorcraft (Linux).
 fn prefs_path() -> Option<std::path::PathBuf> {
-    prefs_path_for("VectorCraft", "vectorcraft")
+    prefs_dir::prefs_path_for("VectorCraft", "vectorcraft")
 }
 
 /// The same place under the project's former name (DrawCraft): read once if there are no
 /// VectorCraft preferences yet, so settings survive the rename.
 fn legacy_prefs_path() -> Option<std::path::PathBuf> {
-    prefs_path_for("DrawCraft", "drawcraft")
+    prefs_dir::prefs_path_for("DrawCraft", "drawcraft")
 }
 
-fn prefs_path_for(name: &str, lower: &str) -> Option<std::path::PathBuf> {
-    let base = if cfg!(target_os = "macos") {
-        std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join("Library/Application Support").join(name))
-    } else if cfg!(windows) {
-        std::env::var_os("APPDATA").map(|a| std::path::PathBuf::from(a).join(name))
-    } else {
-        std::env::var_os("XDG_CONFIG_HOME")
-            .map(std::path::PathBuf::from)
-            .or_else(|| std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join(".config")))
-            .map(|c| c.join(lower))
-    };
-    base.map(|b| b.join("ui.json"))
+/// Where the log files live: `logs` in the preferences folder (see `logging`).
+fn log_dir() -> Option<std::path::PathBuf> {
+    Some(prefs_path()?.parent()?.join("logs"))
 }
 
 /// Runs without preferences (`VECTORCRAFT_NO_PREFS`, agents' test runs) neither read nor write them.
@@ -128,9 +194,22 @@ fn save_prefs(app: &VectorcraftApp) {
     }
 }
 
-/// A native file dialog showing `pick`'s file types, folder and suggested name.
-fn file_dialog(pick: &FilePick) -> rfd::FileDialog {
-    let d = pick.filters.iter().fold(rfd::FileDialog::new(), |d, (name, exts)| d.add_filter(*name, exts));
+/// The window file dialogs belong to.
+type Parent = Option<std::sync::Arc<winit::window::Window>>;
+
+/// A native file dialog for `request` over `parent` (Windows and Linux, where the portal then
+/// shows it over the window and keeps it in front; macOS shows them as before).
+fn file_dialog(request: &PickRequest, parent: &Parent) -> rfd::FileDialog {
+    let d = match parent {
+        Some(w) if !cfg!(target_os = "macos") => rfd::FileDialog::new().set_parent(&**w),
+        _ => rfd::FileDialog::new(),
+    };
+    let pick = match request {
+        PickRequest::Open(pick) | PickRequest::Save(pick) => pick,
+        PickRequest::OpenMany => return fileio::place_filters().fold(d.set_title("Place"), |d, (name, exts)| d.add_filter(name, exts)),
+        PickRequest::Folder => return d,
+    };
+    let d = pick.filters.iter().fold(d, |d, (name, exts)| d.add_filter(*name, exts));
     let d = match &pick.folder {
         Some(folder) => d.set_directory(folder),
         None => d,
@@ -138,6 +217,28 @@ fn file_dialog(pick: &FilePick) -> rfd::FileDialog {
     if pick.name.is_empty() { d } else { d.set_file_name(&pick.name) }
 }
 
+/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked.
+fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
+    let paths = match request {
+        PickRequest::Open(_) => dialog.pick_file().into_iter().collect(),
+        PickRequest::OpenMany => dialog.pick_files().unwrap_or_default(),
+        PickRequest::Save(pick) => {
+            // The Templates folder may not exist yet.
+            if let Some(folder) = &pick.folder {
+                let _ = std::fs::create_dir_all(folder);
+            }
+            dialog.save_file().into_iter().collect()
+        }
+        PickRequest::Folder => dialog.pick_folder().into_iter().collect(),
+    };
+    paths.into_iter().map(|p| p.to_string_lossy().to_string()).collect()
+}
+
+/// Show the dialog for `request` over `parent` now → the paths picked.
+fn pick_now(request: PickRequest, parent: &Parent) -> Vec<String> {
+    show_dialog(file_dialog(&request, parent), &request)
+}
+
 /// File → Show in Folder: select `path` in Finder / Explorer, or open its folder elsewhere.
 fn reveal(path: &str) -> Result<(), String> {
     reveal_command(path).spawn().map(|_| ()).map_err(|e| format!("can't show {path}: {e}"))
@@ -173,31 +274,44 @@ fn write_file(path: &str, bytes: &[u8]) -> Result<(), String> {
     fileio::write_atomic(std::path::Path::new(path), bytes).map_err(|e| e.to_string())
 }
 
-fn services() -> Services {
+/// Linux and macOS: show the dialog for `request` over `parent` on a thread of its own, answering
+/// on the receiver. Shown on the UI thread, nothing would answer the compositor meanwhile on Linux,
+/// which then offers to kill the window as not responding (#592); on macOS the panel ran modally
+/// inside the window's event handler, and resizing it delivered window events to that handler
+/// again, which crashed the app (#867). From another thread, rfd runs the panel on the main thread
+/// from the run loop, outside the handler.
+fn start_pick(request: PickRequest, parent: &Parent) -> Option<std::sync::mpsc::Receiver<Vec<String>>> {
+    let dialog = file_dialog(&request, parent);
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::Builder::new()
+        .name("file-dialog".into())
+        .spawn(move || {
+            // The app gone meanwhile has no use for the answer.
+            let _ = tx.send(show_dialog(dialog, &request));
+        })
+        .ok()?;
+    Some(rx)
+}
+
+fn services(parent: Parent) -> Services {
+    let (p1, p2, p3, p4, p5) = (parent.clone(), parent.clone(), parent.clone(), parent.clone(), parent);
     Services {
-        pick_open: Some(Box::new(|pick: &FilePick| file_dialog(pick).pick_file().map(|p| p.to_string_lossy().to_string()))),
-        pick_open_multi: Some(Box::new(|| {
-            fileio::place_filters()
-                .fold(rfd::FileDialog::new().set_title("Place"), |d, (name, exts)| d.add_filter(name, exts))
-                .pick_files()
-                .unwrap_or_default()
-                .into_iter()
-                .map(|p| p.to_string_lossy().to_string())
-                .collect()
-        })),
-        pick_save: Some(Box::new(|pick: &FilePick| {
-            // The Templates folder may not exist yet.
-            if let Some(folder) = &pick.folder {
-                let _ = std::fs::create_dir_all(folder);
-            }
-            file_dialog(pick).save_file().map(|p| p.to_string_lossy().to_string())
-        })),
+        pick_open: Some(Box::new(move |pick: &FilePick| pick_now(PickRequest::Open(pick.clone()), &p1).into_iter().next())),
+        pick_open_multi: Some(Box::new(move || pick_now(PickRequest::OpenMany, &p2))),
+        pick_save: Some(Box::new(move |pick: &FilePick| pick_now(PickRequest::Save(pick.clone()), &p3).into_iter().next())),
+        // Windows dialogs run the window's events while they are open; Linux's don't, and macOS
+        // ones re-enter the window's event handler (#867).
+        start_pick: cfg!(unix).then(|| Box::new(move |request: PickRequest| start_pick(request, &p5)) as vectorcraft_ui_egui::picks::StartPick),
         read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
         write: Some(Box::new(write_file)),
         // Background Save and Export write from a worker thread.
         write_shared: Some(std::sync::Arc::new(write_file)),
         // Every format Copy offers and Paste reads (menu-bar Paste never sees egui's Paste event).
         system_clipboard: Some(clipboard::system_clipboard()),
+        // Linux checks whether Paste has something to take on a background thread: an X11 clipboard
+        // owner that never answers holds a read for up to 4 s. Windows only asks which formats the
+        // clipboard holds and macOS asks the pasteboard server, so they check in line.
+        clipboard_probe: cfg!(target_os = "linux").then(|| Box::new(clipboard::system_clipboard) as ClipboardProbeFactory),
         // Help → Discord / website / GitHub, the Discord button, About and Home links.
         open_url: Some(Box::new(|url: &str| {
             let _ = webbrowser::open(url);
@@ -205,7 +319,7 @@ fn services() -> Services {
         reveal: Some(Box::new(reveal)),
         // Links panel: Edit Original; Package: Show Package. Relink to Folder and Package pick folders.
         open_file: Some(Box::new(open_file)),
-        pick_folder: Some(Box::new(|| rfd::FileDialog::new().pick_folder().map(|p| p.to_string_lossy().to_string()))),
+        pick_folder: Some(Box::new(move || pick_now(PickRequest::Folder, &p4).into_iter().next())),
         // File → Print: the system's printers and print queue.
         print: Some(Box::new(printing::SystemPrint)),
         ..Default::default()
@@ -241,27 +355,90 @@ fn app_icon() -> egui::IconData {
     eframe::icon_data::from_png_bytes(png).unwrap_or_default()
 }
 
+/// Windows shows a window's big icon (`ICON_BIG`) in the taskbar and Alt+Tab; eframe sets only the
+/// small one (the title bar's), so the taskbar showed a generic icon. Set the big one too.
+#[cfg(windows)]
+fn set_taskbar_icon(w: &winit::window::Window) {
+    use winit::platform::windows::WindowExtWindows as _;
+    let icon = app_icon();
+    // An icon that can't be made leaves the generic one: nothing else depends on it.
+    if let Ok(i) = winit::window::Icon::from_rgba(icon.rgba, icon.width, icon.height) {
+        w.set_taskbar_icon(Some(i));
+    }
+}
+
+/// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
+#[cfg(feature = "wgpu")]
+fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
+    format!("{} ({:?}, {:?})", info.name.trim(), info.backend, info.device_type)
+}
+
 /// Windows and Linux: no OS title bar; the app bar is the title bar (`vectorcraft_ui_egui::titlebar`).
 /// macOS keeps its traffic lights over the integrated title strip.
 const CUSTOM_TITLEBAR: bool = !cfg!(target_os = "macos");
 
-fn main() -> eframe::Result {
+fn main() -> std::process::ExitCode {
+    // First, so every start-up warning is recorded (`logging`).
+    let logger = logging::install();
     vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
+    // Before the first font scan (the app's start): the fonts font services load (#579).
+    #[cfg(all(windows, not(target_vendor = "win7")))]
+    system_fonts::install();
+    #[cfg(target_os = "macos")]
+    mac_fonts::install();
+    // VectorCraft's own Fonts folder, which text.addFontFiles copies fonts into.
+    prefs_dir::install_fonts();
     let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
     let mut files = Vec::new();
+    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
     let mut args = std::env::args().skip(1);
     while let Some(a) = args.next() {
         match a.as_str() {
             "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
+            "--in-window-menus" => in_window_menus = true,
             "--version" => {
                 println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
-                return Ok(());
+                return std::process::ExitCode::SUCCESS;
             }
             _ => files.push(a),
         }
     }
+    // The log file lives in the settings directory, next to the preferences; opened after the
+    // arguments, so `--version` leaves no file behind. Records logged until now are written to it
+    // first. Runs without preferences (agents' test runs) log to standard error only, so they
+    // don't rotate away the user's own logs.
+    if let Some(logger) = logger {
+        match log_dir().filter(|_| prefs_enabled()) {
+            Some(dir) => match logger.attach_dir(&dir) {
+                Ok(path) => log::info!("VectorCraft {}, log file {}", env!("CARGO_PKG_VERSION"), path.display()),
+                // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
+                Err(e) => log::warn!("no log file: {e}"),
+            },
+            None => logger.no_file(),
+        }
+    }
     let saved = read_prefs();
     let saved_window = saved.as_ref().and_then(|ui| ui.window);
+    #[cfg(feature = "wgpu")]
+    let gpu_pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("gpuPreference")).and_then(serde_json::Value::as_str);
+    #[cfg(feature = "wgpu")]
+    let power_env = eframe::wgpu::PowerPreference::from_env();
+    #[cfg(feature = "wgpu")]
+    let power = gpu::power_preference(gpu_pref, power_env);
+    // Automatic draws on the GPU that drives the (primary) display: a GPU without a monitor reset
+    // its driver and took every monitor down (pdfcraft#378). Logged first: the first question in
+    // every black-window report.
+    #[cfg(feature = "wgpu")]
+    let displays = gpu::preferred_displays(gpu_pref, power_env);
+    #[cfg(feature = "wgpu")]
+    if gpu::automatic(gpu_pref, power_env) {
+        let listed: Vec<String> = displays.iter().map(ToString::to_string).collect();
+        log::info!("display GPUs (PCI vendor:device): {}", if listed.is_empty() { "unknown".to_string() } else { listed.join(", ") });
+    } else {
+        log::info!("graphics processor chosen by the user ({power:?}): which GPU drives the display isn't considered");
+    }
+    #[cfg(feature = "wgpu")]
+    let startup = std::sync::Arc::new(gpu::Startup::default());
     let options = eframe::NativeOptions {
         viewport: egui::ViewportBuilder::default()
             .with_title("VectorCraft")
@@ -274,45 +451,147 @@ fn main() -> eframe::Result {
             .with_title_shown(false)
             .with_icon(app_icon())
             .with_app_id("ai.storyteller.vectorcraft"),
+        #[cfg(feature = "windows7")]
+        renderer: eframe::Renderer::Glow,
         ..Default::default()
     };
-    eframe::run_native(
-        "VectorCraft",
-        options,
-        Box::new(move |cc| {
-            let mut app = VectorcraftApp::new(Session::new(), services());
-            load_prefs(&mut app, saved);
-            // Fit the window to its monitor, or put it back where it was (still hidden).
-            if let Some(w) = cc.winit_window() {
-                app.ui.window = Some(window::restore(w, saved_window));
-            }
-            // User Defined swatch and graphic style libraries live next to the preferences.
-            let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
-            app.session.swatch_libraries.set_user_dir(swatches);
-            let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
-            app.session.style_libraries.set_user_dir(styles);
-            // Data Recovery copies live next to the preferences too (none for runs without
-            // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
-            if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
-                let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
-                app.session.recovery.set_default_folder(recovery);
-            }
-            app.integrated_titlebar = cfg!(target_os = "macos");
-            app.custom_titlebar = CUSTOM_TITLEBAR;
-            if let Some(port) = control_port {
-                let rx = control_server::start(port, cc.egui_ctx.clone());
-                app = app.with_control(rx);
-            }
-            for f in files {
-                if let Err(e) = vectorcraft_ui_egui::io::open_path(&mut app, &f) {
-                    eprintln!("vectorcraft: {f}: {e}");
+    #[cfg(feature = "wgpu")]
+    let options = {
+        let mut options = options;
+        // One frame queued, not two: the canvas is rasterized on the CPU and the GPU only
+        // composites it, so the window answers the pointer a frame sooner (#444).
+        options.wgpu_options.surface = eframe::egui_wgpu::SurfaceConfig::LOW_LATENCY;
+        // Only adapters that can show the window, in the order `gpu` gives (#306, #502).
+        if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
+            create.native_adapter_selector = Some(gpu::selector(power, displays, startup.clone()));
+            // Nothing draws or dispatches indirectly, so wgpu's check of indirect arguments only
+            // costs a compute shader at start-up, one some drivers can't compile (OCLP-patched
+            // Metal on an Iris Pro, #651). `WGPU_VALIDATION_INDIRECT_CALL=1` turns it back on.
+            create.instance_descriptor.flags =
+                (eframe::wgpu::InstanceFlags::from_build_config() - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL).with_env();
+            create.instance_descriptor.backends = gpu::backends(create.instance_descriptor.backends, std::env::var_os("WGPU_BACKEND").is_some());
+        }
+        options
+    };
+    #[cfg(feature = "wgpu")]
+    gpu::watch_panics();
+    // Files opened from Finder and the Dock arrive as events, not arguments.
+    #[cfg(target_os = "macos")]
+    open_documents::install();
+    #[cfg(feature = "wgpu")]
+    let created = startup.clone();
+    // A panic that ends the window (egui-wgpu's own, #502) is caught here: never a crash.
+    let outcome = vectorcraft_engine::guard::catch_panic(|| {
+        eframe::run_native(
+            "VectorCraft",
+            options,
+            Box::new(move |cc| {
+                let mut app = VectorcraftApp::new(Session::new(), services(cc.winit_window().cloned()));
+                load_prefs(&mut app, saved);
+                // Fit the window to its monitor, or put it back where it was (still hidden).
+                if let Some(w) = cc.winit_window() {
+                    app.ui.window = Some(window::restore(w, saved_window));
+                    #[cfg(windows)]
+                    set_taskbar_icon(w);
+                }
+                // User Defined swatch and graphic style libraries live next to the preferences.
+                let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
+                app.session.swatch_libraries.set_user_dir(swatches);
+                let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
+                app.session.style_libraries.set_user_dir(styles);
+                // So do the Libraries panel's libraries; runs without preferences (agents' test
+                // runs) keep theirs for the session only, never touching the user's.
+                if prefs_enabled() {
+                    let libraries = prefs_path().and_then(|p| Some(p.parent()?.join("Libraries").to_string_lossy().to_string()));
+                    app.session.libraries.set_dir(libraries);
+                }
+                // Data Recovery copies live next to the preferences too (none for runs without
+                // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
+                if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
+                    let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
+                    app.session.recovery.set_default_folder(recovery);
+                }
+                let graphics_loss = GraphicsLoss::default();
+                #[cfg(feature = "wgpu")]
+                if let Some(rs) = &cc.wgpu_render_state {
+                    let summary = adapter_summary(&rs.adapter.get_info());
+                    log::info!("rendering with {summary} (power preference {power:?})");
+                    created.created(&cc.egui_ctx);
+                    if !gpu::skipped().is_empty() {
+                        app.status(format!("The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}"));
+                    }
+                    app.graphics_adapter = Some(summary);
+                    let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                #[cfg(feature = "windows7")]
+                {
+                    app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
+                }
+                app.integrated_titlebar = cfg!(target_os = "macos");
+                app.custom_titlebar = CUSTOM_TITLEBAR;
+                if let Some(port) = control_port {
+                    let rx = control_server::start(port, cc.egui_ctx.clone());
+                    app = app.with_control(rx);
                 }
-            }
-            Ok(Box::new(App(
-                app,
                 #[cfg(target_os = "macos")]
-                None,
-            )))
-        }),
-    )
+                {
+                    open_documents::set_ui(&cc.egui_ctx);
+                    // The macOS menu bar, installed now so winit's default menu doesn't stay up.
+                    if !in_window_menus {
+                        app.services.native_menu = mac_menu::install(&cc.egui_ctx, &app);
+                    }
+                }
+                #[cfg(not(target_os = "macos"))]
+                let _ = in_window_menus;
+                open_files(&mut app, files);
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false, frames: 0 }))
+            }),
+        )
+    });
+    #[cfg(feature = "wgpu")]
+    let outcome = gpu::finish(outcome, &startup);
+    #[cfg(not(feature = "wgpu"))]
+    let outcome = outcome.and_then(|r| r.map_err(|e| e.to_string()));
+    match outcome {
+        Ok(()) => std::process::ExitCode::SUCCESS,
+        Err(e) => {
+            log::error!("VectorCraft stopped: {e}");
+            std::process::ExitCode::FAILURE
+        }
+    }
+}
+
+#[cfg(all(test, feature = "wgpu"))]
+mod tests {
+    use super::*;
+
+    /// The file extensions the macOS bundle declares: its document types and its own exported type.
+    fn plist_extensions(plist: &str) -> Vec<&str> {
+        ["<key>CFBundleTypeExtensions</key>", "<key>public.filename-extension</key>"]
+            .iter()
+            .flat_map(|key| plist.split(key).skip(1))
+            .filter_map(|rest| rest.split("</array>").next())
+            .flat_map(|array| array.split("<string>").skip(1))
+            .filter_map(|s| s.split("</string>").next())
+            .collect()
+    }
+
+    /// Finder offers the app for every file File › Open reads (#295, #354), takes over no other
+    /// app's files, and hands them to the app rather than to AppKit's document machinery.
+    #[test]
+    fn the_macos_bundle_opens_every_readable_format() {
+        let plist = include_str!("../../../packaging/macos/Info.plist.in");
+        let declared = plist_extensions(plist);
+        for e in fileio::OPEN_EXTS {
+            assert!(declared.contains(e), "Info.plist.in doesn't declare .{e}");
+        }
+        for e in &declared {
+            assert!(fileio::OPEN_EXTS.contains(e), "Info.plist.in declares .{e}, which the app doesn't open");
+        }
+        assert!(!plist.contains("<key>NSDocumentClass</key>"), "not an NSDocument app: AppKit would refuse the files");
+        let types = plist.matches("<key>CFBundleTypeName</key>").count();
+        assert!(types > 1 && plist.matches("<key>LSHandlerRank</key>").count() == types, "every document type has a rank");
+        assert_eq!(plist.matches("<string>Owner</string>").count(), 2, "only VectorCraft documents and templates are owned");
+    }
 }

apps/vectorcraft/src/native_menu.rs

@@ -1,182 +0,0 @@
-//! macOS: VectorCraft's menu tree as the native system menu bar (like Illustrator on the Mac).
-//! Items dispatch through the same command path as the in-window menus; enablement, check marks
-//! and dynamic labels ("Undo Move") are refreshed a few times per second, and the menu is rebuilt
-//! when saved views or recent files come and go.
-
-use std::collections::HashMap;
-use std::str::FromStr;
-
-use muda::accelerator::Accelerator;
-use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
-use serde_json::Value;
-use vectorcraft_ui_egui::VectorcraftApp;
-use vectorcraft_ui_egui::i18n::{self, Lang, t};
-use vectorcraft_ui_egui::menus::{self, Item};
-
-enum Handle {
-    Plain(MenuItem),
-    Check(CheckMenuItem),
-}
-
-pub struct NativeMenu {
-    _menu: Menu,
-    items: HashMap<String, (String, Value, Handle, String)>,
-    last_refresh: f64,
-    /// Shortcut-override / workspace-list generation the menu was built for.
-    generation: u64,
-    /// Saved views and recent files listed (empty slots are left out, so a change rebuilds).
-    slots: usize,
-    /// Plug-in registry revision the Plug-ins submenus were built for.
-    plugins: u64,
-    /// The language the labels were built in (a change rebuilds the menu).
-    language: Lang,
-}
-
-/// Accelerator for a shortcut like "Cmd+Shift+]" (modifier-less shortcuts stay in the app so they
-/// don't steal keys from text fields).
-fn accel(sc: &str) -> Option<Accelerator> {
-    if !(sc.contains("Cmd") || sc.contains("Ctrl") || sc.contains("Alt") || sc.starts_with('F')) {
-        return None;
-    }
-    Accelerator::from_str(&sc.replace("Cmd", "CMD").replace("Alt", "ALT").replace("Shift", "SHIFT").replace("Ctrl", "CTRL")).ok()
-}
-
-impl NativeMenu {
-    pub fn install(app: &mut VectorcraftApp) -> Self {
-        // Accelerators come from `shortcut_of`, which honours the user's overrides.
-        vectorcraft_ui_egui::shortcut_editor::sync(&app.ui);
-        let generation = vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed);
-        let menu = Menu::new();
-        let mut items = HashMap::new();
-        let mut counter = 0usize;
-        for (title, entries) in menus::menu_tree() {
-            let sub = Submenu::new(t(title), true);
-            build(app, &sub, &entries, &mut items, &mut counter);
-            let _ = menu.append(&sub);
-        }
-        menu.init_for_nsapp();
-        app.native_menu = true;
-        app.native_shortcuts = items
-            .values()
-            .filter(|(_, p, _, c)| (p.is_null() || p.as_object().is_some_and(|o| o.is_empty())) && menus::shortcut_of(c).and_then(accel).is_some())
-            .map(|(_, _, _, c)| c.clone())
-            .collect();
-        Self {
-            _menu: menu,
-            items,
-            last_refresh: 0.0,
-            generation,
-            slots: menus::listed_slots(app),
-            plugins: menus::plugin_revision(),
-            language: i18n::current(),
-        }
-    }
-
-    /// Dispatch clicked items and refresh state.
-    pub fn poll(&mut self, app: &mut VectorcraftApp) {
-        while let Ok(ev) = MenuEvent::receiver().try_recv() {
-            if let Some((cmd, params, _, _)) = self.items.get(ev.id.as_ref()) {
-                let p = if params.is_null() { serde_json::json!({}) } else { params.clone() };
-                menus::invoke(app, cmd, p);
-            }
-        }
-        let now = vectorcraft_ui_egui::now_ms();
-        if now - self.last_refresh < 250.0 {
-            return;
-        }
-        self.last_refresh = now;
-        // Shortcuts edited, workspaces added, saved views, recent files, plug-ins or the UI language
-        // changed: rebuild so accelerators, lists and labels are current.
-        if vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed) != self.generation
-            || menus::listed_slots(app) != self.slots
-            || menus::plugin_revision() != self.plugins
-            || i18n::current() != self.language
-        {
-            *self = NativeMenu::install(app);
-            return;
-        }
-        for (run, rp, h, cmd) in self.items.values() {
-            let null = Value::Null;
-            let params = if run == cmd { rp } else { &null };
-            let en = menus::enabled(app, cmd);
-            match h {
-                Handle::Plain(i) => {
-                    i.set_enabled(en);
-                    if matches!(
-                        cmd.as_str(),
-                        "edit.undo"
-                            | "edit.redo"
-                            | "view.outline"
-                            | "view.rulers"
-                            | "view.guides"
-                            | "view.grid"
-                            | "view.edges"
-                            | "view.artboards"
-                            | "view.boundingBox"
-                            | "view.transparencyGrid"
-                            | "window.workspace.reset"
-                    ) || cmd.starts_with("file.openRecent")
-                        || cmd.starts_with("type.recentFont")
-                        || cmd.starts_with("view.goto")
-                        || matches!(
-                            cmd.as_str(),
-                            "view.cornerWidget" | "view.textThreads" | "view.gradientAnnotator" | "effect.last" | "type.hiddenCharacters"
-                        )
-                    {
-                        i.set_text(menus::display_label(app, cmd, ""));
-                    }
-                }
-                Handle::Check(c) => {
-                    c.set_enabled(en);
-                    c.set_checked(menus::checked(app, cmd, params).unwrap_or(false));
-                }
-            }
-        }
-    }
-}
-
-fn build(
-    app: &VectorcraftApp,
-    parent: &Submenu,
-    entries: &[Item],
-    items: &mut HashMap<String, (String, Value, Handle, String)>,
-    counter: &mut usize,
-) {
-    for e in entries {
-        match e {
-            Item::Sep => {
-                let _ = parent.append(&PredefinedMenuItem::separator());
-            }
-            Item::Header(h) => {
-                let _ = parent.append(&MenuItem::new(t(h), false, None));
-            }
-            Item::Todo(label, sc) => {
-                let _ = parent.append(&MenuItem::new(t(label), false, accel(sc)));
-            }
-            Item::Sub(label, children) => {
-                let sub = Submenu::new(t(label), true);
-                build(app, &sub, children, items, counter);
-                let _ = parent.append(&sub);
-            }
-            // Unused saved-view and recent-file slots are left out, as in the in-window menus.
-            Item::Cmd(_, cmd, _) if menus::hidden_slot(app, cmd) => {}
-            Item::Cmd(label, cmd, params) => {
-                *counter += 1;
-                let id = format!("dc{counter}");
-                let sc = if params.is_null() { menus::shortcut_of(cmd).and_then(accel) } else { None };
-                let handle = if menus::checked(app, cmd, params).is_some() {
-                    let c = CheckMenuItem::with_id(id.clone(), menus::display_label(app, cmd, label), true, false, sc);
-                    let _ = parent.append(&c);
-                    Handle::Check(c)
-                } else {
-                    let i = MenuItem::with_id(id.clone(), menus::display_label(app, cmd, label), true, sc);
-                    let _ = parent.append(&i);
-                    Handle::Plain(i)
-                };
-                let (run, run_params) = menus::click_target(label, cmd, params);
-                let _ = &run_params;
-                items.insert(id, (run, run_params, handle, cmd.to_string()));
-            }
-        }
-    }
-}

apps/vectorcraft/src/open_documents.rs

@@ -0,0 +1,106 @@
+//! macOS: files opened from Finder (double-click, Open With, a drop on the Dock icon) or with
+//! `open -a VectorCraft file`.
+//!
+//! macOS doesn't pass these on the command line: AppKit hands them to the application delegate's
+//! `application:openURLs:`, and when the delegate has no such method it asks `NSDocumentController`,
+//! which fails with "VectorCraft cannot open files in the … format" because VectorCraft isn't an
+//! `NSDocument` app. winit 0.30's delegate doesn't implement the method, so [`install`] adds it to
+//! the delegate's class when the app is about to finish launching: after winit set the delegate and
+//! before AppKit delivers the files the app was launched with. The handler queues the paths and
+//! wakes the UI, which opens them with [`take`] like files named on the command line.
+//!
+//! Adding a method to another crate's Objective-C class has no safe API, hence the scoped
+//! `unsafe_code` allowance (winit overrides `sendEvent:` on `NSApplication` the same way).
+#![allow(unsafe_code)]
+
+use std::ptr::NonNull;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+use block2::RcBlock;
+use objc2::MainThreadMarker;
+use objc2::runtime::{AnyObject, Imp, Sel};
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSApplicationWillFinishLaunchingNotification};
+use objc2_foundation::{NSArray, NSNotification, NSNotificationCenter, NSURL};
+
+/// Paths that arrived and haven't been opened yet.
+static PENDING: Mutex<Vec<String>> = Mutex::new(Vec::new());
+/// The UI to wake when files arrive (unset until the window exists; the first frame opens them).
+static UI: OnceLock<egui::Context> = OnceLock::new();
+
+/// Handle open-document events from now on. Call before the event loop runs.
+pub fn install() {
+    let block = RcBlock::new(|_: NonNull<NSNotification>| add_open_urls_method());
+    // SAFETY: the name is AppKit's notification constant; no object or queue filter, so the block
+    // runs on the posting thread (AppKit posts it on the main thread). The notification center
+    // keeps the registration (and the block) for the life of the app.
+    unsafe {
+        NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(
+            Some(NSApplicationWillFinishLaunchingNotification),
+            None,
+            None,
+            &block,
+        );
+    }
+}
+
+/// Wake `ctx` when files arrive while the app runs.
+pub fn set_ui(ctx: &egui::Context) {
+    // Set once; a second call would hand over the same context.
+    let _ = UI.set(ctx.clone());
+}
+
+/// The paths that arrived since the last call.
+pub fn take() -> Vec<String> {
+    std::mem::take(&mut *PENDING.lock().unwrap_or_else(PoisonError::into_inner))
+}
+
+/// `application:openURLs:` on the application delegate's class.
+fn add_open_urls_method() {
+    let Some(mtm) = MainThreadMarker::new() else { return };
+    let Some(delegate) = NSApplication::sharedApplication(mtm).delegate() else {
+        log::warn!("no application delegate; files opened from Finder won't open");
+        return;
+    };
+    let class = AsRef::<AnyObject>::as_ref(&*delegate).class();
+    let handler: extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>) = open_urls;
+    // SAFETY: `Imp` is the untyped form of a method implementation; the Objective-C runtime calls
+    // it with the arguments the type encoding declares, which match `open_urls`: no return value
+    // (`v`), the receiver (`@`), the selector (`:`), the application (`@`) and the URL array (`@`).
+    let added = unsafe {
+        let imp = std::mem::transmute::<extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>), Imp>(handler);
+        objc2::ffi::class_addMethod(std::ptr::from_ref(class).cast_mut(), sel!(application:openURLs:), imp, c"v@:@@".as_ptr())
+    };
+    if !added.as_bool() {
+        log::warn!("the application delegate already handles open-document events");
+    }
+}
+
+/// Queue the files among `urls` and wake the UI. Never panics: it runs inside AppKit.
+extern "C-unwind" fn open_urls(_delegate: &AnyObject, _cmd: Sel, _app: &AnyObject, urls: &NSArray<NSURL>) {
+    // Only file URLs: macOS 27 turns an https URL's path into a file path too (#433).
+    let paths = urls.iter().filter(|u| u.isFileURL()).filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
+    PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(paths);
+    if let Some(ctx) = UI.get() {
+        ctx.request_repaint();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2::runtime::NSObject;
+    use objc2_foundation::NSString;
+
+    use super::*;
+
+    /// Files queue until the UI takes them; URLs that aren't files are left out.
+    #[test]
+    fn opened_files_wait_for_the_ui() {
+        let web = NSURL::URLWithString(&NSString::from_str("https://example.com/a.svg")).unwrap();
+        let urls = NSArray::from_retained_slice(&[NSURL::from_file_path("/tmp/a b.pdf").unwrap(), web, NSURL::from_file_path("/tmp/c.ai").unwrap()]);
+        let any = NSObject::new();
+        open_urls(&any, sel!(application:openURLs:), &any, &urls);
+        assert_eq!(take(), ["/tmp/a b.pdf", "/tmp/c.ai"]);
+        assert!(take().is_empty());
+    }
+}

apps/vectorcraft/src/prefs_dir.rs

@@ -0,0 +1,45 @@
+//! Where VectorCraft keeps its settings, `ui.json`, and next to it folders of the user's own
+//! (Swatches, Graphic Styles, Fonts, Data Recovery, logs). The desktop app and `vectorcraft-cli`
+//! (which shares this file) read the same Fonts folder.
+
+use std::path::PathBuf;
+
+/// The settings file `ui.json` of the app `name`: in a folder named `name` in ~/Library/Application
+/// Support (macOS) or %APPDATA% (Windows), or `lower` in $XDG_CONFIG_HOME or ~/.config (Linux and
+/// BSD).
+pub fn prefs_path_for(name: &str, lower: &str) -> Option<PathBuf> {
+    let base = if cfg!(target_os = "macos") {
+        std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join("Library/Application Support").join(name))
+    } else if cfg!(windows) {
+        std::env::var_os("APPDATA").map(|a| std::path::PathBuf::from(a).join(name))
+    } else {
+        std::env::var_os("XDG_CONFIG_HOME")
+            .map(std::path::PathBuf::from)
+            .or_else(|| std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join(".config")))
+            .map(|c| c.join(lower))
+    };
+    base.map(|b| b.join("ui.json"))
+}
+
+/// Have the font scans read VectorCraft's own Fonts folder, next to the settings, which
+/// `text.addFontFiles` copies font files into. The folder is set whether or not
+/// `VECTORCRAFT_NO_PREFS` is set, as the Swatches and Graphic Styles folders are.
+pub fn install_fonts() {
+    if let Some(dir) = prefs_path_for("VectorCraft", "vectorcraft").and_then(|p| Some(p.parent()?.join("Fonts"))) {
+        vectorcraft_text::set_app_font_dir(dir);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_font_scans_read_the_fonts_folder_next_to_the_settings() {
+        install_fonts();
+        let fonts = prefs_path_for("VectorCraft", "vectorcraft").and_then(|p| Some(p.parent()?.join("Fonts")));
+        assert!(fonts.is_some(), "a home folder to keep the settings in");
+        assert_eq!(vectorcraft_text::app_font_dir().map(std::path::Path::to_path_buf), fonts);
+        assert!(vectorcraft_text::system_font_dirs().contains(&fonts.unwrap_or_default()));
+    }
+}

apps/vectorcraft/src/printing.rs

@@ -156,6 +156,9 @@ mod system {
     }
 
     pub fn printers() -> Vec<Printer> {
+        #[cfg(feature = "windows7")]
+        let script = "Get-WmiObject Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
+        #[cfg(not(feature = "windows7"))]
         let script = "Get-CimInstance Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
         output(&mut powershell(script)).map(|t| windows_printers(&t)).unwrap_or_default()
     }
@@ -174,7 +177,19 @@ mod system {
     }
 
     pub fn setup(_printer: Option<&str>) -> Result<(), String> {
-        Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+        #[cfg(feature = "windows7")]
+        let mut command = {
+            let mut command = Command::new("control.exe");
+            command.arg("printers");
+            command
+        };
+        #[cfg(not(feature = "windows7"))]
+        let mut command = {
+            let mut command = Command::new("explorer");
+            command.arg("ms-settings:printers");
+            command
+        };
+        command.spawn().map(|_| ()).map_err(|e| e.to_string())
     }
 }
 

apps/vectorcraft/src/system_fonts.rs

@@ -0,0 +1,92 @@
+//! Windows: the font files in DirectWrite's system font collection, scanned with the font folders
+//! (`vectorcraft_text::set_platform_font_files`). The desktop app and `vectorcraft-cli` (exports,
+//! MCP) both install it; the CLI shares this file.
+//!
+//! Font services such as Adobe Fonts load their fonts with GDI at run time, from files in their
+//! own folders, without installing them: the font folders and the registry don't list them. Since
+//! Windows 10 (version 1607) DirectWrite's system font collection holds them too
+//! (<https://learn.microsoft.com/windows/win32/directwrite/what-s-new-in-directwrite-for-windows-8-consumer-preview>,
+//! "Support for Adobe Typekit and other font-service clients"), so VectorCraft lists them as other
+//! apps do, reading the files in place (#579).
+//!
+//! DirectWrite is COM, which has no safe API, hence the scoped `unsafe_code` allowance.
+#![allow(unsafe_code)]
+
+use std::collections::BTreeSet;
+
+use windows::Win32::Graphics::DirectWrite::{
+    DWRITE_FACTORY_TYPE_SHARED, DWriteCreateFactory, IDWriteFactory3, IDWriteFontSet, IDWriteLocalFontFileLoader,
+};
+use windows::core::Interface;
+
+/// The most fonts read from the collection (a system has a few thousand).
+const MAX_FONTS: u32 = 1 << 16;
+/// The longest file path taken, in UTF-16 units (Windows' own limit).
+const MAX_PATH: u32 = 32_767;
+
+/// Have the font scans read the font files DirectWrite lists.
+pub fn install() {
+    vectorcraft_text::set_platform_font_files(font_files);
+}
+
+/// The local files of the fonts in DirectWrite's system font collection as it is now (fonts
+/// loaded since the last call included). None before Windows 10, or when DirectWrite fails: the
+/// font folders and the registry still list the installed fonts.
+fn font_files() -> Vec<String> {
+    match collection_files() {
+        Ok(files) => files.into_iter().collect(),
+        Err(e) => {
+            log::debug!("DirectWrite's system fonts aren't listed: {e}");
+            Vec::new()
+        }
+    }
+}
+
+fn collection_files() -> windows::core::Result<BTreeSet<String>> {
+    // SAFETY: plain DirectWrite calls on interfaces it returned, each checked for failure; the
+    // collection is asked to check for fonts loaded since the factory last looked.
+    let set = unsafe {
+        let factory: IDWriteFactory3 = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED)?;
+        let mut collection = None;
+        factory.GetSystemFontCollection(false, &mut collection, true)?;
+        let Some(collection) = collection else { return Ok(BTreeSet::new()) };
+        collection.GetFontSet()?
+    };
+    // SAFETY: a count of the set's fonts.
+    let count = unsafe { set.GetFontCount() }.min(MAX_FONTS);
+    // Faces of one file (a collection's, a variable font's instances) name it once.
+    Ok((0..count).filter_map(|i| local_path(&set, i)).collect())
+}
+
+/// The path of the file holding font `i` of `set`, when it is a local file (not a downloadable
+/// font, nor one in memory).
+fn local_path(set: &IDWriteFontSet, i: u32) -> Option<String> {
+    // SAFETY: `i` is below the set's count; the key DirectWrite hands back stays valid while
+    // `file` (which owns it) lives, and is passed back with its own size; the path buffer is
+    // sized from DirectWrite's answer plus the terminating NUL.
+    unsafe {
+        let file = set.GetFontFaceReference(i).ok()?.GetFontFile().ok()?;
+        let loader: IDWriteLocalFontFileLoader = file.GetLoader().ok()?.cast().ok()?;
+        let (mut key, mut size) = (std::ptr::null_mut(), 0u32);
+        file.GetReferenceKey(&mut key, &mut size).ok()?;
+        let len = loader.GetFilePathLengthFromKey(key, size).ok()?;
+        if len == 0 || len > MAX_PATH {
+            return None;
+        }
+        let mut path = vec![0u16; len as usize + 1];
+        loader.GetFilePathFromKey(key, size, &mut path).ok()?;
+        Some(String::from_utf16_lossy(path.get(..len as usize)?))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    /// DirectWrite lists the installed fonts, by their files' full paths.
+    #[test]
+    fn directwrite_lists_the_installed_font_files() {
+        let files = super::font_files();
+        assert!(files.iter().all(|f| std::path::Path::new(f).is_absolute()), "{:?}", files.first());
+        let fonts = std::path::Path::new(&std::env::var("WINDIR").unwrap()).join("Fonts").to_string_lossy().to_lowercase();
+        assert!(files.iter().any(|f| f.to_lowercase().starts_with(&fonts)), "{} files, {:?}", files.len(), files.first());
+    }
+}

assets/icons/dc-anchor-smooth.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3 20 C5 11 8 7 12 7 S19 11 21 20"/><path d="M5 7 H19"/><circle cx="5" cy="7" r="1.4" fill="currentColor"/><circle cx="19" cy="7" r="1.4" fill="currentColor"/><rect x="10" y="5" width="4" height="4" fill="currentColor"/></svg>

assets/icons/dc-para-ltr.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M11 3V14" /><path d="M14 3V14" /><path d="M16 3H9.5a3 3 0 0 0 0 6H11" /><path d="M4 19H20" /><path d="M17 16L20 19L17 22" /></svg>

assets/icons/dc-para-rtl.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M13 3V14" /><path d="M10 3V14" /><path d="M8 3H14.5a3 3 0 0 1 0 6H13" /><path d="M20 19H4" /><path d="M7 16L4 19L7 22" /></svg>

assets/icons/dc-pen-add.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 19l-7-7 3-6 8 3 3 7-7 3z" /><path d="M5 12l5-5"/><circle cx="11" cy="11" r="1.5"/><path d="M19 3v5M16.5 5.5h5"/></svg>

assets/icons/dc-pen-delete.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 19l-7-7 3-6 8 3 3 7-7 3z" /><path d="M5 12l5-5"/><circle cx="11" cy="11" r="1.5"/><path d="M16.5 5.5h5"/></svg>

assets/icons/pen-tool-add.svg

@@ -0,0 +1,19 @@
+<!-- @license lucide-static v1.49.0 - ISC -->
+<!-- Lucide's pen-tool with a plus badge added for VectorCraft -->
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M15.707 21.293a1 1 0 0 1-1.414 0l-1.586-1.586a1 1 0 0 1 0-1.414l5.586-5.586a1 1 0 0 1 1.414 0l1.586 1.586a1 1 0 0 1 0 1.414z" />
+  <path d="m18 13-1.375-6.874a1 1 0 0 0-.746-.776L3.235 2.028a1 1 0 0 0-1.207 1.207L5.35 15.879a1 1 0 0 0 .776.746L13 18" />
+  <path d="m2.3 2.3 7.286 7.286" />
+  <circle cx="11" cy="11" r="2" />
+  <path d="M4 18.3v4.4M1.8 20.5h4.4" />
+</svg>

assets/icons/pen-tool-delete.svg

@@ -0,0 +1,19 @@
+<!-- @license lucide-static v1.49.0 - ISC -->
+<!-- Lucide's pen-tool with a minus badge added for VectorCraft -->
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M15.707 21.293a1 1 0 0 1-1.414 0l-1.586-1.586a1 1 0 0 1 0-1.414l5.586-5.586a1 1 0 0 1 1.414 0l1.586 1.586a1 1 0 0 1 0 1.414z" />
+  <path d="m18 13-1.375-6.874a1 1 0 0 0-.746-.776L3.235 2.028a1 1 0 0 0-1.207 1.207L5.35 15.879a1 1 0 0 0 .776.746L13 18" />
+  <path d="m2.3 2.3 7.286 7.286" />
+  <circle cx="11" cy="11" r="2" />
+  <path d="M1.8 20.5h4.4" />
+</svg>

contributors/contributors.json

@@ -0,0 +1,800 @@
+{
+  "schema": 1,
+  "repo": "storytold/vectorcraft",
+  "branch": "main",
+  "head": "866ea5878a7f6db7dd3d6b1287f9a9bb3a241c33",
+  "head_date": "2026-10-10T00:04:42Z",
+  "commits": 906,
+  "unattributed_commits": 0,
+  "contributors": [
+    {
+      "login": "echelon",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 18,
+      "commits": 124,
+      "lines_added": 173772,
+      "lines_deleted": 40385,
+      "binary_added": 37,
+      "binary_deleted": 2,
+      "first_commit": "2026-09-30T09:12:46Z",
+      "last_commit": "2026-10-08T14:01:10Z"
+    },
+    {
+      "login": "bflatastic",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 328,
+      "commits": 561,
+      "lines_added": 253056,
+      "lines_deleted": 31036,
+      "binary_added": 2,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-02T15:22:29Z",
+      "last_commit": "2026-10-09T23:27:19Z"
+    },
+    {
+      "login": "storybored379",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 8,
+      "commits": 9,
+      "lines_added": 812,
+      "lines_deleted": 77,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-04T06:45:57Z",
+      "last_commit": "2026-10-09T04:35:07Z"
+    },
+    {
+      "login": "theironchef",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 38,
+      "commits": 41,
+      "lines_added": 2803,
+      "lines_deleted": 232,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T14:40:20Z",
+      "last_commit": "2026-10-07T22:39:00Z"
+    },
+    {
+      "login": "midasdf",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 2,
+      "lines_added": 579,
+      "lines_deleted": 43,
+      "binary_added": 1,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T16:10:37Z",
+      "last_commit": "2026-10-07T20:53:30Z"
+    },
+    {
+      "login": "japbcoelho",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 57,
+      "lines_deleted": 13,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T01:45:49Z",
+      "last_commit": "2026-10-06T01:45:49Z"
+    },
+    {
+      "login": "p0lyg0n",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 6,
+      "lines_added": 780,
+      "lines_deleted": 69,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T09:22:46Z",
+      "last_commit": "2026-10-07T04:33:45Z"
+    },
+    {
+      "login": "imachus",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 21,
+      "commits": 22,
+      "lines_added": 7242,
+      "lines_deleted": 320,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T10:06:18Z",
+      "last_commit": "2026-10-09T08:36:30Z"
+    },
+    {
+      "login": "petrleocompel",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 784,
+      "lines_deleted": 36,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:23:11Z",
+      "last_commit": "2026-10-06T12:23:11Z"
+    },
+    {
+      "login": "fahrim",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 7,
+      "lines_added": 2134,
+      "lines_deleted": 83,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:48:28Z",
+      "last_commit": "2026-10-08T01:33:25Z"
+    },
+    {
+      "login": "EthanSuquet",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 4,
+      "lines_added": 413,
+      "lines_deleted": 71,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T19:30:49Z",
+      "last_commit": "2026-10-07T14:24:14Z"
+    },
+    {
+      "login": "realwitt",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 607,
+      "lines_deleted": 3,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:12:52Z",
+      "last_commit": "2026-10-07T00:12:52Z"
+    },
+    {
+      "login": "WildfootW",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 6809,
+      "lines_deleted": 2627,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:37:02Z",
+      "last_commit": "2026-10-07T00:37:02Z"
+    },
+    {
+      "login": "coygeek",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 4,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:29:03Z",
+      "last_commit": "2026-10-07T02:29:03Z"
+    },
+    {
+      "login": "Luskish",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 261,
+      "lines_deleted": 32,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:50:35Z",
+      "last_commit": "2026-10-07T02:50:35Z"
+    },
+    {
+      "login": "daniel-efrat",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 547,
+      "lines_deleted": 43,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T08:13:19Z",
+      "last_commit": "2026-10-07T08:13:19Z"
+    },
+    {
+      "login": "Pengjingyu1992",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 3132,
+      "lines_deleted": 4,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T09:56:23Z",
+      "last_commit": "2026-10-07T09:56:23Z"
+    },
+    {
+      "login": "MillhioreBT",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 564,
+      "lines_deleted": 41,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T12:58:33Z",
+      "last_commit": "2026-10-07T12:58:33Z"
+    },
+    {
+      "login": "fabian-co",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 270,
+      "lines_deleted": 48,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:05:26Z",
+      "last_commit": "2026-10-07T19:32:11Z"
+    },
+    {
+      "login": "Haven-King",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 9,
+      "commits": 19,
+      "lines_added": 8627,
+      "lines_deleted": 720,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:10:39Z",
+      "last_commit": "2026-10-09T03:25:56Z"
+    },
+    {
+      "login": "njmueller",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 619,
+      "lines_deleted": 11,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:14:42Z",
+      "last_commit": "2026-10-07T21:14:42Z"
+    },
+    {
+      "login": "RicSchonfelder",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2592,
+      "lines_deleted": 9,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:44:42Z",
+      "last_commit": "2026-10-07T21:44:42Z"
+    },
+    {
+      "login": "DWAA1660",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 3,
+      "commits": 3,
+      "lines_added": 392,
+      "lines_deleted": 44,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T23:09:37Z",
+      "last_commit": "2026-10-09T17:33:23Z"
+    },
+    {
+      "login": "raytheengineer",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 94,
+      "lines_deleted": 12,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T03:19:20Z",
+      "last_commit": "2026-10-08T03:19:20Z"
+    },
+    {
+      "login": "bobtherobot",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 6,
+      "lines_added": 824,
+      "lines_deleted": 93,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T03:25:09Z",
+      "last_commit": "2026-10-08T16:57:16Z"
+    },
+    {
+      "login": "devCangrejo",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 859,
+      "lines_deleted": 13,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T06:30:51Z",
+      "last_commit": "2026-10-08T06:30:51Z"
+    },
+    {
+      "login": "wstock",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 7,
+      "commits": 7,
+      "lines_added": 749,
+      "lines_deleted": 92,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T07:45:45Z",
+      "last_commit": "2026-10-08T11:46:16Z"
+    },
+    {
+      "login": "switch87",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 3,
+      "lines_added": 638,
+      "lines_deleted": 3,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T09:25:54Z",
+      "last_commit": "2026-10-08T09:42:11Z"
+    },
+    {
+      "login": "h-a-n-a-s-h-i",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 2,
+      "lines_added": 52,
+      "lines_deleted": 52,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T12:13:01Z",
+      "last_commit": "2026-10-08T14:01:57Z"
+    },
+    {
+      "login": "XusBadia",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 74,
+      "lines_deleted": 1,
+      "binary_added": 2,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T12:58:51Z",
+      "last_commit": "2026-10-08T12:58:51Z"
+    },
+    {
+      "login": "omellado-gh",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 1,
+      "lines_added": 335,
+      "lines_deleted": 7,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T13:05:09Z",
+      "last_commit": "2026-10-08T13:05:09Z"
+    },
+    {
+      "login": "callmeBalloch",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 5,
+      "commits": 13,
+      "lines_added": 11741,
+      "lines_deleted": 698,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T14:01:08Z",
+      "last_commit": "2026-10-09T13:45:55Z"
+    },
+    {
+      "login": "jeremyfry",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 57,
+      "lines_deleted": 2,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T14:57:01Z",
+      "last_commit": "2026-10-08T14:57:01Z"
+    },
+    {
+      "login": "dbambus",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 72,
+      "lines_deleted": 11,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T15:38:18Z",
+      "last_commit": "2026-10-08T15:38:18Z"
+    },
+    {
+      "login": "mo0kid",
+      "people_entry": true,
+      "github_name": "David John Whiting",
+      "prs": 2,
+      "commits": 6,
+      "lines_added": 1973,
+      "lines_deleted": 144,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T19:50:54Z",
+      "last_commit": "2026-10-08T22:03:34Z"
+    },
+    {
+      "login": "MaksPV",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 3682,
+      "lines_deleted": 10,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T20:44:45Z",
+      "last_commit": "2026-10-08T20:44:45Z"
+    },
+    {
+      "login": "omd0",
+      "people_entry": true,
+      "github_name": "Emad Fussi",
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 291,
+      "lines_deleted": 25,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T21:34:00Z",
+      "last_commit": "2026-10-08T21:34:00Z"
+    },
+    {
+      "login": "leblanc-simon",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 4,
+      "lines_added": 3721,
+      "lines_deleted": 60,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T22:00:03Z",
+      "last_commit": "2026-10-08T23:14:11Z"
+    },
+    {
+      "login": "dotCooCoo",
+      "people_entry": true,
+      "github_name": ".CooCoo",
+      "prs": 5,
+      "commits": 6,
+      "lines_added": 1701,
+      "lines_deleted": 139,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T22:18:57Z",
+      "last_commit": "2026-10-09T15:33:59Z"
+    },
+    {
+      "login": "u9151131269-a11y",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 1,
+      "lines_added": 37,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T23:05:11Z",
+      "last_commit": "2026-10-08T23:05:11Z"
+    },
+    {
+      "login": "HEOJUNFO",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 112,
+      "lines_deleted": 17,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T23:49:03Z",
+      "last_commit": "2026-10-08T23:49:03Z"
+    },
+    {
+      "login": "DisasterAreaDesigns",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 14,
+      "lines_added": 3359,
+      "lines_deleted": 116,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T00:15:28Z",
+      "last_commit": "2026-10-09T14:43:23Z"
+    },
+    {
+      "login": "jax-spenser",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 3098,
+      "lines_deleted": 39,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T01:41:46Z",
+      "last_commit": "2026-10-09T01:41:46Z"
+    },
+    {
+      "login": "mateususa",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 18,
+      "lines_deleted": 5,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T02:19:59Z",
+      "last_commit": "2026-10-09T02:19:59Z"
+    },
+    {
+      "login": "fastmikey99",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 5,
+      "lines_added": 490,
+      "lines_deleted": 31,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T04:11:07Z",
+      "last_commit": "2026-10-09T04:11:08Z"
+    },
+    {
+      "login": "AutoHenry",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 351,
+      "lines_deleted": 27,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T10:50:26Z",
+      "last_commit": "2026-10-09T10:50:26Z"
+    },
+    {
+      "login": "jmverges",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 4,
+      "lines_added": 382,
+      "lines_deleted": 73,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T11:17:50Z",
+      "last_commit": "2026-10-09T19:03:09Z"
+    },
+    {
+      "login": "dmatviichuk",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 2,
+      "lines_added": 3893,
+      "lines_deleted": 109,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T12:15:12Z",
+      "last_commit": "2026-10-09T17:51:43Z"
+    },
+    {
+      "login": "hamada147",
+      "people_entry": true,
+      "github_name": "Ahmed Moussa",
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 671,
+      "lines_deleted": 62,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T13:09:34Z",
+      "last_commit": "2026-10-09T14:18:54Z"
+    },
+    {
+      "login": "haranishi",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 571,
+      "lines_deleted": 7,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T17:53:07Z",
+      "last_commit": "2026-10-09T17:53:07Z"
+    },
+    {
+      "login": "Messhias",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 3,
+      "lines_added": 268,
+      "lines_deleted": 27,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T19:00:03Z",
+      "last_commit": "2026-10-09T19:26:55Z"
+    },
+    {
+      "login": "rschuerer",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 450,
+      "lines_deleted": 35,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T23:08:33Z",
+      "last_commit": "2026-10-09T23:08:33Z"
+    },
+    {
+      "login": "dylanmtaylor",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 34,
+      "lines_deleted": 34,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-10T00:04:42Z",
+      "last_commit": "2026-10-10T00:04:42Z"
+    },
+    {
+      "login": "llduyll10",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
+    {
+      "login": "visuarte",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    }
+  ],
+  "models": [
+    {
+      "id": "anthropic/claude-opus/5.5",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "5.5",
+      "commits": 787,
+      "lines_added": 439476,
+      "lines_deleted": 75146
+    },
+    {
+      "id": "anthropic/claude-sonnet/5.5",
+      "company": "Anthropic",
+      "model": "Claude Sonnet",
+      "version": "5.5",
+      "commits": 22,
+      "lines_added": 7688,
+      "lines_deleted": 196
+    },
+    {
+      "id": "anthropic/claude-fable/5.1",
+      "company": "Anthropic",
+      "model": "Claude Fable",
+      "version": "5.1",
+      "commits": 9,
+      "lines_added": 8008,
+      "lines_deleted": 2754
+    },
+    {
+      "id": "anthropic/claude-opus/4.8",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "4.8",
+      "commits": 4,
+      "lines_added": 1729,
+      "lines_deleted": 44
+    },
+    {
+      "id": "openai/codex",
+      "company": "OpenAI",
+      "model": "Codex",
+      "version": "",
+      "commits": 3,
+      "lines_added": 448,
+      "lines_deleted": 120
+    },
+    {
+      "id": "anysphere/cursor",
+      "company": "Anysphere",
+      "model": "Cursor",
+      "version": "",
+      "commits": 2,
+      "lines_added": 63,
+      "lines_deleted": 25
+    },
+    {
+      "id": "anthropic/claude",
+      "company": "Anthropic",
+      "model": "Claude",
+      "version": "",
+      "commits": 1,
+      "lines_added": 55,
+      "lines_deleted": 4
+    },
+    {
+      "id": "anthropic/claude-opus/4.7",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "4.7",
+      "commits": 1,
+      "lines_added": 94,
+      "lines_deleted": 12
+    }
+  ]
+}

contributors/people.toml

@@ -0,0 +1,47 @@
+# Contributor names for the About window (craftrules standards/contributors.md).
+#
+# Everyone who contributes is credited by GitHub username automatically. Anything more is up to
+# you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
+# maintainer may add a person only when that person asked, recording where in consent_source.
+#
+# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
+#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
+#
+# Or copy this block, replacing your-github-username (every field is optional):
+#
+#   [people.your-github-username]
+#   real_name = "Your Name"        # shown when the viewer picks "Real name"
+#   display_name = "Nickname"      # shown when the viewer picks "Display name"
+#   sync_github_name = true        # or: use the name on your public GitHub profile as display name
+#
+# To remove your names, delete your entry (or set fields empty) in a PR. The next
+# contributors.py run, and the next build, drop them.
+
+[people.echelon]
+real_name = "Brandon Thomas"
+display_name = "Brandon Thomas"
+sync_github_name = false
+
+[people.callmeBalloch]
+real_name = "Riccardo Balloch"
+sync_github_name = false
+
+[people.mo0kid]
+sync_github_name = true
+
+[people.omd0]
+sync_github_name = true
+
+[people.dotCooCoo]
+real_name = "Robert Lee"
+sync_github_name = true
+
+[people.AutoHenry]
+real_name = "Hal Goff"
+display_name = "Hal Goff, HG Studio"
+sync_github_name = false
+
+[people.hamada147]
+real_name = "Ahmed Moussa"
+display_name = "Ahmed Moussa"
+sync_github_name = true

crates/affinity/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "vectorcraft-affinity"
+description = "Bounded reader for native Affinity documents: archive, object stream and document model"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[features]
+# Synthetic-container builders for tests and fuzz seeds; not an Affinity exporter.
+synth = []
+
+[dependencies]
+crc32fast = { workspace = true }
+flate2 = { workspace = true }
+image = { workspace = true }
+ruzstd = "0.9"
+
+[dev-dependencies]
+proptest = { workspace = true }

crates/affinity/README.md

@@ -0,0 +1,146 @@
+# vectorcraft-affinity
+
+An independent, bounded Rust reader for native Affinity documents: `.af` from Affinity 3 and
+`.afdesign`, `.afphoto` and `.afpub` from Affinity 1 and 2 (container versions 8 to 12). It reads
+the archive, the tagged object stream in `doc.dat` and the part of the document model listed below,
+and hands the engine a document in pixels with every transform composed. It does not write
+Affinity files.
+
+## What is imported
+
+| Affinity | VectorCraft |
+|---|---|
+| Pages, Publisher spreads (one or two pages) | artboards, spreads side by side |
+| Artboards (legacy `ABEn` or Affinity 3 `phrp`/`aprp`), with name, paint and any transform | artboards plus a clip group with the actual vector outline, background and stroke |
+| Layers (`Scop`), groups (`Grup`), pass-through or isolated | layers and sublayers, groups |
+| Curves (`PCrv`): cubic subpaths, closed flags, live corners (`CnrD`) | paths (multi-subpath curves fill even-odd) |
+| Rectangles with corner radii (relative or absolute), ellipses, polygons (smooth too), stars, square stars, pies, triangles, trapezoids | paths |
+| Compound shapes (`Comp`, add and subtract) | one even-odd path |
+| A shape or curve with children clips them | clip group whose clipping path keeps its fill (behind) and stroke (over) |
+| Vector masks (`AdCh` curves and shapes) | clip group |
+| Pixel masks (`MRst`, attached or as a layer in a group) | opacity mask |
+| Solid fills: RGBA, HSLA, CMYK, grey, Lab (D50) | fill appearance (alpha as fill opacity) |
+| Linear, elliptical and radial gradients with Affinity's midpoint bias | gradients (the bias as the midpoint where the blend is half way) |
+| Strokes: weight, scale with object, dash pattern and phase, alignment, miter limit, behind the fill | stroke appearance |
+| Fill layers (`FRst`) | filled rectangles |
+| Artistic and frame text: Unicode scalar-indexed runs, stored fallback font, family/weight/style, boolean OpenType features, all caps, size, tracking, fixed leading, colour, paragraph alignment, first baseline | point type and area type |
+| Placed images (`ImgN`): the original JPEG/PNG embedded in the file | embedded images |
+| Pixel layers (`Rstr`): RGBA 8/16-bit and CMYK 8-bit tiles, cropped to their content; source-backed RGBA8 JPEG/PNG tiles with matching dimensions and zero origin | embedded PNG images |
+| Embedded documents and symbols (`EmbN`) | the picture Affinity cached of them |
+| Opacity, visibility, lock, names, the blend modes VectorCraft has | the same |
+
+Everything else is reported in the import warnings, one line per kind with a count, never
+dropped silently: layer effects, adjustment layers and live filters, brush and pressure strokes,
+transparency gradients, fill opacity, bitmap fills, master pages, conical gradients (as radial),
+special shapes (cloud, heart, cog, callouts, arrows…, imported as their bounding ellipse), corner
+types other than round, stars with rounded points, several fills or strokes on one object (the
+active one is used), outlined or scaled text, text fields such as page numbers, frames with
+columns or a curved outline, paragraph indents/spacing, mixed paragraph alignments, unsupported font selectors, grey/Lab/32-bit pixels, CMYK pixels (converted to RGB without the
+document's profile) and Affinity-only blend modes (Add, Linear Light… as Normal).
+
+When the native document can't be read at all, the engine opens the embedded PNG preview instead,
+with a warning that names the reason; that preview can't be placed, used as a template or mined
+for swatches and styles. Save never writes back over the Affinity file.
+
+## Provenance and clean-room
+
+Affinity has no published file-format specification, so this reader is built only from a public
+description of the format and from public files, never from Affinity itself. This is how the sibling app PhotoCraft already treats formats that
+are only partly documented:
+its PSD reader fills the gaps in Adobe's specification from the MIT-licensed psd-tools and
+ag-psd, and its camera raw decoder recovered Nikon's compression tables by black-box analysis
+of CC0 sample files.
+
+* **No Affinity software.** Affinity was never downloaded, installed, run, scripted, screenshotted or
+  disassembled for this work, and nothing from an Affinity installation (program code, resources,
+  presets, fonts, colour profiles) was read. No file was made with Affinity for it: every sample
+  is a document its author published.
+* **A public, permissively licensed description.** The container and object-stream layout was
+  learned from [VMDevCpp/afread](https://github.com/VMDevCpp/afread) (MIT, at
+  `04b672334a43e3e37ded6b5ffc57af231d589774`, written for container versions 7–11) and re-described
+  in our own words before this Rust code was written; no code was translated. No GPL/AGPL code (such
+  as Inkscape's Affinity extension) was read.
+* **Every structure checked against public files.** afread doesn't say how its author learned the
+  format, so nothing here rests on it alone: each structure the reader relies on is confirmed by
+  the public documents. Every archive entry carries a CRC-32 that must match, and every field in
+  the object stream names its own type, so a misread layout fails loudly instead of producing
+  plausible wrong data.
+* **Meaning fitted to Affinity's own pictures.** What shapes, paints, text and pixel data mean was
+  worked out by comparing our render with the thumbnail every Affinity document embeds (Affinity's
+  render of itself), on 176 public documents saved by Affinity 1.x, 2.x and 3.0/3.1 on Windows,
+  macOS and iPad. The collection has since grown to 189 distinct documents, and the reader opens
+  all of them. Most are published under CC0, MIT, BSD, Apache-2.0 or CC BY (-SA); the others
+  (no licence stated, or GPL or non-commercial terms) were only opened locally to compare
+  pictures, never committed or redistributed. The corpus test keeps the comparison for the pinned
+  files, which are CC0, MIT or Apache-2.0 only.
+* **Nothing of Affinity's is in this repository**: no program code, assets or documents. The test
+  files are fetched at pinned commits and sha256-verified, never committed.
+* **Read-only.** Nothing is written in Affinity's format; export waits until someone can check
+  written files in Affinity itself.
+
+The reader also has an independent copy in PhotoCraft's `photocraft-affinity`.
+
+## Validation
+
+* Unit tests on synthetic containers built by the `synth` feature (stored, zlib and zstd entries,
+  checksums, budgets, cycles, hostile streams, every truncation) and property tests of random
+  mutations.
+* `cargo xtask corpus --affinity` fetches 51 public CC0/MIT/Apache-2.0 documents at pinned
+  commits, SHA-256 verified against `xtask/affinity-corpus.sha256`, with upstream license notices.
+  Of these, 33 are current `.af`: four CC0 vector illustrations and 28 original Affinity 3.2.3
+  feature probes plus one separately identified derived regression input from
+  [SethRobinson/Patchy](https://github.com/SethRobinson/Patchy). Only document data and provenance
+  notices were inspected, never that project's importer or authoring scripts.
+* `tests/real_files.rs` parses every file and freezes the modeled features of all 33 current
+  `.af` files. Native raster tests compare decoded pixels with independent embedded images;
+  text tests assert Unicode run boundaries, fallback fonts and feature retention.
+* `engine/tests/affinity_corpus.rs` requires editable native import, exact `.vectorcraft`
+  save/reload, and SVG/PDF/PSD export of every board in all 33 current files. It checks SVG/PDF
+  dimensions and reimport, and independently decodes PSD merged pixels using the published
+  specification. These are VectorCraft consistency checks, not independent Affinity PSD oracles.
+  Saved-thumbnail comparisons cover the existing 22 documents plus nine new representative
+  fixtures, checking every board; unsupported effects and text layout are not claimed visually
+  faithful. The Affinity corpus workflow requires the files, so missing fixtures cannot silently
+  pass CI. Run locally with `AFFINITY_CORPUS_REQUIRED=1` for the same strict gate.
+* Synthetic engine regressions cover nested, rotated and curved artboards, negative origins,
+  multiple spreads and resolution conversion, alongside text recovery and native save/export.
+* `engine/tests/import_fuzz.rs` mutates a synthetic native document's stream and archive and checks
+  that whatever opens also renders and exports; `fuzz/` has `cargo-fuzz` targets for the whole
+  reader (`container`) and the object stream (`stream`):
+
+  ```sh
+  cd crates/affinity
+  cargo +nightly fuzz run stream -- -max_total_time=600
+  ```
+
+The source audit, licensing decisions and remaining complex-document/font cases are recorded in
+[affinity-validation.md](../../docs/affinity-validation.md). Reopening VectorCraft's exports in
+Affinity remains an independent validation step that hasn't been done.
+
+What has not been verified: files from Affinity builds or platforms outside the public set, files
+written by other applications, rotated or skewed images against Affinity's render, mask polarity
+against a render with and without the mask, and anything listed as a warning above. The `synth`
+builders write only what this reader accepts; Affinity has never opened their output, so they are
+test fixtures, not an exporter.
+
+## Safety limits
+
+Every size is checked before it is allocated: 256 MiB per archive entry and 1 GiB per import by
+default (`Limits`), a 64 MiB zstd window, 4096 saved revisions, array lengths no longer than the
+bytes left, 16 777 216 decoded values per document stream (fields and array elements together, counted before
+anything is allocated: a value takes about 40 bytes in memory however few it took in the file; the largest of
+those 189 public documents uses 3.3 million), 384 levels of object nesting, 128 levels of layers, 500 000 layers, four million curve
+nodes per curve; compound outlines also cap recursion at 128 levels, operand visits at 100 000
+and cumulative geometry work at four million, rejecting cycles and partial results on limits.
+Pie sweeps normalize finite angles in constant time. Pixel layers are limited to 64 megapixels
+(cropped to their content first); gradients to 1024 stops. Text collection is bounded to a
+million characters per node before allocation, with a cumulative 16 MiB budget for owned font
+names, features and gradient stops. Exhaustion warns and uses default attributes for remaining
+text, preserving its characters.
+Every archive entry's CRC-32 and size must match. Malformed input returns an `Error`; the
+crate has no panics outside tests.
+
+## Privacy
+
+Affinity documents can hold the folder they were saved in, user names, original image paths and
+XMP metadata. This reader never imports those fields.

crates/affinity/fuzz/.gitignore

@@ -0,0 +1,5 @@
+/target
+/corpus
+/artifacts
+/coverage
+/Cargo.lock

crates/affinity/fuzz/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "vectorcraft-affinity-fuzz"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+vectorcraft-affinity = { path = "..", features = ["synth"] }
+
+[[bin]]
+name = "container"
+path = "fuzz_targets/container.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "stream"
+path = "fuzz_targets/stream.rs"
+test = false
+doc = false
+bench = false
+
+[workspace]
+members = ["."]

crates/affinity/fuzz/fuzz_targets/container.rs

@@ -0,0 +1,10 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+// The whole native reader (archive, object stream, model) and the preview, on arbitrary bytes.
+fuzz_target!(|bytes: &[u8]| {
+    let _ = vectorcraft_affinity::container::header(bytes);
+    let _ = vectorcraft_affinity::preview(bytes);
+    let _ = vectorcraft_affinity::read(bytes, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
+});

crates/affinity/fuzz/fuzz_targets/stream.rs

@@ -0,0 +1,11 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+// The doc.dat object stream and the model built from it, wrapped in a stored archive entry so
+// mutations reach the tagged grammar instead of the archive's checksum.
+fuzz_target!(|stream: &[u8]| {
+    let _ = vectorcraft_affinity::stream::parse(stream);
+    let file = vectorcraft_affinity::synth::container(&[("doc.dat", stream, vectorcraft_affinity::synth::Method::Stored)], None);
+    let _ = vectorcraft_affinity::read(&file, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
+});

crates/affinity/src/access.rs

@@ -0,0 +1,105 @@
+//! Typed reads of [`Stream`] objects. Every accessor returns `None` when a field is missing or has
+//! another type, so the document mapping treats odd data as absent rather than failing.
+
+use crate::stream::{ObjId, Object, Stream, Tag, Value};
+
+impl Stream {
+    pub fn object(&self, id: ObjId) -> Option<&Object> {
+        self.objects.get(id)
+    }
+
+    pub fn field(&self, id: ObjId, tag: &[u8; 4]) -> Option<&Value> {
+        self.object(id)?.get(Tag::of(tag))
+    }
+
+    pub fn class(&self, id: ObjId) -> Option<Tag> {
+        self.object(id).map(|o| o.class)
+    }
+
+    pub fn is(&self, id: ObjId, class: &[u8; 4]) -> bool {
+        self.class(id) == Some(Tag::of(class))
+    }
+
+    /// A child object (shared, linked or inline); `None` for null or missing.
+    pub fn obj(&self, id: ObjId, tag: &[u8; 4]) -> Option<ObjId> {
+        match self.field(id, tag)? {
+            Value::Obj(o) => *o,
+            _ => None,
+        }
+    }
+
+    /// An array of objects (nulls skipped).
+    pub fn objs(&self, id: ObjId, tag: &[u8; 4]) -> Vec<ObjId> {
+        match self.field(id, tag) {
+            Some(Value::Array(a)) => a.iter().filter_map(|v| if let Value::Obj(Some(o)) = v { Some(*o) } else { None }).collect(),
+            _ => Vec::new(),
+        }
+    }
+
+    pub fn f64(&self, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
+        match self.field(id, tag)? {
+            Value::Float(f) if f.is_finite() => Some(*f),
+            _ => None,
+        }
+    }
+
+    pub fn int(&self, id: ObjId, tag: &[u8; 4]) -> Option<i64> {
+        match self.field(id, tag)? {
+            Value::Int(i) => Some(*i),
+            Value::UInt(u) => i64::try_from(*u).ok(),
+            _ => None,
+        }
+    }
+
+    pub fn bool(&self, id: ObjId, tag: &[u8; 4]) -> Option<bool> {
+        match self.field(id, tag)? {
+            Value::Bool(b) => Some(*b),
+            _ => None,
+        }
+    }
+
+    pub fn str(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
+        match self.field(id, tag)? {
+            Value::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    pub fn enumeration(&self, id: ObjId, tag: &[u8; 4]) -> Option<(u16, u16)> {
+        match self.field(id, tag)? {
+            Value::Enum { id, version } => Some((*id, *version)),
+            _ => None,
+        }
+    }
+
+    /// A fixed vector of `N` finite floats (points, rectangles, transforms).
+    pub fn floats<const N: usize>(&self, id: ObjId, tag: &[u8; 4]) -> Option<[f64; N]> {
+        match self.field(id, tag)? {
+            Value::Floats(v) if v.len() == N && v.iter().all(|f| f.is_finite()) => {
+                let mut a = [0.0; N];
+                a.copy_from_slice(v);
+                Some(a)
+            }
+            _ => None,
+        }
+    }
+
+    pub fn bytes(&self, id: ObjId, tag: &[u8; 4]) -> Option<&[u8]> {
+        match self.field(id, tag)? {
+            Value::Bytes(b) | Value::Blob(b) => Some(b),
+            _ => None,
+        }
+    }
+
+    pub fn entry(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
+        match self.field(id, tag)? {
+            Value::Entry(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    /// Untagged fields of a positional object, in order.
+    pub fn positional(&self, id: ObjId) -> impl Iterator<Item = &Value> {
+        self.object(id).into_iter().flat_map(|o| o.fields.iter().map(|(_, v)| v))
+    }
+}

crates/affinity/src/container.rs

@@ -0,0 +1,371 @@
+//! The Affinity archive: header, the chain of file allocation tables (one per save) and
+//! bounded, CRC-checked extraction of named entries such as `doc.dat` and raster tiles.
+
+use std::collections::{HashMap, HashSet};
+use std::io::Read;
+
+use crate::Error;
+
+pub const MAGIC: &[u8; 4] = b"\x00\xffKA";
+/// Oldest and newest container versions seen in real documents (Affinity 1.x writes 8,
+/// Affinity 3 writes 12). Version 7 is described by afread but no sample exists.
+pub const VERSIONS: std::ops::RangeInclusive<u16> = 8..=12;
+/// `Prsn` (stored byte-reversed): documents. Asset, brush and style libraries share the magic.
+const DOCUMENT_KIND: &[u8; 4] = b"nsrP";
+
+/// A save appends one table; real files have one to a few hundred.
+const MAX_TABLES: usize = 4096;
+/// zstd window ceiling: real documents use a few MiB; this stops a header from reserving gigabytes.
+const MAX_ZSTD_WINDOW: u64 = 64 << 20;
+
+/// Decompression budget for one import. Every entry declares its size, which is checked against
+/// these limits before anything is allocated, and the decoded length must match it exactly.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Limits {
+    /// Largest single entry (`doc.dat` or one tile).
+    pub max_entry: usize,
+    /// Total bytes extracted over the whole import.
+    pub max_total: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self { max_entry: 256 << 20, max_total: 1 << 30 }
+    }
+}
+
+/// The container header, all integers little-endian.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Header {
+    pub version: u16,
+    /// Seen as 0, 4 or 8 in real files; bits 0 and 1 mark container variants that are rejected.
+    pub flags: u16,
+    pub(crate) fat_offset: u64,
+    pub(crate) thumbnail_offset: u64,
+    /// Save time in Unix seconds, as written by the application.
+    pub saved: u32,
+}
+
+/// One FAT record, as of the newest table that mentions its id.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Entry {
+    pub id: u32,
+    pub name: String,
+    offset: u64,
+    size: u64,
+    compressed: u64,
+    crc: u32,
+    compression: u8,
+}
+
+impl Entry {
+    /// Decompressed size declared by the table.
+    pub fn size(&self) -> u64 {
+        self.size
+    }
+}
+
+#[derive(Debug)]
+pub struct Archive<'a> {
+    bytes: &'a [u8],
+    pub header: Header,
+    /// Head revision of every named, non-deleted entry.
+    entries: HashMap<String, Entry>,
+    /// Number of tables (saves) in the chain.
+    pub revisions: usize,
+    extracted: usize,
+    limits: Limits,
+}
+
+pub(crate) struct Cursor<'a> {
+    bytes: &'a [u8],
+    pub(crate) pos: usize,
+}
+
+impl<'a> Cursor<'a> {
+    pub(crate) fn new(bytes: &'a [u8], pos: usize) -> Self {
+        Self { bytes, pos }
+    }
+    pub(crate) fn remaining(&self) -> usize {
+        self.bytes.len().saturating_sub(self.pos)
+    }
+    pub(crate) fn take(&mut self, n: usize) -> Result<&'a [u8], Error> {
+        let end = self.pos.checked_add(n).ok_or(Error::Malformed("length overflow"))?;
+        let s = self.bytes.get(self.pos..end).ok_or(Error::Malformed("truncated data"))?;
+        self.pos = end;
+        Ok(s)
+    }
+    pub(crate) fn array<const N: usize>(&mut self) -> Result<[u8; N], Error> {
+        let s = self.take(N)?;
+        let mut a = [0u8; N];
+        a.copy_from_slice(s);
+        Ok(a)
+    }
+    pub(crate) fn u8(&mut self) -> Result<u8, Error> {
+        Ok(self.array::<1>()?[0])
+    }
+    pub(crate) fn u16(&mut self) -> Result<u16, Error> {
+        Ok(u16::from_le_bytes(self.array()?))
+    }
+    pub(crate) fn u32(&mut self) -> Result<u32, Error> {
+        Ok(u32::from_le_bytes(self.array()?))
+    }
+    pub(crate) fn u64(&mut self) -> Result<u64, Error> {
+        Ok(u64::from_le_bytes(self.array()?))
+    }
+}
+
+fn offset(v: u64) -> Result<usize, Error> {
+    usize::try_from(v).map_err(|_| Error::Malformed("offset beyond addressable memory"))
+}
+
+/// True when `bytes` start with the Affinity container signature (documents and libraries).
+pub fn is_affinity(bytes: &[u8]) -> bool {
+    bytes.starts_with(MAGIC)
+}
+
+/// Check the signature, version and document kind.
+pub fn header(bytes: &[u8]) -> Result<Header, Error> {
+    if !is_affinity(bytes) {
+        return Err(Error::Malformed("missing container signature"));
+    }
+    let mut c = Cursor::new(bytes, 4);
+    let version = c.u16()?;
+    let flags = c.u16()?;
+    if !VERSIONS.contains(&version) {
+        return Err(Error::Unsupported("unknown container version"));
+    }
+    if flags & 3 != 0 {
+        return Err(Error::Unsupported("container variant"));
+    }
+    if c.take(4)? != DOCUMENT_KIND {
+        return Err(Error::Unsupported("this Affinity file is a library (assets, brushes or styles), not a document"));
+    }
+    if c.take(4)? != b"#Inf" {
+        return Err(Error::Malformed("missing information header"));
+    }
+    let fat_offset = c.u64()?;
+    let thumbnail_offset = c.u64()?;
+    c.take(16)?;
+    let saved = u32::try_from(c.u64()?).unwrap_or(0);
+    c.take(8)?;
+    if c.take(4)? != b"Prot" {
+        return Err(Error::Malformed("missing protocol header"));
+    }
+    Ok(Header { version, flags, fat_offset, thumbnail_offset, saved })
+}
+
+impl<'a> Archive<'a> {
+    pub fn open(bytes: &'a [u8], limits: Limits) -> Result<Self, Error> {
+        let header = header(bytes)?;
+        // Newest record per id: (table date, table index, record).
+        let mut latest: HashMap<u32, (u64, usize, Option<Entry>)> = HashMap::new();
+        let mut names: HashMap<u32, String> = HashMap::new();
+        let mut seen = HashSet::new();
+        let mut next = header.fat_offset;
+        let mut tables = 0usize;
+        while next != 0 {
+            if !seen.insert(next) {
+                return Err(Error::Malformed("allocation tables form a cycle"));
+            }
+            tables += 1;
+            if tables > MAX_TABLES {
+                return Err(Error::Limit("too many saved revisions"));
+            }
+            let mut c = Cursor::new(bytes, offset(next)?);
+            let tag = c.array::<4>()?;
+            let level = match &tag {
+                b"#FAT" => 1,
+                b"#FT2" => 2,
+                b"#FT3" => 3,
+                b"#FT4" => 4,
+                _ => return Err(Error::Malformed("missing allocation table")),
+            };
+            next = c.u64()?;
+            let date = c.u64()?;
+            c.take(24)?;
+            let files = c.u32()?;
+            c.take(8)?;
+            let dirs = c.u16()?;
+            c.take(1)?;
+            for _ in 0..files {
+                let id = c.u32()?;
+                let flag = c.u8()?;
+                let mut record = None;
+                match flag {
+                    0 | 1 => {
+                        let offset = c.u64()?;
+                        let size = c.u64()?;
+                        let compressed = c.u64()?;
+                        let crc = c.u32()?;
+                        let stored = c.u8()?;
+                        if level >= 2 {
+                            c.take(4)?;
+                        }
+                        if level >= 4 {
+                            c.take(4)?;
+                        }
+                        // Old tables number the methods; newer ones store the method byte itself.
+                        let compression = if level <= 2 {
+                            match stored {
+                                1 => 0x01,
+                                2 => 0x41,
+                                3 => 0x81,
+                                4 => 0xC1,
+                                _ => 0,
+                            }
+                        } else {
+                            stored
+                        };
+                        record = Some(Entry { id, name: String::new(), offset, size, compressed, crc, compression });
+                    }
+                    2 => {}
+                    _ => return Err(Error::Malformed("unknown allocation record")),
+                }
+                if flag == 0 {
+                    let len = usize::from(c.u16()?);
+                    let name = String::from_utf8_lossy(c.take(len)?).into_owned();
+                    names.entry(id).or_insert(name);
+                }
+                // Equal dates: the first table in the chain (the newest) wins, as in afread.
+                let replace = latest.get(&id).is_none_or(|(d, _, _)| date > *d);
+                if replace {
+                    latest.insert(id, (date, tables, record));
+                }
+            }
+            for _ in 0..dirs {
+                let len = usize::from(c.u16()?);
+                c.take(10)?;
+                c.take(len)?;
+            }
+        }
+        let mut entries = HashMap::new();
+        for (id, (_, _, record)) in latest {
+            if let (Some(mut e), Some(name)) = (record, names.get(&id)) {
+                e.name = name.clone();
+                entries.insert(e.name.clone(), e);
+            }
+        }
+        Ok(Self { bytes, header, entries, revisions: tables, extracted: 0, limits })
+    }
+
+    pub fn entry(&self, name: &str) -> Option<&Entry> {
+        self.entries.get(name)
+    }
+
+    pub fn entry_names(&self) -> impl Iterator<Item = &str> {
+        self.entries.keys().map(String::as_str)
+    }
+
+    /// Bytes extracted so far, counted against [`Limits::max_total`].
+    pub fn extracted(&self) -> usize {
+        self.extracted
+    }
+
+    /// Extract an entry by name: decompress, undo the byte predictor and verify the CRC.
+    pub fn read(&mut self, name: &str) -> Result<Vec<u8>, Error> {
+        let e = self.entries.get(name).ok_or(Error::Malformed("missing archive entry"))?.clone();
+        let size = usize::try_from(e.size).map_err(|_| Error::Limit("archive entry too large"))?;
+        if size > self.limits.max_entry {
+            return Err(Error::Limit("archive entry too large"));
+        }
+        let total = self.extracted.checked_add(size).ok_or(Error::Limit("document too large"))?;
+        if total > self.limits.max_total {
+            return Err(Error::Limit("document too large"));
+        }
+        let mut c = Cursor::new(self.bytes, offset(e.offset)?);
+        if c.take(4)? != b"#Fil" {
+            return Err(Error::Malformed("archive entry has no data block"));
+        }
+        let method = e.compression & 3;
+        let stored_len = if matches!(method, 1 | 2) { e.compressed } else { e.size };
+        let data = c.take(offset(stored_len)?)?;
+        let mut out = match method {
+            1 => inflate(data, size)?,
+            2 => unzstd(data, size)?,
+            _ => data.to_vec(),
+        };
+        if out.len() != size {
+            return Err(Error::Malformed("archive entry size mismatch"));
+        }
+        unpredict(&mut out, e.compression)?;
+        if crc32fast::hash(&out) != e.crc {
+            return Err(Error::Malformed("archive entry checksum mismatch"));
+        }
+        self.extracted = total;
+        Ok(out)
+    }
+}
+
+/// Read at most `size + 1` bytes so a stream that decodes past its declared size is caught
+/// without unbounded allocation.
+fn read_bounded(mut r: impl Read, size: usize) -> Result<Vec<u8>, Error> {
+    let mut out = Vec::with_capacity(size.min(64 << 20));
+    let cap = u64::try_from(size).unwrap_or(u64::MAX).saturating_add(1);
+    r.by_ref().take(cap).read_to_end(&mut out).map_err(|_| Error::Malformed("corrupt compressed entry"))?;
+    Ok(out)
+}
+
+fn inflate(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
+    read_bounded(flate2::read::ZlibDecoder::new(data), size)
+}
+
+fn unzstd(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
+    let mut src = data;
+    let mut out = Vec::new();
+    // Entries may hold several concatenated frames.
+    while !src.is_empty() {
+        let left = size.checked_sub(out.len()).ok_or(Error::Malformed("archive entry size mismatch"))?;
+        let decoder = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(&mut src, MAX_ZSTD_WINDOW)
+            .map_err(|_| Error::Malformed("corrupt compressed entry"))?;
+        let frame = read_bounded(decoder, left)?;
+        if frame.is_empty() {
+            return Err(Error::Malformed("corrupt compressed entry"));
+        }
+        out.extend_from_slice(&frame);
+        if out.len() > size {
+            return Err(Error::Malformed("archive entry size mismatch"));
+        }
+    }
+    Ok(out)
+}
+
+/// Undo the byte predictor selected by the high bits of the compression byte.
+fn unpredict(b: &mut [u8], compression: u8) -> Result<(), Error> {
+    match (compression & 0xC0, compression & 0x20 != 0) {
+        (0x00, _) => {}
+        (0x40, _) => byte_delta(b),
+        (0x80, false) => {
+            let mut prev = 0u16;
+            for pair in b.as_chunks_mut::<2>().0.iter_mut() {
+                let v = u16::from_le_bytes([pair[0], pair[1]]).wrapping_add(prev);
+                pair.copy_from_slice(&v.to_le_bytes());
+                prev = v;
+            }
+        }
+        (0x80, true) => {
+            byte_delta(b);
+            // A 64 KiB tile of 16-bit samples is stored as all high bytes, then all low bytes.
+            if b.len() == 0x10000 {
+                let planes = b.to_vec();
+                let (hi, lo) = planes.split_at(0x8000);
+                for (i, out) in b.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+                    let (Some(h), Some(l)) = (hi.get(2 * i..2 * i + 2), lo.get(2 * i..2 * i + 2)) else {
+                        return Err(Error::Malformed("tile size"));
+                    };
+                    out.copy_from_slice(&[l[0], h[0], l[1], h[1]]);
+                }
+            }
+        }
+        _ => return Err(Error::Unsupported("archive entry predictor")),
+    }
+    Ok(())
+}
+
+fn byte_delta(b: &mut [u8]) {
+    let mut prev = 0u8;
+    for v in b {
+        *v = v.wrapping_add(prev);
+        prev = *v;
+    }
+}

crates/affinity/src/geometry.rs

@@ -0,0 +1,256 @@
+//! Outlines of curves (`PCvD` node lists), parametric shapes (`Shpe` objects) and compounds, in
+//! node space.
+
+use crate::model::{Affine, Path, Point, Reader, SubPath};
+use crate::stream::{ObjId, Tag, Value};
+
+/// Nodes per curve object.
+const MAX_NODES: usize = 4_000_000;
+/// A shared-object stream is bounded, but a compound graph can expand exponentially. Count
+/// each visit and each curve record / generated contour / transformed segment across the whole
+/// outline, including repeated references. Match the document reader's nesting limit.
+const MAX_OUTLINE_DEPTH: usize = 128;
+const MAX_OUTLINE_VISITS: usize = 100_000;
+
+struct OutlineBudget {
+    active: Vec<ObjId>,
+    visits: usize,
+    work: usize,
+    failed: bool,
+}
+
+impl OutlineBudget {
+    fn fail(&mut self, r: &mut Reader, warning: &'static str) -> Option<()> {
+        if !self.failed {
+            r.warn(warning);
+        }
+        self.failed = true;
+        None
+    }
+
+    fn spend(&mut self, r: &mut Reader, work: usize) -> Option<()> {
+        if work > self.work {
+            return self.fail(r, "compound outlines exceeding the geometry work limit");
+        }
+        self.work -= work;
+        Some(())
+    }
+
+    fn path(&mut self, r: &mut Reader, path: &Path) -> Option<()> {
+        for subpath in &path.subpaths {
+            self.spend(r, 1)?;
+            self.spend(r, subpath.segments.len())?;
+        }
+        Some(())
+    }
+}
+
+/// The node-space outline of a curve, shape or compound node, and whether it fills even-odd.
+/// Instances (master-page or symbol copies) take the geometry of their master.
+pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> Option<(Path, bool)> {
+    let mut budget = OutlineBudget { active: Vec::new(), visits: MAX_OUTLINE_VISITS, work: MAX_NODES, failed: false };
+    bounded_outline(r, id, class, world, &mut budget)
+}
+
+fn bounded_outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
+    if budget.active.contains(&id) {
+        budget.fail(r, "a compound outline that contains itself")?;
+    }
+    if budget.active.len() >= MAX_OUTLINE_DEPTH {
+        budget.fail(r, "compound outlines nested deeper than 128 levels")?;
+    }
+    if budget.visits == 0 {
+        budget.fail(r, "compound outlines exceeding the operand visit limit")?;
+    }
+    budget.visits -= 1;
+    budget.active.push(id);
+    let result = outline_inner(r, id, class, world, budget);
+    // The popped value is our own stack marker, and is no longer needed.
+    let _ = budget.active.pop();
+    result
+}
+
+fn outline_inner(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
+    let s = r.s;
+    match &class.0.to_be_bytes() {
+        b"PCrv" | b"TxtC" => {
+            let crvs = s.obj(id, b"Crvs").or_else(|| s.obj(id, b"MCrM").and_then(|m| s.obj(m, b"Crvs")))?;
+            let path = curves(r, crvs, budget)?;
+            budget.path(r, &path)?;
+            let multi = path.subpaths.len() > 1;
+            Some((path, multi))
+        }
+        b"Comp" => {
+            // One path of all the operands' contours in the compound's space, filled even-odd: this
+            // matches add and subtract operands in every public sample; a true union of overlapping
+            // added operands would differ.
+            let mut path = Path::default();
+            for c in s.objs(id, b"Chld") {
+                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+                let class = s.class(c)?;
+                if s.enumeration(c, b"ComO").is_some_and(|(op, _)| op != 0 && op != 2) {
+                    r.warn("compound shapes that intersect or exclude (imported as add)");
+                }
+                let child_world = local.then(world);
+                if !child_world.is_finite() {
+                    budget.fail(r, "a compound operand with an invalid transform")?;
+                }
+                if let Some((mut p, _)) = bounded_outline(r, c, class, child_world, budget) {
+                    // Charge before transforming or extending. Transform the owned path in place
+                    // so nested compounds do not make an additional copy of every contour.
+                    budget.path(r, &p)?;
+                    for subpath in &mut p.subpaths {
+                        subpath.start = local.apply(subpath.start);
+                        for segment in &mut subpath.segments {
+                            *segment = segment.map(|point| local.apply(point));
+                        }
+                    }
+                    path.subpaths.extend(p.subpaths);
+                } else if budget.failed {
+                    // Never present a partial compound as complete after a cycle or budget limit.
+                    return None;
+                }
+            }
+            Some((path, true))
+        }
+        _ => {
+            let (shape, box_owner) = match s.obj(id, b"Shpe") {
+                Some(sh) => (sh, id),
+                None => {
+                    let master = s.obj(id, b"ShpM")?;
+                    (s.obj(master, b"Shpe")?, master)
+                }
+            };
+            let b = s.floats::<4>(box_owner, b"ShpB")?;
+            let path = crate::shapes::shape(r, shape, b, world)?;
+            budget.path(r, &path)?;
+            Some((path, false))
+        }
+    }
+}
+
+/// `PCvD.Data`: positional `[u8, u32 count, then per subpath: bool closed, 18-byte records]`.
+/// A record is (f64 x, f64 y, u8 kind, u8 role): role 0 is an anchor, 1 the out-handle of the
+/// anchor before it, 2 the in-handle of the anchor after it. A closed subpath repeats its first
+/// anchor at the end. `CnrD` live corners are rounded on the stored polyline.
+fn curves(r: &mut Reader, crvs: ObjId, budget: &mut OutlineBudget) -> Option<Path> {
+    let s = r.s;
+    let data = s.obj(crvs, b"Data")?;
+    let mut fields = s.positional(data);
+    fields.next()?;
+    let count = match fields.next()? {
+        Value::UInt(n) => usize::try_from(*n).ok()?,
+        _ => return None,
+    };
+    budget.spend(r, count)?;
+    let corners = s.obj(crvs, b"CnrD").and_then(|c| corner_radii(s.positional(c).collect()));
+    let mut path = Path::default();
+    let mut seen = 0usize;
+    for index in 0..count {
+        let closed = match fields.next()? {
+            Value::Bool(b) => *b,
+            _ => return None,
+        };
+        let Value::Array(records) = fields.next()? else { return None };
+        seen = seen.checked_add(records.len())?;
+        if seen > MAX_NODES {
+            budget.fail(r, "curves with more than four million nodes")?;
+        }
+        budget.spend(r, records.len())?;
+        let anchors = anchors(records)?;
+        let radii = if index == 0 { corners.as_ref() } else { None };
+        if let Some(sp) = subpath(&anchors, closed, radii) {
+            path.subpaths.push(sp);
+        }
+    }
+    if corners.is_some() && count > 1 {
+        r.warn("rounded corners on curves with several subpaths (only the first is rounded)");
+    }
+    Some(path)
+}
+
+struct Anchor {
+    p: Point,
+    inh: Option<Point>,
+    out: Option<Point>,
+    /// Index of the anchor's record (live corners refer to records).
+    record: usize,
+}
+
+fn record(v: &Value) -> Option<(Point, u8)> {
+    let Value::Bytes(b) = v else { return None };
+    if b.len() != 18 {
+        return None;
+    }
+    let x = f64::from_le_bytes(b.get(0..8)?.try_into().ok()?);
+    let y = f64::from_le_bytes(b.get(8..16)?.try_into().ok()?);
+    if !x.is_finite() || !y.is_finite() {
+        return None;
+    }
+    Some((Point { x, y }, *b.get(17)?))
+}
+
+fn anchors(records: &[Value]) -> Option<Vec<Anchor>> {
+    let mut out: Vec<Anchor> = Vec::with_capacity(records.len() / 3 + 1);
+    let mut pending_in = None;
+    for (i, v) in records.iter().enumerate() {
+        let (p, role) = record(v)?;
+        match role {
+            0 => {
+                out.push(Anchor { p, inh: pending_in.take(), out: None, record: i });
+            }
+            1 => {
+                // A leading out-handle without an anchor is edit state only.
+                if let Some(a) = out.last_mut() {
+                    a.out = Some(p);
+                }
+            }
+            2 => pending_in = Some(p),
+            _ => return None,
+        }
+    }
+    Some(out)
+}
+
+fn subpath(anchors: &[Anchor], closed: bool, radii: Option<&Vec<(usize, f64)>>) -> Option<SubPath> {
+    let first = anchors.first()?;
+    if let Some(radii) = radii.filter(|r| !r.is_empty()) {
+        let corner = |a: &Anchor| radii.iter().filter(|(rec, _)| *rec == a.record).map(|(_, r)| *r).fold(0.0, f64::max);
+        let polyline = anchors.iter().all(|a| a.inh.is_none_or(|h| h == a.p) && a.out.is_none_or(|h| h == a.p));
+        if polyline {
+            let mut pts: Vec<(Point, f64)> = anchors.iter().map(|a| (a.p, corner(a))).collect();
+            // A closed subpath repeats its first anchor; its radius may be on either copy.
+            if closed
+                && pts.len() > 1
+                && pts.first().map(|p| p.0) == pts.last().map(|p| p.0)
+                && let Some((_, r)) = pts.pop()
+                && let Some(f) = pts.first_mut()
+            {
+                f.1 = f.1.max(r);
+            }
+            return Some(crate::shapes::fillet(&pts, closed));
+        }
+    }
+    let segments = anchors
+        .windows(2)
+        .filter_map(|w| {
+            let [a, b] = w else { return None };
+            Some([a.out.unwrap_or(a.p), b.inh.unwrap_or(b.p), b.p])
+        })
+        .collect();
+    Some(SubPath { start: first.p, segments, closed })
+}
+
+/// `CnrD`: positional `[u8, i32[] record indices, f64[] radii, u8[] types]`.
+fn corner_radii(fields: Vec<&Value>) -> Option<Vec<(usize, f64)>> {
+    let (Some(Value::Array(idx)), Some(Value::Array(rad))) = (fields.get(1), fields.get(2)) else { return None };
+    Some(
+        idx.iter()
+            .zip(rad)
+            .filter_map(|(i, r)| match (i, r) {
+                (Value::Int(i), Value::Float(r)) if r.is_finite() && *r > 0.0 => Some((usize::try_from(*i).ok()?, *r)),
+                _ => None,
+            })
+            .collect(),
+    )
+}

crates/affinity/src/lib.rs

@@ -0,0 +1,51 @@
+//! Reader for native Affinity documents (`.af`, and `.afdesign`/`.afphoto`/`.afpub` from
+//! Affinity 1 and 2): the archive container, the tagged object stream in `doc.dat`, and the
+//! subset of the document model VectorCraft imports.
+//!
+//! Layouts follow the MIT-licensed afread reference and were checked against public documents
+//! saved by Affinity 1.x to 3.x (container versions 8 to 12); see the crate README for provenance
+//! and the exact supported subset. Nothing here writes Affinity files.
+#![forbid(unsafe_code)]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use std::fmt;
+
+mod access;
+pub mod container;
+mod geometry;
+pub mod model;
+pub mod paint;
+pub mod preview;
+mod raster;
+mod shapes;
+pub mod stream;
+#[cfg(any(test, feature = "synth"))]
+pub mod synth;
+mod text;
+
+pub use container::{Archive, Limits, MAGIC, is_affinity};
+pub use model::{Document, read};
+pub use preview::{MAX_PREVIEW_BYTES, MAX_PREVIEW_DIMENSION, Preview, preview};
+
+/// Why a file could not be read. Messages are short reasons; callers add advice.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Error {
+    Malformed(&'static str),
+    Unsupported(&'static str),
+    Limit(&'static str),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Malformed(s) => write!(f, "damaged Affinity file: {s}"),
+            Self::Unsupported(s) => write!(f, "unsupported Affinity file: {s}"),
+            Self::Limit(s) => write!(f, "Affinity file exceeds a safety limit: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+#[cfg(test)]
+mod tests;

crates/affinity/src/model.rs

@@ -0,0 +1,618 @@
+//! The document model VectorCraft imports: spreads, artboards, layers, groups, curves, shapes,
+//! text and images, with transforms composed into document space. Anything else is reported
+//! by [`Document::warnings`] instead of being dropped silently.
+
+use std::collections::{BTreeMap, HashSet};
+
+use crate::paint::{self, Paint, Stroke};
+use crate::stream::{ObjId, Stream, Tag};
+use crate::{Archive, Error, Limits, stream};
+
+/// Affine map `x' = a·x + c·y + e`, `y' = b·x + d·y + f` (kurbo's coefficient order).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Affine(pub [f64; 6]);
+
+impl Affine {
+    pub const IDENTITY: Self = Self([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+
+    /// Affinity's `Xfrm`, stored row by row: (a, c, e, b, d, f).
+    pub(crate) fn from_xfrm(m: [f64; 6]) -> Self {
+        Self([m[0], m[3], m[1], m[4], m[2], m[5]])
+    }
+
+    pub fn then(self, outer: Self) -> Self {
+        let [a, b, c, d, e, f] = self.0;
+        let [oa, ob, oc, od, oe, of] = outer.0;
+        Self([oa * a + oc * b, ob * a + od * b, oa * c + oc * d, ob * c + od * d, oa * e + oc * f + oe, ob * e + od * f + of])
+    }
+
+    pub fn apply(&self, p: Point) -> Point {
+        let [a, b, c, d, e, f] = self.0;
+        Point { x: a * p.x + c * p.y + e, y: b * p.x + d * p.y + f }
+    }
+
+    /// Geometric mean of the axis scales: how much a stroke width or font size grows.
+    pub fn scale(&self) -> f64 {
+        let [a, b, c, d, ..] = self.0;
+        (a * d - b * c).abs().sqrt()
+    }
+
+    pub fn is_finite(&self) -> bool {
+        self.0.iter().all(|v| v.is_finite())
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Point {
+    pub x: f64,
+    pub y: f64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Rect {
+    pub x0: f64,
+    pub y0: f64,
+    pub x1: f64,
+    pub y1: f64,
+}
+
+/// One cubic Bézier subpath, in document pixels.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SubPath {
+    pub start: Point,
+    /// (control 1, control 2, end) per segment.
+    pub segments: Vec<[Point; 3]>,
+    pub closed: bool,
+}
+
+/// An outline in document pixels.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct Path {
+    pub subpaths: Vec<SubPath>,
+}
+
+impl Path {
+    pub fn transformed(&self, m: Affine) -> Self {
+        Self {
+            subpaths: self
+                .subpaths
+                .iter()
+                .map(|s| SubPath {
+                    start: m.apply(s.start),
+                    segments: s.segments.iter().map(|seg| seg.map(|p| m.apply(p))).collect(),
+                    closed: s.closed,
+                })
+                .collect(),
+        }
+    }
+}
+
+/// Affinity's blend modes, numbered by the `Blnd` enum.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Blend {
+    #[default]
+    Normal,
+    PassThrough,
+    Darken,
+    DarkerColor,
+    Multiply,
+    ColorBurn,
+    Lighten,
+    LighterColor,
+    Screen,
+    ColorDodge,
+    Add,
+    Overlay,
+    SoftLight,
+    HardLight,
+    VividLight,
+    PinLight,
+    LinearLight,
+    HardMix,
+    Difference,
+    Exclusion,
+    Subtract,
+    Hue,
+    Saturation,
+    Luminosity,
+    Color,
+    Average,
+    Negation,
+    Reflect,
+    Glow,
+    Erase,
+}
+
+impl Blend {
+    /// The enum (id, version) pairs observed in a document whose layers are named after their mode.
+    fn from_enum(id: u16, version: u16) -> Option<Self> {
+        use Blend::*;
+        Some(match (id, version) {
+            (0, _) => Normal,
+            (1, 0) => Darken,
+            (2, 1) => DarkerColor,
+            (2, 0) => Multiply,
+            (3, 0) => ColorBurn,
+            (4, 0) => Lighten,
+            (6, 1) => LighterColor,
+            (5, 0) => Screen,
+            (6, 0) => ColorDodge,
+            (7, 0) => Add,
+            (8, 0) => Overlay,
+            (9, 0) => SoftLight,
+            (10, 0) => HardLight,
+            (11, 0) => VividLight,
+            (12, 0) => PinLight,
+            (15, 1) => LinearLight,
+            (13, 0) => HardMix,
+            (14, 0) => Difference,
+            (15, 0) => Exclusion,
+            (16, 0) => Subtract,
+            (17, 0) => Hue,
+            (18, 0) => Saturation,
+            (19, 0) => Luminosity,
+            (20, 0) => Color,
+            (21, 0) => Average,
+            (22, 0) => Negation,
+            (23, 0) => Reflect,
+            (24, 0) => Glow,
+            (25, 0) => Erase,
+            _ => return None,
+        })
+    }
+}
+
+/// A run of text with one set of character attributes.
+#[derive(Debug, Clone, PartialEq)]
+pub struct TextRun {
+    pub text: String,
+    /// PostScript name and family of the chosen font.
+    pub postscript: String,
+    pub family: String,
+    /// CSS weight (400 regular, 700 bold).
+    pub weight: i64,
+    pub italic: bool,
+    /// Boolean OpenType feature overrides, as tags or `-tag` for disabled features.
+    pub features: Vec<String>,
+    pub all_caps: bool,
+    /// Font size in document pixels, before the node's transform.
+    pub size: f64,
+    /// Tracking in em.
+    pub tracking: f64,
+    /// Fixed line pitch in document pixels, when the run overrides automatic leading.
+    pub leading: Option<f64>,
+    pub fill: Paint,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Align {
+    Left,
+    Center,
+    Right,
+    Justify,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Text {
+    pub runs: Vec<TextRun>,
+    pub align: Align,
+    /// Artistic text: the first baseline's anchor point in node space (start, centre or end of the
+    /// line according to `align`). Frame text: the frame box in node space.
+    pub anchor: Point,
+    pub frame: Option<Rect>,
+    /// Node space to document pixels.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Pixels {
+    /// Straight-alpha RGBA, 8 bits per channel, row by row.
+    Rgba8(Vec<u8>),
+    /// The original file a placed image was made from (PNG, JPEG…), as embedded.
+    Encoded(Vec<u8>),
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Image {
+    pub width: u32,
+    pub height: u32,
+    pub pixels: Pixels,
+    /// Pixel space (0..w, 0..h) to document pixels.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Kind {
+    /// Layer container (`Scop`).
+    Layer,
+    Group,
+    /// Artboard: an export rectangle and vector outline that clips its children.
+    /// `background` paints behind them, and `strokes` over them.
+    Artboard {
+        rect: Rect,
+        /// Actual clipping outline in document pixels. The artboard's export rectangle is its
+        /// bounding box, but a rotated or non-rectangular board still clips to this outline.
+        path: Path,
+        even_odd: bool,
+        background: Vec<Paint>,
+        strokes: Vec<Stroke>,
+    },
+    /// Curve, parametric shape or compound shape: an outline with its fills and strokes.
+    /// Children of a shape are clipped by its outline (painted over its fills, under its strokes).
+    Shape {
+        path: Path,
+        fills: Vec<Paint>,
+        strokes: Vec<Stroke>,
+        even_odd: bool,
+    },
+    Text(Text),
+    Image(Image),
+    /// Something this reader does not import; its children are still imported.
+    Unsupported,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Node {
+    pub class: Tag,
+    pub name: String,
+    pub visible: bool,
+    pub locked: bool,
+    pub opacity: f64,
+    pub blend: Blend,
+    pub kind: Kind,
+    /// Vector mask in document pixels: the node shows only inside it (nonzero fill).
+    pub mask: Option<Path>,
+    /// Pixel mask: grey levels (white shows the node, black hides it); outside it the node is hidden.
+    pub pixel_mask: Option<Image>,
+    /// Bottom to top.
+    pub children: Vec<Node>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Spread {
+    /// Spread bounds in document pixels (the canvas, or the union of the artboards).
+    pub bounds: Rect,
+    /// Pages of a Publisher-style spread (one, or two facing pages), in document pixels.
+    pub pages: Vec<Rect>,
+    /// Transparent background; otherwise the page is white.
+    pub transparent: bool,
+    /// Bottom to top.
+    pub nodes: Vec<Node>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Document {
+    /// Pixels per inch: all geometry is in document pixels at this resolution.
+    pub dpi: f64,
+    pub spreads: Vec<Spread>,
+    /// Application that last saved the file, as stored (`Affinity 3.0.2`), when present.
+    pub saved_by: Option<String>,
+    /// Content that was not imported or was approximated, one line per kind, deduplicated.
+    pub warnings: Vec<String>,
+}
+
+/// Deepest layer nesting followed; deeper content is reported, not imported.
+const MAX_TREE_DEPTH: usize = 128;
+/// Total layer nodes imported.
+const MAX_NODES: usize = 500_000;
+
+/// Read a document: archive, `doc.dat` and the model.
+pub fn read(bytes: &[u8], limits: Limits) -> Result<Document, Error> {
+    let mut archive = Archive::open(bytes, limits)?;
+    let doc = archive.read("doc.dat")?;
+    let s = stream::parse(&doc)?;
+    Reader::new(&s, &mut archive).document()
+}
+
+pub(crate) struct Reader<'s, 'a, 'b> {
+    pub(crate) s: &'s Stream,
+    pub(crate) archive: &'b mut Archive<'a>,
+    pub(crate) dpi: f64,
+    warnings: BTreeMap<String, usize>,
+    nodes: usize,
+    active: HashSet<ObjId>,
+}
+
+impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
+    fn new(s: &'s Stream, archive: &'b mut Archive<'a>) -> Self {
+        Self { s, archive, dpi: 72.0, warnings: BTreeMap::new(), nodes: 0, active: HashSet::new() }
+    }
+
+    pub(crate) fn warn(&mut self, what: impl Into<String>) {
+        *self.warnings.entry(what.into()).or_default() += 1;
+    }
+
+    fn document(mut self) -> Result<Document, Error> {
+        let s = self.s;
+        let root = s.root;
+        self.dpi = s.obj(root, b"UVCn").and_then(|u| s.f64(u, b"UPPI")).filter(|d| *d > 0.0 && *d < 100_000.0).unwrap_or(72.0);
+        let saved_by = s.obj(root, b"NVer").map(|v| {
+            let product = s.str(v, b"Prod").unwrap_or("Affinity");
+            match (s.int(v, b"Majr"), s.int(v, b"Minr"), s.int(v, b"Bild")) {
+                (Some(a), Some(b), Some(c)) => format!("{product} {a}.{b}.{c}"),
+                _ => product.to_string(),
+            }
+        });
+        let doc = s.obj(root, b"DocR").ok_or(Error::Malformed("document has no root node"))?;
+        let mut spreads = Vec::new();
+        for spread in s.objs(doc, b"Chld") {
+            if !s.is(spread, b"Sprd") {
+                self.warn("an unknown kind of page");
+                continue;
+            }
+            let pages = pages(s, spread);
+            let default_size =
+                s.floats::<2>(doc, b"DfSz").filter(|[w, h]| *w > 0.0 && *h > 0.0).map(|[w, h]| Rect { x0: 0.0, y0: 0.0, x1: w, y1: h });
+            let bounds = s.floats::<4>(spread, b"SprB").map(rect).or_else(|| pages.iter().copied().reduce(union)).or(default_size).unwrap_or(Rect {
+                x0: 0.0,
+                y0: 0.0,
+                x1: 0.0,
+                y1: 0.0,
+            });
+            let transparent = s.bool(spread, b"SprT").unwrap_or(false);
+            let (nodes, mask) = self.children(spread, Affine::IDENTITY, 0)?;
+            if mask.is_some() {
+                self.warn("mask layers directly on a page (imported without them)");
+            }
+            spreads.push(Spread { bounds, pages, transparent, nodes });
+        }
+        if spreads.is_empty() {
+            return Err(Error::Malformed("document has no pages"));
+        }
+        if !s.objs(doc, b"MpCh").is_empty() {
+            self.warn("master pages (their content is not placed on the pages that use them)");
+        }
+        let warnings = self.warnings.into_iter().map(|(w, n)| if n > 1 { format!("{w} ({n}×)") } else { w }).collect();
+        Ok(Document { dpi: self.dpi, spreads, saved_by, warnings })
+    }
+
+    /// The children of `parent`, and the pixel mask a mask layer among them puts on the parent.
+    fn children(&mut self, parent: ObjId, world: Affine, depth: usize) -> Result<(Vec<Node>, Option<Image>), Error> {
+        let s = self.s;
+        let mut out = Vec::new();
+        let mut mask = None;
+        for c in s.objs(parent, b"Chld") {
+            if s.is(c, b"MRst") {
+                // A mask layer inside a group or layer masks that container.
+                if s.bool(c, b"Visi") == Some(false) {
+                    continue;
+                }
+                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+                match crate::raster::mask(self, c, local.then(world))? {
+                    Some(m) if mask.is_none() => mask = Some(m),
+                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
+                    None => {}
+                }
+                continue;
+            }
+            if let Some(n) = self.node(c, world, depth + 1)? {
+                out.push(n);
+            }
+        }
+        Ok((out, mask))
+    }
+
+    fn node(&mut self, id: ObjId, parent: Affine, depth: usize) -> Result<Option<Node>, Error> {
+        let s = self.s;
+        if depth > MAX_TREE_DEPTH {
+            self.warn("layers nested deeper than 128 levels");
+            return Ok(None);
+        }
+        self.nodes += 1;
+        if self.nodes > MAX_NODES {
+            return Err(Error::Limit("too many layers"));
+        }
+        // A node that contains itself (a shared object linked back into its own subtree).
+        if !self.active.insert(id) {
+            self.warn("a layer that contains itself");
+            return Ok(None);
+        }
+        let local = s.floats::<6>(id, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+        let world = local.then(parent);
+        let class = s.class(id).unwrap_or(Tag(0));
+        let name = s.str(id, b"Desc").unwrap_or_default().to_string();
+        let visible = s.bool(id, b"Visi").unwrap_or(true);
+        let locked = s.bool(id, b"Edtb").is_some_and(|e| !e);
+        let opacity = s.f64(id, b"Opac").map_or(1.0, |o| o.clamp(0.0, 1.0));
+        let blend = match s.enumeration(id, b"Blnd") {
+            None if s.bool(id, b"PasT") != Some(false) && is_container(class) => Blend::PassThrough,
+            None => Blend::Normal,
+            Some((i, v)) => Blend::from_enum(i, v).unwrap_or_else(|| {
+                self.warn("an unknown blend mode (imported as Normal)");
+                Blend::Normal
+            }),
+        };
+        let kind = if !world.is_finite() {
+            self.warn("a layer with an invalid transform");
+            Kind::Unsupported
+        } else {
+            self.kind(id, class, world, parent)?
+        };
+        // A compound's children are its operands, already merged into its outline.
+        let (children, child_mask) = if class == Tag::of(b"Comp") { (Vec::new(), None) } else { self.children(id, world, depth)? };
+        let (mask, attached_mask) = self.attached_masks(id, world)?;
+        let pixel_mask = attached_mask.or(child_mask);
+        self.active.remove(&id);
+        if s.objs(id, b"FiEf").iter().any(|e| s.bool(*e, b"Enab") != Some(false)) {
+            self.warn("layer effects (shadows, glows, outlines, bevels…)");
+        }
+        Ok(Some(Node { class, name, visible, locked, opacity, blend, kind, mask, pixel_mask, children }))
+    }
+
+    fn kind(&mut self, id: ObjId, class: Tag, world: Affine, parent: Affine) -> Result<Kind, Error> {
+        let s = self.s;
+        Ok(match &class.0.to_be_bytes() {
+            b"Scop" => Kind::Layer,
+            b"Grup" => Kind::Group,
+            b"PCrv" | b"ShpN" | b"Comp" | b"SNEN" | b"SNRR" | b"ShRN" => {
+                // Affinity 3.2.3's two-board public fixture marks board shapes with an `aprp`
+                // property object in `phrp`, while older documents use `ABEn`. Ordinary shapes
+                // in that fixture have neither. See the pinned corpus and validation audit.
+                if s.bool(id, b"ABEn") == Some(true) || s.obj(id, b"phrp").is_some_and(|p| s.is(p, b"aprp")) {
+                    return Ok(self.artboard(id, world));
+                }
+                let Some((local, even_odd)) = crate::geometry::outline(self, id, class, world) else {
+                    self.warn(format!("a {} that could not be read", describe(class)));
+                    return Ok(Kind::Unsupported);
+                };
+                let (fills, strokes) = paint::node_paint(self, id, world);
+                Kind::Shape { path: local.transformed(world), fills, strokes, even_odd }
+            }
+            b"TxtA" | b"TxtF" | b"TxtC" => match crate::text::read(self, id, world) {
+                Some(t) => Kind::Text(t),
+                None => {
+                    self.warn("text whose story could not be read (master-page text, or an unknown layout)");
+                    Kind::Unsupported
+                }
+            },
+            b"ImgN" | b"Rstr" => match crate::raster::node_image(self, id, world)? {
+                Some(img) => Kind::Image(img),
+                None => Kind::Unsupported,
+            },
+            b"EmbN" => match crate::raster::embedded(self, id, world)? {
+                Some(img) => {
+                    self.warn("embedded documents and symbols (imported as pictures of them)");
+                    Kind::Image(img)
+                }
+                None => {
+                    self.warn("embedded documents and symbols without a cached picture");
+                    Kind::Unsupported
+                }
+            },
+            b"FRst" => {
+                // A fill layer paints its whole bitmap area; its gradient lives in page space.
+                let b = s.obj(id, b"Bitm");
+                let size = |t: &[u8; 4]| b.and_then(|b| s.int(b, t)).map(|v| v as f64).filter(|v| *v > 0.0);
+                match (size(b"BmpW"), size(b"BmpH")) {
+                    (Some(w), Some(h)) => {
+                        let local = Path { subpaths: vec![crate::shapes::rectangle(0.0, 0.0, w, h)] };
+                        let fills = paint::fills(self, id, parent, b"BFFl");
+                        Kind::Shape { path: local.transformed(world), fills, strokes: Vec::new(), even_odd: false }
+                    }
+                    _ => {
+                        self.warn("fill layers without an area");
+                        Kind::Unsupported
+                    }
+                }
+            }
+            _ => {
+                self.warn(format!("{} layers", describe(class)));
+                Kind::Unsupported
+            }
+        })
+    }
+
+    /// Vector shapes attached to a node (`AdCh`) mask it: it shows only inside their outlines;
+    /// an attached mask layer is a pixel mask. Adjustments attached the same way are reported.
+    fn attached_masks(&mut self, id: ObjId, world: Affine) -> Result<(Option<Path>, Option<Image>), Error> {
+        let s = self.s;
+        let attached = s.objs(id, b"AdCh");
+        let mut mask: Option<Path> = None;
+        let mut pixels: Option<Image> = None;
+        for a in attached {
+            let class = s.class(a).unwrap_or(Tag(0));
+            if s.bool(a, b"Visi") == Some(false) {
+                continue;
+            }
+            if class == Tag::of(b"PCrv") || class == Tag::of(b"ShpN") || class == Tag::of(b"Comp") {
+                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
+                if let Some((p, _)) = crate::geometry::outline(self, a, class, local) {
+                    mask.get_or_insert_with(Path::default).subpaths.extend(p.transformed(local).subpaths);
+                }
+            } else if class == Tag::of(b"MRst") {
+                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
+                match crate::raster::mask(self, a, local)? {
+                    Some(m) if pixels.is_none() => pixels = Some(m),
+                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
+                    None => {}
+                }
+            } else {
+                self.warn(format!("{} layers attached to other layers (imported without them)", describe(class)));
+            }
+        }
+        Ok((mask, pixels))
+    }
+
+    fn artboard(&mut self, id: ObjId, world: Affine) -> Kind {
+        let s = self.s;
+        let Some(b) = s.floats::<4>(id, b"ShpB").map(rect).filter(|b| b.x1 > b.x0 && b.y1 > b.y0) else {
+            self.warn("an artboard without valid bounds (its children are kept without clipping)");
+            return Kind::Unsupported;
+        };
+        let corners =
+            [Point { x: b.x0, y: b.y0 }, Point { x: b.x1, y: b.y0 }, Point { x: b.x1, y: b.y1 }, Point { x: b.x0, y: b.y1 }].map(|p| world.apply(p));
+        let [a, b2, c, d, ..] = world.0;
+        if b2.abs() > 1e-9 || c.abs() > 1e-9 || a <= 0.0 || d <= 0.0 {
+            self.warn("a rotated or flipped artboard (export bounds are its bounding box; artwork keeps its outline)");
+        }
+        let xs = corners.map(|p| p.x);
+        let ys = corners.map(|p| p.y);
+        let rect = Rect {
+            x0: xs.iter().copied().fold(f64::INFINITY, f64::min),
+            y0: ys.iter().copied().fold(f64::INFINITY, f64::min),
+            x1: xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+            y1: ys.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+        };
+        if ![rect.x0, rect.y0, rect.x1, rect.y1].iter().all(|v| v.is_finite()) || rect.x1 <= rect.x0 || rect.y1 <= rect.y0 {
+            self.warn("an artboard with an invalid transformed size (its children are kept without clipping)");
+            return Kind::Unsupported;
+        }
+        let class = s.class(id).unwrap_or(Tag::of(b"ShpN"));
+        let (path, even_odd) = crate::geometry::outline(self, id, class, world).unwrap_or_else(|| {
+            self.warn("an artboard whose outline could not be read (clipped to its rectangle)");
+            (Path { subpaths: vec![crate::shapes::rectangle(b.x0, b.y0, b.x1, b.y1)] }, false)
+        });
+        let (background, strokes) = paint::node_paint(self, id, world);
+        Kind::Artboard { rect, path: path.transformed(world), even_odd, background, strokes }
+    }
+}
+
+/// Page rectangles: `SpMd.PagR[].rctp` (Publisher 2, Affinity 3) or `SprB` split into `PagC`
+/// equal pages (Publisher 1 facing spreads).
+fn pages(s: &Stream, spread: ObjId) -> Vec<Rect> {
+    if let Some(md) = s.obj(spread, b"SpMd") {
+        let v: Vec<Rect> =
+            s.objs(md, b"PagR").into_iter().filter_map(|p| s.floats::<4>(p, b"rctp").map(rect)).filter(|r| r.x1 > r.x0 && r.y1 > r.y0).collect();
+        if !v.is_empty() {
+            return v;
+        }
+    }
+    match (s.floats::<4>(spread, b"SprB").map(rect), s.int(spread, b"PagC")) {
+        (Some(b), Some(n @ 2..=16)) => {
+            let w = (b.x1 - b.x0) / n as f64;
+            (0..n).map(|i| Rect { x0: b.x0 + w * i as f64, x1: b.x0 + w * (i + 1) as f64, ..b }).collect()
+        }
+        _ => Vec::new(),
+    }
+}
+
+pub(crate) fn union(a: Rect, b: Rect) -> Rect {
+    Rect { x0: a.x0.min(b.x0), y0: a.y0.min(b.y0), x1: a.x1.max(b.x1), y1: a.y1.max(b.y1) }
+}
+
+fn is_container(class: Tag) -> bool {
+    class == Tag::of(b"Scop") || class == Tag::of(b"Grup")
+}
+
+pub(crate) fn rect(v: [f64; 4]) -> Rect {
+    Rect { x0: v[0], y0: v[1], x1: v[2], y1: v[3] }
+}
+
+/// A readable name for a layer class in warnings.
+pub(crate) fn describe(class: Tag) -> &'static str {
+    match &class.0.to_be_bytes() {
+        b"PCrv" => "curve",
+        b"ShpN" | b"SNEN" | b"SNRR" | b"ShRN" => "shape",
+        b"Comp" => "compound",
+        b"Rstr" => "pixel",
+        b"ImgN" => "image",
+        b"EmbN" => "embedded document",
+        b"MPIN" => "master page instance",
+        b"FRst" => "fill",
+        b"MRst" => "mask",
+        b"Slic" | b"SlcP" => "slice",
+        b"3DLA" => "3D",
+        [_, _, b'R', b'A'] => "adjustment",
+        _ => "unknown",
+    }
+}

crates/affinity/src/paint.rs

@@ -0,0 +1,329 @@
+//! Fills, strokes and colours. Two schemas exist: Affinity 1 (`BFil` fill, `PFil` stroke paint,
+//! `LSty` stroke style) and Affinity 2/3 (`BFFl`, `LIFl` and `LILn` lists with a current index).
+
+use crate::model::{Affine, Reader};
+use crate::stream::{ObjId, Value};
+
+/// A colour as stored: RGB and grey values are encoded in the document's RGB space (sRGB unless
+/// the document embeds another profile), CMYK values go through its CMYK profile. Alpha is straight.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Color {
+    Rgb {
+        r: f64,
+        g: f64,
+        b: f64,
+        a: f64,
+    },
+    Cmyk {
+        c: f64,
+        m: f64,
+        y: f64,
+        k: f64,
+        a: f64,
+    },
+    Gray {
+        v: f64,
+        a: f64,
+    },
+    /// CIE L*a*b* (D50).
+    Lab {
+        l: f64,
+        a: f64,
+        b: f64,
+        alpha: f64,
+    },
+}
+
+impl Color {
+    pub fn alpha(&self) -> f64 {
+        match self {
+            Color::Rgb { a, .. } | Color::Cmyk { a, .. } | Color::Gray { a, .. } => *a,
+            Color::Lab { alpha, .. } => *alpha,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum GradientKind {
+    Linear,
+    /// Elliptical and radial: distance from the centre in unit space.
+    Radial,
+    /// Angle around the centre.
+    Conical,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Stop {
+    pub offset: f64,
+    pub color: Color,
+    /// Affinity's midpoint bias for the segment from this stop to the next (0.5 = even blend).
+    pub bias: f64,
+}
+
+impl Stop {
+    /// Where, between this stop (0) and the next (1), the blend reaches half way: the bias curve
+    /// fitted to Affinity's renders is `t^k` (bias ≥ 0.5) or `1-(1-t)^k`, with `k = 1 + 8·|bias-0.5|`.
+    pub fn half_point(&self) -> f64 {
+        let k = 1.0 + 8.0 * (self.bias - 0.5).abs();
+        let h = 0.5f64.powf(1.0 / k);
+        if self.bias >= 0.5 { h } else { 1.0 - h }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Gradient {
+    pub kind: GradientKind,
+    pub stops: Vec<Stop>,
+    /// Unit space to document pixels: linear runs from unit (0,0) to (1,0); radial is the unit
+    /// circle; conical starts along unit +x and turns towards unit +y.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq, Default)]
+pub enum Paint {
+    #[default]
+    None,
+    Solid(Color),
+    Gradient(Gradient),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Cap {
+    Butt,
+    Round,
+    Square,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Join {
+    Miter,
+    Round,
+    Bevel,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Align {
+    Center,
+    Inside,
+    Outside,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Stroke {
+    pub paint: Paint,
+    /// Width in document pixels.
+    pub width: f64,
+    pub cap: Cap,
+    pub join: Join,
+    pub miter_limit: f64,
+    pub align: Align,
+    /// Dash and gap lengths in document pixels, and the phase.
+    pub dash: Option<(Vec<f64>, f64)>,
+    /// Painted below the fill instead of above it.
+    pub behind: bool,
+}
+
+/// Gradient stops per gradient.
+const MAX_STOPS: usize = 1024;
+
+fn floats(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Floats(f) => Some(f.clone()),
+        Value::Bytes(b) if b.len() % 4 == 0 => Some(b.as_chunks::<4>().0.iter().map(|c| f64::from(f32::from_le_bytes(*c))).collect()),
+        _ => None,
+    }
+}
+
+/// A colour object (`RGBA`, `HSLA`, `CMYK`, `GRAY`, `LABA`, `Pant`).
+pub(crate) fn color(r: &mut Reader, id: ObjId) -> Option<Color> {
+    let s = r.s;
+    let class = s.class(id)?;
+    let col = || -> Option<Vec<f64>> {
+        let v = floats(s.field(id, b"_col")?)?;
+        v.iter().all(|f| f.is_finite()).then_some(v)
+    };
+    Some(match &class.0.to_be_bytes() {
+        b"RGBA" => {
+            let v = col()?;
+            Color::Rgb { r: *v.first()?, g: *v.get(1)?, b: *v.get(2)?, a: v.get(3)?.clamp(0.0, 1.0) }
+        }
+        b"HSLA" => {
+            let v = col()?;
+            let (r2, g, b) = hsl(*v.first()?, *v.get(1)?, *v.get(2)?);
+            Color::Rgb { r: r2, g, b, a: v.get(3)?.clamp(0.0, 1.0) }
+        }
+        b"CMYK" => {
+            let v = col()?;
+            Color::Cmyk { c: *v.first()?, m: *v.get(1)?, y: *v.get(2)?, k: *v.get(3)?, a: v.get(4)?.clamp(0.0, 1.0) }
+        }
+        b"GRAY" => {
+            let v = col()?;
+            Color::Gray { v: *v.first()?, a: v.get(1)?.clamp(0.0, 1.0) }
+        }
+        b"LABA" => {
+            let b = s.bytes(id, b"_col")?;
+            let u = |i: usize| -> Option<f64> { Some(f64::from(u16::from_le_bytes([*b.get(2 * i)?, *b.get(2 * i + 1)?])) / 65535.0) };
+            Color::Lab { l: 100.0 * u(0)?, a: 255.0 * u(1)? - 128.0, b: 255.0 * u(2)? - 128.0, alpha: u(3)? }
+        }
+        b"Pant" => {
+            r.warn("spot colours (imported as their RGB equivalent)");
+            return s.obj(id, b"srgb").and_then(|c| color(r, c)).or_else(|| s.obj(id, b"base").and_then(|c| color(r, c)));
+        }
+        b"RegC" => Color::Cmyk { c: 1.0, m: 1.0, y: 1.0, k: 1.0, a: 1.0 },
+        _ => {
+            r.warn("colours in an unknown model");
+            return None;
+        }
+    })
+}
+
+fn hsl(h: f64, s: f64, l: f64) -> (f64, f64, f64) {
+    let c = (1.0 - (2.0 * l - 1.0).abs()) * s;
+    let hp = (h.rem_euclid(1.0)) * 6.0;
+    let x = c * (1.0 - (hp % 2.0 - 1.0).abs());
+    let (r, g, b) = match hp as u32 {
+        0 => (c, x, 0.0),
+        1 => (x, c, 0.0),
+        2 => (0.0, c, x),
+        3 => (0.0, x, c),
+        4 => (x, 0.0, c),
+        _ => (c, 0.0, x),
+    };
+    let m = l - c / 2.0;
+    (r + m, g + m, b + m)
+}
+
+/// A fill descriptor (`FDsc`) or, in Affinity 1 files, a bare `FilS`; `local` maps the node's
+/// space to document pixels.
+pub(crate) fn descriptor(r: &mut Reader, id: ObjId, local: Affine) -> Option<Paint> {
+    let s = r.s;
+    let (fill, unit) = if s.is(id, b"FDsc") {
+        let unit = s.floats::<6>(id, b"FDeX").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+        (s.obj(id, b"FDeF")?, unit)
+    } else {
+        (id, Affine::IDENTITY)
+    };
+    match &s.class(fill)?.0.to_be_bytes() {
+        b"FilN" => Some(Paint::None),
+        b"FilS" => Some(Paint::Solid(color(r, s.obj(fill, b"Colr")?)?)),
+        b"FilG" => {
+            let kind = match s.enumeration(fill, b"Type").map(|(i, _)| i) {
+                Some(0) | None => GradientKind::Linear,
+                Some(1 | 2) => GradientKind::Radial,
+                Some(3) => GradientKind::Conical,
+                Some(_) => {
+                    r.warn("gradients of an unknown kind (imported as linear)");
+                    GradientKind::Linear
+                }
+            };
+            let grad = s.obj(fill, b"Grad")?;
+            let cols = s.objs(grad, b"Cols");
+            let posn: Vec<Vec<f64>> = match s.field(grad, b"Posn") {
+                Some(Value::Array(a)) => a.iter().filter_map(floats).collect(),
+                _ => Vec::new(),
+            };
+            let mut stops = Vec::new();
+            for (c, p) in cols.iter().zip(&posn).take(MAX_STOPS) {
+                let color = color(r, *c)?;
+                let offset = p.first().copied().filter(|v| v.is_finite()).unwrap_or(0.0).clamp(0.0, 1.0);
+                let bias = p.get(1).copied().filter(|v| v.is_finite()).unwrap_or(0.5).clamp(0.0, 1.0);
+                stops.push(Stop { offset, color, bias });
+            }
+            if stops.is_empty() {
+                return Some(Paint::None);
+            }
+            Some(Paint::Gradient(Gradient { kind, stops, transform: unit.then(local) }))
+        }
+        b"FilB" => {
+            r.warn("bitmap and pattern fills (left empty)");
+            Some(Paint::None)
+        }
+        _ => {
+            r.warn("fills of an unknown kind (left empty)");
+            Some(Paint::None)
+        }
+    }
+}
+
+fn current(r: &Reader, id: ObjId, list: &[u8; 4], index: &[u8; 4]) -> Option<ObjId> {
+    let items = r.s.objs(id, list);
+    let i = r.s.int(id, index).and_then(|i| usize::try_from(i).ok()).unwrap_or(0);
+    items.get(i).or_else(|| items.first()).copied()
+}
+
+/// The fills of `list` (artboard backgrounds use `BFFl`).
+pub(crate) fn fills(r: &mut Reader, id: ObjId, local: Affine, list: &[u8; 4]) -> Vec<crate::paint::Paint> {
+    let d = current(r, id, list, b"BFCr").or_else(|| r.s.obj(id, b"BFil"));
+    d.and_then(|d| descriptor(r, d, local)).filter(|p| *p != Paint::None).into_iter().collect()
+}
+
+/// A node's fill and stroke. `local` maps the node's space to document pixels.
+pub(crate) fn node_paint(r: &mut Reader, id: ObjId, local: Affine) -> (Vec<Paint>, Vec<Stroke>) {
+    let s = r.s;
+    let fills = fills(r, id, local, b"BFFl");
+    if r.s.objs(id, b"BFFl").len() > 1 || r.s.objs(id, b"LIFl").len() > 1 {
+        r.warn("several fills or strokes on one object (only the active one is imported)");
+    }
+    if s.f64(id, b"FOpc").is_some_and(|o| o < 0.999) {
+        r.warn("fill opacity (imported at full fill opacity)");
+    }
+    if s.obj(id, b"Trns").is_some() {
+        r.warn("transparency gradients (imported without them)");
+    }
+    let (pen, style) = if s.field(id, b"LIFl").is_some() {
+        (current(r, id, b"LIFl", b"LICr"), current(r, id, b"LILn", b"LICr"))
+    } else {
+        (s.obj(id, b"PFil"), s.obj(id, b"LSty"))
+    };
+    let behind = matches!(s.field(id, b"DrwO"), Some(Value::Array(a)) if a.first() == Some(&Value::Enum { id: 1, version: 0 }));
+    let stroke = match (pen, style) {
+        (Some(pen), Some(style)) => stroke(r, pen, style, local, behind),
+        _ => None,
+    };
+    (fills, stroke.into_iter().collect())
+}
+
+fn stroke(r: &mut Reader, pen: ObjId, ldsc: ObjId, local: Affine, behind: bool) -> Option<Stroke> {
+    let s = r.s;
+    let paint = descriptor(r, pen, local)?;
+    if paint == Paint::None {
+        return None;
+    }
+    let lsty = if s.is(ldsc, b"LDsc") { s.obj(ldsc, b"LDeL")? } else { ldsc };
+    let weight = s.f64(lsty, b"Wght").filter(|w| *w > 0.0 && *w < 1e7)?;
+    // "Scale with object": the weight follows the object's transform; otherwise it is absolute.
+    let scales = s.bool(ldsc, b"LDSc").unwrap_or(true);
+    let width = if scales { weight * local.scale() } else { weight };
+    let data = s.bytes(lsty, b"Data").unwrap_or_default();
+    let miter_limit = data.get(0..8).and_then(|b| b.try_into().ok()).map(f64::from_le_bytes).filter(|m| m.is_finite() && *m >= 1.0).unwrap_or(4.0);
+    // Cap and join bytes are only partly understood: (0, 0) is butt/miter in every clean sample;
+    // (2, 2) ends plain lines square and brush lines round; joins import round, which never
+    // looks wrong.
+    let (cap, join) = match (data.get(8).copied(), data.get(9).copied(), data.get(10).copied()) {
+        (Some(0), Some(0), _) => (Cap::Butt, Join::Miter),
+        (Some(0), Some(_), _) => (Cap::Butt, Join::Round),
+        (Some(2), Some(2), Some(3)) => (Cap::Round, Join::Round),
+        (Some(2), Some(2), _) => (Cap::Square, Join::Round),
+        _ => (Cap::Round, Join::Round),
+    };
+    let align = match s.int(ldsc, b"LDSa") {
+        Some(1) => Align::Inside,
+        Some(2) => Align::Outside,
+        _ => Align::Center,
+    };
+    let dash = match s.field(lsty, b"Patn") {
+        Some(Value::Array(a)) if data.get(10) == Some(&2) || !a.is_empty() => {
+            let mut v: Vec<f64> = a.iter().filter_map(|x| if let Value::Float(f) = x { Some(*f) } else { None }).collect();
+            while v.len() >= 2 && v.iter().rev().take(2).all(|x| *x == 0.0) {
+                v.truncate(v.len() - 2);
+            }
+            let valid = !v.is_empty() && v.iter().all(|x| x.is_finite() && *x >= 0.0) && v.iter().any(|x| *x > 0.0);
+            valid.then(|| (v.iter().map(|x| x * width).collect(), s.f64(lsty, b"Phse").unwrap_or(0.0) * width))
+        }
+        _ => None,
+    };
+    if s.obj(lsty, b"Brus").is_some() || s.obj(ldsc, b"LDeP").is_some() {
+        r.warn("brush and pressure strokes (imported as plain strokes)");
+    }
+    Some(Stroke { paint, width, cap, join, miter_limit, align, dash, behind })
+}

crates/affinity/src/preview.rs

@@ -0,0 +1,124 @@
+//! The indexed PNG thumbnail Affinity stores next to the archive: Affinity's own render of the
+//! document, at most 512 pixels on the long side in real files, never the document itself.
+
+use crate::Error;
+use crate::container::header;
+
+pub const MAX_PREVIEW_BYTES: usize = 16 << 20;
+pub const MAX_PREVIEW_DIMENSION: u32 = 4096;
+
+/// Borrowed embedded thumbnail, at its own dimensions, never the native document dimensions.
+#[derive(Debug)]
+pub struct Preview<'a> {
+    pub png: &'a [u8],
+    pub width: u32,
+    pub height: u32,
+}
+
+fn bytes_at(bytes: &[u8], offset: usize, length: usize) -> Result<&[u8], Error> {
+    let end = offset.checked_add(length).ok_or(Error::Malformed("offset overflow"))?;
+    bytes.get(offset..end).ok_or(Error::Malformed("truncated record"))
+}
+
+fn le32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
+    let b = bytes_at(bytes, offset, 4)?;
+    Ok(u32::from_le_bytes(b.try_into().map_err(|_| Error::Malformed("integer"))?))
+}
+
+fn be32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
+    let b = bytes_at(bytes, offset, 4)?;
+    Ok(u32::from_be_bytes(b.try_into().map_err(|_| Error::Malformed("PNG integer"))?))
+}
+
+/// Read only the indexed `Thmb` record (identical in container versions 8 to 12), checking every PNG chunk CRC. Compressed
+/// pixels must still be validated by the consuming image decoder, with allocation limits.
+pub fn preview(bytes: &[u8]) -> Result<Preview<'_>, Error> {
+    let h = header(bytes)?;
+    if h.thumbnail_offset == 0 {
+        return Err(Error::Unsupported("no embedded preview"));
+    }
+    let offset = usize::try_from(h.thumbnail_offset).map_err(|_| Error::Malformed("thumbnail offset overflow"))?;
+    if offset < 72 {
+        return Err(Error::Malformed("thumbnail overlaps the file header"));
+    }
+    let record = bytes.get(offset..).ok_or(Error::Malformed("thumbnail offset outside file"))?;
+    if bytes_at(record, 0, 8)? != b"\xff\xff\xff\xffThmb" {
+        return Err(Error::Malformed("missing indexed thumbnail"));
+    }
+    if le32(record, 8)? != 1 || bytes_at(record, 28, 1)? != [1] {
+        return Err(Error::Unsupported("thumbnail record version or encoding"));
+    }
+    let size = usize::try_from(le32(record, 24)?).map_err(|_| Error::Limit("encoded size"))?;
+    if size > MAX_PREVIEW_BYTES {
+        return Err(Error::Limit("encoded preview exceeds 16 MiB"));
+    }
+    if le32(record, 16)? != 29 || le32(record, 20)? != 0 || u64::from(le32(record, 12)?) != size as u64 + 13 {
+        return Err(Error::Malformed("inconsistent thumbnail record lengths"));
+    }
+    let png = bytes_at(record, 29, size)?;
+    if bytes_at(png, 0, 8)? != b"\x89PNG\r\n\x1a\n" || be32(png, 8)? != 13 || bytes_at(png, 12, 4)? != b"IHDR" {
+        return Err(Error::Malformed("thumbnail is not a PNG"));
+    }
+    let width = be32(png, 16)?;
+    let height = be32(png, 20)?;
+    if width == 0 || height == 0 || width > MAX_PREVIEW_DIMENSION || height > MAX_PREVIEW_DIMENSION {
+        return Err(Error::Limit("preview dimensions must be 1..4096"));
+    }
+    // Bound work by bytes, not a file-supplied chunk count, and require exactly one complete PNG.
+    let mut pos = 8usize;
+    let (mut palette, mut image_data, mut image_data_ended) = (false, false, false);
+    loop {
+        let length = usize::try_from(be32(png, pos)?).map_err(|_| Error::Limit("PNG chunk length"))?;
+        let chunk_size = length.checked_add(12).ok_or(Error::Malformed("PNG chunk overflow"))?;
+        let chunk = bytes_at(png, pos, chunk_size)?;
+        let checksum_input = bytes_at(chunk, 4, chunk_size - 8)?;
+        if crc32fast::hash(checksum_input) != be32(chunk, chunk_size - 4)? {
+            return Err(Error::Malformed("PNG chunk checksum"));
+        }
+        let kind = bytes_at(chunk, 4, 4)?;
+        if !kind.iter().all(u8::is_ascii_alphabetic) {
+            return Err(Error::Malformed("PNG chunk type"));
+        }
+        match kind {
+            b"IHDR" if pos == 8 => {}
+            b"IHDR" => return Err(Error::Malformed("duplicate PNG header")),
+            b"PLTE" => {
+                if palette || image_data {
+                    return Err(Error::Malformed("PNG palette order"));
+                }
+                palette = true;
+            }
+            b"IDAT" => {
+                if image_data_ended {
+                    return Err(Error::Malformed("non-contiguous PNG image data"));
+                }
+                image_data = true;
+            }
+            b"IEND" if !image_data => return Err(Error::Malformed("PNG has no image data")),
+            b"IEND" => {}
+            _ if kind.first().is_some_and(u8::is_ascii_uppercase) => {
+                return Err(Error::Unsupported("unknown critical PNG chunk"));
+            }
+            _ => {}
+        }
+        if image_data && kind != b"IDAT" {
+            image_data_ended = true;
+        }
+        // Native sample previews are plain, single-frame PNGs. Pixel allocation limits do not
+        // necessarily bound aggregate compressed metadata; leave these layouts unsupported.
+        if matches!(kind, b"zTXt" | b"iTXt" | b"iCCP") {
+            return Err(Error::Unsupported("compressed PNG metadata in the preview"));
+        }
+        if matches!(kind, b"acTL" | b"fcTL" | b"fdAT") {
+            return Err(Error::Unsupported("animated PNG preview"));
+        }
+        pos = pos.checked_add(chunk_size).ok_or(Error::Malformed("PNG offset overflow"))?;
+        if kind == b"IEND" {
+            if length != 0 || pos != png.len() {
+                return Err(Error::Malformed("PNG end or trailing data"));
+            }
+            break;
+        }
+    }
+    Ok(Preview { png, width, height })
+}

crates/affinity/src/raster.rs

@@ -0,0 +1,414 @@
+//! Pixel layers (`Rstr`) and placed images (`ImgN`). A placed image keeps its original file
+//! (`DyBm.Bckg` → archive entry `c/N`), which is imported as is; other pixels are planar tiles of
+//! 256 bytes × 256 rows per channel, each its own archive entry.
+
+use std::collections::HashMap;
+
+use crate::Error;
+use crate::model::{Affine, Image, Pixels, Reader};
+use crate::stream::{self, ObjId, Tag, Value};
+
+/// Pixels decoded per layer (the content's bounding box, not the canvas).
+const MAX_PIXELS: u64 = 64 << 20;
+const TILE: usize = 256;
+const TILE_BYTES: usize = TILE * TILE;
+
+struct CachedPixels {
+    tiles: HashMap<String, Vec<u8>>,
+    source: Option<(usize, Vec<u8>)>,
+}
+
+pub(crate) fn node_image(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(bitmap) = s.obj(id, b"Bitm") else {
+        r.warn("pixel layers without pixels");
+        return Ok(None);
+    };
+    if !s.is(bitmap, b"DyBm") {
+        r.warn("pixel layers stored in an unknown way");
+        return Ok(None);
+    }
+    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 {
+        return Ok(None);
+    }
+    // A placed image: the original file, byte for byte.
+    let has_tiles = s.field(bitmap, b"Sta1").is_some();
+    if let Some(name) = s.entry(bitmap, b"Bckg").filter(|n| !n.is_empty())
+        && (s.is(id, b"ImgN") || !has_tiles)
+    {
+        match original(r, name) {
+            Ok(bytes) => return Ok(Some(Image { width, height, pixels: Pixels::Encoded(bytes), transform: world })),
+            Err(Error::Limit(e)) => return Err(Error::Limit(e)),
+            Err(_) => r.warn("an embedded image file that could not be read (its cached pixels were used)"),
+        }
+    }
+    // The content's bounding box, so a mostly empty canvas-sized layer stays small.
+    let crop = s
+        .field(id, b"BitR")
+        .and_then(|v| if let Value::Ints(i) = v { Some(i.clone()) } else { None })
+        .filter(|v| v.len() == 4 && v[0] > i64::from(i32::MIN) + 1)
+        .map(|v| {
+            (
+                v[0].clamp(0, i64::from(width)) as u32,
+                v[1].clamp(0, i64::from(height)) as u32,
+                v[2].clamp(0, i64::from(width)) as u32,
+                v[3].clamp(0, i64::from(height)) as u32,
+            )
+        })
+        .unwrap_or((0, 0, width, height));
+    let source_tiles_only =
+        (1..=4).all(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if !a.is_empty() && a.iter().all(|v| *v == Value::UInt(5))));
+    if s.field(bitmap, b"Bckg").is_some() && has_tiles && !source_tiles_only && !s.is(id, b"ImgN") {
+        r.warn("edited placed images use their stored pixels");
+    }
+    decode(r, bitmap, crop, world)
+}
+
+/// A mask layer (`MRst`): one channel of coverage as grey pixels (white shows, black hides).
+pub(crate) fn mask(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(bitmap) = s.obj(id, b"Bitm") else { return Ok(None) };
+    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 || !matches!(s.enumeration(bitmap, b"Frmt"), Some((6 | 7, _))) {
+        r.warn("pixel masks in an unknown format (imported without them)");
+        return Ok(None);
+    }
+    decode(r, bitmap, (0, 0, width, height), world)
+}
+
+/// An embedded document or symbol instance (`EmbN`), as the picture of it Affinity caches.
+pub(crate) fn embedded(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(cache) = s.obj(id, b"Bitm").and_then(|e| s.obj(e, b"Cach")) else { return Ok(None) };
+    let Some(bbox) = s.obj(id, b"Bitm").and_then(|e| s.floats::<4>(e, b"ChBB")) else { return Ok(None) };
+    let width = s.int(cache, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(cache, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 {
+        return Ok(None);
+    }
+    let [x0, y0, x1, y1] = bbox;
+    // The instance's origin is the centre of the embedded content (checked against the
+    // thumbnails of documents with embedded documents and SVG files).
+    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
+    let place = Affine([(x1 - x0) / f64::from(width), 0.0, 0.0, (y1 - y0) / f64::from(height), x0 - cx, y0 - cy]).then(world);
+    decode(r, cache, (0, 0, width, height), place)
+}
+
+/// Decode the tiles of a bitmap inside `crop` (pixels), placed by `world` (bitmap pixels to document).
+fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let (x0, y0, x1, y1) = crop;
+    if x1 <= x0 || y1 <= y0 {
+        return Ok(None);
+    }
+    let (w, h) = (x1 - x0, y1 - y0);
+    if u64::from(w) * u64::from(h) > MAX_PIXELS {
+        r.warn("pixel layers larger than 64 megapixels");
+        return Ok(None);
+    }
+    let format = s.enumeration(bitmap, b"Frmt").map(|(f, _)| f);
+    let (channels, bps) = match format {
+        Some(0) => (4, 1),
+        Some(1) => (4, 2),
+        Some(6) => (1, 1),
+        Some(7) => (1, 2),
+        Some(4) => {
+            r.warn("CMYK pixel layers (converted to RGB without the document's colour profile)");
+            (5, 1)
+        }
+        _ => {
+            r.warn("pixel layers in grey, Lab or 32-bit formats");
+            return Ok(None);
+        }
+    };
+    let mut planes = Vec::with_capacity(channels);
+    // Current .af documents can keep level-zero tiles in their embedded JPEG/PNG instead of
+    // duplicating the pixels. State 5 is checked in the public Patchy embedded-jpeg fixture.
+    // Support only the observed, same-size RGBA8 image with a zero bitmap origin; other
+    // representations still receive the existing loss warning rather than guessing a mapping.
+    let needs_source = (1..=channels).any(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if a.contains(&Value::UInt(5))));
+    let source = if needs_source && format == Some(0) && s.int(bitmap, b"LInf") == Some(0) && s.int(bitmap, b"TInf") == Some(0) {
+        if let Some(name) = s.entry(bitmap, b"Bckg") {
+            let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+            let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+            match original(r, name).and_then(|bytes| source_pixels(&bytes, width, height)) {
+                Ok(pixels) => Some((width as usize, pixels)),
+                Err(Error::Limit(e)) => return Err(Error::Limit(e)),
+                Err(_) => None,
+            }
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+    let mut cache = CachedPixels { tiles: HashMap::new(), source };
+    for c in 1..=channels {
+        planes.push(plane(r, bitmap, c, bps, (x0, y0, w, h), &mut cache)?);
+    }
+    let n = (w as usize) * (h as usize);
+    let mut rgba = vec![0u8; n * 4];
+    let sample = |p: &Vec<u8>, i: usize| -> f64 {
+        if bps == 2 {
+            f64::from(u16::from_le_bytes([p.get(2 * i).copied().unwrap_or(0), p.get(2 * i + 1).copied().unwrap_or(0)])) / 65535.0
+        } else {
+            f64::from(p.get(i).copied().unwrap_or(0)) / 255.0
+        }
+    };
+    for (i, px) in rgba.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+        let v: Vec<f64> = planes.iter().map(|p| sample(p, i)).collect();
+        let (r2, g, b, a) = if channels == 1 {
+            (v[0], v[0], v[0], 1.0)
+        } else if channels == 5 {
+            let k = 1.0 - v[3];
+            ((1.0 - v[0]) * k, (1.0 - v[1]) * k, (1.0 - v[2]) * k, v[4])
+        } else {
+            (v[0], v[1], v[2], v[3])
+        };
+        px.copy_from_slice(&[r2, g, b, a].map(|c| (c.clamp(0.0, 1.0) * 255.0).round() as u8));
+    }
+    let transform = Affine([1.0, 0.0, 0.0, 1.0, f64::from(x0), f64::from(y0)]).then(world);
+    Ok(Some(Image { width: w, height: h, pixels: Pixels::Rgba8(rgba), transform }))
+}
+
+/// The original image file: entry `c/N` is a stream whose root (`Blck`) holds it as `Data`.
+fn original(r: &mut Reader, name: &str) -> Result<Vec<u8>, Error> {
+    let bytes = r.archive.read(name)?;
+    let s = stream::parse(&bytes)?;
+    let root = s.object(s.root).ok_or(Error::Malformed("embedded image"))?;
+    match root.get(Tag::of(b"Data")) {
+        Some(Value::Blob(b)) if !b.is_empty() => Ok(b.clone()),
+        _ => Err(Error::Malformed("embedded image without data")),
+    }
+}
+
+/// Decode the source under the same pixel budget as tiled layers, checking its actual
+/// dimensions before allocating decoded pixels. Only JPEG and PNG sources are supported.
+fn source_pixels(bytes: &[u8], width: u32, height: u32) -> Result<Vec<u8>, Error> {
+    use image::{ImageFormat, ImageReader};
+    use std::io::Cursor;
+
+    if u64::from(width) * u64::from(height) > MAX_PIXELS {
+        return Err(Error::Limit("embedded image pixels"));
+    }
+    let mut reader = ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(|_| Error::Malformed("embedded image format"))?;
+    if !matches!(reader.format(), Some(ImageFormat::Jpeg | ImageFormat::Png)) {
+        return Err(Error::Unsupported("embedded source pixel format"));
+    }
+    let dimensions = ImageReader::new(Cursor::new(bytes))
+        .with_guessed_format()
+        .map_err(|_| Error::Malformed("embedded image format"))?
+        .into_dimensions()
+        .map_err(|_| Error::Malformed("embedded image dimensions"))?;
+    if dimensions != (width, height) || width == 0 || height == 0 {
+        return Err(Error::Malformed("embedded source and bitmap dimensions differ"));
+    }
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(width);
+    limits.max_image_height = Some(height);
+    limits.max_alloc = Some(MAX_PIXELS * 8);
+    reader.limits(limits);
+    let decoded = reader.decode().map_err(|e| match e {
+        image::ImageError::Limits(_) => Error::Limit("embedded image decoding"),
+        _ => Error::Malformed("embedded image decoding"),
+    })?;
+    Ok(decoded.into_rgba8().into_raw())
+}
+
+fn tag(prefix: &[u8; 3], c: usize) -> [u8; 4] {
+    [prefix[0], prefix[1], prefix[2], b'0' + c as u8]
+}
+
+/// One channel of level 0, cropped to (x0, y0, w, h) pixels; `bps` bytes per sample.
+fn plane(
+    r: &mut Reader,
+    bitmap: ObjId,
+    c: usize,
+    bps: usize,
+    (x0, y0, w, h): (u32, u32, u32, u32),
+    cache: &mut CachedPixels,
+) -> Result<Vec<u8>, Error> {
+    let CachedPixels { tiles: cache, source } = cache;
+    let s = r.s;
+    let width = s.int(bitmap, b"BmpW").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
+    let tw = s.int(bitmap, &tag(b"TWi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| (width * bps).div_ceil(TILE));
+    let th = s.int(bitmap, &tag(b"THi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| height.div_ceil(TILE));
+    let states: Vec<u8> = match s.field(bitmap, &tag(b"Sta", c)) {
+        Some(Value::Array(a)) => a.iter().map(|v| if let Value::UInt(u) = v { u8::try_from(*u).unwrap_or(255) } else { 255 }).collect(),
+        _ => Vec::new(),
+    };
+    let tiles = s.objs(bitmap, &tag(b"Idx", c));
+    let row = (w as usize) * bps;
+    let mut out = vec![0u8; row * h as usize];
+    let (bx0, bx1) = (x0 as usize * bps, (x0 + w) as usize * bps);
+    let (py0, py1) = (y0 as usize, (y0 + h) as usize);
+    let mut next = 0usize;
+    for (t, state) in states.iter().enumerate().take(tw.saturating_mul(th)) {
+        let (ty, tx) = (t / tw.max(1), t % tw.max(1));
+        let fill = match state {
+            0 | 1 => None,
+            2 => Some(0xFF),
+            4 => {
+                let Some(blck) = tiles.get(next).copied() else { return Err(Error::Malformed("missing pixel tile")) };
+                next += 1;
+                let (ox, oy) = (tx * TILE, ty * TILE);
+                if ox >= bx1 || ox + TILE <= bx0 || oy >= py1 || oy + TILE <= py0 {
+                    continue;
+                }
+                let name = s.entry(blck, b"Data").ok_or(Error::Malformed("pixel tile without data"))?.to_string();
+                if !cache.contains_key(&name) {
+                    let mut data = r.archive.read(&name)?;
+                    // Older files wrap a tile in a one-field stream: header, then a 64 KiB blob.
+                    if data.len() == TILE_BYTES + 22 && data.starts_with(b"\x00\xffKS") {
+                        data = data.get(21..21 + TILE_BYTES).ok_or(Error::Malformed("pixel tile"))?.to_vec();
+                    }
+                    if data.len() != TILE_BYTES {
+                        return Err(Error::Malformed("pixel tile size"));
+                    }
+                    cache.insert(name.clone(), data);
+                }
+                let tile = cache.get(&name).ok_or(Error::Malformed("pixel tile"))?;
+                copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| tile.get(y * TILE + x).copied().unwrap_or(0));
+                continue;
+            }
+            3 => {
+                r.warn("32-bit pixel layers");
+                None
+            }
+            5 => {
+                if let Some((source_width, pixels)) = source.as_ref() {
+                    let (ox, oy) = (tx * TILE, ty * TILE);
+                    copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| {
+                        pixels.get(((oy + y) * source_width + ox + x) * 4 + c - 1).copied().unwrap_or(0)
+                    });
+                    continue;
+                }
+                r.warn("pixel layers drawn from an embedded image (left empty)");
+                None
+            }
+            _ => return Err(Error::Malformed("unknown pixel tile state")),
+        };
+        if let Some(v) = fill {
+            copy(&mut out, row, (bx0, py0, bx1, py1), (tx * TILE, ty * TILE), |_, _| v);
+        }
+    }
+    Ok(out)
+}
+
+/// Copy the overlap of a tile at byte column `ox`, row `oy` into the cropped plane.
+fn copy(out: &mut [u8], row: usize, (bx0, py0, bx1, py1): (usize, usize, usize, usize), (ox, oy): (usize, usize), at: impl Fn(usize, usize) -> u8) {
+    for y in oy.max(py0)..(oy + TILE).min(py1) {
+        for x in ox.max(bx0)..(ox + TILE).min(bx1) {
+            if let Some(b) = out.get_mut((y - py0) * row + (x - bx0)) {
+                *b = at(x - ox, y - oy);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::model::Kind;
+    use crate::synth::{self, F, Method, tag};
+
+    fn png() -> Vec<u8> {
+        let pixels = image::RgbaImage::from_fn(300, 2, |x, y| image::Rgba([(x % 251) as u8, (y * 31) as u8, 77, 255]));
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        pixels.write_to(&mut bytes, image::ImageFormat::Png).unwrap();
+        bytes.into_inner()
+    }
+
+    /// An original synthetic mixed source/cache bitmap. It exercises reader recovery,
+    /// not a claim that Affinity itself accepts the synthetic container.
+    fn fixture(source: &[u8], origin: i32) -> Vec<u8> {
+        let mut bitmap = vec![
+            (tag(b"Frmt"), F::Enum(0, 0)),
+            (tag(b"BmpW"), F::I32(300)),
+            (tag(b"BmpH"), F::I32(2)),
+            (tag(b"LInf"), F::I32(origin)),
+            (tag(b"TInf"), F::I32(0)),
+            (tag(b"Bckg"), F::Entry("c/1".into())),
+        ];
+        for c in 1..=4 {
+            bitmap.push((tag(&super::tag(b"TWi", c)), F::I32(2)));
+            bitmap.push((tag(&super::tag(b"THi", c)), F::I32(1)));
+            bitmap.push((tag(&super::tag(b"Sta", c)), F::U8s(vec![5, 4])));
+            bitmap.push((
+                tag(&super::tag(b"Idx", c)),
+                F::Shared(vec![F::Def(c as u32, vec![tag(b"Blck")], vec![(tag(b"Data"), F::Entry(format!("d/{c}")))])]),
+            ));
+        }
+        let mut crop = vec![0x17];
+        crop.extend(tag(b"BitR").0.to_le_bytes());
+        crop.extend([250i32, 0, 270, 2].into_iter().flat_map(i32::to_le_bytes));
+        let raster = F::Def(
+            10,
+            vec![tag(b"Rstr")],
+            vec![
+                (tag(b"Bitm"), F::Obj(tag(b"DyBm"), bitmap)),
+                (tag(b"BitR"), F::Raw(crop)),
+                (tag(b"Xfrm"), F::F64s(vec![0.0, -2.0, 10.0, 2.0, 0.0, 20.0])),
+            ],
+        );
+        let spread = F::Def(11, vec![tag(b"Sprd")], vec![(tag(b"Chld"), F::Shared(vec![raster]))]);
+        let doc = synth::stream(&[(tag(b"DocR"), F::Obj(tag(b"DocN"), vec![(tag(b"Chld"), F::Shared(vec![spread]))]))]);
+        let mut blob = vec![0x2d];
+        blob.extend(tag(b"Data").0.to_le_bytes());
+        blob.extend((source.len() as u32).to_le_bytes());
+        blob.extend(source);
+        let block = synth::stream(&[(tag(b"Data"), F::Raw(blob))]);
+        let tiles: Vec<_> = [200u8, 10, 30, 255].into_iter().map(|v| vec![v; TILE_BYTES]).collect();
+        synth::container(
+            &[
+                ("doc.dat", &doc, Method::Zlib),
+                ("c/1", &block, Method::Zlib),
+                ("d/1", &tiles[0], Method::Zlib),
+                ("d/2", &tiles[1], Method::Zlib),
+                ("d/3", &tiles[2], Method::Zlib),
+                ("d/4", &tiles[3], Method::Zlib),
+            ],
+            None,
+        )
+    }
+
+    #[test]
+    fn source_tiles_and_cached_edits_survive_crop_rotation_and_tile_boundaries() {
+        let doc = crate::read(&fixture(&png(), 0), crate::Limits::default()).unwrap();
+        assert_eq!(doc.warnings, ["edited placed images use their stored pixels"]);
+        let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
+        assert_eq!((image.width, image.height), (20, 2));
+        assert_eq!(image.transform, Affine([0.0, 2.0, -2.0, 0.0, 10.0, 520.0]));
+        let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
+        for y in 0..2 {
+            for x in 0..20 {
+                let expected = if x + 250 < 256 { [((x + 250) % 251) as u8, (y * 31) as u8, 77, 255] } else { [200, 10, 30, 255] };
+                assert_eq!(&pixels[(y * 20 + x) * 4..(y * 20 + x + 1) * 4], &expected);
+            }
+        }
+    }
+
+    #[test]
+    fn unreadable_sources_and_unknown_origins_preserve_cached_edits_and_warn() {
+        for bytes in [fixture(b"invalid image", 0), fixture(&png(), 1)] {
+            let doc = crate::read(&bytes, crate::Limits::default()).unwrap();
+            assert!(doc.warnings.iter().any(|w| w == "pixel layers drawn from an embedded image (left empty) (4×)"));
+            let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
+            let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
+            assert_eq!(&pixels[..4], &[0, 0, 0, 0]);
+            assert_eq!(&pixels[6 * 4..7 * 4], &[200, 10, 30, 255]);
+        }
+    }
+
+    #[test]
+    fn embedded_source_dimensions_and_pixel_budget_are_checked_before_decode() {
+        let bytes = png();
+        assert!(matches!(source_pixels(&bytes, 299, 2), Err(Error::Malformed(_))));
+        assert!(matches!(source_pixels(&bytes, u32::MAX, u32::MAX), Err(Error::Limit(_))));
+        assert_eq!(source_pixels(&bytes, 300, 2).unwrap().len(), 300 * 2 * 4);
+    }
+}

crates/affinity/src/shapes.rs

@@ -0,0 +1,267 @@
+//! Parametric shapes: Affinity stores the shape's parameters and its box, never the outline.
+//! Formulas were fitted to Affinity's own renders (the document thumbnails) of public files.
+
+use std::f64::consts::{FRAC_PI_2, PI, TAU};
+
+use crate::model::{Affine, Path, Point, Reader, SubPath};
+use crate::stream::{ObjId, Tag, Value};
+
+/// Handle length of a quarter circle of radius 1.
+const KAPPA: f64 = 0.552_284_749_830_793_4;
+/// Vertices of a polygon or star.
+const MAX_SIDES: i64 = 10_000;
+
+/// The last value of a tag: a shape changed from one kind to another keeps a stale first block.
+fn last<'a>(r: &'a Reader, id: ObjId, tag: &[u8; 4]) -> Option<&'a Value> {
+    let t = Tag::of(tag);
+    r.s.object(id)?.fields.iter().rev().find(|(k, _)| *k == t).map(|(_, v)| v)
+}
+
+fn num(r: &Reader, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
+    match last(r, id, tag)? {
+        Value::Float(f) if f.is_finite() => Some(*f),
+        Value::UInt(u) => Some(*u as f64),
+        Value::Int(i) => Some(*i as f64),
+        _ => None,
+    }
+}
+
+fn sides(r: &Reader, id: ObjId, tag: &[u8; 4], default: f64) -> usize {
+    let n = num(r, id, tag).unwrap_or(default).round();
+    n.clamp(3.0, MAX_SIDES as f64) as usize
+}
+
+fn pt(x: f64, y: f64) -> Point {
+    Point { x, y }
+}
+
+fn polygon(pts: impl IntoIterator<Item = Point>) -> Option<SubPath> {
+    let mut it = pts.into_iter();
+    let start = it.next()?;
+    let segments = it.map(|p| [p, p, p]).collect();
+    Some(SubPath { start, segments, closed: true })
+}
+
+/// Outline of `shape` (a `Shpe` object) in the node box `b` = (x0, y0, x1, y1).
+pub(crate) fn shape(r: &mut Reader, shape: ObjId, b: [f64; 4], world: Affine) -> Option<Path> {
+    let [x0, y0, x1, y1] = b;
+    let (w, h) = (x1 - x0, y1 - y0);
+    let (cx, cy, rx, ry) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, w / 2.0, h / 2.0);
+    let on_ellipse = |a: f64, f: f64| pt(cx + f * rx * a.cos(), cy + f * ry * a.sin());
+    let class = r.s.class(shape)?;
+    let sub = match &class.0.to_be_bytes() {
+        b"ShNR" | b"ShRR" => {
+            let rounded = matches!(last(r, shape, b"CTyp"), Some(Value::Array(a)) if !a.is_empty());
+            let radius = match last(r, shape, b"ShCR") {
+                Some(Value::Floats(v)) => v.first().copied().filter(|f| f.is_finite() && *f > 0.0),
+                _ => None,
+            };
+            if let (true, Some(f)) = (rounded, radius) {
+                if let Some(Value::Array(types)) = last(r, shape, b"CTyp")
+                    && types.iter().any(|t| !matches!(t, Value::Enum { id: 0 | 4, .. }))
+                {
+                    r.warn("rectangles with straight, concave or other corner types (imported with round corners)");
+                }
+                let (crx, cry) = if r.s.bool(shape, b"AbSz") == Some(true) {
+                    // An absolute radius is in document pixels, whatever the node's scale.
+                    let [a, b2, c, d, ..] = world.0;
+                    let (sx, sy) = ((a * a + b2 * b2).sqrt(), (c * c + d * d).sqrt());
+                    if sx > 0.0 && sy > 0.0 { (f / sx, f / sy) } else { (0.0, 0.0) }
+                } else {
+                    (f * w.min(h), f * w.min(h))
+                };
+                rounded_rect(b, crx.min(w / 2.0), cry.min(h / 2.0))
+            } else {
+                polygon([pt(x0, y0), pt(x1, y0), pt(x1, y1), pt(x0, y1)])?
+            }
+        }
+        b"ShpE" => ellipse(cx, cy, rx, ry),
+        b"ShPy" => {
+            let n = sides(r, shape, b"Side", 5.0);
+            let a = |i: usize| -FRAC_PI_2 + TAU * i as f64 / n as f64;
+            if r.s.object(shape).is_some_and(|_| matches!(last(r, shape, b"Smth"), Some(Value::Bool(true)))) {
+                // Smoothed: tangent handles of length curv·4/3·tan(π/2n) along the inscribed ellipse.
+                let k = num(r, shape, b"Curv").unwrap_or(0.0) * 4.0 / 3.0 * (PI / (2.0 * n as f64)).tan();
+                let v = |i: usize| on_ellipse(a(i), 1.0);
+                let t = |i: usize| pt(-rx * a(i).sin(), ry * a(i).cos());
+                let segments = (0..n)
+                    .map(|i| {
+                        let (p, q, tp, tq) = (v(i), v(i + 1), t(i), t(i + 1));
+                        [pt(p.x + k * tp.x, p.y + k * tp.y), pt(q.x - k * tq.x, q.y - k * tq.y), q]
+                    })
+                    .collect();
+                SubPath { start: v(0), segments, closed: true }
+            } else {
+                polygon((0..n).map(|i| on_ellipse(a(i), 1.0)))?
+            }
+        }
+        b"ShSt" => {
+            let n = sides(r, shape, b"Pnts", 5.0);
+            let q = num(r, shape, b"IRad").unwrap_or(0.382).clamp(0.0, 1.0);
+            if [b"CrcI", b"CrcO", b"CrvL", b"CrvR"].iter().any(|t| num(r, shape, t).is_some_and(|v| v.abs() > 1e-9)) {
+                r.warn("stars with rounded or curved points (imported with sharp points)");
+            }
+            polygon((0..2 * n).map(|i| on_ellipse(-FRAC_PI_2 + PI * i as f64 / n as f64, if i % 2 == 0 { 1.0 } else { q })))?
+        }
+        b"ShSS" => {
+            let n = sides(r, shape, b"Side", 5.0);
+            let ri = num(r, shape, b"COut").unwrap_or(0.5).clamp(0.0, 1.0);
+            let step = PI / n as f64;
+            let (l, hw, inner) = (step.cos(), ri * step.sin(), ri * step.cos());
+            polygon((0..n).flat_map(|k| {
+                let phi = -FRAC_PI_2 + step + TAU * k as f64 / n as f64;
+                let (c, s) = (phi.cos(), phi.sin());
+                [(inner, -hw), (l, -hw), (l, hw), (inner, hw)].map(|(u, v)| pt(cx + rx * (u * c - v * s), cy + ry * (u * s + v * c)))
+            }))?
+        }
+        b"ShPi" => {
+            let raw_start = num(r, shape, b"AngS").unwrap_or(0.0);
+            let raw_end = num(r, shape, b"AngE").unwrap_or(TAU);
+            // Normalize in constant time. Repeatedly adding TAU can hang on finite values
+            // large enough that floating-point addition no longer changes the endpoint.
+            let start = raw_start.rem_euclid(TAU);
+            let delta = raw_end - raw_start;
+            let sweep = if raw_end >= raw_start {
+                delta.min(TAU)
+            } else if delta.is_finite() {
+                delta.rem_euclid(TAU)
+            } else {
+                (raw_end.rem_euclid(TAU) - start).rem_euclid(TAU)
+            };
+            let inner = num(r, shape, b"IRad").unwrap_or(0.0).clamp(0.0, 1.0);
+            pie(cx, cy, rx, ry, start, start + sweep, inner)
+        }
+        b"ShpT" => {
+            let p = num(r, shape, b"Pos ").unwrap_or(0.5);
+            polygon([pt(x0 + p * w, y0), pt(x1, y1), pt(x0, y1)])?
+        }
+        b"ShTz" => {
+            let (l, rr) = (num(r, shape, b"PosL").unwrap_or(0.25), num(r, shape, b"PosR").unwrap_or(0.75));
+            polygon([pt(x0 + l * w, y0), pt(x0 + rr * w, y0), pt(x1, y1), pt(x0, y1)])?
+        }
+        _ => {
+            r.warn("cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse)");
+            ellipse(cx, cy, rx, ry)
+        }
+    };
+    Some(Path { subpaths: vec![sub] })
+}
+
+pub(crate) fn rectangle(x0: f64, y0: f64, x1: f64, y1: f64) -> SubPath {
+    SubPath { start: pt(x0, y0), segments: [pt(x1, y0), pt(x1, y1), pt(x0, y1)].map(|p| [p, p, p]).to_vec(), closed: true }
+}
+
+fn ellipse(cx: f64, cy: f64, rx: f64, ry: f64) -> SubPath {
+    let (kx, ky) = (KAPPA * rx, KAPPA * ry);
+    SubPath {
+        start: pt(cx + rx, cy),
+        segments: vec![
+            [pt(cx + rx, cy + ky), pt(cx + kx, cy + ry), pt(cx, cy + ry)],
+            [pt(cx - kx, cy + ry), pt(cx - rx, cy + ky), pt(cx - rx, cy)],
+            [pt(cx - rx, cy - ky), pt(cx - kx, cy - ry), pt(cx, cy - ry)],
+            [pt(cx + kx, cy - ry), pt(cx + rx, cy - ky), pt(cx + rx, cy)],
+        ],
+        closed: true,
+    }
+}
+
+fn rounded_rect([x0, y0, x1, y1]: [f64; 4], rx: f64, ry: f64) -> SubPath {
+    let (kx, ky) = ((1.0 - KAPPA) * rx, (1.0 - KAPPA) * ry);
+    SubPath {
+        start: pt(x0 + rx, y0),
+        segments: vec![
+            [pt(x1 - rx, y0), pt(x1 - rx, y0), pt(x1 - rx, y0)],
+            [pt(x1 - kx, y0), pt(x1, y0 + ky), pt(x1, y0 + ry)],
+            [pt(x1, y1 - ry), pt(x1, y1 - ry), pt(x1, y1 - ry)],
+            [pt(x1, y1 - ky), pt(x1 - kx, y1), pt(x1 - rx, y1)],
+            [pt(x0 + rx, y1), pt(x0 + rx, y1), pt(x0 + rx, y1)],
+            [pt(x0 + kx, y1), pt(x0, y1 - ky), pt(x0, y1 - ry)],
+            [pt(x0, y0 + ry), pt(x0, y0 + ry), pt(x0, y0 + ry)],
+            [pt(x0, y0 + ky), pt(x0 + kx, y0), pt(x0 + rx, y0)],
+        ],
+        closed: true,
+    }
+}
+
+/// Elliptical arc from angle `a0` to `a1` (radians, measured y-up as Affinity's pie angles are),
+/// as cubic segments of at most a quarter turn.
+fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, out: &mut Vec<[Point; 3]>) {
+    let n = ((a1 - a0).abs() / FRAC_PI_2).ceil().clamp(1.0, 8.0) as usize;
+    let step = (a1 - a0) / n as f64;
+    let k = 4.0 / 3.0 * (step / 4.0).tan();
+    let p = |a: f64| pt(cx + rx * a.cos(), cy - ry * a.sin());
+    let d = |a: f64| pt(-rx * a.sin(), -ry * a.cos());
+    for i in 0..n {
+        let (s, e) = (a0 + step * i as f64, a0 + step * (i + 1) as f64);
+        let (ps, pe, ds, de) = (p(s), p(e), d(s), d(e));
+        out.push([pt(ps.x + k * ds.x, ps.y + k * ds.y), pt(pe.x - k * de.x, pe.y - k * de.y), pe]);
+    }
+}
+
+fn pie(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, inner: f64) -> SubPath {
+    let start = pt(cx + rx * a0.cos(), cy - ry * a0.sin());
+    let mut segments = Vec::new();
+    arc(cx, cy, rx, ry, a0, a1, &mut segments);
+    if inner > 0.0 {
+        let p = pt(cx + inner * rx * a1.cos(), cy - inner * ry * a1.sin());
+        segments.push([p, p, p]);
+        arc(cx, cy, inner * rx, inner * ry, a1, a0, &mut segments);
+    } else {
+        let c = pt(cx, cy);
+        segments.push([c, c, c]);
+    }
+    SubPath { start, segments, closed: true }
+}
+
+/// A polyline with circular corners of the given radii (Affinity's live corners on curves).
+pub(crate) fn fillet(pts: &[(Point, f64)], closed: bool) -> SubPath {
+    let n = pts.len();
+    let get = |i: isize| -> Option<Point> {
+        if closed { pts.get(i.rem_euclid(n as isize) as usize).map(|p| p.0) } else { usize::try_from(i).ok().and_then(|i| pts.get(i)).map(|p| p.0) }
+    };
+    let mut corners: Vec<(Point, Point, Point, Point)> = Vec::with_capacity(n);
+    for (i, (p, radius)) in pts.iter().enumerate() {
+        let (prev, next) = (get(i as isize - 1), get(i as isize + 1));
+        let (Some(a), Some(b)) = (prev, next) else {
+            corners.push((*p, *p, *p, *p));
+            continue;
+        };
+        let (u1, l1) = unit(*p, a);
+        let (u2, l2) = unit(*p, b);
+        let cos = (u1.x * u2.x + u1.y * u2.y).clamp(-1.0, 1.0);
+        let phi = cos.acos();
+        if *radius <= 0.0 || phi < 1e-6 || (PI - phi) < 1e-6 {
+            corners.push((*p, *p, *p, *p));
+            continue;
+        }
+        let t = (radius / (phi / 2.0).tan()).min(l1 / 2.0).min(l2 / 2.0);
+        let r = t * (phi / 2.0).tan();
+        let k = 4.0 / 3.0 * ((PI - phi) / 4.0).tan() * r;
+        let s = pt(p.x + u1.x * t, p.y + u1.y * t);
+        let e = pt(p.x + u2.x * t, p.y + u2.y * t);
+        corners.push((s, pt(s.x - u1.x * k, s.y - u1.y * k), pt(e.x - u2.x * k, e.y - u2.y * k), e));
+    }
+    let Some(first) = corners.first().copied() else { return SubPath { start: pt(0.0, 0.0), segments: vec![], closed } };
+    let mut segments = Vec::with_capacity(2 * n);
+    let mut cur = first.0;
+    let start = cur;
+    for (i, (s, c1, c2, e)) in corners.iter().enumerate() {
+        if i > 0 {
+            segments.push([cur, *s, *s]);
+        }
+        if s != e {
+            segments.push([*c1, *c2, *e]);
+        }
+        cur = *e;
+    }
+    if closed && cur != start {
+        segments.push([cur, start, start]);
+    }
+    SubPath { start, segments, closed }
+}
+
+fn unit(from: Point, to: Point) -> (Point, f64) {
+    let (dx, dy) = (to.x - from.x, to.y - from.y);
+    let l = (dx * dx + dy * dy).sqrt();
+    if l > 0.0 { (pt(dx / l, dy / l), l) } else { (pt(0.0, 0.0), 0.0) }
+}

crates/affinity/src/stream.rs

@@ -0,0 +1,402 @@
+//! The tagged object stream inside `doc.dat`: a self-describing tree of objects whose fields carry
+//! a type code and a four-character tag. Parsing needs no schema; unknown fields are kept, so the
+//! document mapping can name what it could not import.
+
+use crate::Error;
+use crate::container::Cursor;
+
+/// A four-character tag in its readable order (`Desc`, `Chld`).
+#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct Tag(pub u32);
+
+impl Tag {
+    pub const fn of(s: &[u8; 4]) -> Self {
+        Self(u32::from_be_bytes(*s))
+    }
+}
+
+impl std::fmt::Debug for Tag {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", String::from_utf8_lossy(&self.0.to_be_bytes()))
+    }
+}
+
+impl std::fmt::Display for Tag {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Debug::fmt(self, f)
+    }
+}
+
+/// Index of an object in [`Stream::objects`].
+pub type ObjId = usize;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Value {
+    Int(i64),
+    UInt(u64),
+    Float(f64),
+    Bool(bool),
+    Enum {
+        id: u16,
+        version: u16,
+    },
+    Str(String),
+    /// Fixed-length vectors of i32/f32/f64 (points, rectangles, transforms).
+    Ints(Vec<i64>),
+    Floats(Vec<f64>),
+    /// Fixed-size record (curve nodes, ids) or fixed-size struct (colour components).
+    Bytes(Vec<u8>),
+    Blob(Vec<u8>),
+    /// Name of another archive entry (raster tiles, embedded files).
+    Entry(String),
+    Flags(u64),
+    /// `None` is a null object.
+    Obj(Option<ObjId>),
+    Array(Vec<Value>),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Kind {
+    Root,
+    /// Defined once and referenced by id elsewhere.
+    Shared,
+    Inline,
+    /// Untagged fields identified by position (curve data).
+    Positional,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Object {
+    pub class: Tag,
+    pub kind: Kind,
+    /// Class chain, most derived first (`ShpN`, `VNod`, `Node`).
+    pub chain: Vec<Tag>,
+    /// Fields in stream order; positional fields have tag 0.
+    pub fields: Vec<(Tag, Value)>,
+}
+
+impl Object {
+    pub fn get(&self, tag: Tag) -> Option<&Value> {
+        self.fields.iter().find(|(t, _)| *t == tag).map(|(_, v)| v)
+    }
+}
+
+#[derive(Debug)]
+pub struct Stream {
+    pub root: ObjId,
+    pub objects: Vec<Object>,
+}
+
+/// Deepest object nesting accepted; real documents stay well below (each layer level adds three).
+pub const MAX_DEPTH: usize = 384;
+
+const MAX_OBJECTS: usize = 8_000_000;
+
+/// Most values (fields and array elements) one stream may decode. A value takes about 40 bytes
+/// in memory however few it took in the file (a bool array packs eight in a byte), so the size
+/// of the input alone doesn't bound what parsing allocates: a small compressed entry could
+/// otherwise ask for tens of gigabytes. Real documents stay far below.
+pub const MAX_VALUES: usize = 1 << 24;
+
+struct Parser<'a> {
+    c: Cursor<'a>,
+    objects: Vec<Object>,
+    /// Shared ids, defined at first use and referenced backwards.
+    shared: std::collections::HashMap<u32, ObjId>,
+    depth: usize,
+    /// Values decoded so far, against [`MAX_VALUES`].
+    values: usize,
+}
+
+/// Parse a stream (`00 FF 4B 53` header). Bytes after the root's terminator are ignored.
+pub fn parse(bytes: &[u8]) -> Result<Stream, Error> {
+    let mut c = Cursor::new(bytes, 0);
+    if c.take(4)? != b"\x00\xffKS" {
+        return Err(Error::Malformed("document stream signature"));
+    }
+    let version = c.u16()?;
+    if version > 2 {
+        return Err(Error::Unsupported("document stream version"));
+    }
+    let class = Tag(c.u32()?);
+    c.u16()?;
+    if version == 2 {
+        c.u32()?;
+    }
+    let mut p = Parser { c, objects: Vec::new(), shared: std::collections::HashMap::new(), depth: 0, values: 0 };
+    let root = p.push(Object { class, kind: Kind::Root, chain: vec![class], fields: Vec::new() })?;
+    let fields = p.fields(true, class)?;
+    if let Some(o) = p.objects.get_mut(root) {
+        o.fields = fields;
+    }
+    Ok(Stream { root, objects: p.objects })
+}
+
+impl Parser<'_> {
+    fn push(&mut self, o: Object) -> Result<ObjId, Error> {
+        if self.objects.len() >= MAX_OBJECTS {
+            return Err(Error::Limit("too many objects"));
+        }
+        self.objects.push(o);
+        Ok(self.objects.len() - 1)
+    }
+
+    /// Counts `n` more values against [`MAX_VALUES`], before anything is allocated for them.
+    fn spend(&mut self, n: usize) -> Result<(), Error> {
+        self.values = self.values.checked_add(n).filter(|&v| v <= MAX_VALUES).ok_or(Error::Limit("too many values in the document stream"))?;
+        Ok(())
+    }
+
+    /// An empty array with room for `n` values, paid for first; an allocation that still fails
+    /// is an error, not an abort.
+    fn vec<T>(&mut self, n: usize) -> Result<Vec<T>, Error> {
+        self.spend(n)?;
+        let mut v = Vec::new();
+        v.try_reserve_exact(n).map_err(|_| Error::Limit("not enough memory for the document stream"))?;
+        Ok(v)
+    }
+
+    /// Element count of an array: each element takes at least `min` bytes, so a count the
+    /// remaining input cannot hold is rejected before anything is allocated.
+    fn count(&mut self, min: usize) -> Result<usize, Error> {
+        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+        if n.checked_mul(min.max(1)).is_none_or(|bytes| bytes > self.c.remaining()) {
+            return Err(Error::Malformed("array longer than its data"));
+        }
+        Ok(n)
+    }
+
+    fn fields(&mut self, tagged: bool, class: Tag) -> Result<Vec<(Tag, Value)>, Error> {
+        self.depth += 1;
+        if self.depth > MAX_DEPTH {
+            return Err(Error::Limit("objects nested too deeply"));
+        }
+        let mut out = Vec::new();
+        loop {
+            let t = self.c.u8()?;
+            let code = t & 0x7F;
+            if code == 0 {
+                break;
+            }
+            self.spend(1)?;
+            let tag = if tagged { Tag(self.c.u32()?) } else { Tag(0) };
+            let v = if t & 0x80 != 0 { self.array(code, class)? } else { self.scalar(code, tagged, class)? };
+            out.push((tag, v));
+        }
+        self.depth -= 1;
+        Ok(out)
+    }
+
+    fn string(&mut self) -> Result<String, Error> {
+        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("string length"))?;
+        Ok(String::from_utf8_lossy(self.c.take(n)?).into_owned())
+    }
+
+    fn floats(&mut self, n: usize, wide: bool) -> Result<Value, Error> {
+        let mut v = Vec::with_capacity(n);
+        for _ in 0..n {
+            v.push(if wide { f64::from_le_bytes(self.c.array()?) } else { f64::from(f32::from_le_bytes(self.c.array()?)) });
+        }
+        Ok(Value::Floats(v))
+    }
+
+    fn scalar(&mut self, code: u8, tagged: bool, class: Tag) -> Result<Value, Error> {
+        let c = &mut self.c;
+        Ok(match code {
+            0x01 => Value::UInt(c.u8()?.into()),
+            0x02 => Value::UInt(c.u16()?.into()),
+            0x03 | 0x2f | 0x34 => Value::UInt(c.u32()?.into()),
+            0x04 => Value::UInt(c.u64()?),
+            0x05 => Value::Int(i8::from_le_bytes(c.array()?).into()),
+            0x06 => Value::Int(i16::from_le_bytes(c.array()?).into()),
+            0x07 => Value::Int(i32::from_le_bytes(c.array()?).into()),
+            0x08 => Value::Int(i64::from_le_bytes(c.array()?)),
+            0x09 => Value::Float(f32::from_le_bytes(c.array()?).into()),
+            0x0a => Value::Float(f64::from_le_bytes(c.array()?)),
+            0x15..=0x19 => {
+                let n = usize::from(code - 0x13);
+                let mut v = Vec::with_capacity(n);
+                for _ in 0..n {
+                    v.push(i32::from_le_bytes(c.array()?).into());
+                }
+                Value::Ints(v)
+            }
+            0x1f..=0x23 => return self.floats(usize::from(code - 0x1d), false),
+            0x24..=0x28 => return self.floats(usize::from(code - 0x22), true),
+            0x29 => Value::Bool(c.u8()? != 0),
+            0x2a => Value::Enum { id: c.u16()?, version: c.u16()? },
+            0x2b | 0x2e => Value::Str(self.string()?),
+            0x2c => {
+                let n = usize::from(c.u16()?);
+                Value::Bytes(c.take(n)?.to_vec())
+            }
+            0x35..=0x74 => Value::Bytes(c.take(usize::from(code - 0x34))?.to_vec()),
+            0x2d => {
+                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("blob length"))?;
+                Value::Blob(c.take(n)?.to_vec())
+            }
+            0x33 => {
+                c.u32()?;
+                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("entry name length"))?;
+                Value::Entry(String::from_utf8_lossy(c.take(n)?).into_owned())
+            }
+            0x75 => {
+                c.u16()?;
+                let n = usize::from(c.u8()?);
+                if n > 8 {
+                    return Err(Error::Malformed("flags wider than 64 bits"));
+                }
+                let mut b = [0u8; 8];
+                b.get_mut(..n).ok_or(Error::Malformed("flags"))?.copy_from_slice(c.take(n)?);
+                Value::Flags(u64::from_le_bytes(b))
+            }
+            0x30 => {
+                let fields = self.fields(false, class)?;
+                let id = self.push(Object { class, kind: Kind::Positional, chain: Vec::new(), fields })?;
+                Value::Obj(Some(id))
+            }
+            0x31 | 0x32 if !tagged => return Err(Error::Malformed("object without a field tag")),
+            0x31 => self.shared()?,
+            0x32 => self.inline(None)?,
+            _ => return Err(Error::Unsupported("unknown field type in document stream")),
+        })
+    }
+
+    fn array(&mut self, code: u8, class: Tag) -> Result<Value, Error> {
+        let min = match code {
+            0x01 | 0x05 | 0x29 => 1,
+            0x02 | 0x06 => 2,
+            0x03 | 0x07 | 0x09 | 0x2f | 0x34 => 4,
+            0x04 | 0x08 | 0x0a => 8,
+            0x15..=0x19 => 4 * usize::from(code - 0x13),
+            0x1f..=0x23 => 4 * usize::from(code - 0x1d),
+            0x24..=0x28 => 8 * usize::from(code - 0x22),
+            0x35..=0x74 => usize::from(code - 0x34),
+            _ => 1,
+        };
+        match code {
+            0x29 => {
+                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+                let bits = self.c.take(n.div_ceil(8))?;
+                let mut v = self.vec(n)?;
+                v.extend((0..n).map(|i| Value::Bool(bits.get(i / 8).is_some_and(|b| b >> (i % 8) & 1 != 0))));
+                Ok(Value::Array(v))
+            }
+            0x2a => {
+                let n = self.count(2)?;
+                let version = self.c.u16()?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Enum { id: self.c.u16()?, version });
+                }
+                Ok(Value::Array(v))
+            }
+            0x2b | 0x2e => {
+                self.c.u32()?;
+                let n = self.count(4)?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Str(self.string()?));
+                }
+                Ok(Value::Array(v))
+            }
+            0x2c => {
+                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+                let size = usize::from(self.c.u16()?);
+                if n.checked_mul(size).is_none_or(|b| b > self.c.remaining()) {
+                    return Err(Error::Malformed("array longer than its data"));
+                }
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Bytes(self.c.take(size)?.to_vec()));
+                }
+                Ok(Value::Array(v))
+            }
+            0x32 => {
+                let n = self.count(1)?;
+                let class = Tag(self.c.u32()?);
+                self.c.u16()?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(self.inline(Some(class))?);
+                }
+                Ok(Value::Array(v))
+            }
+            0x2d | 0x33 | 0x75 => Err(Error::Malformed("array of an unarrayable type")),
+            _ => {
+                let n = self.count(min)?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(self.scalar(code, true, class)?);
+                }
+                Ok(Value::Array(v))
+            }
+        }
+    }
+
+    /// Inline object; `class` is given once for a whole array of them.
+    fn inline(&mut self, class: Option<Tag>) -> Result<Value, Error> {
+        match self.c.u8()? {
+            0 => return Ok(Value::Obj(None)),
+            1 => {}
+            _ => return Err(Error::Malformed("object marker")),
+        }
+        let class = match class {
+            Some(c) => c,
+            None => {
+                let c = Tag(self.c.u32()?);
+                self.c.u16()?;
+                c
+            }
+        };
+        let fields = self.fields(true, class)?;
+        let id = self.push(Object { class, kind: Kind::Inline, chain: vec![class], fields })?;
+        Ok(Value::Obj(Some(id)))
+    }
+
+    fn shared(&mut self) -> Result<Value, Error> {
+        let flag = self.c.u8()?;
+        if flag == 0 {
+            return Ok(Value::Obj(None));
+        }
+        let key = self.c.u32()?;
+        match flag {
+            2 => return self.shared.get(&key).map(|id| Value::Obj(Some(*id))).ok_or(Error::Malformed("reference to an undefined object")),
+            1 => {}
+            _ => return Err(Error::Malformed("object marker")),
+        }
+        if self.shared.contains_key(&key) {
+            return Err(Error::Malformed("object defined twice"));
+        }
+        // Register before the fields: an object's own fields may refer back to it.
+        let id = self.push(Object { class: Tag(0), kind: Kind::Shared, chain: Vec::new(), fields: Vec::new() })?;
+        self.shared.insert(key, id);
+        let mut chain = Vec::new();
+        let mut fields = Vec::new();
+        loop {
+            match self.c.u8()? {
+                0 => {
+                    let tag = Tag(self.c.u32()?);
+                    self.c.u16()?;
+                    chain.push(tag);
+                    fields.extend(self.fields(true, tag)?);
+                }
+                1 => {
+                    chain.push(Tag(self.c.u32()?));
+                    break;
+                }
+                2 => break,
+                _ => return Err(Error::Malformed("object class chain")),
+            }
+            if chain.len() > 64 {
+                return Err(Error::Limit("object class chain too long"));
+            }
+        }
+        let class = chain.first().copied().unwrap_or(Tag(0));
+        fields.extend(self.fields(true, class)?);
+        if let Some(o) = self.objects.get_mut(id) {
+            *o = Object { class, kind: Kind::Shared, chain, fields };
+        }
+        Ok(Value::Obj(Some(id)))
+    }
+}

crates/affinity/src/synth.rs

@@ -0,0 +1,259 @@
+//! Synthetic containers for tests and fuzz seeds (cargo feature `synth`).
+//!
+//! These builders write the layout the reader accepts, so tests can describe documents in a few
+//! lines. They are **not** an Affinity exporter: nothing written here has been opened in Affinity.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use crate::stream::Tag;
+
+/// A field value to encode.
+#[derive(Debug, Clone)]
+pub enum F {
+    U8(u8),
+    U32(u32),
+    I32(i32),
+    F32(f32),
+    F64(f64),
+    Bool(bool),
+    Enum(u16, u16),
+    Str(String),
+    /// f64 vector of 2..6 values (points, rectangles, transforms).
+    F64s(Vec<f64>),
+    /// Fixed-size struct (colour components), 1..64 bytes.
+    Struct(Vec<u8>),
+    /// Array of fixed-size records, all `size` bytes.
+    Records(u16, Vec<Vec<u8>>),
+    U8s(Vec<u8>),
+    Entry(String),
+    /// Shared object: `Def` defines id with class chain and fields, `Ref` links back.
+    Def(u32, Vec<Tag>, Vec<(Tag, F)>),
+    Ref(u32),
+    Null,
+    /// Inline object.
+    Obj(Tag, Vec<(Tag, F)>),
+    /// Positional (untagged) object.
+    Pos(Vec<F>),
+    /// Array of shared objects / links.
+    Shared(Vec<F>),
+    /// Array of inline objects of one class.
+    Objs(Tag, Vec<Vec<(Tag, F)>>),
+    /// Raw bytes appended verbatim (malformed-input tests).
+    Raw(Vec<u8>),
+}
+
+pub fn tag(s: &[u8; 4]) -> Tag {
+    Tag::of(s)
+}
+
+fn put_tag(out: &mut Vec<u8>, t: Tag) {
+    out.extend(t.0.to_le_bytes());
+}
+
+fn code(f: &F) -> u8 {
+    match f {
+        F::U8(_) => 0x01,
+        F::U32(_) => 0x03,
+        F::I32(_) => 0x07,
+        F::F32(_) => 0x09,
+        F::F64(_) => 0x0a,
+        F::Bool(_) => 0x29,
+        F::Enum(..) => 0x2a,
+        F::Str(_) => 0x2b,
+        F::F64s(v) => 0x22 + v.len() as u8,
+        F::Struct(b) => 0x34 + b.len() as u8,
+        F::Records(..) => 0x80 | 0x2c,
+        F::U8s(_) => 0x80 | 0x01,
+        F::Entry(_) => 0x33,
+        F::Def(..) | F::Ref(_) => 0x31,
+        F::Null => 0x31,
+        F::Obj(..) => 0x32,
+        F::Pos(_) => 0x30,
+        F::Shared(_) => 0x80 | 0x31,
+        F::Objs(..) => 0x80 | 0x32,
+        F::Raw(_) => 0,
+    }
+}
+
+fn payload(out: &mut Vec<u8>, f: &F) {
+    match f {
+        F::U8(v) => out.push(*v),
+        F::U32(v) => out.extend(v.to_le_bytes()),
+        F::I32(v) => out.extend(v.to_le_bytes()),
+        F::F32(v) => out.extend(v.to_le_bytes()),
+        F::F64(v) => out.extend(v.to_le_bytes()),
+        F::Bool(v) => out.push(u8::from(*v)),
+        F::Enum(id, ver) => {
+            out.extend(id.to_le_bytes());
+            out.extend(ver.to_le_bytes());
+        }
+        F::Str(s) => {
+            out.extend((s.len() as u32).to_le_bytes());
+            out.extend(s.as_bytes());
+        }
+        F::F64s(v) => v.iter().for_each(|x| out.extend(x.to_le_bytes())),
+        F::Struct(b) => out.extend(b),
+        F::Records(size, recs) => {
+            out.extend((recs.len() as u32).to_le_bytes());
+            out.extend(size.to_le_bytes());
+            recs.iter().for_each(|r| out.extend(r));
+        }
+        F::U8s(v) => {
+            out.extend((v.len() as u32).to_le_bytes());
+            out.extend(v);
+        }
+        F::Entry(name) => {
+            put_tag(out, tag(b"Data"));
+            out.extend((name.len() as u32).to_le_bytes());
+            out.extend(name.as_bytes());
+        }
+        F::Def(id, chain, fields) => {
+            out.push(1);
+            out.extend(id.to_le_bytes());
+            // Class chain: each level but the last carries no fields here; the last ends the chain.
+            let (last, rest) = chain.split_last().expect("class chain");
+            for t in rest {
+                out.push(0);
+                put_tag(out, *t);
+                out.extend(0u16.to_le_bytes());
+                out.push(0);
+            }
+            out.push(1);
+            put_tag(out, *last);
+            fields_into(out, fields, true);
+        }
+        F::Ref(id) => {
+            out.push(2);
+            out.extend(id.to_le_bytes());
+        }
+        F::Null => out.push(0),
+        F::Obj(class, fields) => {
+            out.push(1);
+            put_tag(out, *class);
+            out.extend(0u16.to_le_bytes());
+            fields_into(out, fields, true);
+        }
+        F::Pos(items) => {
+            for f in items {
+                out.push(code(f));
+                payload(out, f);
+            }
+            out.push(0);
+        }
+        F::Shared(items) => {
+            out.extend((items.len() as u32).to_le_bytes());
+            items.iter().for_each(|f| payload(out, f));
+        }
+        F::Objs(class, items) => {
+            out.extend((items.len() as u32).to_le_bytes());
+            put_tag(out, *class);
+            out.extend(0u16.to_le_bytes());
+            for fields in items {
+                out.push(1);
+                fields_into(out, fields, true);
+            }
+        }
+        F::Raw(b) => out.extend(b),
+    }
+}
+
+fn fields_into(out: &mut Vec<u8>, fields: &[(Tag, F)], tagged: bool) {
+    for (t, f) in fields {
+        if let F::Raw(b) = f {
+            out.extend(b);
+            continue;
+        }
+        out.push(code(f));
+        if tagged {
+            put_tag(out, *t);
+        }
+        payload(out, f);
+    }
+    out.push(0);
+}
+
+/// A `doc.dat` stream with root class `Pers`.
+pub fn stream(root: &[(Tag, F)]) -> Vec<u8> {
+    let mut out = b"\x00\xffKS".to_vec();
+    out.extend(2u16.to_le_bytes());
+    put_tag(&mut out, tag(b"Pers"));
+    out.extend(0u16.to_le_bytes());
+    out.extend(30u32.to_le_bytes());
+    fields_into(&mut out, root, true);
+    out
+}
+
+/// How an entry is stored.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Method {
+    Stored,
+    Zlib,
+    Zstd,
+}
+
+/// A version-12 container with one `#FT4` table holding `entries`, then an optional thumbnail record.
+pub fn container(entries: &[(&str, &[u8], Method)], thumbnail_png: Option<&[u8]>) -> Vec<u8> {
+    let mut out = vec![0u8; 72];
+    out[..4].copy_from_slice(crate::container::MAGIC);
+    out[4..6].copy_from_slice(&12u16.to_le_bytes());
+    out[6..8].copy_from_slice(&4u16.to_le_bytes());
+    out[8..12].copy_from_slice(b"nsrP");
+    out[12..16].copy_from_slice(b"#Inf");
+    out[64..68].copy_from_slice(b"Prot");
+    let mut records = Vec::new();
+    for (i, (name, data, method)) in entries.iter().enumerate() {
+        let packed = match method {
+            Method::Stored => data.to_vec(),
+            Method::Zlib => {
+                use std::io::Write;
+                let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+                e.write_all(data).unwrap();
+                e.finish().unwrap()
+            }
+            Method::Zstd => ruzstd::encoding::compress_to_vec(*data, ruzstd::encoding::CompressionLevel::Fastest),
+        };
+        let offset = out.len() as u64;
+        out.extend(b"#Fil");
+        out.extend(&packed);
+        let mut r = Vec::new();
+        r.extend((i as u32 + 1).to_le_bytes());
+        r.push(0);
+        r.extend(offset.to_le_bytes());
+        r.extend((data.len() as u64).to_le_bytes());
+        r.extend((packed.len() as u64).to_le_bytes());
+        r.extend(crc32fast::hash(data).to_le_bytes());
+        r.push(match method {
+            Method::Stored => 0,
+            Method::Zlib => 1,
+            Method::Zstd => 2,
+        });
+        r.extend(0u32.to_le_bytes());
+        r.extend(0u32.to_le_bytes());
+        r.extend((name.len() as u16).to_le_bytes());
+        r.extend(name.as_bytes());
+        records.push(r);
+    }
+    let fat = out.len() as u64;
+    out.extend(b"#FT4");
+    out.extend(0u64.to_le_bytes());
+    out.extend(1_700_000_000u64.to_le_bytes());
+    out.extend([0u8; 24]);
+    out.extend((records.len() as u32).to_le_bytes());
+    out.extend([0u8; 8]);
+    out.extend(0u16.to_le_bytes());
+    out.push(0);
+    records.iter().for_each(|r| out.extend(r));
+    let thumb = out.len() as u64;
+    out[16..24].copy_from_slice(&fat.to_le_bytes());
+    if let Some(png) = thumbnail_png {
+        out[24..32].copy_from_slice(&thumb.to_le_bytes());
+        out.extend(b"\xff\xff\xff\xffThmb");
+        out.extend(1u32.to_le_bytes());
+        out.extend((png.len() as u32 + 13).to_le_bytes());
+        out.extend(29u32.to_le_bytes());
+        out.extend(0u32.to_le_bytes());
+        out.extend((png.len() as u32).to_le_bytes());
+        out.push(1);
+        out.extend(png);
+    }
+    out
+}

crates/affinity/src/tests.rs

@@ -0,0 +1,354 @@
+//! Unit tests on synthetic inputs; `tests/real_files.rs` covers public Affinity documents.
+
+mod preview {
+    use crate::container::header;
+    use crate::*;
+    use proptest::prelude::*;
+
+    fn fixture() -> Vec<u8> {
+        let mut png = b"\x89PNG\r\n\x1a\n".to_vec();
+        png.extend(13u32.to_be_bytes());
+        png.extend(b"IHDR");
+        png.extend(2u32.to_be_bytes());
+        png.extend(1u32.to_be_bytes());
+        png.extend([8, 6, 0, 0, 0]);
+        png.extend(crc32fast::hash(&png[12..]).to_be_bytes());
+        png.extend([0; 4]);
+        png.extend(b"IDAT");
+        png.extend(crc32fast::hash(b"IDAT").to_be_bytes());
+        png.extend([0; 4]);
+        png.extend(b"IEND");
+        png.extend(crc32fast::hash(b"IEND").to_be_bytes());
+        let mut b = vec![0; 72];
+        b[..4].copy_from_slice(MAGIC);
+        b[4..6].copy_from_slice(&12u16.to_le_bytes());
+        b[8..12].copy_from_slice(b"nsrP");
+        b[12..16].copy_from_slice(b"#Inf");
+        b[24..32].copy_from_slice(&72u64.to_le_bytes());
+        b[64..68].copy_from_slice(b"Prot");
+        b.extend(b"\xff\xff\xff\xffThmb");
+        b.extend(1u32.to_le_bytes());
+        b.extend((png.len() as u32 + 13).to_le_bytes());
+        b.extend(29u32.to_le_bytes());
+        b.extend(0u32.to_le_bytes());
+        b.extend((png.len() as u32).to_le_bytes());
+        b.push(1);
+        b.extend(png);
+        b
+    }
+
+    #[test]
+    fn indexed_preview_and_header() {
+        let b = fixture();
+        assert_eq!(header(&b).unwrap().version, 12);
+        let p = preview(&b).unwrap();
+        assert_eq!((p.width, p.height), (2, 1));
+        assert_eq!(p.png, &b[101..]);
+    }
+
+    #[test]
+    fn every_truncation_is_rejected() {
+        let b = fixture();
+        for end in 0..b.len() {
+            assert!(preview(&b[..end]).is_err(), "{end}");
+        }
+    }
+
+    #[test]
+    fn rejects_assets_versions_offsets_lengths_and_bombs() {
+        let b = fixture();
+        for (offset, value) in [
+            (4, 13u64.to_le_bytes().to_vec()),
+            (8, b"urBR".to_vec()),
+            (24, u64::MAX.to_le_bytes().to_vec()),
+            (24, 1u64.to_le_bytes().to_vec()),
+            (24, 0u64.to_le_bytes().to_vec()),
+            (84, u32::MAX.to_le_bytes().to_vec()),
+            (88, 30u32.to_le_bytes().to_vec()),
+            (96, u32::MAX.to_le_bytes().to_vec()),
+            (117, 5000u32.to_be_bytes().to_vec()),
+        ] {
+            let mut broken = b.clone();
+            broken[offset..offset + value.len()].copy_from_slice(&value);
+            assert!(preview(&broken).is_err(), "offset {offset}");
+        }
+        // Versions 8 to 11 store the same record (checked on public Affinity 1 and 2 files).
+        for version in 8..12 {
+            let mut legacy = b.clone();
+            legacy[4..6].copy_from_slice(&(version as u16).to_le_bytes());
+            assert!(preview(&legacy).is_ok());
+        }
+        // Flags 4 and 8 occur in real files; the low two bits mark other container variants.
+        for (flags, ok) in [(4u16, true), (8, true), (1, false), (2, false)] {
+            let mut variant = b.clone();
+            variant[6..8].copy_from_slice(&flags.to_le_bytes());
+            assert_eq!(preview(&variant).is_ok(), ok, "flags {flags}");
+        }
+        let mut old = b.clone();
+        old[4..6].copy_from_slice(&7u16.to_le_bytes());
+        assert!(matches!(preview(&old), Err(Error::Unsupported(_))));
+    }
+
+    #[test]
+    fn an_unindexed_png_or_resource_is_never_used() {
+        let mut b = fixture();
+        b[24..32].copy_from_slice(&0u64.to_le_bytes());
+        assert!(preview(&b).is_err());
+        b[24..32].copy_from_slice(&72u64.to_le_bytes());
+        b[76..80].copy_from_slice(b"Meta");
+        assert!(preview(&b).is_err());
+    }
+
+    #[test]
+    fn every_chunk_checksum_including_the_end_is_checked() {
+        let b = fixture();
+        for at in [130, b.len() - 1] {
+            let mut damaged = b.clone();
+            damaged[at] ^= 1;
+            assert_eq!(preview(&damaged).unwrap_err(), Error::Malformed("PNG chunk checksum"));
+        }
+        let mut ancillary = vec![0; 4];
+        ancillary.extend(b"tEXt");
+        ancillary.extend(crc32fast::hash(b"tEXt").to_be_bytes());
+        let mut with_ancillary = b.clone();
+        let at = b.len() - 12;
+        with_ancillary.splice(at..at, ancillary);
+        let png_length = (with_ancillary.len() - 101) as u32;
+        with_ancillary[84..88].copy_from_slice(&(png_length + 13).to_le_bytes());
+        with_ancillary[96..100].copy_from_slice(&png_length.to_le_bytes());
+        assert!(preview(&with_ancillary).is_ok());
+        with_ancillary[at + 8] ^= 1;
+        assert_eq!(preview(&with_ancillary).unwrap_err(), Error::Malformed("PNG chunk checksum"));
+    }
+
+    #[test]
+    fn compressed_metadata_and_animation_are_not_preview_support() {
+        for kind in [b"zTXt", b"iTXt", b"iCCP", b"acTL", b"fcTL", b"fdAT"] {
+            let mut extra = vec![0; 4];
+            extra.extend(kind);
+            extra.extend(crc32fast::hash(kind).to_be_bytes());
+            let mut b = fixture();
+            let at = b.len() - 12;
+            b.splice(at..at, extra);
+            let length = (b.len() - 101) as u32;
+            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
+            b[96..100].copy_from_slice(&length.to_le_bytes());
+            assert!(matches!(preview(&b), Err(Error::Unsupported(_))));
+        }
+    }
+
+    #[test]
+    fn critical_chunks_follow_a_single_complete_png_layout() {
+        fn with_chunks(kinds: &[&[u8; 4]]) -> Vec<u8> {
+            let original = fixture();
+            let mut b = original[..134].to_vec(); // File, record and complete first IHDR.
+            for kind in kinds {
+                b.extend([0; 4]);
+                b.extend(*kind);
+                b.extend(crc32fast::hash(*kind).to_be_bytes());
+            }
+            let length = (b.len() - 101) as u32;
+            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
+            b[96..100].copy_from_slice(&length.to_le_bytes());
+            b
+        }
+        assert!(preview(&with_chunks(&[b"IDAT", b"IDAT", b"IEND"])).is_ok());
+        // PNG readers must not reject an otherwise valid unknown ancillary chunk just
+        // because its reserved (third-letter) bit is set; future versions can define it.
+        assert!(preview(&with_chunks(&[b"abct", b"IDAT", b"IEND"])).is_ok());
+        for kinds in [
+            vec![b"IEND"],
+            vec![b"IDAT", b"IHDR", b"IEND"],
+            vec![b"PLTE", b"PLTE", b"IDAT", b"IEND"],
+            vec![b"IDAT", b"PLTE", b"IEND"],
+            vec![b"IDAT", b"tEXt", b"IDAT", b"IEND"],
+            vec![b"ABCD", b"IDAT", b"IEND"],
+            vec![b"IDAT", b"IEND", b"tEXt"],
+        ] {
+            assert!(preview(&with_chunks(&kinds)).is_err(), "{kinds:?}");
+        }
+    }
+
+    proptest! {
+        #![proptest_config(ProptestConfig::with_cases(256))]
+        #[test]
+        fn arbitrary_input_never_panics(b in prop::collection::vec(any::<u8>(), 0..2048)) {
+            let _ = header(&b);
+            let _ = preview(&b);
+        }
+        #[test]
+        fn mutations_never_panic(edits in prop::collection::vec((0usize..200, any::<u8>()), 0..32)) {
+            let mut b = fixture();
+            for (i, value) in edits { if let Some(v) = b.get_mut(i) { *v = value; } }
+            let _ = preview(&b);
+        }
+    }
+}
+
+mod archive {
+    use crate::Error;
+    use crate::container::{Archive, Limits};
+    use crate::stream::{self, Kind, Tag, Value};
+    use crate::synth::{self, F, Method, tag};
+    use proptest::prelude::*;
+
+    fn doc() -> Vec<u8> {
+        synth::stream(&[
+            (tag(b"Desc"), F::Str("Document".into())),
+            (tag(b"Visi"), F::Bool(true)),
+            (tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])),
+            (tag(b"Colr"), F::Def(7, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0u8; 16].to_vec()))])),
+            (tag(b"Same"), F::Ref(7)),
+            (tag(b"Null"), F::Null),
+            (tag(b"Kids"), F::Shared(vec![F::Def(8, vec![tag(b"Grup"), tag(b"Node")], vec![(tag(b"Desc"), F::Str("g".into()))]), F::Ref(8)])),
+            (
+                tag(b"Crvs"),
+                F::Obj(tag(b"PCvD"), vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(1), F::Bool(true), F::Records(18, vec![vec![0; 18]; 4])]))]),
+            ),
+            (tag(b"Enum"), F::Enum(2, 1)),
+            (tag(b"Tile"), F::Entry("d/3".into())),
+            (tag(b"Stat"), F::U8s(vec![4, 0, 2])),
+        ])
+    }
+
+    #[test]
+    fn every_method_round_trips_with_checksums() {
+        let d = doc();
+        for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+            let file = synth::container(&[("doc.dat", &d, method), ("d/3", b"tile", method)], None);
+            let mut a = Archive::open(&file, Limits::default()).unwrap();
+            assert_eq!(a.header.version, 12);
+            assert_eq!(a.read("doc.dat").unwrap(), d);
+            assert_eq!(a.read("d/3").unwrap(), b"tile");
+            assert_eq!(a.extracted(), d.len() + 4);
+            assert!(a.read("missing").is_err());
+        }
+    }
+
+    #[test]
+    fn the_stream_parses_into_shared_objects_and_links() {
+        let s = stream::parse(&doc()).unwrap();
+        let root = &s.objects[s.root];
+        assert_eq!(root.class, Tag::of(b"Pers"));
+        assert_eq!(root.get(Tag::of(b"Desc")), Some(&Value::Str("Document".into())));
+        assert_eq!(root.get(Tag::of(b"Xfrm")), Some(&Value::Floats(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])));
+        let (Some(Value::Obj(Some(a))), Some(Value::Obj(Some(b)))) = (root.get(Tag::of(b"Colr")), root.get(Tag::of(b"Same"))) else { panic!() };
+        assert_eq!(a, b);
+        assert_eq!(s.objects[*a].class, Tag::of(b"RGBA"));
+        assert_eq!(s.objects[*a].kind, Kind::Shared);
+        let Some(Value::Array(kids)) = root.get(Tag::of(b"Kids")) else { panic!() };
+        assert_eq!(kids[0], kids[1]);
+        let Value::Obj(Some(g)) = kids[0] else { panic!() };
+        assert_eq!(s.objects[g].chain, vec![Tag::of(b"Grup"), Tag::of(b"Node")]);
+        assert_eq!(root.get(Tag::of(b"Enum")), Some(&Value::Enum { id: 2, version: 1 }));
+        assert_eq!(root.get(Tag::of(b"Tile")), Some(&Value::Entry("d/3".into())));
+        assert_eq!(root.get(Tag::of(b"Null")), Some(&Value::Obj(None)));
+    }
+
+    #[test]
+    fn checksums_sizes_and_budgets_are_enforced() {
+        let d = doc();
+        let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
+        // Flip a byte inside the compressed payload, past the "#Fil" tag at offset 72.
+        let mut broken = file.clone();
+        broken[90] ^= 0x55;
+        let mut a = Archive::open(&broken, Limits::default()).unwrap();
+        assert!(a.read("doc.dat").is_err());
+        let mut a = Archive::open(&file, Limits { max_entry: d.len() - 1, max_total: usize::MAX }).unwrap();
+        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
+        let mut a = Archive::open(&file, Limits { max_entry: usize::MAX, max_total: d.len() + 1 }).unwrap();
+        a.read("doc.dat").unwrap();
+        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
+    }
+
+    #[test]
+    fn a_declared_size_smaller_than_the_data_is_rejected_not_truncated() {
+        let big = vec![7u8; 1 << 20];
+        let mut file = synth::container(&[("doc.dat", &big, Method::Zlib)], None);
+        // Rewrite the declared size in the table to 1 KiB: decoding must stop and fail.
+        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap()) as usize;
+        let size_at = fat + 59 + 5 + 8;
+        file[size_at..size_at + 8].copy_from_slice(&1024u64.to_le_bytes());
+        let mut a = Archive::open(&file, Limits::default()).unwrap();
+        assert_eq!(a.read("doc.dat").unwrap_err(), Error::Malformed("archive entry size mismatch"));
+    }
+
+    #[test]
+    fn libraries_and_cyclic_tables_are_rejected() {
+        let d = doc();
+        let mut file = synth::container(&[("doc.dat", &d, Method::Stored)], None);
+        let mut library = file.clone();
+        library[8..12].copy_from_slice(b"rAsA");
+        assert!(matches!(Archive::open(&library, Limits::default()), Err(Error::Unsupported(_))));
+        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap());
+        let at = fat as usize + 4;
+        file[at..at + 8].copy_from_slice(&fat.to_le_bytes());
+        assert_eq!(Archive::open(&file, Limits::default()).unwrap_err(), Error::Malformed("allocation tables form a cycle"));
+    }
+
+    #[test]
+    fn hostile_streams_fail_cleanly() {
+        let deep = (0..2000).fold(Vec::new(), |inner, _| vec![(tag(b"Chld"), F::Obj(tag(b"Grup"), inner))]);
+        assert_eq!(stream::parse(&synth::stream(&deep)).unwrap_err(), Error::Limit("objects nested too deeply"));
+        // An array claiming four billion elements in a few bytes.
+        let huge = synth::stream(&[(tag(b"Big_"), F::Raw(vec![0x81, b'_', b'g', b'i', b'B', 0xff, 0xff, 0xff, 0xff, 0]))]);
+        assert_eq!(stream::parse(&huge).unwrap_err(), Error::Malformed("array longer than its data"));
+        let forward = synth::stream(&[(tag(b"Link"), F::Ref(99))]);
+        assert!(stream::parse(&forward).is_err());
+        let twice = synth::stream(&[(tag(b"A___"), F::Def(1, vec![tag(b"RGBA")], vec![])), (tag(b"B___"), F::Def(1, vec![tag(b"RGBA")], vec![]))]);
+        assert!(stream::parse(&twice).is_err());
+        let unknown = synth::stream(&[(tag(b"X___"), F::Raw(vec![0x0b, 1, 2, 3, 4]))]);
+        assert!(matches!(stream::parse(&unknown), Err(Error::Unsupported(_))));
+        let d = doc();
+        for end in 0..d.len() {
+            assert!(stream::parse(&d[..end]).is_err(), "{end}");
+        }
+    }
+
+    #[test]
+    fn a_small_compressed_entry_cannot_make_the_stream_allocate_gigabytes() {
+        // Each decoded value takes about 40 bytes, and a bool array packs eight in a byte: 16 MiB
+        // of zero bits, a few KiB once compressed, would ask for 2^27 values (about 4 GiB). An
+        // array of one-byte values just past the budget fails the same way, before allocating.
+        let field = |code: u8, n: u32, data: usize| {
+            let mut f = vec![0x80 | code];
+            f.extend(tag(b"Big_").0.to_le_bytes());
+            f.extend(n.to_le_bytes());
+            f.resize(f.len() + data, 0);
+            F::Raw(f)
+        };
+        let bools = 1u32 << 27;
+        let bytes = u32::try_from(stream::MAX_VALUES).unwrap() + 1;
+        for f in [field(0x29, bools, (bools / 8) as usize), field(0x01, bytes, bytes as usize)] {
+            let d = synth::stream(&[(tag(b"Big_"), f)]);
+            let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
+            assert!(file.len() < d.len() / 100, "{} of {}", file.len(), d.len());
+            let entry = Archive::open(&file, Limits::default()).unwrap().read("doc.dat").unwrap();
+            assert_eq!(stream::parse(&entry).unwrap_err(), Error::Limit("too many values in the document stream"));
+        }
+    }
+
+    proptest! {
+        #![proptest_config(ProptestConfig::with_cases(512))]
+        #[test]
+        fn mutated_containers_and_streams_never_panic(edits in prop::collection::vec((0usize..4096, any::<u8>()), 1..24)) {
+            let d = doc();
+            for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+                let mut file = synth::container(&[("doc.dat", &d, method)], None);
+                for (i, v) in &edits {
+                    let n = file.len();
+                    file[i % n] = *v;
+                }
+                if let Ok(bytes) = Archive::open(&file, Limits::default()).and_then(|mut a| a.read("doc.dat")) {
+                    let _ = stream::parse(&bytes);
+                }
+            }
+            let mut s = d.clone();
+            for (i, v) in &edits {
+                let n = s.len();
+                s[i % n] = *v;
+            }
+            let _ = stream::parse(&s);
+        }
+    }
+}

crates/affinity/src/text.rs

@@ -0,0 +1,322 @@
+//! Artistic and frame text: the story's characters with their font, size, colour, tracking and
+//! leading, the paragraph alignment and the first baseline. Layout (line breaks in frames, kerning,
+//! OpenType features) is left to the importing application.
+
+use crate::model::{Affine, Align, Point, Reader, Text, TextRun, rect};
+use crate::paint::{self, Color, Paint};
+use crate::stream::{ObjId, Value};
+
+/// Characters read per text node (stories are split into blocks; this caps hostile ones).
+const MAX_CHARS: usize = 1 << 20;
+/// Shared character attributes must not amplify into unbounded font/feature/gradient data.
+const MAX_ATTRIBUTE_BYTES: usize = 16 << 20;
+
+pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
+    let s = r.s;
+    let story = s.obj(id, b"StSt")?;
+    let frame = s.obj(id, b"TxtH")?;
+    let artistic = s.is(frame, b"ArFr");
+    let bounds = s.floats::<4>(frame, b"FrmB").map(rect)?;
+    let mut runs = Vec::new();
+    let mut align = None;
+    let mut total = 0usize;
+    let mut placeholders = false;
+    let mut attribute_budget = Some(MAX_ATTRIBUTE_BYTES);
+    for block in s.objs(story, b"Blok") {
+        let Some(glyphs) = s.obj(block, b"Glyp") else {
+            r.warn("a text block without readable characters (left out)");
+            continue;
+        };
+        // Bound collection itself, including placeholders, before allocating the character buffer.
+        let budget = MAX_CHARS - total;
+
+        let mut chars: Vec<char> = match s.str(glyphs, b"Utf8") {
+            Some(t) => t.chars().take(budget + 1).collect(),
+            None => {
+                // Inline objects (page numbers, anchors) each take one index before the segment text.
+                let segments = s.objs(glyphs, b"Mixd");
+                if segments.is_empty() {
+                    r.warn("a text block without readable characters (left out)");
+                    continue;
+                }
+                let mut v = Vec::new();
+                for seg in segments {
+                    let inline = s.objs(seg, b"Glys").len();
+                    v.extend(std::iter::repeat_n('\u{FFFC}', inline.min(budget + 1 - v.len())));
+                    placeholders |= inline > 0;
+                    v.extend(s.str(seg, b"Utf8").unwrap_or_default().chars().take(budget + 1 - v.len()));
+                    if v.len() > budget {
+                        break;
+                    }
+                }
+                v
+            }
+        };
+        let truncated = chars.len() > budget;
+        if truncated {
+            chars.truncate(budget);
+            r.warn("text longer than a million characters (truncated)");
+        }
+        total += chars.len();
+        let mut start = 0usize;
+        for run in s.obj(block, b"GAtt").map(|g| s.objs(g, b"Runs")).unwrap_or_default() {
+            let Some(index) = s.int(run, b"Indx").and_then(|v| usize::try_from(v).ok()) else {
+                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
+                continue;
+            };
+            let end = index.min(chars.len());
+            if index > chars.len() || end < start {
+                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
+            }
+            if end <= start {
+                continue;
+            }
+            let text = characters(&chars, start, end);
+            start = end;
+            push_run(r, &mut runs, s.obj(run, b"Item"), text, world, &mut attribute_budget);
+        }
+        if start < chars.len() {
+            let text = characters(&chars, start, chars.len());
+            push_run(r, &mut runs, None, text, world, &mut attribute_budget);
+        }
+        for paragraph in s.obj(block, b"PAtt").map(|p| s.objs(p, b"Runs")).unwrap_or_default() {
+            if let Some(attrs) = s.obj(paragraph, b"Item") {
+                let paragraph = paragraph_align(r, attrs);
+                match align {
+                    None => align = Some(paragraph),
+                    Some(first) if first != paragraph => r.warn("mixed paragraph alignments (the first alignment is used)"),
+                    _ => {}
+                }
+            }
+        }
+        if truncated {
+            break;
+        }
+    }
+    if placeholders {
+        r.warn("text fields such as page numbers (left out of the text)");
+    }
+    let align = align.unwrap_or(Align::Left);
+    let first_baseline = bounds.y0 + s.f64(frame, b"ArtV").unwrap_or(0.0);
+    let anchor_x = match align {
+        Align::Center => (bounds.x0 + bounds.x1) / 2.0,
+        Align::Right => bounds.x1,
+        _ => bounds.x0,
+    };
+    if !artistic {
+        if s.objs(frame, b"ColW").len() > 1 || matches!(s.field(frame, b"ColW"), Some(Value::Array(a)) if a.len() > 1) {
+            r.warn("text frames with several columns (imported as one column)");
+        }
+        if s.class(id) == Some(crate::stream::Tag::of(b"TxtC")) {
+            r.warn("text frames with a curved outline (imported as rectangular frames)");
+        }
+    }
+    Some(Text { runs, align, anchor: Point { x: anchor_x, y: first_baseline }, frame: if artistic { None } else { Some(bounds) }, transform: world })
+}
+
+fn characters(chars: &[char], start: usize, end: usize) -> String {
+    chars.get(start..end).unwrap_or_default().iter().filter(|c| **c != '\0' && **c != '\u{FFFC}').collect()
+}
+
+fn push_run(r: &mut Reader, runs: &mut Vec<TextRun>, attrs: Option<ObjId>, text: String, world: Affine, attribute_budget: &mut Option<usize>) {
+    if text.is_empty() {
+        return;
+    }
+    let run = match attrs {
+        Some(attrs) if attribute_budget.is_some() => run_attrs(r, attrs, text, world, attribute_budget),
+        _ => {
+            // This is a recovery policy, not an assertion about unspecified Affinity attributes.
+            if attrs.is_none() {
+                r.warn("text without character attributes (characters preserved with default attributes)");
+            }
+            TextRun {
+                text,
+                postscript: String::new(),
+                family: String::new(),
+                weight: 400,
+                italic: false,
+                features: Vec::new(),
+                all_caps: false,
+                size: 12.0 * r.dpi / 72.0,
+                tracking: 0.0,
+                leading: None,
+                fill: Paint::Solid(Color::Gray { v: 0.0, a: 1.0 }),
+            }
+        }
+    };
+    runs.push(run);
+}
+
+fn slot<T: Copy>(v: Option<&Value>, i: usize, f: impl Fn(&Value) -> Option<T>) -> Option<T> {
+    match v? {
+        Value::Array(a) => a.get(i).and_then(f),
+        _ => None,
+    }
+}
+
+fn float(v: &Value) -> Option<f64> {
+    match v {
+        Value::Float(f) if f.is_finite() => Some(*f),
+        _ => None,
+    }
+}
+
+fn int(v: &Value) -> Option<i64> {
+    match v {
+        Value::Int(i) => Some(*i),
+        Value::UInt(u) => i64::try_from(*u).ok(),
+        _ => None,
+    }
+}
+
+fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine, attribute_budget: &mut Option<usize>) -> TextRun {
+    let s = r.s;
+    let doubles = s.field(attrs, b"Doub");
+    let ints = s.field(attrs, b"Ints");
+    let size = slot(doubles, 0, float).filter(|v| *v > 0.0 && *v < 1e6).unwrap_or(12.0 * r.dpi / 72.0);
+    let tracking = slot(doubles, 4, float).unwrap_or(0.0);
+    let leading = (slot(ints, 4, int) == Some(1)).then(|| slot(doubles, 13, float)).flatten().filter(|v| *v > 0.0);
+    let objects = match s.field(attrs, b"Objs") {
+        Some(Value::Array(a)) => a.iter().take(8).map(|v| if let Value::Obj(o) = v { *o } else { None }).collect(),
+        _ => Vec::new(),
+    };
+    let mut fill = match objects.first().copied().flatten().and_then(|f| paint::descriptor(r, f, world)) {
+        Some(fill) => fill,
+        None => {
+            r.warn("text without readable fill attributes (default black used)");
+            Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })
+        }
+    };
+    // A single descriptor decode is bounded by paint::MAX_STOPS. Charge its owned stop data
+    // before keeping it; subsequent runs skip attribute decoding once the budget is exhausted.
+    if let Paint::Gradient(gradient) = &fill {
+        let bytes = gradient.stops.len().saturating_mul(std::mem::size_of::<paint::Stop>());
+        if !charge_attributes(r, attribute_budget, bytes) {
+            fill = Paint::Solid(Color::Gray { v: 0.0, a: 1.0 });
+        }
+    }
+    if attribute_budget.is_some() && objects.get(1).copied().flatten().and_then(|f| paint::descriptor(r, f, world)).is_some_and(|p| p != Paint::None)
+    {
+        r.warn("outlined (stroked) text");
+    }
+    if slot(doubles, 10, float).is_some_and(|h| (h - 1.0).abs() > 1e-3) {
+        r.warn("horizontally scaled text");
+    }
+    // A resolved font is populated on the emoji run of the public Affinity 3 text-runs file
+    // (Courier New requested, Segoe UI Emoji stored in RFnt). Empty RFnt records are common.
+    // Source: https://github.com/SethRobinson/Patchy/tree/de84eab550758b30fa062e479f5778cce7693b73/test-fixtures/af
+    let requested = s.obj(attrs, b"DFnt");
+    let resolved =
+        s.obj(attrs, b"RFnt").filter(|f| !s.str(*f, b"Famy").unwrap_or_default().is_empty() || !s.str(*f, b"Post").unwrap_or_default().is_empty());
+    let font = resolved.or(requested);
+    if let Some(resolved) = resolved {
+        let differs = [b"Famy", b"Post"]
+            .iter()
+            .any(|tag| s.str(resolved, tag).unwrap_or_default() != requested.and_then(|f| s.str(f, tag)).unwrap_or_default());
+        if differs {
+            r.warn("text uses a stored fallback font (imported with that font)");
+        }
+    }
+    if font.and_then(|f| s.int(f, b"Widh")).is_some_and(|w| w != 5) {
+        r.warn("font width variants (exact face depends on the installed PostScript font)");
+    }
+    let postscript = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Post")).unwrap_or_default());
+    let family = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Famy")).unwrap_or_default());
+    let (features, all_caps) = font_features(r, objects.get(7).copied().flatten(), attribute_budget);
+    let weight = font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400);
+    let weight = if (1..=1000).contains(&weight) {
+        weight
+    } else {
+        r.warn("invalid font weight (imported as regular)");
+        400
+    };
+    TextRun {
+        text,
+        postscript,
+        family,
+        weight,
+        italic: font.and_then(|f| s.bool(f, b"Ital")).unwrap_or(false),
+        features,
+        all_caps,
+        size,
+        tracking,
+        leading,
+        fill,
+    }
+}
+
+fn charge_attributes(r: &mut Reader, budget: &mut Option<usize>, bytes: usize) -> bool {
+    let Some(remaining) = *budget else { return false };
+    match remaining.checked_sub(bytes) {
+        Some(remaining) => {
+            *budget = Some(remaining);
+            true
+        }
+        None => {
+            *budget = None;
+            r.warn("text attribute budget exceeded (excess font names, features and gradients left out)");
+            false
+        }
+    }
+}
+
+fn metadata_string(r: &mut Reader, budget: &mut Option<usize>, value: &str) -> String {
+    let bytes = value.len().saturating_add(std::mem::size_of::<String>());
+    if value.is_empty() || !charge_attributes(r, budget, bytes) { String::new() } else { value.to_owned() }
+}
+
+/// The public Affinity 3 caps fixture stores `smcp` and the private `CAP\x01` selector in
+/// OtAt/Setn. Only the observed all-caps selector and boolean OpenType tags are mapped; other
+/// values are reported, never guessed. Standard tag syntax: https://learn.microsoft.com/en-us/typography/opentype/spec/featuretags
+fn font_features(r: &mut Reader, attrs: Option<ObjId>, attribute_budget: &mut Option<usize>) -> (Vec<String>, bool) {
+    let mut features = Vec::new();
+    let mut all_caps = false;
+    if attribute_budget.is_none() {
+        return (features, all_caps);
+    }
+    let s = r.s;
+    let Some(Value::Array(settings)) = attrs.and_then(|a| s.field(a, b"Setn")) else { return (features, all_caps) };
+    for (index, setting) in settings.iter().take(257).enumerate() {
+        if index == 256 {
+            r.warn("more than 256 text feature settings (truncated)");
+            break;
+        }
+        let Value::Obj(Some(setting)) = setting else {
+            r.warn("unreadable text feature settings (imported with defaults)");
+            continue;
+        };
+        let setting = *setting;
+        let tag = s.int(setting, b"Feat").and_then(|v| u32::try_from(v).ok()).map(u32::to_be_bytes);
+        let value = r.s.int(setting, b"Valu");
+        match (tag, value) {
+            (Some([b'C', b'A', b'P', 1]), Some(0 | 1)) => all_caps = value == Some(1),
+            (Some(tag), Some(value @ (0 | 1))) if tag.iter().all(u8::is_ascii_alphanumeric) => {
+                if !charge_attributes(r, attribute_budget, std::mem::size_of::<String>() + if value == 0 { 5 } else { 4 }) {
+                    break;
+                }
+                let name = String::from_utf8_lossy(&tag);
+                features.push(if value == 0 { format!("-{name}") } else { name.into_owned() });
+            }
+            _ => r.warn("text feature selectors or non-boolean OpenType settings (imported with defaults)"),
+        }
+    }
+    (features, all_caps)
+}
+
+fn paragraph_align(r: &mut Reader, p: ObjId) -> Align {
+    // Nonzero offsets in these slots are present in the public text-indent and text-para-spacing
+    // fixtures. Their layout is not represented by this importer; retain text and report the gap.
+    if (1..=6).any(|i| slot(r.s.field(p, b"Doub"), i, float).is_some_and(|v| v.abs() > 1e-9)) {
+        r.warn("paragraph indents or spacing (imported with defaults)");
+    }
+    match slot(r.s.field(p, b"Ints"), 0, int) {
+        Some(1) => Align::Center,
+        Some(2) => Align::Right,
+        Some(3) => Align::Justify,
+        Some(0) | None => Align::Left,
+        Some(_) => {
+            r.warn("an unknown paragraph alignment (imported as left)");
+            Align::Left
+        }
+    }
+}

crates/affinity/tests/outline_limits.rs

@@ -0,0 +1,168 @@
+//! Original synthetic graph tests for bounded `.af` outline expansion. These model the reader's
+//! accepted schema, without using Affinity software, third-party parser code or external assets.
+#![cfg(feature = "synth")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use vectorcraft_affinity::{
+    Document, Limits,
+    model::{Kind, Path, Point},
+    synth::{self, F, Method, tag},
+};
+
+fn compound(id: u32, children: Vec<F>) -> F {
+    F::Def(id, vec![tag(b"Comp")], vec![(tag(b"Chld"), F::Shared(children))])
+}
+
+fn shape(id: u32, class: &[u8; 4], parameters: Vec<(vectorcraft_affinity::stream::Tag, F)>) -> F {
+    F::Def(
+        id,
+        vec![tag(b"ShpN")],
+        vec![(tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 10.0, 20.0])), (tag(b"Shpe"), F::Def(id + 10_000, vec![tag(class)], parameters))],
+    )
+}
+
+fn read(definitions: Vec<F>, top: u32) -> Document {
+    let data = synth::stream(&[
+        (tag(b"Defs"), F::Shared(definitions)),
+        (
+            tag(b"DocR"),
+            F::Def(
+                1,
+                vec![tag(b"DocN")],
+                vec![(
+                    tag(b"Chld"),
+                    F::Shared(vec![F::Def(
+                        2,
+                        vec![tag(b"Sprd")],
+                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![F::Ref(top)]))],
+                    )]),
+                )],
+            ),
+        ),
+    ]);
+    let bytes = synth::container(&[("doc.dat", &data, Method::Zlib)], None);
+    vectorcraft_affinity::read(&bytes, Limits::default()).unwrap()
+}
+
+fn path(document: &Document) -> &Path {
+    match &document.spreads[0].nodes[0].kind {
+        Kind::Shape { path, .. } => path,
+        other => panic!("expected shape, got {other:?}"),
+    }
+}
+
+fn rejected(document: &Document, warning: &str) {
+    assert!(matches!(document.spreads[0].nodes[0].kind, Kind::Unsupported));
+    assert!(document.warnings.iter().any(|value| value.contains(warning)), "{:?}", document.warnings);
+}
+
+#[test]
+fn self_cycle_and_mutual_cycle_discard_the_entire_compound() {
+    // A valid first operand ensures a malformed later operand cannot leave a plausible partial path.
+    let rectangle = shape(100, b"ShNR", vec![]);
+    let self_cycle = compound(101, vec![F::Ref(100), F::Ref(101)]);
+    rejected(&read(vec![rectangle.clone(), self_cycle], 101), "compound outline that contains itself");
+    let mutual_cycle = compound(101, vec![F::Ref(100), compound(102, vec![F::Ref(101)])]);
+    rejected(&read(vec![rectangle, mutual_cycle], 101), "compound outline that contains itself");
+}
+
+#[test]
+fn deep_reference_chain_is_bounded_independently_of_stream_nesting() {
+    let mut definitions = vec![shape(100, b"ShNR", vec![])];
+    for id in 101..=250 {
+        definitions.push(compound(id, vec![F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 250), "compound outlines nested deeper than 128 levels");
+}
+
+#[test]
+fn outline_at_the_depth_limit_is_still_imported() {
+    let mut definitions = vec![shape(100, b"ShNR", vec![])];
+    for id in 101..=227 {
+        definitions.push(compound(id, vec![F::Ref(id - 1)]));
+    }
+    let document = read(definitions, 227);
+    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
+    assert_eq!(path(&document).subpaths.len(), 1);
+    assert_eq!(path(&document).subpaths[0].segments.len(), 3);
+}
+
+#[test]
+fn excessive_declared_curve_count_is_rejected_before_expansion() {
+    let curve = F::Def(
+        100,
+        vec![tag(b"PCrv")],
+        vec![(tag(b"Crvs"), F::Def(101, vec![tag(b"PCvD")], vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(u32::MAX)]))]))],
+    );
+    rejected(&read(vec![curve], 100), "compound outlines exceeding the geometry work limit");
+}
+
+#[test]
+fn empty_shared_fanout_cannot_bypass_the_operand_visit_limit() {
+    // Only 21 on-disk objects, but an unbounded traversal would visit over two million operands.
+    let mut definitions = vec![compound(100, vec![])];
+    for id in 101..=120 {
+        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 120), "compound outlines exceeding the operand visit limit");
+}
+
+#[test]
+fn shared_large_operands_are_charged_for_cumulative_geometry_work() {
+    // A small reference graph expands a 20,000-segment star. Count work across every reuse and
+    // transform, rather than permitting each individual operand's allocation limit repeatedly.
+    let mut definitions = vec![shape(100, b"ShSt", vec![(tag(b"Pnts"), F::I32(10_000))])];
+    for id in 101..=112 {
+        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 112), "compound outlines exceeding the geometry work limit");
+}
+
+#[test]
+fn ordinary_nested_compound_preserves_repeated_operands_and_transforms() {
+    let mut rectangle = shape(100, b"ShNR", vec![]);
+    if let F::Def(_, _, fields) = &mut rectangle {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 3.0, 0.0, 1.0, 7.0])));
+    }
+    let inner = compound(101, vec![F::Ref(100), F::Ref(100)]);
+    let mut outer = compound(102, vec![F::Ref(101)]);
+    if let F::Def(_, _, fields) = &mut outer {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 100.0, 0.0, 1.0, 200.0])));
+    }
+    let document = read(vec![rectangle, inner, outer], 102);
+    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
+    let path = path(&document);
+    assert_eq!(path.subpaths.len(), 2);
+    assert_eq!(path.subpaths[0], path.subpaths[1]);
+    assert_eq!(path.subpaths[0].start, Point { x: 103.0, y: 207.0 });
+    assert_eq!(path.subpaths[0].segments.last().unwrap()[2], Point { x: 103.0, y: 227.0 });
+}
+
+#[test]
+fn overflowing_compound_transform_is_reported_before_processing_geometry() {
+    let mut child = shape(100, b"ShNR", vec![]);
+    if let F::Def(_, _, fields) = &mut child {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
+    }
+    let mut outer = compound(101, vec![F::Ref(100)]);
+    if let F::Def(_, _, fields) = &mut outer {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
+    }
+    rejected(&read(vec![child, outer], 101), "compound operand with an invalid transform");
+}
+
+#[test]
+fn pie_angles_with_huge_finite_values_do_not_loop_or_emit_nonfinite_points() {
+    let document = read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(1.0e308)), (tag(b"AngE"), F::F64(-1.0e308))])], 100);
+    for subpath in &path(&document).subpaths {
+        assert!(subpath.start.x.is_finite() && subpath.start.y.is_finite());
+        assert!(subpath.segments.len() <= 20);
+        assert!(subpath.segments.iter().flatten().all(|point| point.x.is_finite() && point.y.is_finite()));
+    }
+}
+
+#[test]
+fn wrapped_pie_angles_keep_the_same_geometry_as_the_positive_span() {
+    let make = |end| read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(0.0)), (tag(b"AngE"), F::F64(end))])], 100);
+    assert_eq!(path(&make(-std::f64::consts::FRAC_PI_2)), path(&make(3.0 * std::f64::consts::FRAC_PI_2)));
+}

crates/affinity/tests/raster.rs

@@ -0,0 +1,116 @@
+//! Pixel retention on current Affinity 3 documents published under MIT by Patchy.
+//! Assertions use this reader's archive/stream and the original embedded image bytes;
+//! no third-party Affinity parser, source code or application is used as an oracle.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use vectorcraft_affinity::{
+    Archive, Limits,
+    model::{Affine, Document, Image, Kind, Node, Pixels},
+    stream,
+};
+
+#[path = "support/corpus.rs"]
+mod corpus;
+
+fn images(nodes: &[Node], out: &mut Vec<Image>) {
+    for node in nodes {
+        if let Kind::Image(image) = &node.kind {
+            out.push(image.clone());
+        }
+        images(&node.children, out);
+    }
+}
+
+fn read_fixture(name: &str) -> Option<(Vec<u8>, Document, Vec<Image>)> {
+    let dir = corpus::pinned()?;
+    let bytes = std::fs::read(dir.join(name)).unwrap();
+    let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
+    assert!(doc.saved_by.as_deref().unwrap().starts_with("Affinity 3."));
+    let mut out = Vec::new();
+    for spread in &doc.spreads {
+        images(&spread.nodes, &mut out);
+    }
+    Some((bytes, doc, out))
+}
+
+fn source(bytes: &[u8]) -> Vec<u8> {
+    let mut archive = Archive::open(bytes, Limits::default()).unwrap();
+    let doc = stream::parse(&archive.read("doc.dat").unwrap()).unwrap();
+    let bitmap =
+        doc.objects.iter().enumerate().find(|(_, o)| o.class == stream::Tag::of(b"DyBm") && o.get(stream::Tag::of(b"Bckg")).is_some()).unwrap().0;
+    let name = doc.entry(bitmap, b"Bckg").unwrap();
+    let block = stream::parse(&archive.read(name).unwrap()).unwrap();
+    block.bytes(block.root, b"Data").unwrap().to_vec()
+}
+
+#[test]
+fn source_backed_tiles_retain_the_embedded_jpeg_pixels() {
+    let Some((bytes, doc, images)) = read_fixture("patchy-embedded-jpeg.af") else { return };
+    assert!(doc.warnings.is_empty(), "{:?}", doc.warnings);
+    assert_eq!(images.len(), 1);
+    let image = &images[0];
+    assert_eq!((image.width, image.height), (400, 300));
+    assert_eq!(image.transform, Affine::IDENTITY);
+    let Pixels::Rgba8(pixels) = &image.pixels else { panic!("expected retained level-zero pixels") };
+    let expected = image::load_from_memory(&source(&bytes)).unwrap().into_rgba8();
+    assert_eq!(pixels.as_slice(), expected.as_raw());
+    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
+}
+
+#[test]
+fn lazy_placed_images_keep_the_original_encoded_bytes() {
+    let Some((bytes, doc, images)) = read_fixture("patchy-lazy-placed.af") else { return };
+    assert!(doc.warnings.is_empty());
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (400, 300));
+    assert_eq!(images[0].transform, Affine::IDENTITY);
+    assert_eq!(images[0].pixels, Pixels::Encoded(source(&bytes)));
+}
+
+#[test]
+fn eight_and_sixteen_bit_channels_retain_the_same_pixel_pattern() {
+    let Some((_, doc8, images8)) = read_fixture("patchy-rgba8.af") else { return };
+    let (_, doc16, images16) = read_fixture("patchy-rgba16.af").unwrap();
+    assert!(doc8.warnings.is_empty());
+    assert!(doc16.warnings.is_empty());
+    assert_eq!(images8.len(), 1);
+    assert_eq!(images16, images8);
+    assert_eq!((images8[0].width, images8[0].height), (64, 48));
+    let Pixels::Rgba8(pixels) = &images8[0].pixels else { panic!() };
+    assert_eq!(pixels.len(), 64 * 48 * 4);
+    assert_eq!(&pixels[..4], &[0, 0, 0, 128]);
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] < 255));
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
+    // Frozen pixel-retention baseline, including every alpha sample. It is not a render oracle.
+    assert_eq!(crc32fast::hash(pixels), 0xc8ee4dc1);
+}
+
+#[test]
+fn rotated_scaled_pixels_keep_the_full_affine_transform() {
+    let Some((_, doc, images)) = read_fixture("patchy-transform.af") else { return };
+    assert!(doc.warnings.is_empty());
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (80, 60));
+    let expected = [1.1742158910592235, 0.4286222593193142, -0.4286222593193142, 1.1742158910592235, 60.0, 40.0];
+    for (actual, expected) in images[0].transform.0.into_iter().zip(expected) {
+        assert!((actual - expected).abs() < 1e-12);
+    }
+    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
+    assert_eq!(pixels.len(), 80 * 60 * 4);
+    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
+    assert_eq!(crc32fast::hash(pixels), 0x3720a442);
+}
+
+#[test]
+fn cmyk_and_lab_losses_are_reported() {
+    let Some((_, cmyk, images)) = read_fixture("patchy-cmyk.af") else { return };
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (64, 48));
+    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
+    assert_eq!(crc32fast::hash(pixels), 0x5872bb76);
+    assert_eq!(cmyk.warnings, ["CMYK pixel layers (converted to RGB without the document's colour profile)"]);
+    let (_, lab, images) = read_fixture("patchy-lab.af").unwrap();
+    assert!(images.is_empty());
+    assert_eq!(lab.warnings, ["pixel layers in grey, Lab or 32-bit formats"]);
+}

crates/affinity/tests/real_files.rs

@@ -0,0 +1,115 @@
+//! Public Affinity documents: the pinned set `cargo xtask corpus --affinity` fetches into
+//! `corpus/affinity`, or any folder of `.af`/`.afdesign`/`.afphoto`/`.afpub` files named by
+//! `AFFINITY_SAMPLES` (searched recursively). CI requires a complete, checksum-verified pinned
+//! corpus via `AFFINITY_CORPUS_REQUIRED=1`; ordinary local runs may skip an absent corpus.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::{Path, PathBuf};
+
+use vectorcraft_affinity::{Archive, Limits, stream};
+
+#[path = "support/corpus.rs"]
+mod corpus;
+#[path = "support/features.rs"]
+mod features;
+
+fn files(dir: &Path, out: &mut Vec<PathBuf>) {
+    for e in std::fs::read_dir(dir).into_iter().flatten().flatten() {
+        let p = e.path();
+        if p.is_dir() {
+            files(&p, out);
+        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["af", "afdesign", "afphoto", "afpub", "aftemplate"].contains(&e)) {
+            out.push(p);
+        }
+    }
+}
+
+fn samples() -> Option<PathBuf> {
+    let pinned = corpus::pinned();
+    std::env::var_os("AFFINITY_SAMPLES").map(PathBuf::from).or(pinned)
+}
+
+#[test]
+fn public_documents_parse_completely() {
+    let Some(dir) = samples() else { return };
+    let mut paths = Vec::new();
+    files(&dir, &mut paths);
+    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
+    let mut failures = Vec::new();
+    for p in &paths {
+        let bytes = std::fs::read(p).unwrap();
+        let result = Archive::open(&bytes, Limits::default()).and_then(|mut a| {
+            let doc = a.read("doc.dat")?;
+            stream::parse(&doc).map(|s| s.objects.len())
+        });
+        match result {
+            Ok(n) => assert!(n > 0),
+            Err(e) => failures.push(format!("{}: {e}", p.display())),
+        }
+    }
+    assert!(failures.is_empty(), "{} of {} failed:\n{}", failures.len(), paths.len(), failures.join("\n"));
+    eprintln!("{} Affinity documents parsed", paths.len());
+}
+
+#[test]
+fn public_documents_map_to_the_model() {
+    let Some(dir) = samples() else { return };
+    let mut paths = Vec::new();
+    files(&dir, &mut paths);
+    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
+    let mut warnings = std::collections::BTreeMap::<String, usize>::new();
+    let mut failures = Vec::new();
+    let (mut nodes, mut docs) = (0usize, 0usize);
+    fn count(n: &[vectorcraft_affinity::model::Node]) -> usize {
+        n.iter().map(|n| 1 + count(&n.children)).sum()
+    }
+    for p in &paths {
+        let bytes = std::fs::read(p).unwrap();
+        match vectorcraft_affinity::read(&bytes, Limits::default()) {
+            Ok(d) => {
+                docs += 1;
+                nodes += d.spreads.iter().map(|s| count(&s.nodes)).sum::<usize>();
+                for w in d.warnings {
+                    let key = w.split(" (").next().unwrap_or(&w).to_string();
+                    *warnings.entry(key).or_default() += 1;
+                }
+            }
+            Err(e) => failures.push(format!("{}: {e}", p.display())),
+        }
+    }
+    eprintln!("{docs} documents, {nodes} nodes");
+    for (w, n) in &warnings {
+        eprintln!("{n:4} documents: {w}");
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+/// Measured structural baselines for actual Affinity 3 files. Unlike a parse-success test,
+/// this detects disappearing nodes, curves, runs, font names, artboards and loss warnings.
+/// It does not claim that an unsupported feature is faithfully rendered.
+#[test]
+fn affinity3_feature_retention_matches_pinned_signatures() {
+    let Some(dir) = corpus::pinned() else { return };
+    let expected = include_str!("support/affinity3-signatures.txt");
+    let mut checked = std::collections::BTreeSet::new();
+    for line in expected.lines().filter(|l| !l.starts_with('#') && !l.is_empty()) {
+        let (name, signature) = line.split_once('\t').expect("signature row must have a tab");
+        assert!(checked.insert(name), "duplicate fixture {name}");
+        let bytes = std::fs::read(dir.join(name)).unwrap();
+        let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
+        assert_eq!(
+            features::signature(&doc),
+            signature,
+            "{name}: imported feature retention changed; review the pinned input and warning changes before updating this baseline"
+        );
+        assert!(
+            doc.saved_by.as_deref().is_some_and(|v| v.starts_with("Affinity 3.")),
+            "{name}: expected an actual Affinity 3 document, got {:?}",
+            doc.saved_by
+        );
+    }
+    let manifest = include_str!("../../../xtask/affinity-corpus.sha256");
+    let af_names: std::collections::BTreeSet<_> =
+        manifest.lines().filter_map(|l| l.split_once("  ")).map(|(_, n)| n).filter(|n| n.ends_with(".af")).collect();
+    assert_eq!(checked, af_names, "every pinned .af file needs a reviewed structural baseline");
+}

crates/affinity/tests/support/affinity3-signatures.txt

@@ -0,0 +1,33 @@
+affinity3-mexican-guy.af	dpi=300;spreads=1;model_crc32=df3c417b;counts={"depth": 8, "fills": 169, "gradients": 0, "groups": 23, "nodes": 283, "opacity": 1, "segments": 1491, "shapes": 260, "strokes": 114, "subpaths": 264};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (114×)", "layer effects (shadows, glows, outlines, bevels…) (156×)"]
+affinity3-mexican-man.af	dpi=300;spreads=1;model_crc32=d0387de4;counts={"depth": 7, "fills": 277, "gradients": 2, "groups": 29, "nodes": 903, "segments": 3225, "shapes": 874, "strokes": 559, "subpaths": 881};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (545×)", "layer effects (shadows, glows, outlines, bevels…) (245×)"]
+affinity3-mexican-woman.af	dpi=300;spreads=1;model_crc32=b966f693;counts={"depth": 9, "fills": 527, "gradients": 0, "groups": 28, "nodes": 595, "segments": 3562, "shapes": 567, "strokes": 60, "subpaths": 570};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (54×)", "layer effects (shadows, glows, outlines, bevels…) (278×)"]
+affinity3-playing-cards.af	dpi=300;spreads=1;model_crc32=ac448123;counts={"depth": 5, "fills": 363, "gradients": 0, "groups": 758, "nodes": 1350, "segments": 4864, "shapes": 592, "strokes": 288, "subpaths": 656};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes)", "layer effects (shadows, glows, outlines, bevels…) (339×)"]
+patchy-adjust-curves.af	dpi=72;spreads=1;model_crc32=10a37502;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
+patchy-adjust-hsl.af	dpi=72;spreads=1;model_crc32=c65409b4;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
+patchy-artboards.af	dpi=72;spreads=1;model_crc32=f1ae5644;counts={"artboards": 2, "depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2};boards=["board-a:0.0000,0.0000,80.0000,60.0000", "board-b:100.0000,10.0000,160.0000,70.0000"];fonts={};warnings=[]
+patchy-blend-affinity.af	dpi=72;spreads=1;model_crc32=f6691ff9;counts={"depth": 2, "fills": 8, "gradients": 0, "images": 1, "layers": 1, "nodes": 10, "segments": 24, "shapes": 8, "strokes": 0, "subpaths": 8};boards=[];fonts={};warnings=["an unknown blend mode (imported as Normal) (2×)"]
+patchy-cmyk.af	dpi=72;spreads=1;model_crc32=5145b5a1;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["CMYK pixel layers (converted to RGB without the document's colour profile)"]
+patchy-dpi300.af	dpi=300;spreads=1;model_crc32=0c23e7c8;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-embedded-jpeg.af	dpi=72;spreads=1;model_crc32=090c674b;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-fx-blur.af	dpi=72;spreads=1;model_crc32=3f1b8b44;counts={"depth": 1, "images": 2, "nodes": 2};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (2×)"]
+patchy-fx-gradient.af	dpi=72;spreads=1;model_crc32=e868c992;counts={"depth": 1, "images": 3, "nodes": 3};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (3×)"]
+patchy-fx.af	dpi=72;spreads=1;model_crc32=5a1c34ac;counts={"depth": 1, "images": 5, "nodes": 5};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (5×)"]
+patchy-group.af	dpi=72;spreads=1;model_crc32=c217ab38;counts={"depth": 2, "images": 3, "layers": 1, "nodes": 4};boards=[];fonts={};warnings=[]
+patchy-incremental-chain.af	dpi=72;spreads=1;model_crc32=63ad778e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…)"]
+patchy-lab.af	dpi=72;spreads=1;model_crc32=01e8a926;counts={"depth": 1, "nodes": 1, "unsupported": 1};boards=[];fonts={};warnings=["pixel layers in grey, Lab or 32-bit formats"]
+patchy-lazy-placed.af	dpi=72;spreads=1;model_crc32=9ce9937e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-live-filter.af	dpi=72;spreads=1;model_crc32=30c5f8ee;counts={"depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 6, "shapes": 2, "strokes": 0, "subpaths": 2, "unsupported": 2};boards=[];fonts={};warnings=["adjustment layers", "unknown layers"]
+patchy-rgba16.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-rgba8.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-shapes-2.af	dpi=72;spreads=1;model_crc32=7828d3cd;counts={"depth": 1, "fills": 12, "gradients": 0, "nodes": 12, "segments": 62, "shapes": 12, "strokes": 0, "subpaths": 12};boards=[];fonts={};warnings=["cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse) (9×)"]
+patchy-shapes.af	dpi=72;spreads=1;model_crc32=e127e129;counts={"depth": 1, "fills": 4, "gradients": 0, "nodes": 4, "segments": 29, "shapes": 4, "strokes": 0, "subpaths": 4};boards=[];fonts={};warnings=["rectangles with straight, concave or other corner types (imported with round corners)"]
+patchy-text-artistic.af	dpi=72;spreads=1;model_crc32=b6137f6e;counts={"depth": 1, "nodes": 1, "text_chars": 5, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=[]
+patchy-text-caps.af	dpi=72;spreads=1;model_crc32=b5527e72;counts={"depth": 1, "nodes": 2, "text_chars": 21, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)"]
+patchy-text-frame.af	dpi=72;spreads=1;model_crc32=7a2cd32d;counts={"depth": 1, "nodes": 1, "text_chars": 11, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=["paragraph indents or spacing (imported with defaults)"]
+patchy-text-indent.af	dpi=72;spreads=1;model_crc32=30ee834c;counts={"depth": 1, "nodes": 2, "text_chars": 104, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)", "paragraph indents or spacing (imported with defaults) (2×)"]
+patchy-text-para-spacing.af	dpi=72;spreads=1;model_crc32=3d580ad2;counts={"depth": 1, "nodes": 1, "text_chars": 13, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)"]
+patchy-text-rotated.af	dpi=72;spreads=1;model_crc32=ad77772a;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)"]
+patchy-text-runs.af	dpi=72;spreads=1;model_crc32=a8da3052;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 5, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false", "Courier New:CourierNewPSMT:400:false", "Segoe UI Emoji:SegoeUIEmoji:400:false", "Times New Roman:TimesNewRomanPSMT:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)", "text uses a stored fallback font (imported with that font)"]
+patchy-transform.af	dpi=72;spreads=1;model_crc32=f8807611;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-vector-mask.af	dpi=72;spreads=1;model_crc32=1851fd90;counts={"depth": 1, "fills": 2, "gradients": 0, "nodes": 2, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2, "vector_masks": 1};boards=[];fonts={};warnings=["unknown layers attached to other layers (imported without them)"]
+patchy-vector.af	dpi=72;spreads=1;model_crc32=b89a91d3;counts={"depth": 1, "fills": 3, "gradients": 0, "nodes": 4, "segments": 17, "shapes": 4, "strokes": 2, "subpaths": 5};boards=[];fonts={};warnings=[]

crates/affinity/tests/support/corpus.rs

@@ -0,0 +1,30 @@
+//! Shared pinned corpus gate: an installed corpus must be complete and unmodified.
+#![allow(dead_code)]
+
+use std::path::PathBuf;
+
+#[path = "../../../../xtask/src/sha256.rs"]
+mod sha256;
+
+pub fn pinned() -> Option<PathBuf> {
+    // This helper is compiled in both affinity and engine integration tests.
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
+    let required = std::env::var_os("AFFINITY_CORPUS_REQUIRED").is_some_and(|v| v != "0");
+    if !dir.exists() {
+        assert!(!required, "required Affinity corpus absent: run `cargo xtask corpus --affinity`");
+        eprintln!("Affinity corpus absent: run `cargo xtask corpus --affinity` (CI sets AFFINITY_CORPUS_REQUIRED=1)");
+        return None;
+    }
+    assert!(dir.join("SOURCES.md").is_file(), "incomplete Affinity corpus: missing SOURCES.md; run `cargo xtask corpus --affinity`");
+    let manifest = include_str!("../../../../xtask/affinity-corpus.sha256");
+    let mut count = 0;
+    for line in manifest.lines().filter(|l| !l.trim().is_empty()) {
+        let (digest, name) = line.split_once("  ").expect("malformed pinned Affinity SHA256 manifest");
+        assert_eq!(digest.len(), 64, "invalid SHA256 for {name}");
+        let bytes = std::fs::read(dir.join(name)).unwrap_or_else(|e| panic!("missing pinned Affinity file {name}: {e}"));
+        assert_eq!(sha256::hex(&bytes), digest, "{name}: pinned corpus modified; run `cargo xtask corpus --affinity`");
+        count += 1;
+    }
+    assert!(count >= 4, "pinned Affinity manifest must include the four Affinity 3 .af fixtures");
+    Some(dir)
+}

crates/affinity/tests/support/features.rs

@@ -0,0 +1,63 @@
+//! Structural regression signatures, measured from the pinned files through our own reader.
+//! These freeze feature retention; they are not independent visual or compatibility oracles.
+//! The model CRC covers every decoded field via its Debug representation (including paths,
+//! paint, masks, image pixels and text runs). A deliberate reader/Debug change needs review;
+//! input authenticity is independently checked with SHA256 by the corpus gate.
+use std::collections::{BTreeMap, BTreeSet};
+use vectorcraft_affinity::model::{Document, Kind, Node};
+use vectorcraft_affinity::paint::Paint;
+
+pub fn signature(doc: &Document) -> String {
+    fn visit(nodes: &[Node], counts: &mut BTreeMap<&'static str, usize>, fonts: &mut BTreeSet<String>, boards: &mut Vec<String>, depth: usize) {
+        for n in nodes {
+            *counts.entry("nodes").or_default() += 1;
+            counts.entry("depth").and_modify(|v| *v = (*v).max(depth)).or_insert(depth);
+            let key = match &n.kind {
+                Kind::Layer => "layers",
+                Kind::Group => "groups",
+                Kind::Artboard { rect, .. } => {
+                    boards.push(format!("{}:{:.4},{:.4},{:.4},{:.4}", n.name, rect.x0, rect.y0, rect.x1, rect.y1));
+                    "artboards"
+                }
+                Kind::Shape { path, fills, strokes, .. } => {
+                    *counts.entry("subpaths").or_default() += path.subpaths.len();
+                    *counts.entry("segments").or_default() += path.subpaths.iter().map(|p| p.segments.len()).sum::<usize>();
+                    *counts.entry("fills").or_default() += fills.len();
+                    *counts.entry("strokes").or_default() += strokes.len();
+                    *counts.entry("gradients").or_default() += fills.iter().filter(|p| matches!(p, Paint::Gradient(_))).count();
+                    "shapes"
+                }
+                Kind::Text(t) => {
+                    *counts.entry("text_runs").or_default() += t.runs.len();
+                    *counts.entry("text_chars").or_default() += t.runs.iter().map(|r| r.text.chars().count()).sum::<usize>();
+                    for r in &t.runs {
+                        fonts.insert(format!("{}:{}:{}:{}", r.family, r.postscript, r.weight, r.italic));
+                    }
+                    "texts"
+                }
+                Kind::Image(_) => "images",
+                Kind::Unsupported => "unsupported",
+            };
+            *counts.entry(key).or_default() += 1;
+            for (key, yes) in
+                [("hidden", !n.visible), ("vector_masks", n.mask.is_some()), ("pixel_masks", n.pixel_mask.is_some()), ("opacity", n.opacity < 1.0)]
+            {
+                if yes {
+                    *counts.entry(key).or_default() += 1;
+                }
+            }
+            visit(&n.children, counts, fonts, boards, depth + 1);
+        }
+    }
+    let (mut counts, mut fonts, mut boards) = (BTreeMap::new(), BTreeSet::new(), Vec::new());
+    for spread in &doc.spreads {
+        visit(&spread.nodes, &mut counts, &mut fonts, &mut boards, 1);
+    }
+    let model_crc32 = crc32fast::hash(format!("{:?}", doc.spreads).as_bytes());
+    format!(
+        "dpi={};spreads={};model_crc32={model_crc32:08x};counts={counts:?};boards={boards:?};fonts={fonts:?};warnings={:?}",
+        doc.dpi,
+        doc.spreads.len(),
+        doc.warnings
+    )
+}

crates/affinity/tests/support/text_fixture.rs

@@ -0,0 +1,170 @@
+//! Original synthetic reader fixtures, shared by native and engine regression tests.
+//! These describe the reader's existing schema; no Affinity software or third-party parser was
+//! used to create them. They prove recovery/mapping behavior, not Affinity's layout or exporter.
+#![allow(dead_code)]
+
+use vectorcraft_affinity::synth::{self, F, Method, tag};
+
+pub fn array_f64(field: &[u8; 4], values: &[f64]) -> F {
+    let mut bytes = vec![0x8a];
+    bytes.extend(tag(field).0.to_le_bytes());
+    bytes.extend((values.len() as u32).to_le_bytes());
+    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
+    F::Raw(bytes)
+}
+
+pub fn array_i32(field: &[u8; 4], values: &[i32]) -> F {
+    let mut bytes = vec![0x87];
+    bytes.extend(tag(field).0.to_le_bytes());
+    bytes.extend((values.len() as u32).to_le_bytes());
+    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
+    F::Raw(bytes)
+}
+
+pub fn solid(alpha: f32) -> F {
+    F::Obj(
+        tag(b"FilS"),
+        vec![(
+            tag(b"Colr"),
+            F::Obj(tag(b"RGBA"), vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, alpha].iter().flat_map(|v| v.to_le_bytes()).collect()))]),
+        )],
+    )
+}
+
+pub fn attrs(family: &str, postscript: &str, weight: i32, italic: bool, size: f64) -> F {
+    let mut doubles = vec![0.0; 14];
+    doubles[0] = size;
+    doubles[4] = 0.025;
+    doubles[10] = 1.0;
+    doubles[13] = 30.0;
+    F::Obj(
+        tag(b"GAtt"),
+        vec![
+            (
+                tag(b"DFnt"),
+                F::Obj(
+                    tag(b"Font"),
+                    vec![
+                        (tag(b"Famy"), F::Str(family.into())),
+                        (tag(b"Post"), F::Str(postscript.into())),
+                        (tag(b"Wegt"), F::I32(weight)),
+                        (tag(b"Ital"), F::Bool(italic)),
+                    ],
+                ),
+            ),
+            (tag(b"Doub"), array_f64(b"Doub", &doubles)),
+            (tag(b"Ints"), array_i32(b"Ints", &[0, 0, 0, 0, 1])),
+            (tag(b"Objs"), F::Shared(vec![solid(1.0)])),
+        ],
+    )
+}
+
+pub fn run(end: i32, attrs: Option<F>) -> Vec<(vectorcraft_affinity::stream::Tag, F)> {
+    let mut fields = vec![(tag(b"Indx"), F::I32(end))];
+    if let Some(attrs) = attrs {
+        fields.push((tag(b"Item"), attrs));
+    }
+    fields
+}
+
+pub fn block(glyphs: F, runs: Vec<Vec<(vectorcraft_affinity::stream::Tag, F)>>, alignments: &[i32]) -> F {
+    F::Obj(
+        tag(b"StBl"),
+        vec![
+            (tag(b"Glyp"), glyphs),
+            (tag(b"GAtt"), F::Obj(tag(b"GlAS"), vec![(tag(b"Runs"), F::Objs(tag(b"GlAR"), runs))])),
+            (
+                tag(b"PAtt"),
+                F::Obj(
+                    tag(b"PaAS"),
+                    vec![(
+                        tag(b"Runs"),
+                        F::Objs(
+                            tag(b"PaAR"),
+                            alignments
+                                .iter()
+                                .map(|a| vec![(tag(b"Item"), F::Obj(tag(b"PAtt"), vec![(tag(b"Ints"), array_i32(b"Ints", &[*a]))]))])
+                                .collect(),
+                        ),
+                    )],
+                ),
+            ),
+        ],
+    )
+}
+
+pub fn utf8(text: &str) -> F {
+    F::Obj(tag(b"GStr"), vec![(tag(b"Utf8"), F::Str(text.into()))])
+}
+
+pub fn document(blocks: Vec<F>, frame: bool, dpi: f64, transform: [f64; 6]) -> Vec<u8> {
+    let text = F::Obj(
+        tag(if frame { b"TxtF" } else { b"TxtA" }),
+        vec![
+            (tag(b"StSt"), F::Obj(tag(b"Stry"), vec![(tag(b"Blok"), F::Shared(blocks))])),
+            (
+                tag(b"TxtH"),
+                F::Obj(
+                    tag(if frame { b"FrFr" } else { b"ArFr" }),
+                    vec![(tag(b"FrmB"), F::F64s(vec![10.0, 20.0, 210.0, 120.0])), (tag(b"ArtV"), F::F64(18.0))],
+                ),
+            ),
+            (tag(b"Xfrm"), F::F64s(transform.to_vec())),
+        ],
+    );
+    let mut root = vec![
+        (tag(b"UVCn"), F::Obj(tag(b"UVCn"), vec![(tag(b"UPPI"), F::F64(dpi))])),
+        (
+            tag(b"DocR"),
+            F::Obj(
+                tag(b"DocN"),
+                vec![(
+                    tag(b"Chld"),
+                    F::Shared(vec![F::Obj(
+                        tag(b"Sprd"),
+                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![text]))],
+                    )]),
+                )],
+            ),
+        ),
+    ];
+    let mut next_id = 1000;
+    for (_, value) in &mut root {
+        shared_objects(value, &mut next_id);
+    }
+    let stream = synth::stream(&root);
+    synth::container(&[("doc.dat", &stream, Method::Zlib)], None)
+}
+
+pub const IDENTITY: [f64; 6] = [1.0, 0.0, 0.0, 0.0, 1.0, 0.0];
+
+// Shared arrays require definitions/references, whereas inline fields use Obj. Give the original
+// fixture objects independent shared IDs without making the fixture descriptions noisy.
+fn shared_objects(value: &mut F, next_id: &mut u32) {
+    match value {
+        F::Shared(items) => {
+            for item in items {
+                if let F::Obj(class, fields) = item {
+                    let class = *class;
+                    let fields = std::mem::take(fields);
+                    *next_id += 1;
+                    *item = F::Def(*next_id, vec![class], fields);
+                }
+                shared_objects(item, next_id);
+            }
+        }
+        F::Obj(_, fields) | F::Def(_, _, fields) => {
+            for (_, value) in fields {
+                shared_objects(value, next_id);
+            }
+        }
+        F::Objs(_, items) => {
+            for fields in items {
+                for (_, value) in fields {
+                    shared_objects(value, next_id);
+                }
+            }
+        }
+        _ => {}
+    }
+}

crates/affinity/tests/text.rs

@@ -0,0 +1,322 @@
+//! Synthetic `.af` version-12 text regression oracles; see support/text_fixture.rs for provenance.
+//! Unicode ranges below test the scalar-index contract corroborated by the pinned Affinity 3
+//! mixed-run fixture. Broad complex typography still needs independent visual validation.
+#![cfg(feature = "synth")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+mod support {
+    pub mod corpus;
+    pub mod text_fixture;
+}
+use support::text_fixture::*;
+use vectorcraft_affinity::{
+    Document, Limits,
+    model::{Align, Kind, Text},
+    paint::{Color, Paint},
+    synth::{F, tag},
+};
+
+fn read(blocks: Vec<F>) -> Document {
+    vectorcraft_affinity::read(&document(blocks, false, 96.0, IDENTITY), Limits::default()).unwrap()
+}
+fn text(d: &Document) -> &Text {
+    match &d.spreads[0].nodes[0].kind {
+        Kind::Text(t) => t,
+        other => panic!("expected text, got {other:?}"),
+    }
+}
+fn content(t: &Text) -> String {
+    t.runs.iter().map(|r| r.text.as_str()).collect()
+}
+fn warning(d: &Document, needle: &str) -> bool {
+    d.warnings.iter().any(|w| w.contains(needle))
+}
+
+#[test]
+fn mixed_fonts_keep_unicode_and_attribute_boundaries() {
+    let d = read(vec![block(
+        utf8("Aé😀e\u{301}אב日本\u{2028}x\u{2029}\0"),
+        vec![
+            run(3, Some(attrs("Family One", "FamilyOne-Regular", 400, false, 16.0))),
+            run(9, Some(attrs("Family Two", "FamilyTwo-BoldItalic", 700, true, 24.0))),
+            run(13, Some(attrs("Family Three", "FamilyThree-Light", 300, false, 20.0))),
+        ],
+        &[1],
+    )]);
+    let t = text(&d);
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["Aé😀", "e\u{301}אב日本", "\u{2028}x\u{2029}"]);
+    assert_eq!(content(t), "Aé😀e\u{301}אב日本\u{2028}x\u{2029}");
+    assert_eq!(
+        (t.runs[1].family.as_str(), t.runs[1].postscript.as_str(), t.runs[1].weight, t.runs[1].italic),
+        ("Family Two", "FamilyTwo-BoldItalic", 700, true)
+    );
+    assert_eq!((t.runs[1].size, t.runs[1].tracking, t.runs[1].leading), (24.0, 0.025, Some(30.0)));
+    assert!(matches!(t.runs[1].fill, Paint::Solid(Color::Rgb { a: 1.0, .. })));
+    assert_eq!(t.align, Align::Center);
+    assert_eq!((t.anchor.x, t.anchor.y), (110.0, 38.0));
+    assert!(d.warnings.is_empty(), "{:?}", d.warnings);
+}
+
+#[test]
+fn missing_attributes_and_uncovered_tail_preserve_characters() {
+    for runs in [vec![], vec![run(2, None)], vec![run(2, Some(attrs("First", "", 400, false, 14.0)))]] {
+        let d = read(vec![block(utf8("é😀 tail\0"), runs, &[])]);
+        assert_eq!(content(text(&d)), "é😀 tail");
+        assert!(warning(&d, "text without character attributes"));
+        assert!(matches!(text(&d).runs.last().unwrap().fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
+        assert_eq!(text(&d).runs.last().unwrap().size, 16.0); // Recovery default: 12 pt at 96 dpi.
+    }
+}
+
+#[test]
+fn malformed_ranges_do_not_discard_the_story() {
+    let mut missing = run(1, None);
+    missing.clear();
+    let d = read(vec![block(
+        utf8("abcdef"),
+        vec![missing, run(-1, None), run(3, Some(attrs("First", "", 400, false, 10.0))), run(2, None), run(i32::MAX, None)],
+        &[],
+    )]);
+    assert_eq!(content(text(&d)), "abcdef");
+    assert_eq!(text(&d).runs[0].text, "abc");
+    assert!(warning(&d, "invalid text attribute range"));
+}
+
+#[test]
+fn inline_fields_count_for_ranges_but_are_reported_and_omitted() {
+    let glyphs = F::Obj(
+        tag(b"GStr"),
+        vec![(
+            tag(b"Mixd"),
+            F::Objs(
+                tag(b"MixS"),
+                vec![
+                    vec![(tag(b"Glys"), F::Shared(vec![F::Obj(tag(b"FldN"), vec![])])), (tag(b"Utf8"), F::Str("é😀".into()))],
+                    vec![(tag(b"Utf8"), F::Str("尾\0".into()))],
+                ],
+            ),
+        )],
+    );
+    let d =
+        read(vec![block(glyphs, vec![run(3, Some(attrs("First", "", 400, false, 10.0))), run(5, Some(attrs("Second", "", 700, false, 15.0)))], &[])]);
+    assert_eq!(text(&d).runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["é😀", "尾"]);
+    assert!(warning(&d, "text fields such as page numbers"));
+}
+
+#[test]
+fn mixed_paragraph_alignments_are_explicitly_reported() {
+    let d = read(vec![block(utf8("one\u{2029}"), vec![run(4, None)], &[2]), block(utf8("two"), vec![run(3, None)], &[0, 1])]);
+    assert_eq!(content(text(&d)), "one\u{2029}two");
+    assert_eq!(text(&d).align, Align::Right);
+    assert!(warning(&d, "mixed paragraph alignments"));
+}
+
+#[test]
+fn unknown_alignment_and_invalid_font_weight_have_honest_fallbacks() {
+    let d = read(vec![block(utf8("test"), vec![run(4, Some(attrs("", "OnlyPostScript", -50, true, f64::NAN)))], &[99])]);
+    assert_eq!((text(&d).runs[0].weight, text(&d).runs[0].size), (400, 16.0));
+    assert_eq!(text(&d).align, Align::Left);
+    assert!(warning(&d, "invalid font weight"));
+    assert!(warning(&d, "unknown paragraph alignment"));
+}
+
+#[test]
+fn unreadable_block_does_not_remove_later_readable_text() {
+    let d = read(vec![F::Obj(tag(b"StBl"), vec![]), block(utf8("still here"), vec![], &[])]);
+    assert_eq!(content(text(&d)), "still here");
+    assert!(warning(&d, "a text block without readable characters"));
+}
+
+#[test]
+fn text_budget_preserves_prefix_and_reports_truncation() {
+    let d = read(vec![block(utf8(&"é".repeat((1 << 20) + 1)), vec![], &[]), block(utf8("later"), vec![], &[])]);
+    assert_eq!(content(text(&d)).chars().count(), 1 << 20);
+    assert!(content(text(&d)).chars().all(|c| c == 'é'));
+    assert!(warning(&d, "text longer than a million characters"));
+}
+
+#[test]
+fn boolean_opentype_and_observed_all_caps_selector_are_kept() {
+    let mut a = attrs("Family", "", 400, false, 12.0);
+    let settings = F::Obj(
+        tag(b"OtAt"),
+        vec![(
+            tag(b"Setn"),
+            F::Objs(
+                tag(b"OTFS"),
+                vec![
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"liga"))), (tag(b"Valu"), F::I32(0))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"CAP\x01"))), (tag(b"Valu"), F::I32(1))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"salt"))), (tag(b"Valu"), F::I32(2))],
+                ],
+            ),
+        )],
+    );
+    if let F::Obj(_, fields) = &mut a {
+        let objects = fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap();
+        objects.1 = F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let d = read(vec![block(utf8("Mixed"), vec![run(5, Some(a))], &[])]);
+    assert_eq!(text(&d).runs[0].features, ["smcp", "-liga"]);
+    assert!(text(&d).runs[0].all_caps);
+    assert_eq!(content(text(&d)), "Mixed");
+    assert!(warning(&d, "non-boolean OpenType settings"));
+}
+
+#[test]
+fn stored_fallback_font_is_used_only_when_it_names_a_font() {
+    for (family, expected) in [("", "Requested"), ("Emoji Family", "Emoji Family")] {
+        let mut a = attrs("Requested", "RequestedPS", 700, true, 12.0);
+        if let F::Obj(_, fields) = &mut a {
+            fields.push((tag(b"RFnt"), F::Obj(tag(b"Font"), vec![(tag(b"Famy"), F::Str(family.into())), (tag(b"Wegt"), F::I32(400))])));
+        }
+        let d = read(vec![block(utf8("😀"), vec![run(1, Some(a))], &[])]);
+        assert_eq!(text(&d).runs[0].family, expected);
+        assert_eq!(warning(&d, "stored fallback font"), !family.is_empty());
+    }
+}
+
+#[test]
+fn real_affinity3_text_fixtures_confirm_unicode_and_caps_fields() {
+    let Some(corpus) = support::corpus::pinned() else { return };
+    // Files fetched at the commit and sha256 in xtask/affinity-corpus.sha256. No Patchy parser
+    // source was read; assertions describe this crate's parsing of its published MIT documents.
+    let load = |name: &str| vectorcraft_affinity::read(&std::fs::read(corpus.join(name)).unwrap(), Limits::default()).unwrap();
+    let d = load("patchy-text-runs.af");
+    let t = text(&d);
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["AB", "cd", "É", "😀", "X"]);
+    assert_eq!(t.runs[3].family, "Segoe UI Emoji");
+    assert_eq!(t.runs[4].family, "Courier New");
+    assert!(warning(&d, "stored fallback font"));
+    let d = load("patchy-text-caps.af");
+    let texts: Vec<_> = d.spreads[0].nodes.iter().filter_map(|n| if let Kind::Text(t) = &n.kind { Some(t) } else { None }).collect();
+    assert_eq!(texts.len(), 2);
+    assert!(texts[0].runs[0].all_caps);
+    assert_eq!(texts[1].runs[0].features, ["smcp"]);
+    for name in ["patchy-text-indent.af", "patchy-text-para-spacing.af"] {
+        let d = load(name);
+        assert!(warning(&d, "paragraph indents or spacing"), "{name}: {:?}", d.warnings);
+    }
+}
+
+proptest::proptest! {
+    #![proptest_config(proptest::test_runner::Config::with_cases(64))]
+    #[test]
+    fn arbitrary_unicode_survives_damaged_attribute_ranges(
+        chars in proptest::collection::vec(proptest::prelude::any::<char>(), 0..128),
+        ends in proptest::collection::vec(-10i32..200, 0..32),
+    ) {
+        let original: String = chars.into_iter().collect();
+        let expected: String = original.chars().filter(|c| *c != '\0' && *c != '\u{FFFC}').collect();
+        let d = read(vec![block(utf8(&original), ends.into_iter().map(|end| run(end, None)).collect(), &[])]);
+        proptest::prop_assert_eq!(content(text(&d)), expected);
+    }
+}
+
+#[test]
+fn partially_missing_attributes_use_visible_fill_but_explicit_no_fill_is_kept() {
+    let empty = F::Obj(tag(b"GAtt"), vec![]);
+    let none = F::Obj(tag(b"GAtt"), vec![(tag(b"Objs"), F::Shared(vec![F::Obj(tag(b"FilN"), vec![])]))]);
+    let d = read(vec![block(utf8("ab"), vec![run(1, Some(empty)), run(2, Some(none))], &[])]);
+    assert!(matches!(text(&d).runs[0].fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
+    assert_eq!(text(&d).runs[1].fill, Paint::None);
+    assert_eq!(content(text(&d)), "ab");
+    assert!(warning(&d, "without readable fill attributes"));
+}
+
+#[test]
+fn excessive_feature_settings_are_bounded_and_reported() {
+    let mut a = attrs("Family", "", 400, false, 12.0);
+    if let F::Obj(_, fields) = &mut a {
+        let settings = F::Obj(
+            tag(b"OtAt"),
+            vec![(
+                tag(b"Setn"),
+                F::Objs(
+                    tag(b"OTFS"),
+                    (0..257).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
+                ),
+            )],
+        );
+        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
+            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let d = read(vec![block(utf8("x"), vec![run(1, Some(a))], &[])]);
+    assert_eq!(text(&d).runs[0].features.len(), 256);
+    assert!(warning(&d, "more than 256 text feature settings"));
+}
+
+#[test]
+fn shared_font_metadata_amplification_is_bounded_without_losing_characters() {
+    let mut a = attrs(&"F".repeat(16 * 1024), &"P".repeat(16 * 1024), 400, false, 12.0);
+    if let F::Obj(_, fields) = &mut a {
+        let settings = F::Obj(
+            tag(b"OtAt"),
+            vec![(
+                tag(b"Setn"),
+                F::Objs(
+                    tag(b"OTFS"),
+                    (0..256).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
+                ),
+            )],
+        );
+        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
+            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let F::Obj(class, fields) = a else { panic!("attributes must be an object") };
+    let mut runs = vec![run(1, Some(F::Def(42, vec![class], fields)))];
+    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
+    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
+    let t = text(&d);
+    assert_eq!(content(t), "x".repeat(1000));
+    assert_eq!(t.runs.len(), 1000);
+    let metadata: usize = t
+        .runs
+        .iter()
+        .flat_map(|r| [&r.family, &r.postscript].into_iter().chain(r.features.iter()))
+        .filter(|s| !s.is_empty())
+        .map(|s| s.len() + std::mem::size_of::<String>())
+        .sum();
+    assert!(metadata <= 16 << 20, "shared metadata was amplified to {metadata} bytes");
+    assert_eq!(t.runs[0].family.len(), 16 * 1024);
+    assert_eq!(t.runs[0].features.len(), 256);
+    assert!(t.runs.last().unwrap().family.is_empty());
+    assert!(t.runs.last().unwrap().features.is_empty());
+    assert!(warning(&d, "text attribute budget exceeded"));
+}
+
+#[test]
+fn shared_gradient_attributes_are_bounded_without_losing_characters() {
+    let color =
+        F::Def(43, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, 1.0].iter().flat_map(|v| v.to_le_bytes()).collect()))]);
+    let mut colors = vec![color];
+    colors.extend((1..1024).map(|_| F::Ref(43)));
+    let positions = (0..1024).map(|i| [(i as f32) / 1023.0, 0.5].iter().flat_map(|v| v.to_le_bytes()).collect()).collect();
+    let gradient = F::Obj(
+        tag(b"FilG"),
+        vec![(tag(b"Grad"), F::Obj(tag(b"Grad"), vec![(tag(b"Cols"), F::Shared(colors)), (tag(b"Posn"), F::Records(8, positions))]))],
+    );
+    let attrs = F::Def(42, vec![tag(b"GAtt")], vec![(tag(b"Objs"), F::Shared(vec![gradient]))]);
+    let mut runs = vec![run(1, Some(attrs))];
+    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
+    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
+    let t = text(&d);
+    assert_eq!(content(t), "x".repeat(1000));
+    assert_eq!(t.runs.len(), 1000);
+    let stop_count: usize = t
+        .runs
+        .iter()
+        .map(|r| match &r.fill {
+            Paint::Gradient(g) => g.stops.len(),
+            _ => 0,
+        })
+        .sum();
+    assert!(stop_count > 0);
+    assert!(stop_count * std::mem::size_of::<vectorcraft_affinity::paint::Stop>() <= 16 << 20);
+    let Paint::Gradient(first) = &t.runs[0].fill else { panic!("first gradient must fit") };
+    assert_eq!(first.stops.len(), 1024);
+    assert!(matches!(t.runs.last().unwrap().fill, Paint::Solid(_)));
+    assert!(warning(&d, "text attribute budget exceeded"));
+    assert!(!warning(&d, "text without character attributes"), "budget recovery must not claim source attributes are absent");
+}

crates/brush/src/calli.rs

@@ -4,13 +4,21 @@
 //! in the directions normal to the path. For nib axes `u`, `v` with semi-axes `a`, `b` the
 //! support point in direction `d` is `(a²(u·d)u + b²(v·d)v) / √(a²(u·d)² + b²(v·d)²)`, so the
 //! stroke's local width across direction `n` is `2·√(a²(u·n)² + b²(v·n)²)`.
+//!
+//! A Calligraphic brush with Pressure variation changes its nib along the stroke with the pen
+//! pressure recorded on it (`StrokeLayer::pressure`): the sweep is sampled densely and each
+//! sample takes the nib for the pressure there.
 
 use vectorcraft_color::Paint;
-use vectorcraft_doc::Node;
+use vectorcraft_doc::{Node, PressureProfile, StrokeLayer};
 use vectorcraft_geom::{BezPath, PathData, Point, SubPath, Vec2};
 
 use crate::track::{Rng, Track, normal, seed_of, tracks};
-use crate::{Bristle, BristleShape, Calligraphic, filled, tolerance};
+use crate::{Bristle, BristleShape, Calligraphic, Variation, filled, tolerance};
+
+/// The most pieces a varying nib cuts one segment of a subpath into, and about how many samples
+/// it takes along a whole subpath.
+const MAX_STEPS: f64 = 1024.0;
 
 /// An elliptical nib.
 #[derive(Clone, Copy, Debug)]
@@ -43,39 +51,53 @@ fn rot(base: Vec2, angle: f64) -> Vec2 {
     base * angle.cos() + normal(base) * angle.sin()
 }
 
-/// Samples (point, tangent) along a track, with extra tangents fanned in at corners so the
-/// outer edge of the sweep follows the nib around the corner.
-fn samples(t: &Track) -> Vec<(Point, Vec2)> {
+/// Samples (point, tangent, fraction of the track's length) along a track, with extra tangents
+/// fanned in at corners so the outer edge of the sweep follows the nib around the corner. `step`
+/// (for a nib that varies along the track): segments are cut into pieces at most that long.
+fn samples(t: &Track, step: Option<f64>) -> Vec<(Point, Vec2, f64)> {
     let mut out = vec![];
     let n = t.segments();
+    let len = t.len().max(1e-12);
     for i in 0..=n {
         let p = t.verts[i];
+        let f = t.cum[i] / len;
         if t.corner[i] {
             let (a, b) = t.in_out(i);
             let turn = a.cross(b).atan2(a.dot(b));
             let steps = (turn.abs() / 10f64.to_radians()).ceil().max(1.0) as usize;
             for k in 0..=steps {
-                out.push((p, rot(a, turn * k as f64 / steps as f64)));
+                out.push((p, rot(a, turn * k as f64 / steps as f64), f));
             }
         } else {
-            out.push((p, t.tangents[i]));
+            out.push((p, t.tangents[i], f));
+        }
+        if let Some(step) = step
+            && i < n
+        {
+            let seg = t.cum[i + 1] - t.cum[i];
+            let pieces = (seg / step).ceil().clamp(1.0, MAX_STEPS) as usize;
+            for k in 1..pieces {
+                let u = k as f64 / pieces as f64;
+                out.push((p.lerp(t.verts[i + 1], u), t.dirs[i], (t.cum[i] + seg * u) / len));
+            }
         }
     }
     out
 }
 
-/// The swept outline of `nib` along `t` as closed subpaths.
-pub(crate) fn sweep(t: &Track, nib: &Nib) -> Vec<SubPath> {
-    let s = samples(t);
-    let left: Vec<Point> = s.iter().map(|(p, tg)| *p + nib.support(normal(*tg))).collect();
-    let right: Vec<Point> = s.iter().map(|(p, tg)| *p + nib.support(-normal(*tg))).collect();
+/// The swept outline along `t` of the nib `nib(f)` (`f`: the fraction of the track's length) as
+/// closed subpaths. `step`: how often a varying nib is sampled (None: a constant nib).
+pub(crate) fn sweep(t: &Track, nib: &dyn Fn(f64) -> Nib, step: Option<f64>) -> Vec<SubPath> {
+    let s = samples(t, step);
+    let left: Vec<Point> = s.iter().map(|(p, tg, f)| *p + nib(*f).support(normal(*tg))).collect();
+    let right: Vec<Point> = s.iter().map(|(p, tg, f)| *p + nib(*f).support(-normal(*tg))).collect();
     if t.closed {
         let mut r = right;
         r.reverse();
         return vec![SubPath::polyline(&left, true), SubPath::polyline(&r, true)];
     }
-    let cap = |p: Point, tg: Vec2, from: f64, to: f64, out: &mut Vec<Point>| {
-        let steps = 16;
+    let cap = |(p, tg, f): (Point, Vec2, f64), from: f64, to: f64, out: &mut Vec<Point>| {
+        let (steps, nib) = (16, nib(f));
         for k in 1..steps {
             let ang = from + (to - from) * k as f64 / steps as f64;
             out.push(p + nib.support(rot(tg, ang)));
@@ -83,31 +105,66 @@ pub(crate) fn sweep(t: &Track, nib: &Nib) -> Vec<SubPath> {
     };
     let half = std::f64::consts::FRAC_PI_2;
     let mut poly = left.clone();
-    let (Some(&(pe, te)), Some(&(ps, ts))) = (s.last(), s.first()) else { return Vec::new() };
-    cap(pe, te, half, -half, &mut poly);
+    let (Some(&end), Some(&start)) = (s.last(), s.first()) else { return Vec::new() };
+    cap(end, half, -half, &mut poly);
     poly.extend(right.iter().rev());
-    cap(ps, ts, -half, -3.0 * half, &mut poly);
+    cap(start, -half, -3.0 * half, &mut poly);
     vec![SubPath::polyline(&poly, true)]
 }
 
-fn randomized(c: &Calligraphic, rng: &mut Rng) -> (f64, f64, f64) {
-    let [va, vr, vs] = c.variation;
-    let angle = c.angle + rng.range(-va, va);
-    let round = (c.roundness + rng.range(-vr, vr)).clamp(1.0, 100.0);
-    let size = (c.size + rng.range(-vs, vs)).max(0.05);
-    (angle, round, size)
+/// The stroke's angle, roundness and size: Random ones drawn for this stroke (from `rng`), the
+/// others the brush's values.
+fn randomized(c: &Calligraphic, rng: &mut Rng) -> [f64; 3] {
+    let mut out = [c.angle, c.roundness, c.size];
+    for ((v, var), mode) in out.iter_mut().zip(c.variation).zip(c.modes()) {
+        // Every value draws, so a stroke's random values stay the same whatever the other modes.
+        let r = rng.range(-var, var);
+        if mode == Variation::Random {
+            *v += r;
+        }
+    }
+    let [angle, round, size] = out;
+    [angle, round.clamp(1.0, 100.0), size.max(0.05)]
 }
 
-pub(crate) fn calligraphic(c: &Calligraphic, bp: &BezPath, weight: f64, paint: &Paint, name: &str) -> Vec<Node> {
+/// The nib's angle, roundness and size at pen pressure `p` (0..1): each Pressure value goes from
+/// the brush's value less its variation (lightest) to the value plus the variation (heaviest),
+/// kept within its range; the others are `base`'s.
+fn pressured(c: &Calligraphic, base: [f64; 3], p: f64) -> [f64; 3] {
+    let values = [c.angle, c.roundness, c.size];
+    let mut out = base;
+    for (i, (v, mode)) in out.iter_mut().zip(c.modes()).enumerate() {
+        let (Some(&value), Some(&var), Some(&(lo, hi))) = (values.get(i), c.variation.get(i), Calligraphic::RANGES.get(i)) else { continue };
+        if mode == Variation::Pressure {
+            let x = value + var * (2.0 * p.clamp(0.0, 1.0) - 1.0);
+            *v = if x.is_finite() { x.clamp(lo, hi) } else { value.clamp(lo, hi) };
+        }
+    }
+    let [angle, round, size] = out;
+    [angle, round.clamp(1.0, 100.0), size.max(0.05)]
+}
+
+pub(crate) fn calligraphic(c: &Calligraphic, bp: &BezPath, weight: f64, stroke: &StrokeLayer, name: &str) -> Vec<Node> {
     let mut rng = Rng::new(seed_of(bp, name));
-    let (angle, round, size) = randomized(c, &mut rng);
-    let size = size * weight;
-    let nib = Nib::new(angle, round / 100.0, size);
-    let subs: Vec<SubPath> = tracks(bp, tolerance(size)).iter().flat_map(|t| sweep(t, &nib)).collect();
+    let base = randomized(c, &mut rng);
+    let subs: Vec<SubPath> = if c.uses_pressure() {
+        let pressure = stroke.pressure.as_ref();
+        let nib = |f: f64| {
+            let [angle, round, size] = pressured(c, base, pressure.map_or(PressureProfile::MID, |p| p.at(f)));
+            Nib::new(angle, round / 100.0, size * weight)
+        };
+        // Flattened for the largest nib the pressure gives.
+        let size = pressured(c, base, 0.0)[2].max(pressured(c, base, 1.0)[2]) * weight;
+        tracks(bp, tolerance(size)).iter().flat_map(|t| sweep(t, &nib, Some((t.len() / MAX_STEPS).max(0.25)))).collect()
+    } else {
+        let [angle, round, size] = base;
+        let nib = Nib::new(angle, round / 100.0, size * weight);
+        tracks(bp, tolerance(size * weight)).iter().flat_map(|t| sweep(t, &|_| nib, None)).collect()
+    };
     if subs.is_empty() {
         return vec![];
     }
-    vec![filled(PathData::new(subs), paint)]
+    vec![filled(PathData::new(subs), &stroke.paint)]
 }
 
 /// Offset a track sideways by `d` (a polyline following it).
@@ -165,7 +222,7 @@ pub(crate) fn bristle(b: &Bristle, bp: &BezPath, weight: f64, paint: &Paint, nam
             let Some(sp) = offset_track(&t, off, t0.min(l * 0.3), t1.min(l * 0.3)) else { continue };
             let w = thick * (0.6 + 0.4 * edge) * rng.range(0.8, 1.2);
             let nib = Nib::new(0.0, 1.0, w);
-            let subs: Vec<SubPath> = tracks(&sp, tolerance(w)).iter().flat_map(|tt| sweep(tt, &nib)).collect();
+            let subs: Vec<SubPath> = tracks(&sp, tolerance(w)).iter().flat_map(|tt| sweep(tt, &|_| nib, None)).collect();
             if subs.is_empty() {
                 continue;
             }

crates/brush/src/defaults.rs

@@ -132,7 +132,7 @@ fn diamond_tile() -> Node {
 }
 
 fn calli(name: &str, angle: f64, roundness: f64, size: f64) -> Brush {
-    Brush { name: name.into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, variation: [0.0; 3] }) }
+    Brush { name: name.into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, ..Default::default() }) }
 }
 
 /// The default library.

crates/brush/src/lib.rs

@@ -99,13 +99,69 @@ pub struct Calligraphic {
     pub roundness: f64,
     /// Nib diameter in points.
     pub size: f64,
-    /// Random variation per stroke: angle (°), roundness (%), size (pt).
+    /// How far angle (°), roundness (%) and size (pt) vary each way, as [`Self::modes`] say.
     pub variation: [f64; 3],
+    /// How angle, roundness and size vary. `None` (brushes saved before there were modes): Random
+    /// where the variation is non-zero, else Fixed — see [`Calligraphic::modes`].
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub modes: Option<[Variation; 3]>,
 }
 
 impl Default for Calligraphic {
     fn default() -> Self {
-        Self { angle: 0.0, roundness: 100.0, size: 3.0, variation: [0.0; 3] }
+        Self { angle: 0.0, roundness: 100.0, size: 3.0, variation: [0.0; 3], modes: None }
+    }
+}
+
+impl Calligraphic {
+    /// The ranges of angle (°), roundness (%) and size (pt), and the most each varies.
+    pub const RANGES: [(f64, f64); 3] = [(-180.0, 180.0), (0.0, 100.0), (0.0, 1296.0)];
+    pub const MAX_VARIATION: [f64; 3] = [180.0, 100.0, 1296.0];
+
+    /// How angle, roundness and size vary.
+    pub fn modes(&self) -> [Variation; 3] {
+        self.modes.unwrap_or_else(|| self.variation.map(|v| if v != 0.0 { Variation::Random } else { Variation::Fixed }))
+    }
+    /// Does the pen's pressure change the nib?
+    pub fn uses_pressure(&self) -> bool {
+        self.modes().contains(&Variation::Pressure)
+    }
+}
+
+/// How a Calligraphic brush's angle, roundness or size varies (Brush Options). Saved by name: new
+/// modes are appended, never renamed.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Variation {
+    /// Always the value.
+    #[default]
+    Fixed,
+    /// A random value within the variation either side, new for each stroke.
+    Random,
+    /// From the value less the variation at the lightest pen pressure to the value plus the
+    /// variation at the heaviest.
+    Pressure,
+}
+
+impl Variation {
+    pub const ALL: [Variation; 3] = [Variation::Fixed, Variation::Random, Variation::Pressure];
+    /// The name brush definitions use.
+    pub fn id(self) -> &'static str {
+        match self {
+            Variation::Fixed => "fixed",
+            Variation::Random => "random",
+            Variation::Pressure => "pressure",
+        }
+    }
+    pub fn label(self) -> &'static str {
+        match self {
+            Variation::Fixed => "Fixed",
+            Variation::Random => "Random",
+            Variation::Pressure => "Pressure",
+        }
+    }
+    pub fn parse(id: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|v| v.id() == id)
     }
 }
 
@@ -345,7 +401,7 @@ fn tolerance(scale: f64) -> f64 {
 pub fn stroke_pieces(brush: &Brush, bp: &BezPath, stroke: &StrokeLayer) -> Vec<Node> {
     let w = if stroke.width > 0.0 { stroke.width } else { 1.0 };
     let mut out = match &brush.kind {
-        BrushKind::Calligraphic(c) => calli::calligraphic(c, bp, w, &stroke.paint, &brush.name),
+        BrushKind::Calligraphic(c) => calli::calligraphic(c, bp, w, stroke, &brush.name),
         BrushKind::Bristle(b) => calli::bristle(b, bp, w, &stroke.paint, &brush.name),
         BrushKind::Art(a) => warp::art(a, bp, w),
         BrushKind::Scatter(s) => warp::scatter(s, bp, w, &brush.name),

crates/brush/src/tests.rs

@@ -16,7 +16,7 @@ fn stroke(w: f64) -> StrokeLayer {
 }
 
 fn calli(angle: f64, roundness: f64, size: f64) -> Brush {
-    Brush { name: "c".into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, variation: [0.0; 3] }) }
+    Brush { name: "c".into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, ..Default::default() }) }
 }
 
 fn bounds(nodes: &[Node]) -> Rect {
@@ -334,3 +334,116 @@ fn expand_keeps_fill_and_adds_pieces() {
     let plain = Node::path(NodeId(9), shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0)), Appearance::default_art());
     assert!(expand(&d, &plain).is_none());
 }
+
+/// A Calligraphic brush (round nib) whose size follows the pen pressure by `var` either way.
+fn pressure_calli(size: f64, var: f64) -> Brush {
+    let c = Calligraphic {
+        size,
+        variation: [0.0, 0.0, var],
+        modes: Some([Variation::Fixed, Variation::Fixed, Variation::Pressure]),
+        ..Default::default()
+    };
+    Brush { name: "p".into(), kind: BrushKind::Calligraphic(c) }
+}
+
+/// The stroke's half-width (largest |y|) among outline points with x in `x0..x1`.
+fn half_width(nodes: &[Node], x0: f64, x1: f64) -> f64 {
+    let mut pts = vec![];
+    for n in nodes {
+        all_points(n, &mut pts);
+    }
+    pts.iter().filter(|p| p.x >= x0 && p.x <= x1).map(|p| p.y.abs()).fold(0.0, f64::max)
+}
+
+fn pressed(points: Vec<(f64, f64)>) -> StrokeLayer {
+    StrokeLayer { pressure: Some(vectorcraft_doc::PressureProfile { points }), ..stroke(1.0) }
+}
+
+/// #852: with Size on Pressure the nib goes from size − variation at the lightest pressure to
+/// size + variation at the heaviest, along the stroke where the pen pressed.
+#[test]
+fn pressure_maps_to_size_along_the_stroke() {
+    let b = pressure_calli(10.0, 4.0);
+    let light_to_heavy = pressed(vec![(0.0, 0.0), (1.0, 1.0)]);
+    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &light_to_heavy);
+    // Lightest: 6 pt (half 3); heaviest: 14 pt (half 7); in between the pressure there.
+    assert!(near(half_width(&out, 0.5, 1.5), 3.0, 0.1), "{}", half_width(&out, 0.5, 1.5));
+    assert!(near(half_width(&out, 98.5, 99.5), 7.0, 0.1), "{}", half_width(&out, 98.5, 99.5));
+    assert!(near(half_width(&out, 49.5, 50.5), 5.0, 0.1), "{}", half_width(&out, 49.5, 50.5));
+    // The stroke weight scales it.
+    let heavy = StrokeLayer { width: 2.0, ..light_to_heavy };
+    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &heavy);
+    assert!(near(half_width(&out, 98.5, 99.5), 14.0, 0.2));
+    // No pressure recorded (a mouse, or a path the brush was applied to): the size itself.
+    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &stroke(1.0));
+    assert!(near(bounds(&out).height(), 10.0, 0.05), "{:?}", bounds(&out));
+    // Kept within the valid range: 2 ± 4 never goes below nothing.
+    let out = stroke_pieces(&pressure_calli(2.0, 4.0), &line(0.0, 0.0, 100.0, 0.0), &pressed(vec![(0.0, 0.0), (1.0, 0.0)]));
+    assert!(!out.is_empty() && bounds(&out).height() < 0.2, "{:?}", bounds(&out));
+}
+
+/// Angle and roundness follow the pressure the same way, clamped to their ranges.
+#[test]
+fn pressure_varies_angle_and_roundness() {
+    let c = |modes| Calligraphic { angle: 0.0, roundness: 60.0, size: 10.0, variation: [90.0, 60.0, 0.0], modes: Some(modes) };
+    let horizontal = line(0.0, 0.0, 100.0, 0.0);
+    let draw = |c: Calligraphic, p: f64| {
+        let b = Brush { name: "a".into(), kind: BrushKind::Calligraphic(c) };
+        bounds(&stroke_pieces(&b, &horizontal, &pressed(vec![(0.0, p), (1.0, p)]))).height()
+    };
+    use Variation::{Fixed, Pressure};
+    // Angle 0 ± 90: heavy pressure stands the flat nib up across the stroke.
+    assert!(near(draw(c([Pressure, Fixed, Fixed]), 0.5), 6.0, 0.05));
+    assert!(near(draw(c([Pressure, Fixed, Fixed]), 1.0), 10.0, 0.05));
+    // Roundness 60 ± 60, kept within 1..100: light is a hairline, heavy is round.
+    let vertical = Calligraphic { angle: 90.0, ..c([Fixed, Pressure, Fixed]) };
+    let wide = |p| {
+        let b = Brush { name: "r".into(), kind: BrushKind::Calligraphic(vertical.clone()) };
+        bounds(&stroke_pieces(&b, &line(0.0, 0.0, 0.0, 100.0), &pressed(vec![(0.0, p), (1.0, p)]))).width()
+    };
+    assert!(near(wide(0.0), 0.1, 0.05), "{}", wide(0.0));
+    assert!(near(wide(1.0), 10.0, 0.05), "{}", wide(1.0));
+}
+
+/// Brushes saved before the variation modes keep their look: a variation means Random, none
+/// means Fixed, and they are written back without modes.
+#[test]
+fn brushes_without_modes_vary_randomly_as_before() {
+    let old: Brush = serde_json::from_value(serde_json::json!({"name": "x", "type": "calligraphic", "size": 8, "variation": [0, 0, 3]})).unwrap();
+    let BrushKind::Calligraphic(c) = &old.kind else { panic!() };
+    assert_eq!(c.modes, None);
+    assert_eq!(c.modes(), [Variation::Fixed, Variation::Fixed, Variation::Random]);
+    assert!(!c.uses_pressure());
+    assert!(serde_json::to_value(&old).unwrap().get("modes").is_none(), "written back as it was");
+    // The same strokes as the brush with its modes spelled out.
+    let explicit = Brush {
+        kind: BrushKind::Calligraphic(Calligraphic { modes: Some([Variation::Fixed, Variation::Fixed, Variation::Random]), ..c.clone() }),
+        ..old.clone()
+    };
+    let bp = preview_path(120.0, 24.0);
+    assert_eq!(stroke_pieces(&old, &bp, &stroke(1.0)), stroke_pieces(&explicit, &bp, &stroke(1.0)));
+    // Fixed ignores the variation; Random still draws a different size per stroke.
+    let fixed = Brush { kind: BrushKind::Calligraphic(Calligraphic { modes: Some([Variation::Fixed; 3]), ..c.clone() }), ..old.clone() };
+    assert!(near(bounds(&stroke_pieces(&fixed, &line(0.0, 0.0, 100.0, 0.0), &stroke(1.0))).height(), 8.0, 0.05));
+    // Recorded pressure changes nothing for a brush that doesn't use it.
+    assert_eq!(stroke_pieces(&old, &bp, &stroke(1.0)), stroke_pieces(&old, &bp, &pressed(vec![(0.0, 0.0), (1.0, 1.0)])));
+    // Modes are saved by name.
+    assert_eq!(serde_json::to_value(Variation::ALL).unwrap(), serde_json::json!(["fixed", "random", "pressure"]));
+    assert!(Variation::ALL.iter().all(|v| Variation::parse(v.id()) == Some(*v)));
+}
+
+/// Junk definitions and pressure never panic and never draw non-finite art.
+#[test]
+fn junk_pressure_brushes_draw_finite_art() {
+    let bp = preview_path(120.0, 24.0);
+    for (size, var) in [(1e308, 1e308), (-1e308, 1e308), (0.0, -1e308), (f64::MAX, f64::MAX)] {
+        for profile in [vec![], vec![(0.0, 2.0), (0.0, -1.0), (5.0, 0.5)], vec![(1.0, 1.0), (0.0, 0.0)]] {
+            let out = stroke_pieces(&pressure_calli(size, var), &bp, &pressed(profile));
+            let mut pts = vec![];
+            for n in &out {
+                all_points(n, &mut pts);
+            }
+            assert!(pts.iter().all(|p| p.x.is_finite() && p.y.is_finite()), "{size} {var}");
+        }
+    }
+}

crates/cad/src/lib.rs

@@ -2,9 +2,9 @@
 //!
 //! [`export`] writes the visible art of a document into one DXF drawing: each layer becomes a DXF
 //! layer (hidden ones switched off, locked ones locked, non-printing ones not plotted), paths
-//! become polylines (straight segments) or cubic splines (curves), fills solid hatches, type text
-//! entities or glyph outlines, and placed images image entities linked to PNG or JPEG files the
-//! caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
+//! become polylines (straight segments) or cubic splines (curves), fills their outlines and solid
+//! hatches, type text entities or glyph outlines, and placed images image entities linked to PNG
+//! or JPEG files the caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
 //! `unit` of the art, with the origin at the bottom-left corner of [`DxfOptions::region`].
 //!
 //! What DXF can't hold (blending modes, opacity masks, raster effects, gradients, patterns,

crates/cad/src/scene.rs

@@ -1,6 +1,7 @@
 //! The document walk: each visible object becomes DXF entities on its layer's DXF layer, in paint
-//! order. Fills are solid hatches (outlines in R12), strokes polylines and cubic splines with a
-//! lineweight and dashes, or filled outlines where the look needs them.
+//! order. Fills are their outlines then solid hatches (the outlines alone in R12), strokes
+//! polylines and cubic splines with a lineweight and dashes, or filled outlines where the look
+//! needs them.
 
 use std::collections::HashMap;
 use std::io::Cursor;
@@ -315,7 +316,7 @@ impl<'a> Scene<'a> {
                 }
             }
             // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(c, false);
@@ -504,8 +505,9 @@ impl<'a> Scene<'a> {
         Some(vectorcraft_brush::stroke_pieces(b, bp, st))
     }
 
-    /// A filled area as a solid hatch (R12: its outlines). `clean`: the path has no overlaps, so
-    /// the hatch's even-odd rule reads it as it is.
+    /// A filled area as its outlines followed by a solid hatch (R12: the outlines alone). Laser
+    /// and cutter software reads the outlines and skips hatches. `clean`: the path has no
+    /// overlaps, so the hatch's even-odd rule reads it as it is.
     fn area(&mut self, bp: &BezPath, rule: FillRule, style: &EntityStyle, clean: bool) {
         if !self.o.version.handles() {
             self.warn(NO_FILLS);
@@ -517,10 +519,12 @@ impl<'a> Scene<'a> {
             .then(|| vectorcraft_pathops::try_normalize(&PathData::from_bezpath(bp), rule).ok())
             .flatten()
             .map(|p| p.to_bezpath());
-        let loops: Vec<Vec<Point>> = polygons(normalized.as_ref().unwrap_or(bp)).into_iter().filter(|p| p.len() >= 3).collect();
+        let outline = normalized.as_ref().unwrap_or(bp);
+        let loops: Vec<Vec<Point>> = polygons(outline).into_iter().filter(|p| p.len() >= 3).collect();
         if loops.is_empty() {
             return;
         }
+        self.lines(outline, style, 0.0);
         let h = self.handle();
         let layer = self.layer.clone();
         self.e.entity("HATCH", h, fixed::MODEL_RECORD, &layer, style, "AcDbHatch");

crates/cad/src/tests.rs

@@ -129,30 +129,42 @@ fn every_version_declares_its_acadver_and_is_well_formed() {
 fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     let d = shapes_doc();
     let out = export(&d, &opts(&d)).unwrap();
-    assert_eq!(kinds(&out), ["HATCH", "LWPOLYLINE", "SPLINE"], "fill, then stroke, then the ellipse's stroke");
+    assert_eq!(
+        kinds(&out),
+        ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"],
+        "the fill's outline and hatch, then the stroke, then the ellipse's stroke"
+    );
     let e = entities(&out);
     // The rectangle, y up from the artboard's bottom-left corner: 10..110 × 40..90.
-    let poly = &e[1];
-    assert_eq!(get(poly, 70), Some("1"), "closed");
-    let mut xs = all(poly, 10);
-    xs.sort_by(f64::total_cmp);
-    assert_eq!(xs, [10.0, 10.0, 110.0, 110.0]);
-    let mut ys = all(poly, 20);
-    ys.sort_by(f64::total_cmp);
-    assert_eq!(ys, [40.0, 40.0, 90.0, 90.0]);
-    let hatch = &e[0];
+    let corners = |poly: &Pairs| {
+        let mut xs = all(poly, 10);
+        xs.sort_by(f64::total_cmp);
+        let mut ys = all(poly, 20);
+        ys.sort_by(f64::total_cmp);
+        (xs, ys)
+    };
+    let rect = (vec![10.0, 10.0, 110.0, 110.0], vec![40.0, 40.0, 90.0, 90.0]);
+    for poly in [&e[0], &e[2]] {
+        assert_eq!(get(poly, 70), Some("1"), "closed");
+        assert_eq!(corners(poly), rect);
+    }
+    // Laser and cutter software skips hatches: the fill's outline comes first, without a lineweight.
+    assert_eq!((get(&e[0], 370), get(&e[2], 370)), (None, Some("35")));
+    let hatch = &e[1];
     assert_eq!((get(hatch, 2), get(hatch, 70), get(hatch, 91), get(hatch, 93)), (Some("SOLID"), Some("1"), Some("1"), Some("4")));
     // The ellipse: four cubics through clamped knots.
-    let spline = &e[2];
+    let spline = &e[3];
     assert_eq!((get(spline, 71), get(spline, 73)), (Some("3"), Some("13")));
     assert_eq!(all(spline, 40), [0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 1.0, 2.0, 2.0, 2.0, 3.0, 3.0, 3.0, 4.0, 4.0, 4.0, 4.0]);
     // R14 has lightweight polylines but no lineweights: the stroke is a polyline width.
     let r14 = export(&d, &DxfOptions { version: DxfVersion::R14, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&r14)[1], 43), Some("1"));
-    assert_eq!(get(&entities(&r14)[1], 370), None);
+    assert_eq!(get(&entities(&r14)[2], 43), Some("1"));
+    assert_eq!(get(&entities(&r14)[2], 370), None);
+    assert_eq!(get(&entities(&r14)[0], 43), None, "a fill's outline has no width");
     // R13 has splines and hatches, and polylines of vertices.
     let r13 = export(&d, &DxfOptions { version: DxfVersion::R13, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&r13), ["HATCH", "POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND", "SPLINE"]);
+    let poly = ["POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND"];
+    assert_eq!(kinds(&r13), [&poly[..], &["HATCH"], &poly, &["SPLINE"]].concat());
     // R12: polylines only; the fill is its outline, the ellipse flattened.
     let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
     let k = kinds(&r12);
@@ -171,8 +183,9 @@ fn colours_map_to_the_index_palette_or_true_colour() {
     };
     let out = export(&d, &opts(&d)).unwrap();
     assert_eq!(style(&out, 0), (Some("1".into()), Some("16711680".into())), "red: index 1, true colour 0xFF0000");
-    assert_eq!(style(&out, 1), (Some("7".into()), Some("0".into())), "black is index 7");
-    assert_eq!(style(&out, 2), (Some("5".into()), Some("255".into())));
+    assert_eq!(style(&out, 1), style(&out, 0), "the fill's outline has the fill's colour");
+    assert_eq!(style(&out, 2), (Some("7".into()), Some("0".into())), "black is index 7");
+    assert_eq!(style(&out, 3), (Some("5".into()), Some("255".into())));
     for depth in [ColorDepth::Aci8, ColorDepth::Aci16, ColorDepth::Aci256] {
         let o = export(&d, &DxfOptions { colors: depth, ..opts(&d) }).unwrap();
         assert_eq!(style(&o, 0), (Some("1".into()), None), "{depth:?}");
@@ -196,7 +209,7 @@ fn colours_map_to_the_index_palette_or_true_colour() {
 fn units_scale_coordinates_and_set_insunits() {
     let d = shapes_doc();
     let insunits = |o: &DxfOutput| header(&pairs(&o.bytes), "$INSUNITS");
-    let max_x = |o: &DxfOutput| all(&entities(o)[1], 10).into_iter().fold(f64::MIN, f64::max);
+    let max_x = |o: &DxfOutput| all(&entities(o)[2], 10).into_iter().fold(f64::MIN, f64::max);
     let mm = export(&d, &DxfOptions { unit: Unit::Millimeters, ..opts(&d) }).unwrap();
     assert_eq!(insunits(&mm).as_deref(), Some("4"));
     assert!((max_x(&mm) - 110.0 * 25.4 / 72.0).abs() < 1e-5);
@@ -208,9 +221,9 @@ fn units_scale_coordinates_and_set_insunits() {
     assert_eq!(insunits(&scaled).as_deref(), Some("0"));
     assert!((max_x(&scaled) - 110.0 / 72.0 * 10.0).abs() < 1e-5);
     // Lineweights: 1 pt is 0.35 mm, scaled with the drawing only when asked.
-    assert_eq!(get(&entities(&scaled)[1], 370), Some("35"));
+    assert_eq!(get(&entities(&scaled)[2], 370), Some("35"));
     let heavy = export(&d, &DxfOptions { unit: Unit::Inches, scale: 2.0, scale_lineweights: true, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&heavy)[1], 370), Some("70"));
+    assert_eq!(get(&entities(&heavy)[2], 370), Some("70"));
     assert!(export(&d, &DxfOptions { scale: 0.0, ..opts(&d) }).is_err());
     assert!(export(&d, &DxfOptions { scale: f64::NAN, ..opts(&d) }).is_err());
 }
@@ -238,7 +251,7 @@ fn layers_become_dxf_layers() {
     assert_eq!(names, ["0", "Layer 1", "Dims_ _top_", "Notes"], "the template layer is left out");
     assert!(layers[3].1.starts_with('-'), "a hidden layer is switched off");
     let on: Vec<String> = entities(&out).iter().map(|e| get(e, 8).unwrap().to_string()).collect();
-    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Notes"]);
+    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Dims_ _top_", "Notes", "Notes"]);
     // Before 2000: capitals, letters, digits and $-_ only.
     let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
     let names: Vec<String> = table(&r12, "LAYER").iter().map(|o| get(o, 2).unwrap().to_string()).collect();
@@ -270,18 +283,21 @@ fn dashes_become_linetypes_and_opacity_transparency() {
 fn alter_paths_writes_strokes_as_filled_outlines() {
     let d = shapes_doc();
     let out = export(&d, &DxfOptions { alter_paths: true, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&out), ["HATCH", "HATCH", "HATCH"]);
+    // Each fill and stroke: its outlines, then its hatch.
+    let fill = ["LWPOLYLINE", "HATCH"];
+    let rect_stroke = ["LWPOLYLINE", "LWPOLYLINE", "HATCH"];
+    assert_eq!(kinds(&out), [&fill[..], &rect_stroke, &["SPLINE", "SPLINE", "HATCH"]].concat());
     // The rectangle's stroke: an outer and an inner boundary.
-    assert_eq!(get(&entities(&out)[1], 91), Some("2"));
+    assert_eq!(get(&entities(&out)[4], 91), Some("2"));
     // Preserve Appearance outlines only the strokes a line can't draw.
     let mut d = shapes_doc();
     let rect = d.layers[0].children().and_then(|c| c.first()).map(|n| n.id).unwrap();
     if let Some(st) = d.node_mut(rect).and_then(|n| n.appearance.stroke_mut()) {
         st.align = vectorcraft_doc::StrokeAlign::Outside;
     }
-    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), ["HATCH", "HATCH", "SPLINE"]);
+    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), [&fill[..], &rect_stroke, &["SPLINE"]].concat());
     let editable = export(&d, &DxfOptions { preserve: Preserve::Editability, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&editable), ["HATCH", "LWPOLYLINE", "SPLINE"]);
+    assert_eq!(kinds(&editable), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"]);
     assert!(editable.warnings.iter().any(|w| w.contains("stroke alignment")));
 }
 
@@ -308,7 +324,9 @@ fn type_is_text_or_outlines() {
     // Outline Text, and Preserve Appearance: the glyphs as filled outlines.
     for o in [DxfOptions { preserve: Preserve::Editability, outline_text: true, ..opts(&d) }, opts(&d)] {
         let k = kinds(&export(&d, &o).unwrap());
-        assert!(!k.is_empty() && k.iter().all(|k| k == "HATCH"), "{k:?}");
+        assert!(k.iter().any(|k| k == "HATCH"), "{k:?}");
+        assert!(k.iter().all(|k| matches!(k.as_str(), "HATCH" | "LWPOLYLINE" | "SPLINE")), "{k:?}");
+        assert_eq!(k.first().map(String::as_str), Some("SPLINE"), "a glyph's outline before its hatch");
     }
 }
 
@@ -367,5 +385,5 @@ fn crop_leaves_out_art_outside_the_region() {
     // Only the ellipse (120..180) reaches into 115..200.
     let o = DxfOptions { region: Rect::new(115.0, 0.0, 200.0, 100.0), crop: true, ..opts(&d) };
     assert_eq!(kinds(&export(&d, &o).unwrap()), ["SPLINE"]);
-    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 3);
+    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 4);
 }

crates/color/src/cms/icc.rs

@@ -1,7 +1,7 @@
 //! ICC profiles through `moxcms` (pure Rust): built-in RGB spaces and user-supplied `.icc` files,
 //! and the profiles exports embed ([`encode_builtin`]), written in code from the CMS.
 
-use std::sync::{Arc, OnceLock};
+use std::sync::{Arc, Mutex, OnceLock};
 
 use moxcms::{
     ColorProfile, DataColorSpace, Layout, LocalizableString, LutMultidimensionalType, LutStore, LutWarehouse, Matrix3d, ProfileClass, ProfileText,
@@ -27,6 +27,9 @@ fn intent_index(i: Intent) -> usize {
 
 type Xf = Option<Arc<TransformF32Executor>>;
 
+/// A direct transform's cache key: destination name, intent index, black-point compensation.
+type DirectKey = (String, usize, bool);
+
 /// A parsed ICC profile plus lazily-built transforms to/from sRGB.
 pub struct IccProfile {
     pub name: String,
@@ -37,6 +40,21 @@ pub struct IccProfile {
     srgb: ColorProfile,
     to_srgb: [OnceLock<Xf>; 4],
     from_srgb: [OnceLock<Xf>; 4],
+    /// Direct transforms into other RGB profiles ([`Self::to_rgb_of`]), by destination, intent
+    /// and black-point compensation.
+    direct: Mutex<Vec<(DirectKey, Option<Arc<Direct>>)>>,
+}
+
+/// A transform from one profile into an RGB profile without passing through sRGB: into the
+/// destination's primaries with linear tone curves, where black-point compensation is a linear
+/// remap, then onto its own curves.
+struct Direct {
+    to_linear: Arc<TransformF32Executor>,
+    /// Linear → the destination's curves; `None` when the destination isn't a matrix profile
+    /// (the first transform goes straight into it, without compensation).
+    to_dest: Option<Arc<TransformF32Executor>>,
+    /// The source black's luminance in the linear destination (0: no compensation).
+    black: f32,
 }
 
 impl std::fmt::Debug for IccProfile {
@@ -72,6 +90,7 @@ impl IccProfile {
             srgb: ColorProfile::new_srgb(),
             to_srgb: Default::default(),
             from_srgb: Default::default(),
+            direct: Mutex::new(Vec::new()),
         })
     }
 
@@ -135,6 +154,72 @@ impl IccProfile {
         Some(dst.into_iter().map(|x| x.clamp(0.0, 1.0)).collect())
     }
 
+    /// Device values (RGB / CMYK / Gray, 0..1) → `dest`'s RGB, converted directly with `intent`:
+    /// not through sRGB, so colours outside sRGB keep their place in a wider space. With `bpc`
+    /// (and an intent other than absolute), this profile's black maps onto the destination's
+    /// black (black-point compensation, the darkest ink the profile prints becoming RGB 0 rather
+    /// than a dark grey). `None` when `dest` isn't RGB or no transform can be built.
+    pub fn to_rgb_of(&self, dest: &IccProfile, v: &[f32], intent: Intent, bpc: bool) -> Option<[f32; 3]> {
+        let t = self.direct_xf(dest, intent, bpc && intent != Intent::AbsoluteColorimetric)?;
+        let mut src = v.to_vec();
+        src.resize(self.channels(), 0.0);
+        let mut lin = [0.0f32; 3];
+        t.to_linear.transform(&src, &mut lin).ok()?;
+        let Some(to_dest) = &t.to_dest else { return Some(lin.map(|x| x.clamp(0.0, 1.0))) };
+        if t.black > 0.0 {
+            lin = lin.map(|x| (x - t.black) / (1.0 - t.black));
+        }
+        let lin = lin.map(|x| x.clamp(0.0, 1.0));
+        let mut out = [0.0f32; 3];
+        to_dest.transform(&lin, &mut out).ok()?;
+        Some(out.map(|x| x.clamp(0.0, 1.0)))
+    }
+
+    fn direct_xf(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Arc<Direct>> {
+        if dest.kind != ProfileKind::Rgb {
+            return None;
+        }
+        let key = (dest.name.clone(), intent_index(intent), bpc);
+        let mut cache = self.direct.lock().unwrap_or_else(|e| e.into_inner());
+        if let Some((_, t)) = cache.iter().find(|(k, _)| *k == key) {
+            return t.clone();
+        }
+        let t = self.build_direct(dest, intent, bpc).map(Arc::new);
+        cache.push((key, t.clone()));
+        t
+    }
+
+    fn build_direct(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Direct> {
+        let d = &dest.profile;
+        let matrix = d.red_trc.is_some() && d.green_trc.is_some() && d.blue_trc.is_some();
+        if !matrix {
+            let xf = self.profile.create_transform_f32(self.layout(), d, Layout::Rgb, Self::opts(intent)).ok()?;
+            return Some(Direct { to_linear: xf, to_dest: None, black: 0.0 });
+        }
+        let mut linear = d.clone();
+        for trc in [&mut linear.red_trc, &mut linear.green_trc, &mut linear.blue_trc] {
+            *trc = Some(ToneReprCurve::Parametric(vec![1.0]));
+        }
+        // A coding-independent code point names the transfer curve outright (moxcms's sRGB has
+        // one) and would override the linear curves.
+        linear.cicp = None;
+        let to_linear = self.profile.create_transform_f32(self.layout(), &linear, Layout::Rgb, Self::opts(intent)).ok()?;
+        let to_dest = linear.create_transform_f32(Layout::Rgb, d, Layout::Rgb, Self::opts(Intent::RelativeColorimetric)).ok()?;
+        // The source black: the darkest colour the profile reproduces, found as lcms does for an
+        // output profile (black sent into the profile and read back), made neutral.
+        let black = if bpc && self.kind == ProfileKind::Cmyk {
+            let inks = self.from_srgb([0.0; 3], Intent::RelativeColorimetric)?;
+            let mut lin = [0.0f32; 3];
+            to_linear.transform(&inks, &mut lin).ok()?;
+            let y = |c: &moxcms::Xyzd| c.y as f32;
+            let lum = lin[0] * y(&d.red_colorant) + lin[1] * y(&d.green_colorant) + lin[2] * y(&d.blue_colorant);
+            lum.clamp(0.0, 0.5)
+        } else {
+            0.0
+        };
+        Some(Direct { to_linear, to_dest: Some(to_dest), black })
+    }
+
     /// Whether transforms can be built for this profile (checked at registration).
     pub fn usable(&self) -> bool {
         self.to_xf(Intent::RelativeColorimetric).is_some() && self.inverse_xf(Intent::RelativeColorimetric).is_some()

crates/color/src/cms/mod.rs

@@ -356,10 +356,37 @@ impl Cms {
         }
     }
 
-    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour).
+    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour). An ICC
+    /// CMYK profile converts as [`Self::cmyk_to_rgb`] does into sRGB (with the settings'
+    /// black-point compensation), so what shows is what an RGB export writes.
     pub fn cmyk_to_srgb(&self, cmyk: [f32; 4], absolute: bool) -> [f32; 3] {
+        if let (false, CmykSpace::Icc(p)) = (absolute, &self.cmyk)
+            && let Some(srgb) = builtin_rgb_cache(SRGB)
+            && let Some(v) = p.to_rgb_of(&srgb, &cmyk.map(|v| v.clamp(0.0, 1.0)), Intent::RelativeColorimetric, self.settings.bpc)
+        {
+            return v;
+        }
         Self::cmyk_to_srgb_in(&self.cmyk, cmyk, absolute)
     }
+    /// CMYK in the working space → working RGB with `intent`. An ICC CMYK profile converts
+    /// directly into the RGB profile: not through display sRGB, which would clip colours a wider
+    /// RGB space holds (Wide Gamut RGB keeps CMYK cyan that sRGB can't show), and with the
+    /// settings' black-point compensation. The built-in CMYK spaces go through sRGB as before
+    /// (Generic CMYK compensates in its own model).
+    pub fn cmyk_to_rgb(&self, cmyk: [f32; 4], intent: Intent) -> [f32; 3] {
+        let cmyk = cmyk.map(|v| v.clamp(0.0, 1.0));
+        let src = match &self.cmyk {
+            CmykSpace::Icc(p) => Some(p.clone()),
+            CmykSpace::Generic(_) | CmykSpace::Device => None,
+        };
+        let dest = match &self.rgb {
+            RgbSpace::Icc(p) => Some(p.clone()),
+            RgbSpace::Srgb => builtin_rgb_cache(SRGB),
+        };
+        src.zip(dest)
+            .and_then(|(s, d)| s.to_rgb_of(&d, &cmyk, intent, self.settings.bpc))
+            .unwrap_or_else(|| self.srgb_to_rgb(self.cmyk_to_srgb(cmyk, false)))
+    }
     /// Display sRGB → working CMYK with `intent`.
     pub fn srgb_to_cmyk(&self, srgb: [f32; 3], intent: Intent) -> [f32; 4] {
         Self::srgb_to_cmyk_in(&self.cmyk, srgb, intent, self.settings.bpc)
@@ -424,6 +451,10 @@ impl Cms {
                 let [c, m, y, k] = self.to_cmyk(c, intent);
                 Color::Cmyk { c, m, y, k }
             }
+            (Color::Cmyk { c, m, y, k }, Model::Rgb) => {
+                let [r, g, b] = self.cmyk_to_rgb([*c, *m, *y, *k], intent);
+                Color::Rgb { r, g, b }
+            }
             (_, Model::Rgb) => {
                 let [r, g, b] = self.srgb_to_rgb(self.display_rgb(c));
                 Color::Rgb { r, g, b }
@@ -662,6 +693,60 @@ impl ProofLut {
     }
 }
 
+/// A 17⁴ CMYK → four values lookup table with quadrilinear interpolation: ink amounts to a
+/// colour (XYZ, RGB, or CMYK in another space).
+pub struct CmykLut {
+    data: Vec<[f32; 4]>,
+}
+
+impl CmykLut {
+    pub fn build(f: impl Fn([f32; 4]) -> [f32; 4]) -> Self {
+        let s = (LUT_N - 1) as f32;
+        let mut data = Vec::with_capacity(LUT_N.pow(4));
+        for c in 0..LUT_N {
+            for m in 0..LUT_N {
+                for y in 0..LUT_N {
+                    for k in 0..LUT_N {
+                        data.push(f([c, m, y, k].map(|i| i as f32 / s)));
+                    }
+                }
+            }
+        }
+        Self { data }
+    }
+
+    pub fn apply(&self, inks: [f32; 4]) -> [f32; 4] {
+        const STRIDE: [usize; 4] = [LUT_N * LUT_N * LUT_N, LUT_N * LUT_N, LUT_N, 1];
+        let p = inks.map(|v| v.clamp(0.0, 1.0) * (LUT_N - 1) as f32);
+        let i = p.map(|v| (v as usize).min(LUT_N - 2));
+        let base: usize = (0..4).map(|d| i[d] * STRIDE[d]).sum();
+        let mut out = [0.0f32; 4];
+        for corner in 0..16 {
+            let (mut w, mut at) = (1.0f32, base);
+            for d in 0..4 {
+                let t = p[d] - i[d] as f32;
+                if corner >> d & 1 == 1 {
+                    w *= t;
+                    at += STRIDE[d];
+                } else {
+                    w *= 1.0 - t;
+                }
+            }
+            if w > 0.0 {
+                for (o, v) in out.iter_mut().zip(self.data[at]) {
+                    *o += w * v;
+                }
+            }
+        }
+        out
+    }
+
+    /// [`Self::apply`] to 8-bit ink amounts, for 8-bit values.
+    pub fn apply8(&self, inks: [u8; 4]) -> [u8; 4] {
+        self.apply(inks.map(|v| v as f32 / 255.0)).map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8)
+    }
+}
+
 // ---------- the active (process-wide) settings ----------
 
 static ACTIVE: RwLock<Option<Arc<Cms>>> = RwLock::new(None);

crates/color/src/cms/tests_icc.rs

@@ -60,3 +60,54 @@ fn a_loaded_profile_is_embedded_as_loaded() {
     register_icc(&bytes, Some("Embedded As Loaded RGB".into())).unwrap();
     assert_eq!(&*icc_bytes("Embedded As Loaded RGB").unwrap(), &bytes[..]);
 }
+
+/// Settings with an ICC CMYK profile (Generic CMYK's, loaded as a file is) and Wide Gamut RGB.
+fn icc_cmyk(bpc: bool) -> Cms {
+    let name = register_icc(&icc_bytes(GENERIC_CMYK).unwrap(), Some("Test ICC CMYK".into())).unwrap().name;
+    Cms::new(&ColorSettings { rgb: WIDE_GAMUT_RGB.into(), cmyk: name, bpc, ..ColorSettings::default() }).unwrap()
+}
+
+#[test]
+fn icc_cmyk_converts_into_a_wide_rgb_space_directly_without_clipping_to_srgb() {
+    let wide = icc_cmyk(true);
+    let cyan = [1.0, 0.0, 0.0, 0.0];
+    let direct = wide.cmyk_to_rgb(cyan, Intent::RelativeColorimetric);
+    // Through sRGB, cyan clips to sRGB's gamut first: in the wider space that reads as a red
+    // channel well above zero.
+    let hub = wide.srgb_to_rgb(wide.cmyk_to_srgb(cyan, false));
+    assert!(direct[0] + 0.15 < hub[0], "direct {direct:?}, through sRGB {hub:?}");
+    // Same colour either way where sRGB holds it: a mid grey and paper white.
+    for inks in [[0.0, 0.0, 0.0, 0.5], [0.0; 4]] {
+        let (d, h) = (wide.cmyk_to_rgb(inks, Intent::RelativeColorimetric), wide.srgb_to_rgb(wide.cmyk_to_srgb(inks, false)));
+        assert!(d.iter().zip(h).all(|(a, b)| (a - b).abs() < 0.02), "{inks:?}: direct {d:?}, through sRGB {h:?}");
+    }
+    // Cms::convert takes the direct route for CMYK.
+    let Color::Rgb { r, .. } = wide.convert(&Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 }, Model::Rgb, Intent::RelativeColorimetric) else {
+        panic!("RGB")
+    };
+    assert!((r - direct[0]).abs() < 1e-6);
+}
+
+#[test]
+fn black_point_compensation_maps_the_darkest_ink_to_rgb_black() {
+    let rich = [0.75, 0.68, 0.67, 0.9];
+    let (on, off) = (icc_cmyk(true).cmyk_to_rgb(rich, Intent::RelativeColorimetric), icc_cmyk(false).cmyk_to_rgb(rich, Intent::RelativeColorimetric));
+    // Without compensation the profile's black is a dark grey; with it, rich black goes most of
+    // the way to RGB black (not all: it isn't quite the darkest ink the profile prints).
+    assert!(off.iter().all(|v| *v > 0.1), "without: {off:?}");
+    assert!(on.iter().zip(off).all(|(a, b)| *a < 0.08 && *a < b * 0.5), "with: {on:?}, without: {off:?}");
+    // The screen shows what an sRGB conversion writes, compensated alike.
+    let srgb = |bpc| {
+        let c = icc_cmyk(bpc);
+        Cms::new(&ColorSettings { rgb: SRGB.into(), ..c.settings().clone() }).unwrap()
+    };
+    for bpc in [true, false] {
+        let c = srgb(bpc);
+        assert_eq!(c.cmyk_to_srgb(rich, false), c.cmyk_to_rgb(rich, Intent::RelativeColorimetric), "bpc {bpc}");
+    }
+    // White is untouched, and absolute colorimetric never compensates.
+    let white = icc_cmyk(true).cmyk_to_rgb([0.0; 4], Intent::RelativeColorimetric);
+    assert!(white.iter().all(|v| *v > 0.99), "{white:?}");
+    let abs = |bpc| icc_cmyk(bpc).cmyk_to_rgb(rich, Intent::AbsoluteColorimetric);
+    assert_eq!(abs(true), abs(false));
+}

crates/color/src/palette_io.rs

@@ -1,6 +1,10 @@
 //! Swatch library files: the native `.vcswatches` JSON (colour models, global, spot, gradients
 //! and colour groups exactly), `.gpl` palettes (8-bit RGB; colour groups as `# Group:` comment
-//! headers) and CSS custom properties (written only).
+//! headers), swatch exchange `.ase` files (binary: solid colors in their own model, global, spot
+//! and process colors, color groups), color books `.acb` (read only: the books a user owns, such
+//! as a Pantone book) and CSS custom properties (written only).
+
+use std::collections::{HashMap, HashSet};
 
 use serde::{Deserialize, Serialize};
 
@@ -13,18 +17,22 @@ pub enum PaletteFormat {
     Native,
     /// `.gpl`: a plain-text RGB palette many paint and design tools read.
     Gpl,
+    /// `.ase`: a swatch exchange file (binary): solid colors in their own model, global, spot or
+    /// process, and color groups.
+    Ase,
     /// `.css`: custom properties on `:root` (colours and gradients; written only).
     Css,
 }
 
 impl PaletteFormat {
-    pub const ALL: [PaletteFormat; 3] = [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Css];
+    pub const ALL: [PaletteFormat; 4] = [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Ase, PaletteFormat::Css];
 
     /// The format's id, which is also its extension.
     pub fn id(self) -> &'static str {
         match self {
             PaletteFormat::Native => "vcswatches",
             PaletteFormat::Gpl => "gpl",
+            PaletteFormat::Ase => "ase",
             PaletteFormat::Css => "css",
         }
     }
@@ -32,6 +40,7 @@ impl PaletteFormat {
         match self {
             PaletteFormat::Native => "VectorCraft Swatches (.vcswatches)",
             PaletteFormat::Gpl => "GPL Palette (.gpl)",
+            PaletteFormat::Ase => "Swatch Exchange (.ase)",
             PaletteFormat::Css => "CSS Custom Properties (.css)",
         }
     }
@@ -44,6 +53,10 @@ impl PaletteFormat {
     pub fn readable(self) -> bool {
         self != PaletteFormat::Css
     }
+    /// Are files of this format binary rather than text?
+    pub fn binary(self) -> bool {
+        self == PaletteFormat::Ase
+    }
 }
 
 /// The native file: a header around the library.
@@ -58,12 +71,25 @@ struct NativeFile {
 const NATIVE_FORMAT: &str = "vcswatches";
 const GPL_HEADER: &str = "GIMP Palette";
 const GPL_GROUP: &str = "# Group:";
+const ASE_SIGNATURE: &[u8] = b"ASEF";
+const ASE_GROUP_START: u16 = 0xC001;
+const ASE_GROUP_END: u16 = 0xC002;
+const ASE_COLOR: u16 = 0x0001;
+/// The most colors and groups read from one `.ase` file.
+const ASE_MAX_ENTRIES: usize = 100_000;
+/// The most UTF-16 code units of a name that are kept.
+const ASE_MAX_NAME: usize = 1024;
+const ASE_CUT_SHORT: &str = "the swatch exchange file is cut short";
+const ACB_SIGNATURE: &[u8] = b"8BCB";
+const ACB_CUT_SHORT: &str = "the color book is cut short";
 
-/// Write `lib` in `format`. Pattern swatches (their tiles live in a document) and None are left
-/// out; `.gpl` keeps solid colours only, as 8-bit RGB.
-pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> String {
+/// Write `lib` in `format` → the file's bytes. Pattern swatches (their tiles live in a document)
+/// and None are left out; `.gpl` keeps solid colours only, as 8-bit RGB, and `.ase` keeps solid
+/// colors in their own model. Writing `.ase` fails for a library with more colors and groups than
+/// [`read_bytes`] reads from one file.
+pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> Result<Vec<u8>, String> {
     let keep = |w: &&Swatch| matches!(w.paint, Paint::Solid { .. } | Paint::Gradient(_));
-    match format {
+    let text = match format {
         PaletteFormat::Native => {
             let strip = |list: &[Swatch]| list.iter().filter(keep).cloned().collect::<Vec<_>>();
             let library = SwatchLibrary {
@@ -75,8 +101,10 @@ pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> String {
             serde_json::to_string_pretty(&file).unwrap_or_default()
         }
         PaletteFormat::Gpl => write_gpl(lib),
+        PaletteFormat::Ase => return write_ase(lib),
         PaletteFormat::Css => write_css(lib, keep),
-    }
+    };
+    Ok(text.into_bytes())
 }
 
 /// One line of text: no line breaks or tabs.
@@ -172,6 +200,102 @@ fn write_css(lib: &SwatchLibrary, keep: impl Fn(&&Swatch) -> bool) -> String {
     out
 }
 
+/// `.ase`, as [`read_ase`] reads it: version 1.0, the ungrouped colors, then each color group as a
+/// group start (its name), its colors and a group end, also for a group without colors. A color is
+/// written in its own model: RGB, CMYK and gray components from 0 to 1 (gray as a level, 1 is
+/// white), Lab lightness as a fraction of 100 and a and b from −128 to 127. Components are clamped
+/// to those ranges, and a component that isn't a finite number is written as 0. The color type is
+/// 1 for a spot color, 0 for another global color and 2 for a process color.
+///
+/// A swatch exchange file holds solid colors only: gradients, patterns and None are left out, and
+/// a tint swatch is written as the color it shows, a process color without its link to its base.
+/// The file has no library name ([`read_ase`] names a library after its file). More than
+/// [`ASE_MAX_ENTRIES`] colors and groups is an error.
+fn write_ase(lib: &SwatchLibrary) -> Result<Vec<u8>, String> {
+    let solid = |list: &[Swatch]| list.iter().filter(|w| w.paint.color().is_some()).count();
+    let entries = solid(&lib.swatches) + lib.groups.iter().map(|g| 1 + solid(&g.swatches)).sum::<usize>();
+    if entries > ASE_MAX_ENTRIES {
+        return Err(format!(
+            "VectorCraft reads at most {ASE_MAX_ENTRIES} colors and groups from a swatch exchange file, and this library has {entries}"
+        ));
+    }
+    let mut body = vec![];
+    let mut blocks = put_ase_colors(&mut body, &lib.swatches)?;
+    for g in &lib.groups {
+        let mut name = vec![];
+        put_ase_name(&mut name, &g.name)?;
+        put_ase_block(&mut body, ASE_GROUP_START, &name)?;
+        blocks += 2 + put_ase_colors(&mut body, &g.swatches)?;
+        put_ase_block(&mut body, ASE_GROUP_END, &[])?;
+    }
+    let blocks = u32::try_from(blocks).map_err(|_| "too many swatch exchange blocks".to_string())?;
+    let mut out = ASE_SIGNATURE.to_vec();
+    out.extend(1u16.to_be_bytes());
+    out.extend(0u16.to_be_bytes());
+    out.extend(blocks.to_be_bytes());
+    out.extend(body);
+    Ok(out)
+}
+
+/// The color blocks of the solid colors in `list` → how many were written.
+fn put_ase_colors(out: &mut Vec<u8>, list: &[Swatch]) -> Result<usize, String> {
+    let unit = |v: f32| if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
+    let ab = |v: f32| if v.is_finite() { v.clamp(-128.0, 127.0) } else { 0.0 };
+    let mut n = 0;
+    for (w, color) in list.iter().filter_map(|w| Some((w, w.paint.color()?))) {
+        let mut body = vec![];
+        put_ase_name(&mut body, &w.name)?;
+        let (model, values): (&[u8; 4], Vec<f32>) = match color {
+            Color::Rgb { r, g, b } => (b"RGB ", vec![unit(r), unit(g), unit(b)]),
+            Color::Cmyk { c, m, y, k } => (b"CMYK", vec![unit(c), unit(m), unit(y), unit(k)]),
+            Color::Lab { l, a, b } => (b"LAB ", vec![unit(l / 100.0), ab(a), ab(b)]),
+            Color::Gray { k } => (b"Gray", vec![1.0 - unit(k)]),
+        };
+        body.extend(model);
+        body.extend(values.iter().flat_map(|v| v.to_be_bytes()));
+        let kind: u16 = if w.spot {
+            1
+        } else if w.global {
+            0
+        } else {
+            2
+        };
+        body.extend(kind.to_be_bytes());
+        put_ase_block(out, ASE_COLOR, &body)?;
+        n += 1;
+    }
+    Ok(n)
+}
+
+/// A block: its type, the length of its body and the body.
+fn put_ase_block(out: &mut Vec<u8>, kind: u16, body: &[u8]) -> Result<(), String> {
+    let len = u32::try_from(body.len()).map_err(|_| "a swatch exchange block is too long".to_string())?;
+    out.extend(kind.to_be_bytes());
+    out.extend(len.to_be_bytes());
+    out.extend_from_slice(body);
+    Ok(())
+}
+
+/// A name as `.ase` stores it: a `u16` count of UTF-16 code units, the terminating zero included,
+/// then the units. NUL characters are left out, and a name longer than [`ASE_MAX_NAME`] code units
+/// is cut before the character that would pass that limit.
+fn put_ase_name(out: &mut Vec<u8>, name: &str) -> Result<(), String> {
+    let mut units: Vec<u16> = vec![];
+    for c in name.chars().filter(|&c| c != '\0') {
+        let mut buf = [0; 2];
+        let encoded = c.encode_utf16(&mut buf);
+        if units.len() + encoded.len() > ASE_MAX_NAME {
+            break;
+        }
+        units.extend_from_slice(encoded);
+    }
+    units.push(0);
+    let count = u16::try_from(units.len()).map_err(|_| "a swatch exchange name is too long".to_string())?;
+    out.extend(count.to_be_bytes());
+    out.extend(units.iter().flat_map(|u| u.to_be_bytes()));
+    Ok(())
+}
+
 /// Read a `.vcswatches` or `.gpl` library (detected from its content). `name` names it when the
 /// file doesn't.
 pub fn read(text: &str, name: &str) -> Result<SwatchLibrary, String> {
@@ -199,16 +323,38 @@ pub fn sniff(text: &str) -> bool {
     t.starts_with(GPL_HEADER) || (t.starts_with('{') && t.contains(NATIVE_FORMAT))
 }
 
+/// Read the bytes of a library file: a swatch exchange `.ase` file, else a `.vcswatches` or
+/// `.gpl` library ([`read`]). `name` names it when the file doesn't.
+pub fn read_bytes(bytes: &[u8], name: &str) -> Result<SwatchLibrary, String> {
+    if bytes.starts_with(ASE_SIGNATURE) {
+        return read_ase(bytes, name);
+    }
+    if bytes.starts_with(ACB_SIGNATURE) {
+        return read_acb(bytes, name).map_err(|e| if e == ASE_CUT_SHORT { ACB_CUT_SHORT.into() } else { e });
+    }
+    read(&String::from_utf8_lossy(bytes), name)
+}
+
+/// Are `bytes` a library [`read_bytes`] understands? Text that isn't valid UTF-8 is checked as
+/// [`read_bytes`] reads it, with the invalid bytes replaced (its first KiB is enough).
+pub fn sniff_bytes(bytes: &[u8]) -> bool {
+    bytes.starts_with(ASE_SIGNATURE)
+        || bytes.starts_with(ACB_SIGNATURE)
+        || std::str::from_utf8(bytes).is_ok_and(sniff)
+        || sniff(&String::from_utf8_lossy(bytes.get(..1024).unwrap_or(bytes)))
+}
+
 /// `.gpl`: `Name:` names the library, `# Group: name` starts a colour group, other `#` lines and
-/// headers (`Columns:`) are skipped, as are lines that aren't `r g b [name]`. Unnamed colours are
-/// named by their values; repeated names get a number.
+/// headers (`Columns:`) are skipped, as are lines that aren't `r g b [name]`. Unnamed colors are
+/// named by their values and unnamed groups "Color Group"; a name a color or group already has gets
+/// a number ([`UniqueNames`]).
 fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
     let mut lib = SwatchLibrary { name: fallback.into(), ..Default::default() };
-    let mut names: Vec<String> = vec![];
+    let mut names = UniqueNames::default();
     for line in text.lines().skip(1) {
         let line = line.trim();
         if let Some(g) = line.strip_prefix(GPL_GROUP) {
-            lib.groups.push(SwatchGroup { name: g.trim().to_string(), swatches: vec![] });
+            lib.groups.push(SwatchGroup { name: names.unique(group_name(g)), swatches: vec![] });
             continue;
         }
         if let Some(n) = line.strip_prefix("Name:") {
@@ -221,9 +367,7 @@ fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
         let [r, g, b] = rgb[..] else { continue };
         let rest = words[3..].join(" ");
         let base = if rest.is_empty() { format!("R={r} G={g} B={b}") } else { rest };
-        let name = (1..).map(|i| if i == 1 { base.clone() } else { format!("{base} {i}") }).find(|n| !names.contains(n)).unwrap_or(base);
-        names.push(name.clone());
-        let w = Swatch { name, paint: Paint::solid(Color::rgb8(r, g, b)), global: false, spot: false };
+        let w = Swatch { name: names.unique(base), paint: Paint::solid(Color::rgb8(r, g, b)), global: false, spot: false };
         match lib.groups.last_mut() {
             Some(grp) => grp.swatches.push(w),
             None => lib.swatches.push(w),
@@ -232,10 +376,326 @@ fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
     lib
 }
 
+/// `.ase`, from public descriptions of the format: the layout from
+/// <https://www.selapa.net/swatches/colors/fileformats.php>, the component ranges from
+/// <https://github.com/nsfmc/swatch>. After the signature come, big-endian, a `u16` major (1) and
+/// minor version, a `u32` block count and the blocks, each a `u16` type, a `u32` body length and
+/// the body. A group start's body is a name. A color's body is a name, a four-character model
+/// (`RGB `, `CMYK`, `LAB `, `Gray`), its components as `f32` (3, 4, 3 and 1 of them) and a `u16`
+/// color type (0 global, 1 spot, 2 process). RGB, CMYK and gray components run from 0 to 1 (a
+/// gray level of 1 is white), Lab lightness from 0 to 1 and a and b from −128 to 127. A lightness
+/// above 1 is read as L* itself. A name is a `u16` count of UTF-16 code units, the terminating zero
+/// included, then the units.
+///
+/// Color groups become groups: a group start inside an open group ends that group, and a group
+/// left open ends with the file. Blocks of other types and colors in other models are skipped.
+/// Unnamed colors are named by their values and unnamed groups "Color Group"; a name a color or
+/// group already has gets a number ([`UniqueNames`]). A truncated file, a major version other than
+/// 1 or more than [`ASE_MAX_ENTRIES`] colors and groups is an error.
+fn read_ase(bytes: &[u8], fallback: &str) -> Result<SwatchLibrary, String> {
+    let mut data = AseData(bytes);
+    data.bytes(ASE_SIGNATURE.len())?;
+    let (major, minor) = (data.u16()?, data.u16()?);
+    if major != 1 {
+        return Err(format!("swatch exchange version {major}.{minor} isn't supported (only 1.x)"));
+    }
+    let blocks = data.u32()?;
+    let mut lib = SwatchLibrary { name: fallback.into(), ..Default::default() };
+    let mut names = UniqueNames::default();
+    let (mut in_group, mut entries) = (false, 0usize);
+    for _ in 0..blocks {
+        let kind = data.u16()?;
+        let len = usize::try_from(data.u32()?).unwrap_or(usize::MAX);
+        let mut body = AseData(data.bytes(len)?);
+        if matches!(kind, ASE_GROUP_START | ASE_COLOR) {
+            entries += 1;
+            if entries > ASE_MAX_ENTRIES {
+                return Err(format!("the swatch exchange file holds more than {ASE_MAX_ENTRIES} colors and groups"));
+            }
+        }
+        match kind {
+            ASE_GROUP_START => {
+                lib.groups.push(SwatchGroup { name: names.unique(group_name(&body.name()?)), swatches: vec![] });
+                in_group = true;
+            }
+            ASE_GROUP_END => in_group = false,
+            ASE_COLOR => {
+                let Some(mut w) = ase_swatch(&mut body)? else { continue };
+                w.name = names.unique(std::mem::take(&mut w.name));
+                match lib.groups.last_mut().filter(|_| in_group) {
+                    Some(g) => g.swatches.push(w),
+                    None => lib.swatches.push(w),
+                }
+            }
+            // Other blocks are skipped.
+            _ => {}
+        }
+    }
+    Ok(lib)
+}
+
+/// `.acb` (a color book, read only), from public descriptions of the format: after the signature
+/// come, big-endian, a `u16` version (1) and book id, the title, prefix, suffix and description
+/// as strings, a `u16` color count, page size and page selector offset, a `u16` color space (0
+/// RGB, 2 CMYK, 7 Lab) and the colors: each a name, a six-character catalog code and its
+/// components as bytes. RGB runs from 0 to 255, CMYK ink is stored inverted (255 is no ink), Lab
+/// lightness is 0 to 255 for 0 to 100 and a and b are offset by 128. A string is a `u32` count of
+/// UTF-16 code units, then the units; a `$$$/key=Text` string means `Text`, and `^R`, `^C` stand
+/// for ® and ©. An optional `spflspot` or `spflproc` at the end says whether the colors are spot
+/// or process colors (a book without it is a spot color book).
+///
+/// The book's colors are named with its prefix and suffix ("PANTONE 185 C"); colors without a
+/// name (the padding of a book's pages) are left out. A version other than 1, a color space other
+/// than those three or more than [`ASE_MAX_ENTRIES`] colors is an error.
+fn read_acb(bytes: &[u8], fallback: &str) -> Result<SwatchLibrary, String> {
+    let mut data = AseData(bytes);
+    data.bytes(ACB_SIGNATURE.len())?;
+    let version = data.u16()?;
+    if version != 1 {
+        return Err(format!("color book version {version} isn't supported (only 1)"));
+    }
+    let _book_id = data.u16()?;
+    let [title, prefix, suffix, _description] = [data.acb_string()?, data.acb_string()?, data.acb_string()?, data.acb_string()?];
+    let count = usize::from(data.u16()?);
+    if count > ASE_MAX_ENTRIES {
+        return Err(format!("the color book holds more than {ASE_MAX_ENTRIES} colors"));
+    }
+    let (_page_size, _page_offset) = (data.u16()?, data.u16()?);
+    let space = data.u16()?;
+    let mut colors = Vec::with_capacity(count);
+    for _ in 0..count {
+        let name = data.acb_string()?;
+        let _code = data.bytes(6)?;
+        let color = match space {
+            0 => {
+                let [r, g, b] = data.array::<3>()?;
+                Color::rgb8(r, g, b)
+            }
+            2 => {
+                let ink = |v: u8| f32::from(255 - v) / 255.0;
+                let [c, m, y, k] = data.array::<4>()?;
+                Color::cmyk(ink(c), ink(m), ink(y), ink(k))
+            }
+            7 => {
+                let [l, a, b] = data.array::<3>()?;
+                Color::lab(f32::from(l) * 100.0 / 255.0, f32::from(a) - 128.0, f32::from(b) - 128.0)
+            }
+            other => return Err(format!("color books in color space {other} aren't supported (only RGB, CMYK and Lab)")),
+        };
+        colors.push((name, color));
+    }
+    // Spot colors unless the book says process ones.
+    let spot = data.0.windows(8).last() != Some(b"spflproc".as_slice());
+    let mut lib = SwatchLibrary { name: if title.is_empty() { fallback.into() } else { title }, ..Default::default() };
+    let mut names = UniqueNames::default();
+    for (name, color) in colors.into_iter().filter(|(n, _)| !n.trim().is_empty()) {
+        let name = names.unique(format!("{prefix}{name}{suffix}").trim().to_string());
+        lib.swatches.push(Swatch { name, paint: Paint::solid(color), global: spot, spot });
+    }
+    Ok(lib)
+}
+
+/// The swatch of an `.ase` color block, `None` for a model other than RGB, CMYK, Lab and Gray.
+/// Components are clamped to their ranges.
+fn ase_swatch(body: &mut AseData) -> Result<Option<Swatch>, String> {
+    let name = body.name()?;
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let color = match &body.array::<4>()? {
+        b"RGB " => {
+            let [r, g, b] = [body.f32()?, body.f32()?, body.f32()?];
+            Color::rgb(unit(r), unit(g), unit(b))
+        }
+        b"CMYK" => {
+            let [c, m, y, k] = [body.f32()?, body.f32()?, body.f32()?, body.f32()?];
+            Color::cmyk(unit(c), unit(m), unit(y), unit(k))
+        }
+        // Lightness is stored as a fraction of 100. Some writers store L* itself, which shows as a
+        // value above 1.
+        b"LAB " => {
+            let [l, a, b] = [body.f32()?, body.f32()?, body.f32()?];
+            let l = if l > 1.0 { l.min(100.0) } else { unit(l) * 100.0 };
+            Color::lab(l, a.clamp(-128.0, 127.0), b.clamp(-128.0, 127.0))
+        }
+        // A gray level (1 is white); a gray color holds its ink.
+        b"Gray" => Color::gray(1.0 - unit(body.f32()?)),
+        _ => return Ok(None),
+    };
+    // Some writers leave the color type out, which makes a process color.
+    let kind = if body.0.len() >= 2 { body.u16()? } else { 2 };
+    // Spot colors are global.
+    let (global, spot) = match kind {
+        0 => (true, false),
+        1 => (true, true),
+        _ => (false, false),
+    };
+    let name = if name.is_empty() { value_name(color) } else { name };
+    Ok(Some(Swatch { name, paint: Paint::solid(color), global, spot }))
+}
+
+/// A color's values in its own model, as new swatches are named ("C=10 M=20 Y=30 K=0",
+/// "R=255 G=128 B=0", "Gray K=40", "L=52 a=70 b=-30").
+fn value_name(c: Color) -> String {
+    let pct = |v: f32| (v * 100.0).round();
+    let byte = |v: f32| (v * 255.0).round();
+    match c {
+        Color::Cmyk { c, m, y, k } => format!("C={} M={} Y={} K={}", pct(c), pct(m), pct(y), pct(k)),
+        Color::Rgb { r, g, b } => format!("R={} G={} B={}", byte(r), byte(g), byte(b)),
+        Color::Gray { k } => format!("Gray K={}", pct(k)),
+        // `+ 0.0` turns a rounded -0 into 0.
+        Color::Lab { l, a, b } => format!("L={} a={} b={}", l.round() + 0.0, a.round() + 0.0, b.round() + 0.0),
+    }
+}
+
+/// `.ase` data, read field by field; reading past its end is an error.
+struct AseData<'a>(&'a [u8]);
+
+impl<'a> AseData<'a> {
+    fn bytes(&mut self, n: usize) -> Result<&'a [u8], String> {
+        let (head, rest) = self.0.split_at_checked(n).ok_or(ASE_CUT_SHORT)?;
+        self.0 = rest;
+        Ok(head)
+    }
+    fn array<const N: usize>(&mut self) -> Result<[u8; N], String> {
+        let (head, rest) = self.0.split_first_chunk::<N>().ok_or(ASE_CUT_SHORT)?;
+        self.0 = rest;
+        Ok(*head)
+    }
+    fn u16(&mut self) -> Result<u16, String> {
+        self.array().map(u16::from_be_bytes)
+    }
+    fn u32(&mut self) -> Result<u32, String> {
+        self.array().map(u32::from_be_bytes)
+    }
+    /// A component; one that isn't a finite number reads as 0.
+    fn f32(&mut self) -> Result<f32, String> {
+        let v = f32::from_be_bytes(self.array()?);
+        Ok(if v.is_finite() { v } else { 0.0 })
+    }
+    /// A color book string ([`read_acb`]): a `u32` count of UTF-16 code units, then the units,
+    /// with `$$$/key=Text` read as `Text` and `^R`, `^C` as ®, ©; at most [`ASE_MAX_NAME`] units
+    /// are kept.
+    fn acb_string(&mut self) -> Result<String, String> {
+        let n = usize::try_from(self.u32()?).unwrap_or(usize::MAX);
+        let (units, _) = self.bytes(n.checked_mul(2).ok_or(ASE_CUT_SHORT)?)?.as_chunks::<2>();
+        let units: Vec<u16> = units.iter().take(ASE_MAX_NAME).map(|u| u16::from_be_bytes(*u)).take_while(|&u| u != 0).collect();
+        let s = String::from_utf16_lossy(&units);
+        let s = match s.strip_prefix("$$$/") {
+            Some(key) => key.split_once('=').map_or("", |(_, text)| text).to_string(),
+            None => s,
+        };
+        Ok(s.replace("^R", "®").replace("^C", "©"))
+    }
+    /// A name up to its terminating zero, trimmed. A block that ends before it has no name.
+    fn name(&mut self) -> Result<String, String> {
+        if self.0.is_empty() {
+            return Ok(String::new());
+        }
+        let n = usize::from(self.u16()?);
+        let (units, _) = self.bytes(n * 2)?.as_chunks::<2>();
+        let units: Vec<u16> = units.iter().take(ASE_MAX_NAME).map(|u| u16::from_be_bytes(*u)).take_while(|&u| u != 0).collect();
+        Ok(String::from_utf16_lossy(&units).trim().to_string())
+    }
+}
+
+/// A group's name as a file gives it, trimmed; "Color Group" when it has none.
+fn group_name(name: &str) -> String {
+    let name = name.trim();
+    if name.is_empty() { "Color Group".into() } else { name.to_string() }
+}
+
+/// The swatch and group names a reader has handed out. Swatches and color groups share one set of
+/// names, as in a document, and a name already taken gets the first free number ("Black 2").
+#[derive(Default)]
+struct UniqueNames {
+    taken: HashSet<String>,
+    /// The last number tried for each repeated name.
+    last: HashMap<String, usize>,
+}
+
+impl UniqueNames {
+    fn unique(&mut self, base: String) -> String {
+        if self.taken.insert(base.clone()) {
+            return base;
+        }
+        // Each pass tries the next number, and only finitely many names are taken.
+        let n = self.last.entry(base.clone()).or_insert(1);
+        loop {
+            *n += 1;
+            let name = format!("{base} {n}");
+            if self.taken.insert(name.clone()) {
+                return name;
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::{Gradient, GradientPaint, GradientStop};
+    use proptest::prelude::*;
+
+    /// A color book's string: a `u32` count of UTF-16 code units, then the units.
+    fn acb_str(out: &mut Vec<u8>, s: &str) {
+        let units: Vec<u16> = s.encode_utf16().collect();
+        out.extend((units.len() as u32).to_be_bytes());
+        units.iter().for_each(|u| out.extend(u.to_be_bytes()));
+    }
+
+    /// A color book in `space` (0 RGB, 2 CMYK, 7 Lab) with `colors` (name, components) and an
+    /// optional spot/process marker.
+    fn acb(space: u16, colors: &[(&str, &[u8])], marker: &[u8]) -> Vec<u8> {
+        let mut b = b"8BCB".to_vec();
+        b.extend(1u16.to_be_bytes());
+        b.extend(3000u16.to_be_bytes());
+        for s in ["$$$/colorbook/Test/title=Test Book^R", "TEST ", " C", "a book"] {
+            acb_str(&mut b, s);
+        }
+        b.extend((colors.len() as u16).to_be_bytes());
+        b.extend(7u16.to_be_bytes());
+        b.extend(0u16.to_be_bytes());
+        b.extend(space.to_be_bytes());
+        for (name, comps) in colors {
+            acb_str(&mut b, name);
+            b.extend(b"TST001");
+            b.extend(*comps);
+        }
+        b.extend(marker);
+        b
+    }
+
+    /// #831: color books (`.acb`) are read: their colors in RGB, CMYK or Lab, named with the book's
+    /// prefix and suffix, spot unless the book says process; page padding is left out.
+    #[test]
+    fn color_books_are_read() {
+        let lib = read_bytes(&acb(0, &[("185", &[228, 0, 43]), ("", &[0, 0, 0]), ("Red 032", &[239, 51, 64])], b"spflspot"), "fallback").unwrap();
+        assert_eq!(lib.name, "Test Book®");
+        let names: Vec<&str> = lib.swatches.iter().map(|s| s.name.as_str()).collect();
+        assert_eq!(names, ["TEST 185 C", "TEST Red 032 C"]);
+        assert!(lib.swatches.iter().all(|s| s.spot && s.global));
+        assert_eq!(lib.swatches[0].paint.color(), Some(Color::rgb8(228, 0, 43)));
+        // CMYK ink is stored inverted; a book marked process gives process colors.
+        let lib = read_bytes(&acb(2, &[("Cyan", &[0, 255, 255, 255])], b"spflproc"), "x").unwrap();
+        assert_eq!(lib.swatches[0].paint.color(), Some(Color::cmyk(1.0, 0.0, 0.0, 0.0)));
+        assert!(!lib.swatches[0].spot && !lib.swatches[0].global);
+        // Lab: lightness 0..255 for 0..100, a and b offset by 128; no marker: spot.
+        let lib = read_bytes(&acb(7, &[("Grey", &[255, 128, 128])], b""), "x").unwrap();
+        assert_eq!(lib.swatches[0].paint.color(), Some(Color::lab(100.0, 0.0, 0.0)));
+        assert!(lib.swatches[0].spot);
+        assert!(sniff_bytes(&acb(0, &[], b"")));
+        // Unsupported versions and color spaces, and short files, are errors.
+        let mut v2 = acb(0, &[], b"");
+        v2[5] = 2;
+        assert!(read_bytes(&v2, "x").is_err());
+        assert!(read_bytes(&acb(1, &[("x", &[1, 2, 3])], b""), "x").is_err());
+        let full = acb(0, &[("185", &[228, 0, 43])], b"");
+        for cut in 4..full.len() {
+            assert!(read_bytes(&full[..cut], "x").is_err(), "{cut} bytes");
+        }
+        let mut huge = b"8BCB\0\x01\0\x01".to_vec();
+        huge.extend(u32::MAX.to_be_bytes());
+        assert!(read_bytes(&huge, "x").is_err(), "a string longer than the file");
+    }
 
     fn sample() -> SwatchLibrary {
         let grad = Paint::Gradient(Box::new(GradientPaint::new(Gradient {
@@ -262,10 +722,15 @@ mod tests {
         }
     }
 
+    /// `lib` written as text format `f`.
+    fn written(lib: &SwatchLibrary, f: PaletteFormat) -> String {
+        String::from_utf8(write(lib, f).unwrap()).unwrap()
+    }
+
     #[test]
     fn native_round_trip_keeps_cmyk_spot_and_groups() {
         let lib = sample();
-        let text = write(&lib, PaletteFormat::Native);
+        let text = written(&lib, PaletteFormat::Native);
         assert!(sniff(&text));
         let back = read(&text, "fallback").unwrap();
         let mut expected = lib.clone();
@@ -278,7 +743,7 @@ mod tests {
 
     #[test]
     fn gpl_writes_rgb_with_group_headers_and_reads_comments_and_headers() {
-        let text = write(&sample(), PaletteFormat::Gpl);
+        let text = written(&sample(), PaletteFormat::Gpl);
         assert!(text.starts_with("GIMP Palette\nName: Brand */ Colours\n"));
         assert!(text.contains("# Group: Neutrals\n255   0   0\tR=255 G=0 B=0\n"), "{text}");
         assert!(!text.contains("Fade") && !text.contains("Tiles"), "only solid colours");
@@ -294,6 +759,11 @@ mod tests {
         assert_eq!(names, ["Sky Blue", "R=10 G=20 B=30", "Black", "Black 2"]);
         assert_eq!(lib.swatches[0].paint.color(), Some(Color::rgb8(0, 128, 255)));
         assert_eq!(read("GIMP Palette\n1 2 3 x\n", "Fallback").unwrap().name, "Fallback");
+        // Colors and groups share names; an unnamed group is "Color Group".
+        let lib = read("GIMP Palette\n0 0 0 Black\n# Group: Black\n1 1 1 Black\n# Group:\n", "x").unwrap();
+        let groups: Vec<(&str, Vec<&str>)> =
+            lib.groups.iter().map(|g| (g.name.as_str(), g.swatches.iter().map(|w| w.name.as_str()).collect())).collect();
+        assert_eq!(groups, [("Black 2", vec!["Black 3"]), ("Color Group", vec![])]);
     }
 
     #[test]
@@ -303,7 +773,7 @@ mod tests {
         assert_eq!(css_property("#FF00CC"), "--\\#ff00cc");
         assert_eq!(css_property("Café 50%"), "--café-50\\%");
         assert_eq!(css_property("  "), "--swatch");
-        let text = write(&sample(), PaletteFormat::Css);
+        let text = written(&sample(), PaletteFormat::Css);
         assert!(text.starts_with("/* Brand * / Colours */\n:root {\n"), "{text}");
         assert!(text.contains("  --ink: #"), "{text}");
         assert!(text.contains("; /* spot */"));
@@ -317,8 +787,306 @@ mod tests {
             swatches: ["Red", "red"].map(|n| Swatch { name: n.into(), paint: Paint::solid(Color::BLACK), global: false, spot: false }).to_vec(),
             groups: vec![],
         };
-        let text = write(&lib, PaletteFormat::Css);
+        let text = written(&lib, PaletteFormat::Css);
         assert!(text.contains("--red: #000000;") && text.contains("--red-2: #000000;"));
         assert!(read(&text, "x").is_err(), "CSS is written only");
     }
+
+    /// A swatch exchange file of `blocks` (type, body).
+    fn ase(blocks: &[(u16, Vec<u8>)]) -> Vec<u8> {
+        let mut out = b"ASEF\0\x01\0\0".to_vec();
+        out.extend((blocks.len() as u32).to_be_bytes());
+        for (kind, body) in blocks {
+            out.extend(kind.to_be_bytes());
+            out.extend((body.len() as u32).to_be_bytes());
+            out.extend(body);
+        }
+        out
+    }
+
+    /// A name as `.ase` stores it.
+    fn ase_name(name: &str) -> Vec<u8> {
+        let units: Vec<u16> = name.encode_utf16().chain([0]).collect();
+        let mut out = (units.len() as u16).to_be_bytes().to_vec();
+        out.extend(units.iter().flat_map(|u| u.to_be_bytes()));
+        out
+    }
+
+    /// A color block: name, model, components and color type.
+    fn ase_color(name: &str, model: &[u8; 4], values: &[f32], kind: u16) -> (u16, Vec<u8>) {
+        let mut body = ase_name(name);
+        body.extend(model);
+        body.extend(values.iter().flat_map(|v| v.to_be_bytes()));
+        body.extend(kind.to_be_bytes());
+        (ASE_COLOR, body)
+    }
+
+    #[test]
+    fn ase_reads_color_models_kinds_and_groups() {
+        let bytes = ase(&[
+            ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0),
+            ase_color("Ink", b"CMYK", &[1.0, 0.5, 0.0, 0.2], 1),
+            (ASE_GROUP_START, ase_name("Neutrals")),
+            ase_color("Mist", b"Gray", &[0.75], 2),
+            ase_color("Clay", b"LAB ", &[0.5, 20.0, -30.0], 2),
+            (ASE_GROUP_END, vec![]),
+            ase_color("Paper", b"RGB ", &[1.0, 1.0, 1.0], 2),
+        ]);
+        assert!(sniff_bytes(&bytes));
+        let sw = |name: &str, color, global, spot| Swatch { name: name.into(), paint: Paint::solid(color), global, spot };
+        let expected = SwatchLibrary {
+            name: "Brand".into(),
+            swatches: vec![
+                sw("Sky", Color::rgb(0.0, 0.5, 1.0), true, false),
+                sw("Ink", Color::cmyk(1.0, 0.5, 0.0, 0.2), true, true),
+                sw("Paper", Color::WHITE, false, false),
+            ],
+            groups: vec![SwatchGroup {
+                name: "Neutrals".into(),
+                swatches: vec![sw("Mist", Color::gray(0.25), false, false), sw("Clay", Color::lab(50.0, 20.0, -30.0), false, false)],
+            }],
+        };
+        assert_eq!(read_bytes(&bytes, "Brand").unwrap(), expected, "named after the file; 0 global, 1 spot, 2 process");
+        // A lightness above 1 is L* itself.
+        let deep = read_bytes(&ase(&[ase_color("Deep", b"LAB ", &[53.0, 20.0, -30.0], 2)]), "x").unwrap();
+        assert_eq!(deep.swatches[0].paint.color(), Some(Color::lab(53.0, 20.0, -30.0)));
+        // Text libraries read through the same call, also when they aren't valid UTF-8.
+        assert!(sniff_bytes(b"GIMP Palette\n1 2 3 x\n") && !sniff_bytes(b"ASE") && !sniff_bytes(&[0xff, 0xfe, 0]));
+        assert_eq!(read_bytes(b"GIMP Palette\n1 2 3 x\n", "F").unwrap().swatches.len(), 1);
+        let latin1 = b"GIMP Palette\n1 2 3 Caf\xe9\n";
+        assert!(sniff_bytes(latin1));
+        assert_eq!(read_bytes(latin1, "F").unwrap().swatches.len(), 1);
+    }
+
+    #[test]
+    fn ase_names_unnamed_and_repeated_entries_and_skips_other_blocks() {
+        let mut untyped = ase_color("Plain", b"RGB ", &[0.2, 0.4, 0.6], 2);
+        untyped.1.truncate(untyped.1.len() - 2);
+        let bytes = ase(&[
+            ase_color("Café 🎨", b"RGB ", &[1.0, 0.0, 0.0], 2),
+            ase_color("", b"CMYK", &[0.1, 0.2, 0.3, 0.0], 2),
+            ase_color(" Red ", b"RGB ", &[2.0, -1.0, f32::NAN], 0),
+            ase_color("Red", b"Gray", &[0.0], 2),
+            untyped,
+            ase_color("Hue", b"HSB ", &[0.1, 0.2, 0.3], 2),
+            (0x0042, vec![1, 2, 3]),
+            (ASE_GROUP_END, vec![]),
+            (ASE_GROUP_START, ase_name("")),
+            (ASE_GROUP_START, ase_name("Red")),
+            ase_color("Red", b"Gray", &[1.0], 2),
+        ]);
+        let lib = read_bytes(&bytes, "x").unwrap();
+        let names: Vec<&str> = lib.swatches.iter().map(|w| w.name.as_str()).collect();
+        assert_eq!(names, ["Café 🎨", "C=10 M=20 Y=30 K=0", "Red", "Red 2", "Plain"], "an HSB color and an unknown block are skipped");
+        assert_eq!(lib.swatches[2].paint.color(), Some(Color::rgb(1.0, 0.0, 0.0)), "clamped, NaN read as 0");
+        assert!(lib.swatches[2].global && !lib.swatches[4].global, "without a color type: process");
+        // A group start ends the open group, and groups and colors share names.
+        let groups: Vec<(&str, Vec<&str>)> =
+            lib.groups.iter().map(|g| (g.name.as_str(), g.swatches.iter().map(|w| w.name.as_str()).collect())).collect();
+        assert_eq!(groups, [("Color Group", vec![]), ("Red 3", vec!["Red 4"])]);
+        assert_eq!(lib.groups[1].swatches[0].paint.color(), Some(Color::gray(0.0)), "gray level 1 is white");
+    }
+
+    #[test]
+    fn damaged_ase_files_are_errors() {
+        let good = ase(&[(ASE_GROUP_START, ase_name("G")), ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0)]);
+        assert_eq!(read_bytes(&good, "x").unwrap().len(), 1);
+        for n in ASE_SIGNATURE.len()..good.len() {
+            assert!(read_bytes(&good[..n], "x").is_err(), "cut at {n}");
+        }
+        let mut v2 = good.clone();
+        v2[5] = 2;
+        assert!(read_bytes(&v2, "x").unwrap_err().contains("2.0"), "version 2.0");
+        // Too many colors, or too many groups (empty group starts take 6 bytes each).
+        let colors: Vec<(u16, Vec<u8>)> = (0..=ASE_MAX_ENTRIES).map(|_| ase_color("Gray", b"Gray", &[0.5], 2)).collect();
+        assert!(read_bytes(&ase(&colors), "x").unwrap_err().contains("more than"));
+        let groups: Vec<(u16, Vec<u8>)> = (0..=ASE_MAX_ENTRIES).map(|_| (ASE_GROUP_START, vec![])).collect();
+        assert!(read_bytes(&ase(&groups), "x").unwrap_err().contains("more than"));
+        assert_eq!(read_bytes(&ase(&groups[1..]), "x").unwrap().groups.len(), ASE_MAX_ENTRIES, "up to the limit");
+    }
+
+    #[test]
+    fn ase_writes_each_model_kind_and_group() {
+        let sw = |name: &str, color, global, spot| Swatch { name: name.into(), paint: Paint::solid(color), global, spot };
+        let tint = Swatch {
+            name: "Ink 40%".into(),
+            paint: Paint::Solid { color: Color::cmyk(0.4, 0.2, 0.0, 0.08), swatch: Some("Ink".into()), tint: 0.4 },
+            global: false,
+            spot: false,
+        };
+        // `sample()` holds the spot color Ink, the gradient Fade, the pattern Tiles and the group Neutrals.
+        let mut lib = sample();
+        lib.swatches.insert(0, sw("Sky", Color::rgb(0.0, 0.5, 1.0), true, false));
+        lib.swatches.push(tint);
+        lib.groups[0].swatches = vec![sw("Mist", Color::gray(0.25), false, false), sw("Clay", Color::lab(50.0, 20.0, -30.0), false, false)];
+        lib.groups.push(SwatchGroup { name: "Empty".into(), swatches: vec![] });
+        let bytes = write(&lib, PaletteFormat::Ase).unwrap();
+        let expected = ase(&[
+            ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0),
+            ase_color("Ink", b"CMYK", &[1.0, 0.5, 0.0, 0.2], 1),
+            ase_color("Ink 40%", b"CMYK", &[0.4, 0.2, 0.0, 0.08], 2),
+            (ASE_GROUP_START, ase_name("Neutrals")),
+            ase_color("Mist", b"Gray", &[0.75], 2),
+            ase_color("Clay", b"LAB ", &[0.5, 20.0, -30.0], 2),
+            (ASE_GROUP_END, vec![]),
+            (ASE_GROUP_START, ase_name("Empty")),
+            (ASE_GROUP_END, vec![]),
+        ]);
+        assert_eq!(bytes, expected, "no gradient or pattern; the tint as the process color it shows");
+        let back = read_bytes(&bytes, "Brand").unwrap();
+        assert_eq!((back.len(), back.groups.len()), (5, 2), "the empty group stays");
+        assert_eq!(PaletteFormat::parse(".ASE"), Some(PaletteFormat::Ase));
+        assert!(PaletteFormat::Ase.readable() && PaletteFormat::Ase.binary() && !PaletteFormat::Gpl.binary());
+    }
+
+    #[test]
+    fn ase_names_lose_nul_and_stop_at_the_reader_limit() {
+        let names = ["Re\0d".to_string(), "é".repeat(1030), format!("a{}", "🎨".repeat(600))];
+        let swatches = names.iter().map(|n| Swatch { name: n.clone(), paint: Paint::solid(Color::BLACK), global: false, spot: false }).collect();
+        let lib = SwatchLibrary { name: "x".into(), swatches, groups: vec![] };
+        let back = read_bytes(&write(&lib, PaletteFormat::Ase).unwrap(), "x").unwrap();
+        let got: Vec<&str> = back.swatches.iter().map(|w| w.name.as_str()).collect();
+        // At most 1024 UTF-16 code units, cut between characters: "a" and 511 two-unit emoji.
+        assert_eq!(got, ["Red".to_string(), "é".repeat(1024), format!("a{}", "🎨".repeat(511))]);
+    }
+
+    #[test]
+    fn ase_clamps_components_and_writes_non_finite_ones_as_zero() {
+        let sw = |name: &str, color| Swatch { name: name.into(), paint: Paint::solid(color), global: false, spot: false };
+        let swatches = vec![
+            sw("Lab", Color::lab(100.5, 300.0, -300.0)),
+            sw("Rgb", Color::rgb(2.0, -1.0, f32::NAN)),
+            sw("Cmyk", Color::cmyk(1.5, 0.0, 0.0, f32::INFINITY)),
+            sw("Gray", Color::gray(1.5)),
+        ];
+        let bytes = write(&SwatchLibrary { name: "x".into(), swatches, groups: vec![] }, PaletteFormat::Ase).unwrap();
+        let expected = ase(&[
+            ase_color("Lab", b"LAB ", &[1.0, 127.0, -128.0], 2),
+            ase_color("Rgb", b"RGB ", &[1.0, 0.0, 0.0], 2),
+            ase_color("Cmyk", b"CMYK", &[1.0, 0.0, 0.0, 0.0], 2),
+            ase_color("Gray", b"Gray", &[0.0], 2),
+        ]);
+        assert_eq!(bytes, expected, "clamped to the ranges .ase holds, a component that isn't finite as 0");
+        // Lightness 100.5 is written as 1, which reads back as L* 100.
+        let back = read_bytes(&bytes, "x").unwrap();
+        assert_eq!(back.swatches[0].paint.color(), Some(Color::lab(100.0, 127.0, -128.0)));
+    }
+
+    #[test]
+    fn ase_write_refuses_more_entries_than_the_reader_takes() {
+        let gray = |i: usize| Swatch { name: format!("G{i}"), paint: Paint::solid(Color::gray(0.5)), global: false, spot: false };
+        // The limit counts colors and groups: a group and `ASE_MAX_ENTRIES - 1` colors reach it.
+        let mut lib = SwatchLibrary {
+            name: "x".into(),
+            swatches: (1..ASE_MAX_ENTRIES).map(gray).collect(),
+            groups: vec![SwatchGroup { name: "Group".into(), swatches: vec![] }],
+        };
+        let back = read_bytes(&write(&lib, PaletteFormat::Ase).unwrap(), "x").unwrap();
+        assert_eq!((back.len(), back.groups.len()), (ASE_MAX_ENTRIES - 1, 1));
+        lib.swatches.push(gray(0));
+        let e = write(&lib, PaletteFormat::Ase).unwrap_err();
+        assert!(e.contains("reads at most 100000 colors and groups from a swatch exchange file, and this library has 100001"), "{e}");
+        // A gradient is left out and is not counted.
+        lib.swatches.last_mut().unwrap().paint = sample().swatches[1].paint.clone();
+        assert!(write(&lib, PaletteFormat::Ase).is_ok());
+    }
+
+    /// A color in one of the four models, in the ranges `.ase` holds.
+    fn arb_color() -> impl Strategy<Value = Color> {
+        let unit = || 0.0f32..=1.0;
+        prop_oneof![
+            (unit(), unit(), unit()).prop_map(|(r, g, b)| Color::rgb(r, g, b)),
+            (unit(), unit(), unit(), unit()).prop_map(|(c, m, y, k)| Color::cmyk(c, m, y, k)),
+            unit().prop_map(Color::gray),
+            (0.0f32..=100.0, -128.0f32..=127.0, -128.0f32..=127.0).prop_map(|(l, a, b)| Color::lab(l, a, b)),
+        ]
+    }
+
+    /// A swatch's paint with its global and spot flags: a solid color with any flags, a tint swatch
+    /// (both flags off) or a gradient.
+    fn arb_paint() -> impl Strategy<Value = (Paint, bool, bool)> {
+        prop_oneof![
+            4 => (arb_color(), any::<bool>(), any::<bool>()).prop_map(|(c, global, spot)| (Paint::solid(c), global, spot)),
+            1 => arb_color().prop_map(|c| (Paint::Solid { color: c, swatch: Some("Base".into()), tint: 0.4 }, false, false)),
+            1 => Just((sample().swatches[1].paint.clone(), false, false)),
+        ]
+    }
+
+    /// Ungrouped swatches and color groups. A name is a number and up to 12 characters of any script
+    /// but NUL, trimmed, so swatches and groups have unique names, as in a document.
+    fn arb_library() -> impl Strategy<Value = SwatchLibrary> {
+        let swatches = || prop::collection::vec((arb_paint(), "[^\\x00]{0,12}"), 0..12);
+        (swatches(), prop::collection::vec(("[^\\x00]{0,12}", swatches()), 0..4)).prop_map(|(loose, groups)| {
+            let mut n = 0;
+            let mut name = |prefix: &str, base: &str| {
+                n += 1;
+                format!("{prefix}{n} {base}").trim().to_string()
+            };
+            let mut lib = SwatchLibrary { name: "Fuzz".into(), ..Default::default() };
+            for ((paint, global, spot), base) in loose {
+                lib.swatches.push(Swatch { name: name("", &base), paint, global, spot });
+            }
+            for (base, list) in groups {
+                let mut g = SwatchGroup { name: name("G", &base), swatches: vec![] };
+                for ((paint, global, spot), base) in list {
+                    g.swatches.push(Swatch { name: name("", &base), paint, global, spot });
+                }
+                lib.groups.push(g);
+            }
+            lib
+        })
+    }
+
+    /// Are `got` and `want` in the same model, with every component within 1e-4? Lab lightness and
+    /// gray read back within `f32` rounding.
+    fn close(got: Color, want: Color) -> bool {
+        let near = |a: f32, b: f32| (a - b).abs() < 1e-4;
+        match (got, want) {
+            (Color::Rgb { r, g, b }, Color::Rgb { r: r2, g: g2, b: b2 }) => near(r, r2) && near(g, g2) && near(b, b2),
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => near(c, c2) && near(m, m2) && near(y, y2) && near(k, k2),
+            (Color::Gray { k }, Color::Gray { k: k2 }) => near(k, k2),
+            (Color::Lab { l, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => near(l, l2) && near(a, a2) && near(b, b2),
+            _ => false,
+        }
+    }
+
+    /// The swatches of `list` as an `.ase` file reads them back: solid colors only, unlinked, spot
+    /// colors global.
+    fn ase_expected(list: &[Swatch]) -> Vec<Swatch> {
+        list.iter()
+            .filter_map(|w| Some(Swatch { name: w.name.clone(), paint: Paint::solid(w.paint.color()?), global: w.global || w.spot, spot: w.spot }))
+            .collect()
+    }
+
+    /// Do swatches `got` have the names, flags and unlinked colors (within 1e-4) of `want`?
+    fn same_swatches(got: &[Swatch], want: &[Swatch]) -> bool {
+        got.len() == want.len()
+            && got.iter().zip(want).all(|(g, w)| {
+                let color = match (&g.paint, w.paint.color()) {
+                    (Paint::Solid { color, swatch: None, .. }, Some(c)) => close(*color, c),
+                    _ => false,
+                };
+                g.name == w.name && g.global == w.global && g.spot == w.spot && color
+            })
+    }
+
+    proptest! {
+        #![proptest_config(ProptestConfig { failure_persistence: None, ..ProptestConfig::default() })]
+
+        /// A written `.ase` file reads back as the library's solid colors in their own model, with
+        /// their names, kinds and color groups.
+        #[test]
+        fn ase_round_trip_keeps_models_kinds_and_groups(lib in arb_library()) {
+            let bytes = write(&lib, PaletteFormat::Ase).unwrap();
+            prop_assert!(sniff_bytes(&bytes));
+            let back = read_bytes(&bytes, &lib.name).unwrap();
+            prop_assert_eq!(&back.name, &lib.name);
+            prop_assert!(same_swatches(&back.swatches, &ase_expected(&lib.swatches)), "{:?}", back.swatches);
+            prop_assert_eq!(back.groups.len(), lib.groups.len());
+            for (g, want) in back.groups.iter().zip(&lib.groups) {
+                prop_assert_eq!(&g.name, &want.name);
+                prop_assert!(same_swatches(&g.swatches, &ase_expected(&want.swatches)), "{}: {:?}", g.name, g.swatches);
+            }
+        }
+    }
 }

crates/doc/Cargo.toml

@@ -13,9 +13,12 @@ vectorcraft-geom = { workspace = true }
 vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
+tiff = { workspace = true }
+zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+jpeg-encoder = { workspace = true }
 proptest = { workspace = true }

crates/doc/src/appearance.rs

@@ -293,6 +293,129 @@ impl WidthProfile {
     }
 }
 
+/// Pen pressure recorded along a stroke (the Paintbrush with a graphics tablet): (position 0..1
+/// along the path, pressure 0..1) samples in order, positions measured as a [`WidthProfile`]'s
+/// are. Calligraphic brushes with Pressure variation read it; everything else ignores it.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PressureProfile {
+    pub points: Vec<(f64, f64)>,
+}
+
+impl PressureProfile {
+    /// The pressure of a stroke drawn without one (a mouse, or a path the brush was applied to):
+    /// half way, so a Pressure brush draws its own value there.
+    pub const MID: f64 = 0.5;
+    /// The most samples a stroke keeps (after simplifying them).
+    pub const MAX_POINTS: usize = 512;
+    /// How far (in pressure) simplifying may move the recorded curve.
+    const TOLERANCE: f64 = 0.01;
+
+    /// The pressure at `t` (0..1), linear between samples; [`Self::MID`] without any.
+    pub fn at(&self, t: f64) -> f64 {
+        let p = &self.points;
+        let (Some(first), Some(last)) = (p.first(), p.last()) else { return Self::MID };
+        let v = if t <= first.0 {
+            first.1
+        } else {
+            p.windows(2)
+                .find_map(|w| match w {
+                    [a, b] if t <= b.0 => Some(a.1 + (b.1 - a.1) * ((t - a.0) / (b.0 - a.0).max(1e-9)).clamp(0.0, 1.0)),
+                    _ => None,
+                })
+                .unwrap_or(last.1)
+        };
+        if v.is_finite() { v.clamp(0.0, 1.0) } else { Self::MID }
+    }
+
+    /// A profile from (position, pressure) samples in order along the stroke: values are clamped
+    /// into 0..1 (non-finite ones dropped), the curve is simplified to within 1 % and kept to
+    /// [`Self::MAX_POINTS`]. `None` without a sample.
+    pub fn from_samples(samples: impl IntoIterator<Item = (f64, f64)>) -> Option<Self> {
+        let pts: Vec<(f64, f64)> =
+            samples.into_iter().filter(|(t, p)| t.is_finite() && p.is_finite()).map(|(t, p)| (t.clamp(0.0, 1.0), p.clamp(0.0, 1.0))).collect();
+        if pts.is_empty() {
+            return None;
+        }
+        // Simplifying is quadratic at worst: a huge stroke is thinned evenly first.
+        let mut pts = thin(pts, 16 * Self::MAX_POINTS);
+        // Positions only ever go forward.
+        let mut prev = 0.0;
+        for p in &mut pts {
+            p.0 = p.0.max(prev);
+            prev = p.0;
+        }
+        let keep = simplify_1d(&pts, Self::TOLERANCE);
+        let pts = thin(pts.iter().zip(keep).filter(|(_, k)| *k).map(|(p, _)| *p).collect(), Self::MAX_POINTS);
+        let round = |v: f64| (v * 1e4).round() / 1e4;
+        Some(Self { points: pts.into_iter().map(|(t, p)| (round(t), round(p))).collect() })
+    }
+
+    /// The pressure of a path `old_len` long (`old`; None: drawn without pressure) continued at its
+    /// end by a stroke `added_len` long (`added`). None when neither has pressure.
+    pub fn extended(old: Option<&Self>, old_len: f64, added: Option<&Self>, added_len: f64) -> Option<Self> {
+        if old.is_none() && added.is_none() {
+            return None;
+        }
+        let (old_len, added_len) = (old_len.max(0.0), added_len.max(0.0));
+        let total = old_len + added_len;
+        if !total.is_finite() || total <= 1e-9 {
+            return old.or(added).cloned();
+        }
+        let flat = Self { points: vec![(0.0, Self::MID), (1.0, Self::MID)] };
+        let (old, added) = (old.unwrap_or(&flat), added.unwrap_or(&flat));
+        let o = old_len / total;
+        let old_pts = old.points.iter().map(|&(t, p)| (t * o, p));
+        Self::from_samples(old_pts.chain(added.points.iter().map(|&(u, p)| (o + u * (1.0 - o), p))))
+    }
+
+    /// The pressure of the path reversed.
+    pub fn reversed(&self) -> Self {
+        Self { points: self.points.iter().rev().map(|&(t, p)| (1.0 - t, p)).collect() }
+    }
+
+    /// A light–heavy–light stroke, for previews of pressure-sensitive brushes.
+    pub fn sample() -> Self {
+        Self { points: vec![(0.0, 0.0), (0.5, 1.0), (1.0, 0.0)] }
+    }
+}
+
+/// At most `max` of `pts`, evenly spread (the ends kept).
+fn thin(pts: Vec<(f64, f64)>, max: usize) -> Vec<(f64, f64)> {
+    let n = pts.len();
+    if n <= max || max < 2 {
+        return pts;
+    }
+    (0..max).filter_map(|i| pts.get(i * (n - 1) / (max - 1)).copied()).collect()
+}
+
+/// Douglas–Peucker over a function sampled at `pts`: which samples to keep so the polyline through
+/// them stays within `tol` (vertically) of every sample. The ends are always kept.
+fn simplify_1d(pts: &[(f64, f64)], tol: f64) -> Vec<bool> {
+    let mut keep = vec![false; pts.len()];
+    let Some(last) = pts.len().checked_sub(1) else { return keep };
+    for i in [0, last] {
+        if let Some(k) = keep.get_mut(i) {
+            *k = true;
+        }
+    }
+    let mut stack = vec![(0, last)];
+    while let Some((i, j)) = stack.pop() {
+        let (Some(&a), Some(&b)) = (pts.get(i), pts.get(j)) else { continue };
+        let line = |t: f64| if b.0 - a.0 > 1e-12 { a.1 + (b.1 - a.1) * (t - a.0) / (b.0 - a.0) } else { (a.1 + b.1) / 2.0 };
+        let far = (i + 1..j).filter_map(|k| pts.get(k).map(|q| (k, (q.1 - line(q.0)).abs()))).max_by(|x, y| x.1.total_cmp(&y.1));
+        if let Some((k, d)) = far
+            && d > tol
+        {
+            if let Some(f) = keep.get_mut(k) {
+                *f = true;
+            }
+            stack.push((i, k));
+            stack.push((k, j));
+        }
+    }
+    keep
+}
+
 /// A width profile saved to the Profile list under a name (Add to Profiles), kept with the
 /// preferences.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -386,6 +509,11 @@ pub struct StrokeLayer {
     /// How a gradient paint maps onto the stroke (within, along or across it).
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     pub gradient_mode: StrokeGradientMode,
+    /// The pen pressure the stroke was drawn with (Paintbrush with a tablet): pressure-sensitive
+    /// brushes vary with it. It belongs to this path's shape, so appearances copied to other
+    /// art leave it behind ([`Appearance::without_pressure`]).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pressure: Option<PressureProfile>,
 }
 
 /// How a gradient on a stroke is laid out (the Gradient panel's Stroke buttons). Saved by variant
@@ -456,6 +584,7 @@ impl StrokeLayer {
             arrow_align: ArrowAlign::Extend,
             overprint: false,
             gradient_mode: StrokeGradientMode::Within,
+            pressure: None,
         }
     }
     /// Weight of the start (`end == false`) or end arrowhead: stroke weight × its scale, at least
@@ -640,6 +769,15 @@ impl Appearance {
     pub fn stroke_mut(&mut self) -> Option<&mut StrokeLayer> {
         self.items.iter_mut().rev().find_map(|i| if let AppearanceItem::Stroke(s) = i { Some(s) } else { None })
     }
+    /// This appearance for other art: the pen pressure its strokes were drawn with stays with them.
+    pub fn without_pressure(mut self) -> Self {
+        for it in &mut self.items {
+            if let AppearanceItem::Stroke(s) = it {
+                s.pressure = None;
+            }
+        }
+        self
+    }
     pub fn fill_paint(&self) -> Paint {
         self.fill().map(|f| f.paint.clone()).unwrap_or(Paint::None)
     }
@@ -1103,6 +1241,58 @@ mod tests {
         assert!(matches!(a.items[0], AppearanceItem::Fill(_)));
     }
 
+    /// #852: pen pressure is kept simplified along the stroke and read back by position.
+    #[test]
+    fn pressure_profile_samples_simplify_and_interpolate() {
+        // A steady ramp keeps only its ends; a bump keeps its peak.
+        let ramp = PressureProfile::from_samples((0..=100).map(|i| (i as f64 / 100.0, i as f64 / 100.0))).unwrap();
+        assert_eq!(ramp.points, vec![(0.0, 0.0), (1.0, 1.0)]);
+        assert!((ramp.at(0.25) - 0.25).abs() < 1e-9);
+        let bump = PressureProfile::from_samples([(0.0, 0.2), (0.3, 0.2), (0.5, 0.9), (0.7, 0.2), (1.0, 0.2)]).unwrap();
+        assert!(bump.points.contains(&(0.5, 0.9)) && (bump.at(0.4) - 0.55).abs() < 1e-9, "{bump:?}");
+        // Junk is clamped or dropped; positions never go back; nothing at all is no profile.
+        let junk = PressureProfile::from_samples([(f64::NAN, 0.5), (0.5, 7.0), (0.2, -1.0), (2.0, f64::INFINITY)]).unwrap();
+        assert_eq!(junk.points, vec![(0.5, 1.0), (0.5, 0.0)]);
+        assert!(PressureProfile::from_samples([(f64::NAN, 0.5)]).is_none());
+        assert_eq!(PressureProfile::default().at(0.3), PressureProfile::MID);
+        // A long noisy stroke stays bounded.
+        let noisy = PressureProfile::from_samples((0..1_000_000).map(|i| (i as f64 / 1e6, (i % 2) as f64))).unwrap();
+        assert!(noisy.points.len() <= PressureProfile::MAX_POINTS);
+        // Out-of-order points (a hand-edited file) still read within 0..1.
+        let odd = PressureProfile { points: vec![(1.0, 5.0), (0.0, -3.0)] };
+        assert!((0.0..=1.0).contains(&odd.at(0.5)));
+    }
+
+    #[test]
+    fn pressure_profile_extends_and_reverses() {
+        let old = PressureProfile { points: vec![(0.0, 0.0), (1.0, 1.0)] };
+        let added = PressureProfile { points: vec![(0.0, 1.0), (1.0, 0.0)] };
+        // A 30 pt path continued by 10 pt: its ramp fills the first three quarters.
+        let joined = PressureProfile::extended(Some(&old), 30.0, Some(&added), 10.0).unwrap();
+        assert!((joined.at(0.75) - 1.0).abs() < 1e-9 && (joined.at(0.375) - 0.5).abs() < 1e-9 && joined.at(1.0) == 0.0, "{joined:?}");
+        // A side without pressure is half way.
+        let half = PressureProfile::extended(None, 10.0, Some(&added), 10.0).unwrap();
+        assert_eq!(half.at(0.25), PressureProfile::MID);
+        assert!(PressureProfile::extended(None, 10.0, None, 10.0).is_none());
+        assert_eq!(PressureProfile::extended(Some(&old), 0.0, None, f64::NAN), Some(old.clone()));
+        assert_eq!(old.reversed().points, vec![(0.0, 1.0), (1.0, 0.0)]);
+    }
+
+    /// Strokes saved before pen pressure load as they were, and are written without it.
+    #[test]
+    fn strokes_without_pressure_round_trip_unchanged() {
+        let json = serde_json::to_value(StrokeLayer::new(Paint::None, 2.0)).unwrap();
+        assert!(json.get("pressure").is_none());
+        let st: StrokeLayer = serde_json::from_value(json).unwrap();
+        assert_eq!(st.pressure, None);
+        let pressed = StrokeLayer { pressure: Some(PressureProfile::sample()), ..st };
+        let back: StrokeLayer = serde_json::from_value(serde_json::to_value(&pressed).unwrap()).unwrap();
+        assert_eq!(back, pressed);
+        let mut ap = Appearance::basic(Paint::None, Paint::None, 1.0);
+        ap.stroke_mut().unwrap().pressure = Some(PressureProfile::sample());
+        assert_eq!(ap.without_pressure().stroke().unwrap().pressure, None);
+    }
+
     #[test]
     fn profile_interp() {
         let p = WidthProfile::lens();

crates/doc/src/blend.rs

@@ -527,7 +527,8 @@ impl Lerp {
             (NodeKind::Mesh(ma), NodeKind::Mesh(mb)) if ma.rows == mb.rows && ma.cols == mb.cols && ma.points.len() == mb.points.len() => Shape::Mesh,
             (NodeKind::Text(_), NodeKind::Text(_))
             | (NodeKind::SymbolInstance { .. }, NodeKind::SymbolInstance { .. })
-            | (NodeKind::Image(_), NodeKind::Image(_)) => Shape::Placed,
+            | (NodeKind::Image(_), NodeKind::Image(_))
+            | (NodeKind::PlacedDocument(_), NodeKind::PlacedDocument(_)) => Shape::Placed,
             _ => match (node_path(a), node_path(b)) {
                 (Some((pa, ra, ma)), Some((pb, rb, mb))) => {
                     Shape::Path { pair: PathPair::new(&pa, &pb, starts), rules: (ra, rb), members: ma.zip(mb) }
@@ -586,6 +587,7 @@ impl Lerp {
                         *o = lerp_affine(*x, *y, t)
                     }
                     (NodeKind::Image(o), NodeKind::Image(x), NodeKind::Image(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
+                    (NodeKind::PlacedDocument(o), NodeKind::PlacedDocument(x), NodeKind::PlacedDocument(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
                     _ => {}
                 }
                 n.mask = None;
@@ -687,6 +689,7 @@ fn lerp_text(o: &mut TextObject, x: &TextObject, y: &TextObject, t: f64) {
     }
     if resized {
         o.cached_bounds = None;
+        o.cached_baselines.clear();
     }
 }
 

crates/doc/src/clipnest.rs

@@ -1,8 +1,10 @@
-//! Clipped art read from page descriptions (metafiles, PostScript) into clipping groups.
+//! Clipped and grouped art read from page descriptions (metafiles, PostScript) into clipping
+//! groups and groups.
 //!
-//! Importers record each object they draw with the chain of clips in force at the time, outermost
-//! first ([`Drawn`]); [`nest`] then puts runs of objects under the same clip into one clipping
-//! group, nesting groups for nested clips, keeping the drawing order.
+//! Importers record each object they draw with the chain of clips (and groups) in force at the
+//! time, outermost first ([`Drawn`]); [`nest`] then puts runs of objects under the same clip into
+//! one clipping group (under the same group into one group), nesting groups for nested clips,
+//! keeping the drawing order.
 
 use std::sync::Arc;
 
@@ -11,20 +13,30 @@ use vectorcraft_geom::{BezPath, FillRule, PathData};
 use crate::appearance::Appearance;
 use crate::{Document, Node, NodeKind};
 
-/// A clip: a region in document space and its rule. Each has an id unique within an import, so
-/// what one clip clips can be grouped.
+/// A clip: a region in document space and its rule, or a plain group (one that holds its art
+/// without clipping it, such as an Illustrator file's `u` … `U`). Each has an id unique within an
+/// import, so what one clip clips (or one group holds) can be grouped.
 #[derive(Debug)]
 pub struct Clip {
     pub id: u32,
-    pub path: BezPath,
-    pub rule: FillRule,
+    /// The region and its rule; `None` for a plain group.
+    pub region: Option<(BezPath, FillRule)>,
+}
+
+/// Deepest nesting of clips, and of groups, an importer records ([`nest`] goes one level deeper
+/// for each): deeper ones are left out.
+pub const MAX_NEST: usize = 128;
+
+/// The warning for clips left out for nesting deeper than [`MAX_NEST`].
+pub fn deep_clips() -> String {
+    format!("clips nested more than {MAX_NEST} deep were left out: what they clip is clipped by the clips around them")
 }
 
 /// Objects in drawing order, each with its clips (outermost first).
 pub type Drawn = Vec<(Vec<Arc<Clip>>, Node)>;
 
-/// The nodes of `items`, those under clips grouped into clipping groups (ids from `doc`), in
-/// order.
+/// The nodes of `items`, those under clips grouped into clipping groups and those in groups into
+/// groups (ids from `doc`), in order.
 pub fn nest(doc: &mut Document, items: Drawn) -> Vec<Arc<Node>> {
     nest_at(doc, items, 0)
 }
@@ -53,14 +65,18 @@ fn nest_at(doc: &mut Document, items: Drawn, depth: usize) -> Vec<Arc<Node>> {
     out
 }
 
-/// A clipping group of `items`, clipped by `c` (their clip at `depth`).
+/// A clipping group of `items`, clipped by `c` (their clip at `depth`), or their group when `c` is
+/// a plain group.
 fn clip_group(doc: &mut Document, c: &Clip, items: Drawn, depth: usize) -> Arc<Node> {
-    let mut path = Node::path(doc.alloc_id(), PathData::from_bezpath(&c.path), Appearance::default());
-    if let NodeKind::Path { clipping, rule, .. } = &mut path.kind {
-        *clipping = true;
-        *rule = c.rule;
+    let mut children = vec![];
+    if let Some((bp, r)) = &c.region {
+        let mut path = Node::path(doc.alloc_id(), PathData::from_bezpath(bp), Appearance::default());
+        if let NodeKind::Path { clipping, rule, .. } = &mut path.kind {
+            *clipping = true;
+            *rule = *r;
+        }
+        children.push(Arc::new(path));
     }
-    let mut children = vec![Arc::new(path)];
     children.extend(nest_at(doc, items, depth + 1));
-    Arc::new(Node::new(doc.alloc_id(), NodeKind::Group { children, clip: true }))
+    Arc::new(Node::new(doc.alloc_id(), NodeKind::Group { children, clip: c.region.is_some() }))
 }

crates/doc/src/cmyk.rs

@@ -0,0 +1,243 @@
+//! CMYK images: the ink amounts of image blobs that hold CMYK samples.
+//!
+//! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
+//! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
+//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
+//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+
+use std::io::Cursor;
+
+use zune_jpeg::zune_core::bytestream::ZCursor;
+use zune_jpeg::zune_core::colorspace::ColorSpace;
+use zune_jpeg::zune_core::options::DecoderOptions;
+
+use crate::ImageBlob;
+
+/// Most pixels a CMYK image is decoded with (256 MB of samples): larger ones decode as RGB.
+pub const MAX_CMYK_PIXELS: u64 = 1 << 26;
+
+/// The ink amounts of a CMYK image: C, M, Y and K bytes per pixel, 0 is no ink.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Inks {
+    pub width: u32,
+    pub height: u32,
+    pub data: Vec<u8>,
+}
+
+impl Inks {
+    /// `data` as a `width` × `height` image; `None` when it doesn't hold that many pixels, the
+    /// image is empty or it has more than [`MAX_CMYK_PIXELS`].
+    pub fn new(width: u32, height: u32, data: Vec<u8>) -> Option<Self> {
+        let n = pixels(width, height)?;
+        (data.len() as u64 == n * 4).then_some(Self { width, height, data })
+    }
+}
+
+/// `width` × `height` when it is a CMYK image's size: not empty, at most [`MAX_CMYK_PIXELS`].
+fn pixels(width: u32, height: u32) -> Option<u64> {
+    let n = width as u64 * height as u64;
+    (n > 0 && n <= MAX_CMYK_PIXELS).then_some(n)
+}
+
+/// The number of colour components of JPEG `bytes` (its frame header); `None` when they aren't a
+/// JPEG.
+pub fn jpeg_components(bytes: &[u8]) -> Option<usize> {
+    if !bytes.starts_with(&[0xFF, 0xD8]) {
+        return None;
+    }
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    Some(d.info()?.components as usize)
+}
+
+fn is_tiff(bytes: &[u8]) -> bool {
+    bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
+}
+
+/// The colour type of TIFF `bytes` and its decoder.
+fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
+    if !is_tiff(bytes) {
+        return None;
+    }
+    let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
+    Some((d.colortype().ok()?, d))
+}
+
+impl ImageBlob {
+    /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
+    pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
+        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        let mut out = Cursor::new(Vec::new());
+        TiffEncoder::new(&mut out)
+            .ok()?
+            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
+            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
+            .ok()?;
+        Some(Self::new("image/tiff", out.into_inner()))
+    }
+
+    /// Does the image hold CMYK samples (a four-component JPEG or a CMYK TIFF)? Reads only its
+    /// header.
+    pub fn is_cmyk(&self) -> bool {
+        jpeg_components(&self.bytes) == Some(4) || tiff(&self.bytes).is_some_and(|(t, _)| matches!(t, tiff::ColorType::CMYK(8 | 16)))
+    }
+
+    /// The ink amounts of a CMYK image; `None` for other images, and ones that can't be decoded
+    /// or are larger than [`MAX_CMYK_PIXELS`].
+    pub fn cmyk(&self) -> Option<Inks> {
+        let bytes = self.bytes.as_slice();
+        if bytes.starts_with(&[0xFF, 0xD8]) { jpeg_inks(bytes) } else { tiff_inks(bytes) }
+    }
+}
+
+/// The ink amounts of a four-component JPEG (its samples inverted back; YCCK converted to CMYK
+/// first, as JPEG readers do).
+fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    let space = d.input_colorspace()?;
+    if d.info()?.components != 4 || !matches!(space, ColorSpace::CMYK | ColorSpace::YCCK) {
+        return None;
+    }
+    let (w, h) = d.dimensions()?;
+    let (w, h) = (u32::try_from(w).ok()?, u32::try_from(h).ok()?);
+    pixels(w, h)?;
+    d.set_options(DecoderOptions::default().jpeg_set_out_colorspace(space));
+    let mut data = d.decode().ok()?;
+    for p in data.as_chunks_mut::<4>().0 {
+        if space == ColorSpace::YCCK {
+            let [y, cb, cr] = [p[0], p[1], p[2]].map(f32::from);
+            // libjpeg's YCCK → CMYK: the complement of the YCbCr colour's RGB.
+            p[0] = (434.456 - y - 1.402 * cr).clamp(0.0, 255.0) as u8;
+            p[1] = (119.541 - y + 0.344 * cb + 0.714 * cr).clamp(0.0, 255.0) as u8;
+            p[2] = (481.816 - y - 1.772 * cb).clamp(0.0, 255.0) as u8;
+        }
+        for v in p.iter_mut() {
+            *v = 255 - *v;
+        }
+    }
+    Inks::new(w, h, data)
+}
+
+/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
+    let (kind, mut d) = tiff(bytes)?;
+    let (w, h) = d.dimensions().ok()?;
+    // Planar samples (one plane per ink) would read as interleaved.
+    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+        return None;
+    }
+    let data = match d.read_image().ok()? {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    Inks::new(w, h, data)
+}
+
+/// A CMYK TIFF with an alpha channel (5 samples) as RGBA pixels, each colour converted by `rgb`
+/// (ink amounts 0..1 → sRGB 0..1) and associated (premultiplied) alpha divided back out; `None`
+/// for other images, planar ones and ones larger than [`MAX_CMYK_PIXELS`]. The image decoder
+/// doesn't read these at all; the inks can't be kept with the transparency, so they show as RGB.
+pub fn cmyka_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
+    let (kind, mut d) = tiff(bytes)?;
+    let (w, h) = d.dimensions().ok()?;
+    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
+    if !matches!(kind, tiff::ColorType::CMYKA(8 | 16)) || planar {
+        return None;
+    }
+    let n = usize::try_from(pixels(w, h)?).ok()?;
+    // ExtraSamples 1: associated alpha (premultiplied colour); 2 (or none stated): unassociated.
+    let associated = d.find_tag_unsigned_vec::<u16>(tiff::tags::Tag::ExtraSamples).ok().flatten().is_some_and(|v| v.first() == Some(&1));
+    let data: Vec<u8> = match d.read_image().ok()? {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    if data.len() != n * 5 {
+        return None;
+    }
+    let mut out = Vec::with_capacity(n * 4);
+    for p in data.as_chunks::<5>().0 {
+        let a = f32::from(p[4]) / 255.0;
+        let ink = |v: u8| {
+            let v = f32::from(v) / 255.0;
+            if associated && a > 0.0 { (v / a).min(1.0) } else { v }
+        };
+        let [r, g, b] = rgb([ink(p[0]), ink(p[1]), ink(p[2]), ink(p[3])]);
+        out.extend([r, g, b].map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8));
+        out.push(p[4]);
+    }
+    image::RgbaImage::from_raw(w, h, out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_cmyk_tiff_with_alpha_reads_as_rgba() {
+        use tiff::encoder::{TiffEncoder, colortype::CMYKA8};
+        // 2 × 1: full cyan opaque, then 100% K at half alpha (premultiplied: K 128, alpha 128).
+        let mut file = Cursor::new(Vec::new());
+        let mut enc = TiffEncoder::new(&mut file).unwrap();
+        let mut img = enc.new_image::<CMYKA8>(2, 1).unwrap();
+        img.encoder().write_tag(tiff::tags::Tag::ExtraSamples, &[1u16][..]).unwrap();
+        img.write_data(&[255, 0, 0, 0, 255, 0, 0, 0, 128, 128]).unwrap();
+        let bytes = file.into_inner();
+        let naive = |[c, m, y, k]: [f32; 4]| [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
+        let px = cmyka_tiff_rgba(&bytes, naive).expect("CMYKA reads");
+        assert_eq!(px.dimensions(), (2, 1));
+        assert_eq!(px.get_pixel(0, 0).0, [0, 255, 255, 255], "cyan, opaque");
+        assert_eq!(px.get_pixel(1, 0).0, [0, 0, 0, 128], "the premultiplied K divided back out: black at half alpha");
+        // Not CMYKA: not this reader's.
+        assert!(cmyka_tiff_rgba(&ImageBlob::cmyk_tiff(&inks()).unwrap().bytes, naive).is_none());
+    }
+
+    fn inks() -> Inks {
+        Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
+    }
+
+    #[test]
+    fn a_cmyk_tiff_keeps_its_ink_amounts_and_shows_as_rgb() {
+        let b = ImageBlob::cmyk_tiff(&inks()).unwrap();
+        assert_eq!(b.mime, "image/tiff");
+        assert!(b.is_cmyk());
+        assert_eq!(b.cmyk(), Some(inks()), "lossless");
+        // Every image reader sees an RGB image: cyan is (0, 255, 255).
+        let rgb = image::load_from_memory(&b.bytes).unwrap().to_rgb8();
+        assert_eq!(rgb.get_pixel(1, 0).0, [0, 255, 255]);
+    }
+
+    #[test]
+    fn a_cmyk_jpeg_reads_back_as_ink_amounts() {
+        // A flat CMYK JPEG: Adobe's inverted samples with its marker.
+        let flat = [10u8, 40, 100, 20];
+        let px: Vec<u8> = (0..16 * 16).flat_map(|_| flat).collect();
+        let mut jpg = Vec::new();
+        jpeg_encoder::Encoder::new(&mut jpg, 100).encode(&px, 16, 16, jpeg_encoder::ColorType::Cmyk).unwrap();
+        let b = ImageBlob::new("image/jpeg", jpg);
+        assert_eq!(jpeg_components(&b.bytes), Some(4));
+        assert!(b.is_cmyk());
+        let back = b.cmyk().unwrap();
+        assert_eq!((back.width, back.height), (16, 16));
+        for p in back.data.as_chunks::<4>().0 {
+            assert!(p.iter().zip(flat).all(|(a, b)| a.abs_diff(b) <= 2), "{p:?}");
+        }
+    }
+
+    #[test]
+    fn other_images_are_not_cmyk() {
+        let mut png = Vec::new();
+        image::RgbaImage::new(2, 2).write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        let mut jpg = Vec::new();
+        image::RgbImage::new(8, 8).write_to(&mut Cursor::new(&mut jpg), image::ImageFormat::Jpeg).unwrap();
+        for b in [ImageBlob::png(png), ImageBlob::new("image/jpeg", jpg), ImageBlob::new("image/tiff", b"II*\0junk".to_vec())] {
+            assert!(!b.is_cmyk() && b.cmyk().is_none(), "{}", b.mime);
+        }
+        assert_eq!(Inks::new(2, 2, vec![0; 15]), None, "too few samples");
+        assert_eq!(Inks::new(0, 2, vec![]), None, "empty");
+        assert_eq!(Inks::new(1 << 14, 1 << 13, vec![]), None, "too large");
+    }
+}

crates/doc/src/corners.rs

@@ -0,0 +1,271 @@
+//! Live Corners on any path: the corners of its uncut outline (a live rectangle's or polygon's, a
+//! live path's, or a plain path's own), each one's radius and kind, and the anchors of the path as
+//! drawn that belong to each. [`set_corners`] edits them.
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+
+use vectorcraft_geom::corners::{Corner, cut_corners, path_corners};
+use vectorcraft_geom::shapes::{self, CornerKind};
+use vectorcraft_geom::{Affine, PathData, Rect};
+
+use crate::node::{LiveShape, Node, NodeKind};
+use crate::selection::AnchorRef;
+
+/// The Live Corners of a path.
+#[derive(Clone, Debug)]
+pub struct LiveCorners<'a> {
+    /// The path with its corners uncut, in the corners' own space: a live rectangle's (its size
+    /// and radii in document units, see [`LiveShape::folded`]), else the document's.
+    pub base: Cow<'a, PathData>,
+    /// Maps `base` into the document.
+    pub xf: Affine,
+    /// The corners that can be cut, in anchor order ([`path_corners`] of `base`).
+    pub corners: Vec<Corner>,
+    radii: Vec<f64>,
+    kinds: Vec<CornerKind>,
+    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
+    sources: Vec<Vec<usize>>,
+}
+
+impl<'a> LiveCorners<'a> {
+    /// The Live Corners of `path` and its live shape; `None` for shapes without corners (ellipses,
+    /// lines).
+    pub fn new(path: &'a PathData, live: Option<&'a LiveShape>) -> Option<Self> {
+        let (base, xf, radii, kinds) = match live {
+            None => (Cow::Borrowed(path), Affine::IDENTITY, vec![], vec![]),
+            Some(l @ LiveShape::Rectangle { .. }) => {
+                let LiveShape::Rectangle { w, h, radii, kinds, xf } = l.folded() else { return None };
+                (Cow::Owned(shapes::rectangle(Rect::new(0.0, 0.0, w, h))), xf, radii.to_vec(), kinds.to_vec())
+            }
+            Some(l @ LiveShape::Polygon { radii, kinds, .. }) => (Cow::Owned(l.polygon_outline()), Affine::IDENTITY, radii.clone(), kinds.clone()),
+            Some(LiveShape::Path { base, radii, kinds }) => (Cow::Borrowed(base), Affine::IDENTITY, radii.clone(), kinds.clone()),
+            Some(LiveShape::Ellipse { .. } | LiveShape::Line { .. }) => return None,
+        };
+        let sources = if radii.iter().any(|r| *r > 0.0) {
+            cut_corners(&base, &radii, &kinds).1
+        } else {
+            let mut first = 0;
+            base.subpaths
+                .iter()
+                .map(|sp| {
+                    first += sp.anchors.len();
+                    (first - sp.anchors.len()..first).collect()
+                })
+                .collect()
+        };
+        Some(Self { corners: path_corners(&base), base, xf, radii, kinds, sources })
+    }
+
+    /// The Live Corners of a path object.
+    pub fn of(node: &'a Node) -> Option<Self> {
+        let NodeKind::Path { path, live, .. } = &node.kind else { return None };
+        Self::new(path, live.as_ref())
+    }
+
+    /// The corner at anchor `index` of `base`.
+    pub fn corner(&self, index: usize) -> Option<&Corner> {
+        self.corners.binary_search_by_key(&index, |c| c.index).ok().and_then(|i| self.corners.get(i))
+    }
+
+    /// The radius corner `index` is set to, in document units (drawn no larger than fits).
+    pub fn radius(&self, index: usize) -> f64 {
+        self.radii.get(index).copied().unwrap_or(0.0)
+    }
+
+    /// The kind corner `index` is cut with.
+    pub fn kind(&self, index: usize) -> CornerKind {
+        self.kinds.get(index).copied().unwrap_or_default()
+    }
+
+    /// Every corner.
+    pub fn all(&self) -> BTreeSet<usize> {
+        self.corners.iter().map(|c| c.index).collect()
+    }
+
+    /// The corners holding one of `anchors` (of the path as drawn).
+    pub fn corners_of(&self, anchors: &BTreeSet<AnchorRef>) -> BTreeSet<usize> {
+        anchors.iter().filter_map(|(si, ai)| self.sources.get(*si)?.get(*ai).copied()).filter(|k| self.corner(*k).is_some()).collect()
+    }
+
+    /// The corners Live Corners edit for a selection: those holding a selected anchor when the
+    /// path is partly selected (Direct Selection), else every corner.
+    pub fn picked(&self, partial: Option<&BTreeSet<AnchorRef>>) -> BTreeSet<usize> {
+        let picked = partial.map(|a| self.corners_of(a)).unwrap_or_default();
+        if picked.is_empty() { self.all() } else { picked }
+    }
+
+    /// The anchors of the path as drawn that belong to `corners` (to keep them selected as the
+    /// path changes).
+    pub fn anchors_of(&self, corners: &BTreeSet<usize>) -> BTreeSet<AnchorRef> {
+        let mut out = BTreeSet::new();
+        for (si, from) in self.sources.iter().enumerate() {
+            out.extend(from.iter().enumerate().filter(|(_, k)| corners.contains(k)).map(|(ai, _)| (si, ai)));
+        }
+        out
+    }
+
+    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
+    pub fn sources(&self) -> &[Vec<usize>] {
+        &self.sources
+    }
+
+    /// The radius (document units) and kind `corners` share (each `None` when they differ, or
+    /// for no corners).
+    pub fn style(&self, corners: &BTreeSet<usize>) -> (Option<f64>, Option<CornerKind>) {
+        fn shared<T: Copy>(mut it: impl Iterator<Item = T>, same: impl Fn(T, T) -> bool) -> Option<T> {
+            let first = it.next()?;
+            it.all(|x| same(x, first)).then_some(first)
+        }
+        let radius = shared(corners.iter().map(|k| self.radius(*k)), |a, b| (a - b).abs() < 1e-9);
+        (radius, shared(corners.iter().map(|k| self.kind(*k)), |a, b| a == b))
+    }
+}
+
+/// Set `radius` (document units; negative: 0) and/or `kind` on the `corners` (anchor indices of
+/// the uncut outline, see [`LiveCorners`]) of a path and its live shape, then cut the path again.
+/// A path that isn't a live shape keeps its uncut outline as a [`LiveShape::Path`], which is a
+/// plain path again once no corner is cut. Ellipses and lines have no corners: they stay as they
+/// are.
+pub fn set_corners(path: &mut PathData, live: &mut Option<LiveShape>, corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
+    fn edit(radii: &mut [f64], kinds: &mut [CornerKind], corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
+        for k in corners {
+            if let (Some(r), Some(slot)) = (radius, radii.get_mut(*k)) {
+                *slot = r.max(0.0);
+            }
+            if let (Some(kind), Some(slot)) = (kind, kinds.get_mut(*k)) {
+                *slot = kind;
+            }
+        }
+    }
+    /// One radius and kind per corner of an outline of `n` anchors while editing; none saved
+    /// when all are sharp or round.
+    fn edit_vec(
+        n: usize,
+        radii: &mut Vec<f64>,
+        kinds: &mut Vec<CornerKind>,
+        corners: &BTreeSet<usize>,
+        radius: Option<f64>,
+        kind: Option<CornerKind>,
+    ) {
+        radii.resize(n, 0.0);
+        kinds.resize(n, CornerKind::Round);
+        edit(radii, kinds, corners, radius, kind);
+        if radii.iter().all(|r| *r <= 0.0) {
+            radii.clear();
+        }
+        if kinds.iter().all(|k| *k == CornerKind::Round) {
+            kinds.clear();
+        }
+    }
+    let l = live.get_or_insert_with(|| LiveShape::Path { base: path.clone(), radii: vec![], kinds: vec![] });
+    // Radii are document lengths and corners circular, also on a rectangle from a file that kept
+    // an uneven scale in its transform (#442).
+    l.fold_scale();
+    match l {
+        LiveShape::Rectangle { radii, kinds, .. } => edit(radii, kinds, corners, radius, kind),
+        LiveShape::Polygon { sides, radii, kinds, .. } => edit_vec(*sides as usize, radii, kinds, corners, radius, kind),
+        LiveShape::Path { base, radii, kinds } => edit_vec(base.anchor_count(), radii, kinds, corners, radius, kind),
+        LiveShape::Ellipse { .. } | LiveShape::Line { .. } => return,
+    }
+    match live {
+        Some(LiveShape::Path { base, radii, kinds }) if radii.is_empty() && kinds.is_empty() => {
+            *path = std::mem::take(base);
+            *live = None;
+        }
+        Some(l) => *path = l.to_path(),
+        None => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_geom::{Point, SubPath};
+
+    fn set(v: &[usize]) -> BTreeSet<usize> {
+        v.iter().copied().collect()
+    }
+
+    fn anchors(v: &[usize]) -> BTreeSet<AnchorRef> {
+        v.iter().map(|ai| (0, *ai)).collect()
+    }
+
+    #[test]
+    fn rectangle_corners_map_to_their_anchors() {
+        let l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
+        let path = l.to_path();
+        let c = LiveCorners::new(&path, Some(&l)).unwrap();
+        // Anchors: top-left, the top-right corner's two, bottom-right, bottom-left.
+        assert_eq!(c.sources(), [vec![0, 1, 1, 2, 3]]);
+        assert_eq!(path.anchor_count(), 5);
+        assert_eq!(c.corners_of(&anchors(&[2, 4])), set(&[1, 3]));
+        assert!(c.corners_of(&anchors(&[9])).is_empty(), "out of range");
+        assert_eq!(c.anchors_of(&set(&[1, 3])), anchors(&[1, 2, 4]));
+        // Partly selected: the corners of the selected anchors; wholly (or no anchor): all four.
+        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[0]));
+        assert_eq!(c.picked(None), set(&[0, 1, 2, 3]));
+        assert_eq!(c.picked(Some(&anchors(&[]))), set(&[0, 1, 2, 3]));
+        assert_eq!(c.style(&set(&[1])), (Some(10.0), Some(CornerKind::Round)));
+        assert_eq!(c.style(&set(&[0, 1])), (None, Some(CornerKind::Round)));
+        assert_eq!(c.style(&set(&[0, 2, 3])), (Some(0.0), Some(CornerKind::Round)));
+        let e = LiveShape::Ellipse { w: 1.0, h: 1.0, pie: (0.0, 360.0), xf: Affine::IDENTITY };
+        assert!(LiveCorners::new(&e.to_path(), Some(&e)).is_none());
+    }
+
+    /// #511: a plain path (a star) rounds its corners and keeps them editable; with none cut it
+    /// is plain again.
+    #[test]
+    fn a_plain_path_keeps_its_cut_corners_live() {
+        let star = shapes::star(Point::new(100.0, 100.0), 50.0, 25.0, 5, 0.0);
+        let (mut path, mut live) = (star.clone(), None);
+        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(5.0), None);
+        let Some(LiveShape::Path { base, radii, kinds }) = &live else { panic!("live corners: {live:?}") };
+        assert_eq!((base, radii.len(), kinds.len()), (&star, 10, 0));
+        assert_eq!(path.anchor_count(), 12, "two corners cut");
+        let c = LiveCorners::new(&path, live.as_ref()).unwrap();
+        assert_eq!(c.style(&set(&[0, 2])), (Some(5.0), Some(CornerKind::Round)));
+        assert_eq!(c.corners_of(&anchors(&[0, 11])), set(&[0]), "the first corner's cut ends the path");
+        // Kinds alone keep it live; squaring every corner makes it the plain star again.
+        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(0.0), Some(CornerKind::Chamfer));
+        assert!(matches!(&live, Some(LiveShape::Path { radii, .. }) if radii.is_empty()));
+        set_corners(&mut path, &mut live, &set(&[0, 2]), None, Some(CornerKind::Round));
+        assert_eq!((path, live), (star, None));
+    }
+
+    /// A polygon's corners are cut in the document and survive a change of sides when shared.
+    #[test]
+    fn polygon_corners_follow_their_sides() {
+        let mut l = LiveShape::Polygon { radius: 50.0, sides: 6, xf: Affine::translate((100.0, 100.0)), radii: vec![], kinds: vec![] };
+        let (mut path, mut live) = (l.to_path(), Some(l.clone()));
+        set_corners(&mut path, &mut live, &set(&[0, 1, 2, 3, 4, 5]), Some(8.0), None);
+        assert_eq!(path.anchor_count(), 12);
+        l = live.clone().unwrap();
+        l.set_sides(8);
+        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == vec![8.0; 8]));
+        assert_eq!(l.to_path().anchor_count(), 16);
+        // Mixed radii: the new corners are sharp.
+        set_corners(&mut path, &mut live, &set(&[1]), Some(3.0), None);
+        let mut l = live.unwrap();
+        l.set_sides(7);
+        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == [8.0, 3.0, 8.0, 8.0, 8.0, 8.0, 0.0]));
+        // An uneven scale keeps the cuts circular: the radius scales by the mean scale.
+        let mut p = l.clone();
+        assert!(p.transform(Affine::scale_non_uniform(4.0, 1.0)));
+        assert!(matches!(&p, LiveShape::Polygon { radii, .. } if (radii[0] - 16.0).abs() < 1e-9));
+        assert!(!p.transform(Affine::translate((5.0, 0.0))), "a move needs no new cuts");
+    }
+
+    #[test]
+    fn open_paths_and_curves_keep_their_ends_and_smooth_anchors() {
+        let pen = PathData::single(SubPath::polyline(&[Point::new(0.0, 0.0), Point::new(100.0, 0.0), Point::new(100.0, 80.0)], false));
+        let c = LiveCorners::new(&pen, None).unwrap();
+        assert_eq!(c.all(), set(&[1]));
+        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[1]), "an end is no corner: every corner");
+        let (mut path, mut live) = (pen.clone(), None);
+        set_corners(&mut path, &mut live, &c.all(), Some(10.0), None);
+        assert_eq!(path.anchor_count(), 4);
+        assert_eq!(path.subpaths[0].anchors[0].p, Point::new(0.0, 0.0));
+        assert_eq!(path.subpaths[0].anchors[3].p, Point::new(100.0, 80.0));
+    }
+}

crates/doc/src/hit.rs

@@ -23,6 +23,8 @@ pub struct Hit {
     /// The innermost envelope in the ancestry whose contents are being edited (Edit Contents):
     /// its content, not the envelope, is the object clicked.
     pub contents_of: Option<NodeId>,
+    /// How many entries at the start of `ancestry` are layers (the layer and its sublayers).
+    pub layers: usize,
 }
 
 impl Hit {
@@ -34,36 +36,75 @@ impl Hit {
         if let Some(i) = at(scope).max(at(self.contents_of)) {
             return self.ancestry.get(i + 1).copied().unwrap_or(self.leaf);
         }
-        // Skip layers and sublayers.
-        self.ancestry.get(1).copied().unwrap_or(self.leaf)
+        // Skip layers and sublayers: they are not objects.
+        self.ancestry.get(self.layers.max(1)).copied().unwrap_or(self.leaf)
     }
 }
 
 /// Options for hit testing.
 #[derive(Clone, Copy, Debug)]
 pub struct HitOptions {
+    /// The isolated construction container, whose retained Shaper sources are hittable.
+    pub scope: Option<NodeId>,
     /// Tolerance in document units (screen tolerance / zoom).
     pub tol: f64,
     /// Outline mode: only outlines are hittable.
     pub outline: bool,
     /// "Object Selection by Path Only" preference.
     pub path_only: bool,
+    /// "Type Object Selection by Path Only" preference: type is picked on its type path only
+    /// (point type's baseline, area type's frame, type on a path's path), not anywhere in its
+    /// bounds.
+    pub type_path_only: bool,
 }
 
 impl Default for HitOptions {
     fn default() -> Self {
-        Self { tol: 3.0, outline: false, path_only: false }
+        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false, scope: None }
     }
 }
 
 /// Topmost editable object under `p`.
 pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
+    hit_test_skipping(doc, p, opt, &|_| false)
+}
+
+/// The objects under `p` that [`Hit::top_object`] picks in `scope` (isolation mode), topmost
+/// first: what clicks there select, one below the other (Cmd/Ctrl-click selects behind).
+pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
+    let opt = HitOptions { scope: scope.or(opt.scope), ..opt };
+    let mut tops: Vec<NodeId> = vec![];
+    // Each round leaves out the objects found so far (and everything inside them).
+    while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id)).map(|h| h.top_object(scope)) {
+        if tops.contains(&top) {
+            break;
+        }
+        tops.push(top);
+    }
+    tops
+}
+
+/// [`hit_test`] passing over the nodes `skip` names (and their contents).
+fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool) -> Option<Hit> {
+    let finish = |mut h: Hit| {
+        h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
+        h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
+        h
+    };
+    // Isolation mode: only what is inside the isolated container hits. The art around it is
+    // locked, and clicks pass through it (#833).
+    if let Some(scope) = opt.scope
+        && let Some(container) = doc.node(scope).filter(|n| n.is_container())
+        && let Some(mut chain) = doc.ancestry(scope)
+    {
+        return hit_children(container, p, opt, skip, &mut chain).map(finish);
+    }
     let mut chain = Vec::new();
     for layer in doc.layers.iter().rev() {
         if !layer.visible || layer.locked {
             continue;
         }
-        if let NodeKind::Layer { template: true, .. } = layer.kind {
+        if layer.is_template() {
             continue;
         }
         // Pattern editing mode: only the tile art is editable.
@@ -71,9 +112,9 @@ pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
             continue;
         }
         chain.push(layer.id);
-        if let Some(mut h) = hit_children(layer, p, opt, &mut chain) {
-            h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
-            return Some(h);
+        let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
+        if let Some(h) = hit_children(layer, p, opt, skip, &mut chain) {
+            return Some(finish(h));
         }
         chain.pop();
     }
@@ -95,7 +136,7 @@ fn clip_contains(clip: &Node, p: Point) -> bool {
     clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
 }
 
-fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId>) -> Option<Hit> {
+fn hit_children(parent: &Node, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, chain: &mut Vec<NodeId>) -> Option<Hit> {
     let children = parent.children()?;
     // A clip group (or a layer with a clipping mask) only hits inside its clipping path.
     if parent.clips()
@@ -104,12 +145,20 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
     {
         return None;
     }
-    for c in children.iter().rev() {
-        if !c.visible || c.locked {
+    for (i, c) in children.iter().enumerate().rev() {
+        if parent.shaper.is_some() {
+            let construction = children.first().is_some_and(|source| Some(source.id) == opt.scope);
+            if (i == 0) != construction {
+                continue;
+            }
+        }
+        // Hidden, locked and template sublayers block clicks like top-level layers do.
+        if !c.visible || c.locked || c.is_template() || skip(c.id) {
             continue;
         }
         // (An envelope's content sits where it was, not where the envelope draws it.)
-        if !edits_contents(c)
+        if !(edits_contents(c)
+            || c.shaper.is_some() && c.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope))
             && let Some(b) = c.reach_bounds()
             && !b.inflate(opt.tol, opt.tol).contains(p)
         {
@@ -117,14 +166,16 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
         }
         chain.push(c.id);
         let hit = match &c.kind {
-            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, chain),
+            // A sublayer whose Preview is off is clicked in outline, like an outline view.
+            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain),
+            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain),
             // Edit Contents: the envelope's content hits, undistorted.
-            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, chain),
+            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain),
             // A blend's key objects first (Direct and Group Selection pick them); its steps hit
             // as the blend.
-            NodeKind::Blend { .. } => hit_children(c, p, opt, chain)
-                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None })),
-            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None }),
+            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain)
+                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
+            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
         };
         if hit.is_some() {
             return hit;
@@ -162,11 +213,19 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
             if let Some(k) = hit_stroke(n, &bp, *rule, p, opt) {
                 return Some(k);
             }
-            (!opt.outline && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
+            (!opt.outline && !opt.path_only && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
         }
-        NodeKind::Text(_) | NodeKind::Image(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
-            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
+        // The type path lies within the bounds: they rule out the rest before it is measured.
+        NodeKind::Text(t) if opt.type_path_only => {
+            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p))?;
+            on_type_path(n, t, p, opt.tol).then_some(HitKind::Outline)
         }
+        NodeKind::Text(_)
+        | NodeKind::Image(_)
+        | NodeKind::PlacedDocument(_)
+        | NodeKind::SymbolInstance { .. }
+        | NodeKind::Blend { .. }
+        | NodeKind::Envelope { .. } => n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
         NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt)),
         NodeKind::Mesh(m) => {
             let bp = m.outline().to_bezpath();
@@ -179,6 +238,28 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
     }
 }
 
+/// Is `p` within `tol` of the type path of `t` (in `n`), what "Type Object Selection by Path
+/// Only" picks type by: its baselines ([`crate::TextObject::baselines`]), area type's frame and
+/// type on a path's path, drawn through `n`'s perspective projection if it has one.
+fn on_type_path(n: &Node, t: &crate::TextObject, p: Point, tol: f64) -> bool {
+    use crate::TextKind;
+    use vectorcraft_geom::kurbo::ParamCurveNearest;
+    let h = n.projection();
+    let project = |q: Point| h.as_ref().and_then(|h| h.apply(q)).unwrap_or(q);
+    // A homography keeps straight lines straight: a baseline's ends are enough.
+    let near = |(a, b): (Point, Point)| vectorcraft_geom::Line::new(project(t.xf * a), project(t.xf * b)).nearest(p, 1e-9).distance_sq <= tol * tol;
+    if t.baselines().any(near) {
+        return true;
+    }
+    let (TextKind::Area { frame: path } | TextKind::OnPath { path, .. }) = &t.kind else { return false };
+    let mut path = path.transformed(t.xf);
+    if h.is_some() {
+        let piece = path.bounds().map_or(1.0, |b| (b.width().max(b.height()) / 64.0).max(0.25));
+        path = crate::live::map_nonlinear(&path, piece, project);
+    }
+    stroke_contains(&path.to_bezpath(), 0.0, tol, p)
+}
+
 /// Hit anywhere in an evaluated subtree (groups recurse; leaves use [`hit_leaf`]).
 fn hit_any(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
     match &n.kind {
@@ -192,13 +273,28 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
     let mut out = Vec::new();
     let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
         Some(s) => s.children().map(|c| c.iter().collect()).unwrap_or_default(),
+        // The objects of the layers, looking through sublayers (hidden, locked and template ones
+        // are left out).
         None => doc
             .layers
             .iter()
-            .filter(|l| l.visible && !l.locked && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
-            .flat_map(|l| l.children().into_iter().flatten())
+            .filter(|l| l.visible && !l.locked && !l.is_template() && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
+            .flat_map(|l| layer_objects(l))
             .collect(),
     };
+    fn layer_objects(l: &Node) -> Vec<&std::sync::Arc<Node>> {
+        let mut out = vec![];
+        for c in l.children().into_iter().flatten() {
+            if c.is_layer() {
+                if c.visible && !c.locked && !c.is_template() {
+                    out.extend(layer_objects(c));
+                }
+            } else {
+                out.push(c);
+            }
+        }
+        out
+    }
     fn touches(n: &Node, r: Rect) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
@@ -296,6 +392,194 @@ mod tests {
         assert!(marquee(&d, Rect::new(100.0, 100.0, 105.0, 105.0), None, false).is_empty());
     }
 
+    /// Art in a sublayer is an object of its own: a click or a marquee takes it, not the
+    /// sublayer; hidden, locked and template sublayers block both.
+    #[test]
+    fn sublayers_are_not_objects() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let sub = d.alloc_id();
+        d.insert(Some(l), 0, Node::layer(sub, "Sub", crate::LayerColor::Preset(2))).unwrap();
+        let inner = d.alloc_id();
+        d.insert(Some(sub), 0, Node::layer(inner, "Inner", crate::LayerColor::Preset(3))).unwrap();
+        let a = d.alloc_id();
+        d.insert(Some(inner), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+        let g = d.alloc_id();
+        let b = d.alloc_id();
+        let pb = Node::path(b, shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default_art());
+        d.insert(Some(sub), 9, Node::group(g, vec![Arc::new(pb)])).unwrap();
+        let h = hit_test(&d, Point::new(10.0, 10.0), HitOptions::default()).unwrap();
+        assert_eq!((h.leaf, h.top_object(None), h.layers), (a, a, 3));
+        let h = hit_test(&d, Point::new(110.0, 10.0), HitOptions::default()).unwrap();
+        assert_eq!((h.top_object(None), h.top_object(Some(g))), (g, b));
+        let all = Rect::new(-5.0, -5.0, 200.0, 200.0);
+        assert_eq!(marquee(&d, all, None, false), vec![a, g]);
+        assert_eq!(d.layer_containing(a), Some(inner));
+        assert_eq!(d.layer_color(a), crate::LayerColor::Preset(3).rgb(), "the sublayer's own colour");
+        assert_eq!(d.selectable_art(), vec![a, g]);
+        for f in [
+            |n: &mut Node| n.visible = false,
+            |n: &mut Node| n.locked = true,
+            |n: &mut Node| {
+                if let NodeKind::Layer { template, .. } = &mut n.kind {
+                    *template = true;
+                }
+            },
+        ] {
+            let mut d2 = d.clone();
+            f(d2.node_mut(inner).unwrap());
+            assert!(hit_test(&d2, Point::new(10.0, 10.0), HitOptions::default()).is_none());
+            assert_eq!(marquee(&d2, all, None, false), vec![g]);
+            assert_eq!(d2.selectable_art(), vec![g]);
+        }
+        // A sublayer whose Preview is off is clicked in outline: its fill no longer hits.
+        if let NodeKind::Layer { preview, .. } = &mut d.node_mut(inner).unwrap().kind {
+            *preview = false;
+        }
+        assert!(hit_test(&d, Point::new(25.0, 25.0), HitOptions::default()).is_none());
+        assert!(hit_test(&d, Point::new(0.5, 25.0), HitOptions::default()).is_some());
+    }
+
+    /// Object Selection by Path Only: a filled path or compound path hits on its outline only.
+    #[test]
+    fn path_only_leaves_out_fills() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let (a, c) = (d.alloc_id(), d.alloc_id());
+        d.insert(Some(l), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+        let inner = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default());
+        let mut compound = Node::new(c, NodeKind::Compound { children: vec![Arc::new(inner)], rule: vectorcraft_geom::FillRule::NonZero });
+        compound.appearance = Appearance::default_art();
+        d.insert(Some(l), 9, compound).unwrap();
+        let path_only = HitOptions { path_only: true, ..Default::default() };
+        for (id, inside, edge) in [(a, Point::new(25.0, 25.0), Point::new(0.5, 25.0)), (c, Point::new(125.0, 25.0), Point::new(100.5, 25.0))] {
+            assert_eq!(hit_test(&d, inside, HitOptions::default()).map(|h| h.leaf), Some(id), "the fill hits");
+            assert!(hit_test(&d, inside, path_only).is_none(), "path only: the fill of {id:?} doesn't hit");
+            assert_eq!(hit_test(&d, edge, path_only).map(|h| h.leaf), Some(id), "path only: the outline does");
+        }
+    }
+
+    /// Type Object Selection by Path Only: point type is picked on its baseline, area type on its
+    /// frame and type on a path on its path, no longer anywhere in its bounds.
+    #[test]
+    fn type_path_only_picks_type_on_its_path() {
+        use crate::{CharStyle, TextKind, TextObject};
+        let mut d = Document::new(400.0, 400.0);
+        let l = d.layers[0].id;
+        let mut add = |t: TextObject| {
+            let id = d.alloc_id();
+            d.insert(Some(l), 9, Node::new(id, NodeKind::Text(Box::new(t)))).unwrap();
+            id
+        };
+        // Point type at (10, 100), 20 pt: its glyphs rise above the baseline, its layout is 60 wide.
+        let mut point = TextObject::point(Point::new(10.0, 100.0), "Hello", CharStyle { size: 20.0, ..CharStyle::default() });
+        point.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 4.0));
+        let point = add(point);
+        let mut area = TextObject::point(Point::new(200.0, 200.0), "Area", CharStyle::default());
+        area.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)) };
+        let area = add(area);
+        let mut on_path = TextObject::point(Point::new(10.0, 300.0), "Path", CharStyle::default());
+        on_path.kind = TextKind::OnPath { path: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 40.0)), start: 0.0, end: None };
+        let on_path = add(on_path);
+        let path_only = HitOptions { type_path_only: true, ..Default::default() };
+        let hit = |p: Point, opt: HitOptions| hit_test(&d, p, opt).map(|h| (h.leaf, h.kind));
+        // Off: anywhere in the bounds.
+        assert_eq!(hit(Point::new(40.0, 90.0), HitOptions::default()), Some((point, HitKind::Bounds)));
+        assert_eq!(hit(Point::new(250.0, 225.0), HitOptions::default()), Some((area, HitKind::Bounds)));
+        assert_eq!(hit(Point::new(60.0, 320.0), HitOptions::default()), Some((on_path, HitKind::Bounds)));
+        // On: the glyphs and the inside of the frame or path no longer pick the type.
+        assert_eq!(hit(Point::new(40.0, 90.0), path_only), None, "point type: among its glyphs");
+        assert_eq!(hit(Point::new(250.0, 225.0), path_only), None, "area type: inside its frame");
+        assert_eq!(hit(Point::new(60.0, 320.0), path_only), None, "type on a path: inside its path");
+        // The baseline (within the tolerance, across the layout's width), frame and path do.
+        assert_eq!(hit(Point::new(40.0, 101.5), path_only), Some((point, HitKind::Outline)), "point type: its baseline");
+        assert_eq!(hit(Point::new(75.0, 100.0), path_only), None, "point type: past the end of its layout");
+        assert_eq!(hit(Point::new(250.0, 200.5), path_only), Some((area, HitKind::Outline)), "area type: its frame");
+        assert_eq!(hit(Point::new(60.0, 339.5), path_only), Some((on_path, HitKind::Outline)), "type on a path: its path");
+    }
+
+    /// Type Object Selection by Path Only with the layout's baselines: every line's for point type,
+    /// area type's besides its frame, a vertical column's centre line, and type in perspective
+    /// where it is drawn.
+    #[test]
+    fn type_path_only_picks_every_baseline() {
+        use crate::{CharStyle, PerspectiveAttachment, TextKind, TextObject};
+        use vectorcraft_geom::{Affine, Homography};
+        let mut d = Document::new(400.0, 400.0);
+        let l = d.layers[0].id;
+        let mut add = |t: TextObject, perspective: Option<Affine>| {
+            let mut n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(t)));
+            n.perspective = perspective.map(|a| {
+                Box::new(PerspectiveAttachment { projection: Some(Homography::from_affine(a).to_array()), ..PerspectiveAttachment::new("left", 0.0) })
+            });
+            let id = n.id;
+            d.insert(Some(l), 9, n).unwrap();
+            id
+        };
+        let style = CharStyle { size: 20.0, ..CharStyle::default() };
+        // Two lines of point type at (10, 100), 24 pt apart.
+        let mut point = TextObject::point(
+            Point::new(10.0, 100.0),
+            "Hello
+world",
+            style.clone(),
+        );
+        point.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 28.0));
+        point.cached_baselines = vec![(Point::ZERO, Point::new(60.0, 0.0)), (Point::new(0.0, 24.0), Point::new(50.0, 24.0))];
+        let point = add(point, None);
+        // Area type: a line inside its frame.
+        let mut area = TextObject::point(Point::new(200.0, 50.0), "Area", style.clone());
+        area.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)) };
+        area.cached_baselines = vec![(Point::new(0.0, 16.0), Point::new(40.0, 16.0))];
+        let area = add(area, None);
+        // Vertical point type at (300, 200) with no baselines cached: down its first column.
+        let mut vertical = TextObject::point(Point::new(300.0, 200.0), "Tate", style.clone());
+        vertical.vertical = true;
+        vertical.cached_bounds = Some(Rect::new(-10.0, 0.0, 10.0, 80.0));
+        let vertical = add(vertical, None);
+        // Point type drawn 100 to the right of where it is laid out.
+        let mut moved = TextObject::point(Point::new(10.0, 350.0), "Moved", style);
+        moved.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 4.0));
+        let moved = add(moved, Some(Affine::translate((100.0, 0.0))));
+        let path_only = HitOptions { type_path_only: true, ..Default::default() };
+        let hit = |p: Point| hit_test(&d, p, path_only).map(|h| h.leaf);
+        assert_eq!(hit(Point::new(40.0, 100.0)), Some(point), "the first line's baseline");
+        assert_eq!(hit(Point::new(40.0, 125.0)), Some(point), "the second line's");
+        assert_eq!(hit(Point::new(40.0, 112.0)), None, "between the lines");
+        assert_eq!(hit(Point::new(65.0, 124.0)), None, "past the end of the shorter second line");
+        assert_eq!(hit(Point::new(220.0, 66.0)), Some(area), "area type: a line's baseline");
+        assert_eq!(hit(Point::new(220.0, 80.0)), None, "area type: inside the frame, off the baselines");
+        assert_eq!(hit(Point::new(299.0, 260.0)), Some(vertical), "vertical type: down the column");
+        assert_eq!(hit(Point::new(306.0, 260.0)), None, "vertical type: beside it");
+        assert_eq!(hit(Point::new(140.0, 351.0)), Some(moved), "in perspective: where it is drawn");
+        assert_eq!(hit(Point::new(40.0, 351.0)), None, "in perspective: not where it is laid out");
+    }
+
+    /// `objects_at`: every object under the point, topmost first; a group counts once.
+    #[test]
+    fn objects_at_lists_the_stack() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let rect =
+            |d: &mut Document, x: f64| Node::path(d.alloc_id(), shapes::rectangle(Rect::new(x, 0.0, x + 50.0, 50.0)), Appearance::default_art());
+        let a = rect(&mut d, 0.0);
+        let (b, c) = (rect(&mut d, 10.0), rect(&mut d, 20.0));
+        let (a_id, b_id, c_id, g) = (a.id, b.id, c.id, d.alloc_id());
+        d.insert(Some(l), 0, a).unwrap();
+        d.insert(Some(l), 9, Node::group(g, vec![Arc::new(b), Arc::new(c)])).unwrap();
+        let far = rect(&mut d, 120.0);
+        d.insert(Some(l), 9, far).unwrap();
+        let at = |x: f64, scope| objects_at(&d, Point::new(x, 25.0), HitOptions::default(), scope);
+        assert_eq!(at(30.0, None), vec![g, a_id]);
+        assert_eq!(at(30.0, Some(g)), [c_id, b_id], "isolated: the group's own objects");
+        // Isolated, the art around the group is locked: clicks pass through it (#833).
+        assert!(at(5.0, Some(g)).is_empty());
+        assert!(at(130.0, Some(g)).is_empty());
+        assert!(hit_test(&d, Point::new(5.0, 25.0), HitOptions { scope: Some(g), ..HitOptions::default() }).is_none());
+        assert_eq!(at(5.0, None), vec![a_id]);
+        assert!(at(90.0, None).is_empty());
+    }
+
     #[test]
     fn locked_and_hidden_skip() {
         let mut d = Document::new(200.0, 200.0);

crates/doc/src/inline.rs

@@ -0,0 +1,108 @@
+//! Inline graphics in text ([`crate::TextRun::inline`]): resolving each inline symbol's art bounds
+//! from the document's symbols, which the text layout needs to size and place it.
+
+use std::borrow::Cow;
+
+use vectorcraft_geom::{Affine, Rect};
+
+use crate::{Document, NodeId, NodeKind, TextObject};
+
+/// The document key under which the app records each symbol's natural size (`{name: [w, h]}`).
+pub const SYMBOL_SIZES: &str = "symbolSizes";
+/// Half the side of the square symbol art is normalised to.
+pub const SYMBOL_HALF: f64 = 10.0;
+
+/// Usable art bounds: finite, non-degenerate.
+fn usable(r: Option<Rect>) -> Option<Rect> {
+    r.filter(|r| [r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.is_finite()) && r.width() >= 0.0 && r.height() > 1e-9)
+}
+
+impl Document {
+    /// Symbol space → the symbol's art at its natural size. Symbols made in the app keep their
+    /// art in a 20 × 20 square around the origin and their size as drawn in the document's
+    /// `symbolSizes` (an instance is placed with that scale); other symbols are as they are.
+    pub fn symbol_natural_xf(&self, name: &str) -> Affine {
+        let size = self.unknown.get(SYMBOL_SIZES).and_then(|m| m.get(name)).and_then(|v| Some((v.get(0)?.as_f64()?, v.get(1)?.as_f64()?)));
+        match size {
+            Some((w, h)) if w.is_finite() && h.is_finite() && w > 0.0 && h > 0.0 => {
+                Affine::scale_non_uniform(w / (2.0 * SYMBOL_HALF), h / (2.0 * SYMBOL_HALF))
+            }
+            _ => Affine::IDENTITY,
+        }
+    }
+
+    /// Visual bounds of the art of the symbol named `name` at its natural size (see
+    /// [`Self::symbol_natural_xf`]), if it exists and has a usable extent.
+    pub fn symbol_art_bounds(&self, name: &str) -> Option<Rect> {
+        let s = self.symbols.iter().find(|s| s.name == name)?;
+        let b = usable(s.art.visual_bounds().or_else(|| s.art.geometric_bounds()))?;
+        usable(Some(self.symbol_natural_xf(name).transform_rect_bbox(b)))
+    }
+
+    /// Does `t` have inline graphics whose resolved bounds differ from the document's symbols?
+    fn inline_stale(&self, t: &TextObject) -> bool {
+        t.runs.iter().filter_map(|r| r.inline.as_ref()).any(|a| a.bounds != self.symbol_art_bounds(&a.symbol))
+    }
+
+    /// `t` with its inline graphics' art bounds resolved from this document's symbols (borrowed
+    /// when nothing changes). Renderers and exporters lay text out through this, so they never
+    /// depend on the cached bounds being current.
+    pub fn inline_resolved<'a>(&self, t: &'a TextObject) -> Cow<'a, TextObject> {
+        if !self.inline_stale(t) {
+            return Cow::Borrowed(t);
+        }
+        let mut t = t.clone();
+        self.resolve_text_inline(&mut t);
+        Cow::Owned(t)
+    }
+
+    /// Fill in the art bounds of `t`'s inline graphics; returns whether any changed (the text's
+    /// cached layout bounds are then cleared).
+    pub fn resolve_text_inline(&self, t: &mut TextObject) -> bool {
+        let mut changed = false;
+        for r in &mut t.runs {
+            if let Some(a) = &mut r.inline {
+                let b = self.symbol_art_bounds(&a.symbol);
+                if a.bounds != b {
+                    a.bounds = b;
+                    changed = true;
+                }
+            }
+        }
+        if changed {
+            t.cached_bounds = None;
+        }
+        changed
+    }
+
+    /// Resolve the inline graphics of every text object in the layers (after opening a document
+    /// or changing its symbols). Returns the ids of the texts that changed: their cached layout
+    /// bounds were cleared and need recomputing.
+    pub fn resolve_inline_art(&mut self) -> Vec<NodeId> {
+        let mut stale = vec![];
+        self.walk(|n| {
+            if let NodeKind::Text(t) = &n.kind
+                && t.runs.iter().any(|r| r.inline.is_some())
+                && self.inline_stale(t)
+            {
+                stale.push(n.id);
+            }
+        });
+        let mut out = vec![];
+        for id in stale {
+            let Some(mut t) = self.node(id).and_then(|n| match &n.kind {
+                NodeKind::Text(t) => Some(t.clone()),
+                _ => None,
+            }) else {
+                continue;
+            };
+            if self.resolve_text_inline(&mut t)
+                && let Some(n) = self.node_mut(id)
+            {
+                n.kind = NodeKind::Text(t);
+                out.push(id);
+            }
+        }
+        out
+    }
+}

crates/doc/src/lib.rs

@@ -9,9 +9,13 @@ pub mod appearance;
 pub mod assets;
 pub mod blend;
 pub mod clipnest;
+pub mod cmyk;
+pub mod corners;
 pub mod graph;
 pub mod hit;
 pub mod inks;
+mod inline;
+pub use inline::{SYMBOL_HALF, SYMBOL_SIZES};
 pub mod links;
 pub mod live;
 pub mod marks;
@@ -22,6 +26,7 @@ pub mod overprint;
 pub mod pattern;
 pub mod perspective;
 mod pixels;
+pub mod placed_document;
 pub mod profiles;
 pub mod puppet;
 pub mod range;
@@ -30,10 +35,12 @@ mod reach;
 pub mod recolor;
 pub mod selection;
 pub mod setup;
+pub mod shaper;
 pub mod slices;
 pub mod style_libs;
 pub mod swatches;
 pub mod text;
+pub mod trace;
 
 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -53,10 +60,11 @@ pub(crate) mod skip {
 
 pub use appearance::StrokeGradientMode;
 pub use appearance::{
-    Appearance, AppearanceItem, ArrowAlign, Arrowhead, Dash, Effect, FillLayer, LineCap, LineJoin, ProfilePreset, SavedProfile, StrokeAlign,
-    StrokeLayer, WidthProfile,
+    Appearance, AppearanceItem, ArrowAlign, Arrowhead, Dash, Effect, FillLayer, LineCap, LineJoin, PressureProfile, ProfilePreset, SavedProfile,
+    StrokeAlign, StrokeLayer, WidthProfile,
 };
 pub use assets::ExportAsset;
+pub use corners::LiveCorners;
 pub use graph::{GraphKind, GraphSpec};
 pub use hit::{Hit, HitKind};
 pub use links::{LinkInfo, PlacementOptions};
@@ -69,6 +77,7 @@ pub use node::{ImageObject, LAYER_COLORS, LayerColor, LiveShape, Node, NodeId, N
 pub use orient::OrientedBox;
 pub use pattern::{Overlap, PatternDef, PatternEdit, RepeatKind, RepeatSpec, TileType};
 pub use perspective::PerspectiveAttachment;
+pub use placed_document::PlacedDocument;
 pub use profiles::ColorProfiles;
 pub use puppet::{PuppetPin, PuppetPins};
 pub use rastersettings::{RasterColorModel, RasterEffectsSettings};
@@ -77,15 +86,17 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaOptions, CharPosition, CharStyle, FirstBaseline, Justify, ParaStyle, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject,
-    TextRun, TextStyleDef, TextWrap, WrapShape,
+    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, FirstBaseline, InlineArt, Justify, Kinsoku, LeadingModel,
+    Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef,
+    TextWrap, VerticalAlign, WrapShape,
 };
+pub use trace::TraceView;
 pub use vectorcraft_color as color;
 pub use vectorcraft_geom as geom;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::{Swatch, SwatchGroup};
-use vectorcraft_geom::{Point, Rect};
+use vectorcraft_geom::{Affine, Point, Rect, Vec2};
 
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum DocError {
@@ -166,6 +177,18 @@ impl Unit {
             Unit::Feet => "Feet",
         }
     }
+    /// The rulers' label step at `zoom` (screen pixels per point), in this unit: the first of
+    /// 1, 2, 5 × 10ⁿ that puts labels at least 50 pixels apart. Ticks mark every tenth of it.
+    pub fn ruler_step(self, zoom: f64) -> f64 {
+        const STEPS: [f64; 19] =
+            [0.01, 0.02, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0, 50.0, 100.0, 200.0, 500.0, 1000.0, 2000.0, 5000.0, 10000.0];
+        STEPS.iter().copied().find(|s| s * self.points() * zoom >= 50.0).unwrap_or(10000.0)
+    }
+    /// `v` (points) on the nearest ruler tick at `zoom` ([`Self::ruler_step`]).
+    pub fn snap_to_ruler_tick(self, v: f64, zoom: f64) -> f64 {
+        let tick = self.ruler_step(zoom) / 10.0 * self.points();
+        (v / tick).round() * tick
+    }
     pub fn from_pt(self, v: f64) -> f64 {
         v / self.points()
     }
@@ -178,7 +201,10 @@ impl Unit {
     }
     /// [`Unit::format`] without the suffix (`12.5`), for narrow fields.
     pub fn number(self, pt: f64) -> String {
-        let s = format!("{:.3}", self.from_pt(pt));
+        // Three decimals for the small units (`595.276 pt`), four for the large ones (`8.2677 in`,
+        // `35.2778 mm`, the `0.0078 in` stroke preset); trailing zeros are trimmed (`1 pt` is `1`).
+        let decimals = if matches!(self, Unit::Points | Unit::Pixels | Unit::Picas) { 3 } else { 4 };
+        let s = format!("{:.*}", decimals, self.from_pt(pt));
         let s = s.trim_end_matches('0').trim_end_matches('.');
         if s == "-0" { "0".into() } else { s.into() }
     }
@@ -339,11 +365,53 @@ pub struct SavedView {
     pub rotation: f64,
 }
 
+/// A saved selection (Select → Save Selection…): the objects that were selected, listed by name at
+/// the bottom of the Select menu.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SavedSelection {
+    pub name: String,
+    pub objects: Vec<NodeId>,
+}
+
+impl SavedSelection {
+    /// Most saved selections a document keeps (the Select menu lists every one).
+    pub const MAX: usize = 25;
+    /// Longest name, in characters.
+    pub const MAX_NAME: usize = 255;
+
+    /// `name` trimmed and cut to [`Self::MAX_NAME`] characters (`None` when blank).
+    pub fn clean_name(name: &str) -> Option<String> {
+        let name: String = name.trim().chars().take(Self::MAX_NAME).collect();
+        (!name.is_empty()).then_some(name)
+    }
+
+    /// The first "Selection N" none of `saved` is named.
+    pub fn default_name(saved: &[SavedSelection]) -> String {
+        (1..=saved.len() + 1).map(|i| format!("Selection {i}")).find(|n| !saved.iter().any(|x| &x.name == n)).unwrap_or_default()
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Guide {
     /// true = vertical guide at `pos` (x), false = horizontal at `pos` (y).
     pub vertical: bool,
     pub pos: f64,
+    /// An artboard guide: the [`Artboard::id`] it belongs to. It runs across that artboard only
+    /// and moves, is copied and is deleted with it. None: a canvas guide, across the whole canvas.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub artboard: Option<u32>,
+}
+
+impl Guide {
+    /// A canvas guide.
+    pub fn new(vertical: bool, pos: f64) -> Self {
+        Self { vertical, pos, artboard: None }
+    }
+
+    /// Moved by `d` (a vertical guide across, a horizontal one down).
+    pub fn moved(&self, d: Vec2) -> Self {
+        Self { pos: self.pos + if self.vertical { d.x } else { d.y }, ..self.clone() }
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -490,6 +558,9 @@ pub struct Document {
     /// View → New View… (up to 25, like Illustrator).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub views: Vec<SavedView>,
+    /// Select → Save Selection… (at most [`SavedSelection::MAX`]); saved with the document.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub saved_selections: Vec<SavedSelection>,
     #[serde(default)]
     pub grid: GridPrefs,
     #[serde(default = "ppi72")]
@@ -541,6 +612,11 @@ pub struct Document {
     /// save time only, so changing the view never marks the document modified.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_view: Option<SavedView>,
+    /// The layers, sublayers and groups open in the Layers panel when the document was saved; they
+    /// reopen that way. `None`: the default, only the top-level layers open. Written at save time
+    /// only, like [`Document::last_view`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub layers_open: Option<Vec<NodeId>>,
     /// Edit → Assign Profile: the profiles the document is tagged with (files before format v3
     /// kept them in `unknown`, see [`Document::migrate_color_profiles`]).
     #[serde(default, skip_serializing_if = "ColorProfiles::is_empty")]
@@ -616,6 +692,7 @@ impl Document {
             symbols: vec![],
             guides: vec![],
             views: vec![],
+            saved_selections: vec![],
             grid: GridPrefs::default(),
             raster_effects_ppi: 72.0,
             images: BTreeMap::new(),
@@ -632,6 +709,7 @@ impl Document {
             metadata: DocMetadata::default(),
             raster_effects: RasterEffectsSettings::default(),
             last_view: None,
+            layers_open: None,
             color_profiles: ColorProfiles::default(),
             export_settings: Default::default(),
             extra: Default::default(),
@@ -663,7 +741,8 @@ impl Document {
         }
         max = self.slices.iter().fold(max, |m, s| m.max(s.id.0));
         max = self.assets.iter().fold(max, |m, a| m.max(a.id));
-        self.next_id = self.next_id.max(max + 1);
+        // An id of u64::MAX (a damaged file) can't overflow: ids after it are reused at worst.
+        self.next_id = self.next_id.max(max.saturating_add(1));
     }
 
     /// Find a node anywhere in the tree.
@@ -810,15 +889,17 @@ impl Document {
         self.layers.push(Arc::new(Node::layer(id, &name, LayerColor::Preset((n % LAYER_COLORS.len()) as u8))));
         id
     }
+    /// The default name of a new layer or sublayer, "Layer N". Layers and sublayers share the
+    /// numbering: it starts after the number of layers there are and skips any layer's name.
     pub fn next_layer_name(&self) -> String {
-        let mut i = self.layers.len() + 1;
-        loop {
-            let name = format!("Layer {i}");
-            if !self.layers.iter().any(|l| l.name.as_deref() == Some(&name)) {
-                return name;
+        let (mut count, mut taken) = (0, std::collections::HashSet::new());
+        self.walk(|n| {
+            if n.is_layer() {
+                count += 1;
+                taken.extend(n.name.as_deref());
             }
-            i += 1;
-        }
+        });
+        (count + 1..).map(|i| format!("Layer {i}")).find(|name| !taken.contains(name.as_str())).unwrap_or_default()
     }
 
     /// Visit every node depth first in paint order (bottom to top).
@@ -837,9 +918,19 @@ impl Document {
     pub fn is_visible(&self, id: NodeId) -> bool {
         self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| n.visible)))
     }
-    /// Colour of the layer containing `id` (selection highlight colour).
+    /// The innermost layer or sublayer containing `id` (`id` itself when it is a layer).
+    pub fn layer_containing(&self, id: NodeId) -> Option<NodeId> {
+        let a = self.ancestry(id)?;
+        a.iter().rev().copied().find(|i| self.node(*i).is_some_and(Node::is_layer))
+    }
+    /// Every art object the Selection tool can reach (Select All): the visible, unlocked objects
+    /// of the visible, unlocked, non-template layers, looking through sublayers (bottom first).
+    pub fn selectable_art(&self) -> Vec<NodeId> {
+        self.layers.iter().filter(|l| l.visible && !l.locked && !l.is_template()).flat_map(|l| l.layer_art(true)).collect()
+    }
+    /// Colour of the innermost layer or sublayer containing `id` (selection highlight colour).
     pub fn layer_color(&self, id: NodeId) -> [u8; 3] {
-        let l = self.layer_of(id).and_then(|l| self.node(l));
+        let l = self.layer_containing(id).and_then(|l| self.node(l));
         match l.map(|n| &n.kind) {
             Some(NodeKind::Layer { color, .. }) => color.rgb(),
             _ => LAYER_COLORS[0].1,
@@ -859,6 +950,81 @@ impl Document {
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
         self.artboards.iter().rposition(|a| a.rect.contains(p))
     }
+    /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
+    /// sublayers) lying entirely inside it. Locked and hidden objects and layers stay put unless
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn art_on_artboard(&self, rect: Rect, locked_and_hidden: bool) -> Vec<NodeId> {
+        fn collect(n: &Node, rect: Rect, all: bool, out: &mut Vec<NodeId>) {
+            for c in n.children().into_iter().flatten().filter(|c| c.rides_with_artboard(all)) {
+                if c.is_layer() {
+                    collect(c, rect, all, out);
+                } else if let Some(b) = c.geometric_bounds()
+                    // Inside it, edges included: art flush with the right or bottom edge is on it too
+                    // (`Rect::contains` leaves those out, #890).
+                    && b.x0 >= rect.x0
+                    && b.y0 >= rect.y0
+                    && b.x1 <= rect.x1
+                    && b.y1 <= rect.y1
+                {
+                    out.push(c.id);
+                }
+            }
+        }
+        let mut art = vec![];
+        for l in self.layers.iter().filter(|l| l.rides_with_artboard(locked_and_hidden)) {
+            collect(l, rect, locked_and_hidden, &mut art);
+        }
+        art
+    }
+    /// Where ruler guide `g` runs along its line (the y range of a vertical guide): across its
+    /// artboard for an artboard guide, None (the whole canvas) for a canvas guide or one whose
+    /// artboard is gone.
+    pub fn guide_span(&self, g: &Guide) -> Option<(f64, f64)> {
+        let r = self.artboards.iter().find(|a| Some(a.id) == g.artboard)?.rect;
+        Some(if g.vertical { (r.y0, r.y1) } else { (r.x0, r.x1) })
+    }
+    /// Does ruler guide `g` run past `p` (up to `tol` beyond its ends)?
+    pub fn guide_passes(&self, g: &Guide, p: Point, tol: f64) -> bool {
+        let along = if g.vertical { p.y } else { p.x };
+        self.guide_span(g).is_none_or(|(a, b)| along >= a - tol && along <= b + tol)
+    }
+    /// Keep the ruler guides `keep` accepts (by index), the selected ones left keeping their
+    /// place among the rest (the selected art stays selected). Returns how many went.
+    pub fn retain_guides(&mut self, sel: &mut Selection, keep: impl Fn(usize, &Guide) -> bool) -> usize {
+        let kept: Vec<bool> = self.guides.iter().enumerate().map(|(i, g)| keep(i, g)).collect();
+        // Where each kept guide ends up.
+        let (mut to, mut n) = (Vec::with_capacity(kept.len()), 0);
+        for k in &kept {
+            to.push(k.then_some(n));
+            n += usize::from(*k);
+        }
+        sel.guides = sel.guides.iter().filter_map(|i| to.get(*i).copied().flatten()).collect();
+        let before = self.guides.len();
+        let mut flags = kept.into_iter();
+        self.guides.retain(|_| flags.next().unwrap_or(true));
+        before - self.guides.len()
+    }
+    /// Move the guides of artboard `id` by `d` (along with their artboard).
+    pub fn move_artboard_guides(&mut self, id: u32, d: Vec2) {
+        for g in self.guides.iter_mut().filter(|g| g.artboard == Some(id)) {
+            *g = g.moved(d);
+        }
+    }
+    /// Map the guides of artboard `id` through `xf`, an axis-aligned scale and move (Scale Artwork
+    /// with Artboard).
+    pub fn map_artboard_guides(&mut self, id: u32, xf: Affine) {
+        for g in self.guides.iter_mut().filter(|g| g.artboard == Some(id)) {
+            g.pos = if g.vertical { (xf * Point::new(g.pos, 0.0)).x } else { (xf * Point::new(0.0, g.pos)).y };
+        }
+    }
+    /// Copy the guides of artboard `from` onto artboard `to`, `d` away (with a copy of their
+    /// artboard).
+    pub fn copy_artboard_guides(&mut self, from: u32, to: u32, d: Vec2) {
+        let copies: Vec<Guide> =
+            self.guides.iter().filter(|g| g.artboard == Some(from)).map(|g| Guide { artboard: Some(to), ..g.moved(d) }).collect();
+        self.guides.extend(copies);
+    }
     pub fn next_artboard_id(&self) -> u32 {
         self.artboards.iter().map(|a| a.id).max().unwrap_or(0) + 1
     }
@@ -881,6 +1047,33 @@ impl Document {
 }
 
 impl Document {
+    /// Saved selections as a file gives them, made safe to list and recall: at most
+    /// [`SavedSelection::MAX`], each with a clean, unique name and naming objects this document
+    /// has, each once. (An id it doesn't have would select whatever object takes that id later.)
+    pub fn tidy_saved_selections(&mut self) {
+        if self.saved_selections.is_empty() {
+            return;
+        }
+        let mut ids = std::collections::HashSet::new();
+        self.walk(|n| {
+            ids.insert(n.id);
+        });
+        let mut kept: Vec<SavedSelection> = vec![];
+        for s in std::mem::take(&mut self.saved_selections) {
+            if kept.len() >= SavedSelection::MAX {
+                break;
+            }
+            let Some(name) = SavedSelection::clean_name(&s.name) else { continue };
+            if kept.iter().any(|k| k.name == name) {
+                continue;
+            }
+            let mut seen = std::collections::HashSet::new();
+            let objects = s.objects.into_iter().filter(|id| ids.contains(id) && seen.insert(*id)).collect();
+            kept.push(SavedSelection { name, objects });
+        }
+        self.saved_selections = kept;
+    }
+
     /// Leave opacity-mask editing: drop the temporary editing layer, a working copy of art the
     /// mask already holds (the engine syncs it after every edit).
     pub fn drop_edit_modes(&mut self) {
@@ -979,6 +1172,27 @@ mod tests {
         assert_eq!(d.artboards[0].rect, Rect::new(0.0, 0.0, 612.0, 792.0));
     }
 
+    #[test]
+    fn art_on_artboard_takes_unlocked_objects_wholly_inside() {
+        let (mut d, a, b) = doc_with_rects();
+        let wide = Rect::new(-1.0, -1.0, 40.0, 15.0);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 15.0, 15.0), false), vec![a]);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 25.0, 15.0), false), vec![a], "b only half inside");
+        // Flush with the artboard's edges counts as inside: the right and bottom ones too (#890).
+        for board in [Rect::new(0.0, 0.0, 10.0, 10.0), Rect::new(-5.0, 0.0, 10.0, 15.0), Rect::new(0.0, -5.0, 15.0, 10.0)] {
+            assert_eq!(d.art_on_artboard(board, false), vec![a], "{board:?}");
+        }
+        d.node_mut(a).unwrap().locked = true;
+        assert_eq!(d.art_on_artboard(wide, false), vec![b]);
+        // Move Locked and Hidden Artwork with Artboard (#394): hidden art stays too, unless on.
+        d.node_mut(b).unwrap().visible = false;
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b]);
+        Arc::make_mut(&mut d.layers[0]).locked = true;
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b], "a locked layer's art too");
+    }
+
     #[test]
     fn find_and_paths() {
         let (d, a, b) = doc_with_rects();

crates/doc/src/links.rs

@@ -137,7 +137,7 @@ impl Document {
         }
     }
 
-    /// The keys of image blobs only linked images show: what a save writes as their preview.
+    /// The keys of image blobs only linked images (or placed documents, always linked) show: what a save writes as their preview.
     pub fn linked_only_images(&self) -> BTreeSet<String> {
         if self.images.values().all(|b| b.proxy.is_none()) {
             return BTreeSet::new();
@@ -152,6 +152,8 @@ impl Document {
                 u.1 = true;
             }
         });
+        // A placed document saves its file's preview the same way.
+        self.visit_placed(|_, p| uses.entry(p.key.as_str()).or_default().0 = true);
         uses.into_iter().filter(|(_, (linked, embedded))| *linked && !embedded).map(|(k, _)| k.to_string()).collect()
     }
 }
@@ -253,6 +255,34 @@ impl Align {
 }
 
 impl Document {
+    /// Rewrite linked file locations in both raster images and placed VectorCraft documents,
+    /// including those inside symbols, patterns and opacity masks. Used to make packages portable.
+    pub fn update_links(&mut self, mut f: impl FnMut(&mut LinkInfo)) {
+        fn walk(n: &mut Arc<Node>, f: &mut dyn FnMut(&mut LinkInfo)) {
+            let n = Arc::make_mut(n);
+            match &mut n.kind {
+                NodeKind::Image(image) => {
+                    if let Some(link) = &mut image.link {
+                        f(link);
+                    }
+                }
+                NodeKind::PlacedDocument(placed) => f(&mut placed.link),
+                _ => {}
+            }
+            if let Some(mask) = &mut n.mask {
+                walk(&mut mask.art, f);
+            }
+            for child in n.children_mut().into_iter().flatten() {
+                walk(child, f);
+            }
+        }
+        let roots =
+            self.layers.iter_mut().chain(self.symbols.iter_mut().map(|s| &mut s.art)).chain(self.patterns.iter_mut().flat_map(|p| &mut p.art));
+        for root in roots {
+            walk(root, &mut f);
+        }
+    }
+
     /// Change every image object (in the layers, symbol definitions and pattern swatches, opacity-mask
     /// art included) for which `pick` holds; only the subtrees holding one are copied.
     pub fn update_images(&mut self, pick: impl Fn(&ImageObject) -> bool, mut f: impl FnMut(&mut ImageObject)) {

crates/doc/src/live.rs

@@ -589,6 +589,46 @@ impl GradientMesh {
         self.rows >= 1 && self.cols >= 1 && self.points.len() == (self.rows as usize + 1) * (self.cols as usize + 1)
     }
 
+    /// A 1×1 mesh from its four corners (bottom-left, top-left, top-right, bottom-right in u/v
+    /// order: row 0 is v = 0, columns follow u), each with its handles ([`H_RIGHT`] …).
+    fn patch(corners: [(Point, [Vec2; 4], Color); 4]) -> Self {
+        let point = |(p, handles, color): (Point, [Vec2; 4], Color)| MeshPoint { p, color, opacity: 1.0, handles };
+        let [a, b, c, d] = corners;
+        Self { rows: 1, cols: 1, points: vec![point(a), point(d), point(b), point(c)] }
+    }
+
+    /// A 1×1 mesh from a Coons patch's twelve boundary points (in the order PDF and PostScript
+    /// shadings list them: v runs cp0 → cp3 along cp1 and cp2, u runs cp0 → cp9 along cp11 and
+    /// cp10) and its corner colours (at cp0, cp3, cp6, cp9); `None` if a point isn't finite.
+    pub fn coons(cp: &[Point; 12], colors: [Color; 4]) -> Option<Self> {
+        if !cp.iter().all(|p| p.is_finite()) {
+            return None;
+        }
+        let h = |a: usize, b: usize| cp[b] - cp[a];
+        let handles = |right: Vec2, left: Vec2, down: Vec2, up: Vec2| {
+            let mut h = [Vec2::ZERO; 4];
+            (h[H_RIGHT], h[H_LEFT], h[H_DOWN], h[H_UP]) = (right, left, down, up);
+            h
+        };
+        let [c0, c1, c2, c3] = colors;
+        Some(Self::patch([
+            (cp[0], handles(h(0, 11), Vec2::ZERO, h(0, 1), Vec2::ZERO), c0),
+            (cp[3], handles(h(3, 4), Vec2::ZERO, Vec2::ZERO, h(3, 2)), c1),
+            (cp[6], handles(Vec2::ZERO, h(6, 5), Vec2::ZERO, h(6, 7)), c2),
+            (cp[9], handles(Vec2::ZERO, h(9, 10), h(9, 8), Vec2::ZERO), c3),
+        ]))
+    }
+
+    /// A 1×1 mesh of a Gouraud-shaded triangle (a patch with two corners together); `None` if a
+    /// point isn't finite.
+    pub fn triangle(corners: [(Point, Color); 3]) -> Option<Self> {
+        if !corners.iter().all(|(p, _)| p.is_finite()) {
+            return None;
+        }
+        let [a, b, c] = corners.map(|(p, color)| (p, [Vec2::ZERO; 4], color));
+        Some(Self::patch([a, b, c, c]))
+    }
+
     /// A mesh over surface `s` (u, v ∈ [0,1]) with handles from its partial derivatives.
     pub fn from_surface(rows: u32, cols: u32, s: &dyn Fn(f64, f64) -> Point, color: &dyn Fn(f64, f64) -> Color) -> Self {
         let (us, vs) = (even_steps(cols), even_steps(rows));
@@ -1407,6 +1447,8 @@ fn map_node(n: &Node, w: &Warper) -> Node {
             let im = im.clone();
             return warp_image(&out, &im, w);
         }
+        // Its art is plain, so it warps at this depth.
+        NodeKind::PlacedDocument(_) => return map_node(&expanded_group_hooks(n, w.hooks), w),
     }
     out
 }
@@ -1567,7 +1609,7 @@ pub fn envelope_bounds(content: &[Arc<Node>], kind: &EnvelopeKind, frame: Affine
 
 /// Is this one of the live kinds?
 pub fn is_live(n: &Node) -> bool {
-    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_))
+    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_))
 }
 
 /// Mesh tessellation as filled quad paths (no stroke), `n`×`n` per patch.
@@ -1601,6 +1643,7 @@ pub fn expand_live_hooks(n: &Node, hooks: Hooks) -> Vec<Node> {
         NodeKind::Envelope { content, kind, fidelity, options, frame, .. } => expand_envelope(content, kind, *fidelity, *options, *frame, hooks),
         NodeKind::Mesh(m) => mesh_quad_nodes(m, 8),
         NodeKind::Repeat(r) => r.expand(),
+        NodeKind::PlacedDocument(p) => p.art(n),
         _ => vec![n.clone()],
     }
 }

crates/doc/src/node.rs

@@ -4,7 +4,9 @@ use std::sync::Arc;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::BlendMode;
-use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect, shapes};
+use vectorcraft_geom::corners::cut_corners;
+use vectorcraft_geom::shapes::{self, CornerKind};
+use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
 
 use crate::appearance::Appearance;
 use crate::live::{BlendSpec, EnvelopeKind, GradientMesh, Outliner};
@@ -75,12 +77,19 @@ impl LayerColor {
 #[serde(tag = "shape", rename_all = "lowercase")]
 pub enum LiveShape {
     Rectangle {
-        /// Untransformed width/height.
+        /// Untransformed width/height. Transforms fold their scale into these (see
+        /// [`LiveShape::transform`]), so they are document lengths unless `xf` shears.
         w: f64,
         h: f64,
-        /// Corner radii: top-left, top-right, bottom-right, bottom-left.
+        /// Corner radii: top-left, top-right, bottom-right, bottom-left. In the same units as
+        /// `w`/`h`: the corners are circular arcs in the document whenever `xf` doesn't scale.
         radii: [f64; 4],
-        /// Maps the untransformed shape (origin at its top-left) into the document.
+        /// Corner kinds, in the same order (Live Corners' corner types).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: [CornerKind; 4],
+        /// Maps the untransformed shape (origin at its top-left) into the document. A rotation
+        /// or reflection plus a move, unless a shear (or a file saved before transforms folded
+        /// their scale into `w`/`h`) put more in it.
         xf: Affine,
     },
     Ellipse {
@@ -94,11 +103,30 @@ pub enum LiveShape {
         radius: f64,
         sides: u32,
         xf: Affine,
+        /// Corner radii in document units, by vertex from the first one clockwise (none: sharp).
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        radii: Vec<f64>,
+        /// Corner kinds, in the same order (none: round).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: Vec<CornerKind>,
     },
     Line {
         a: Point,
         b: Point,
     },
+    /// Any other path whose corners Live Corners cut (a star, a pen path): it keeps its uncut
+    /// outline so the corners stay editable. Without a cut corner it is a plain path again.
+    Path {
+        /// The path with its corners uncut, in the document.
+        base: PathData,
+        /// Corner radii in document units, by anchor index of `base` (counting every subpath's
+        /// anchors in order; missing: sharp).
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        radii: Vec<f64>,
+        /// Corner kinds, in the same order (missing: round).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: Vec<CornerKind>,
+    },
 }
 
 impl LiveShape {
@@ -109,45 +137,121 @@ impl LiveShape {
             LiveShape::Ellipse { .. } => "Ellipse",
             LiveShape::Polygon { .. } => "Polygon",
             LiveShape::Line { .. } => "Line",
+            LiveShape::Path { .. } => "Path",
         }
     }
     /// Regenerate the path.
     pub fn to_path(&self) -> PathData {
         match self {
-            LiveShape::Rectangle { w, h, radii, xf } => {
-                let r = Rect::new(0.0, 0.0, *w, *h);
-                let p = if radii.iter().all(|x| (x - radii[0]).abs() < 1e-9) {
-                    shapes::rounded_rectangle(r, radii[0])
-                } else {
-                    // Per-corner radii: generate uniformly then adjust (approximation until M2.5).
-                    shapes::rounded_rectangle(r, radii.iter().cloned().fold(0.0, f64::max))
-                };
-                p.transformed(*xf)
+            LiveShape::Rectangle { w, h, radii, kinds, xf } => {
+                shapes::rectangle_with_corners(Rect::new(0.0, 0.0, *w, *h), *radii, *kinds).transformed(*xf)
             }
-            LiveShape::Ellipse { w, h, xf, .. } => shapes::ellipse(Rect::new(0.0, 0.0, *w, *h)).transformed(*xf),
-            LiveShape::Polygon { radius, sides, xf } => shapes::polygon(Point::ZERO, *radius, *sides, 0.0).transformed(*xf),
+            LiveShape::Ellipse { w, h, pie, xf } => shapes::ellipse_pie(Rect::new(0.0, 0.0, *w, *h), pie.0, pie.1).transformed(*xf),
+            LiveShape::Polygon { radii, kinds, .. } => cut_corners(&self.polygon_outline(), radii, kinds).0,
             LiveShape::Line { a, b } => shapes::line(*a, *b),
+            LiveShape::Path { base, radii, kinds } => cut_corners(base, radii, kinds).0,
         }
     }
-    pub fn transform(&mut self, a: Affine) {
+    /// A polygon's outline with its corners uncut, in the document (empty for other shapes).
+    pub fn polygon_outline(&self) -> PathData {
         match self {
-            LiveShape::Rectangle { xf, .. } | LiveShape::Ellipse { xf, .. } | LiveShape::Polygon { xf, .. } => *xf = a * *xf,
+            LiveShape::Polygon { radius, sides, xf, .. } => shapes::polygon(Point::ZERO, *radius, *sides, 0.0).transformed(*xf),
+            _ => PathData::default(),
+        }
+    }
+    /// Give a polygon `n` sides (3–1000). Its corners keep the radius and kind they shared; else
+    /// the corners past the old last one are sharp.
+    pub fn set_sides(&mut self, n: u64) {
+        let LiveShape::Polygon { sides, radii, kinds, .. } = self else { return };
+        *sides = n.clamp(3, 1000) as u32;
+        fn spread<T: Copy + PartialEq + Default>(v: &mut Vec<T>, n: usize) {
+            match v.first().copied() {
+                Some(x) if v.iter().all(|y| *y == x) => *v = vec![x; n],
+                Some(_) => v.resize(n, T::default()),
+                None => {}
+            }
+        }
+        spread(radii, *sides as usize);
+        spread(kinds, *sides as usize);
+    }
+    /// Apply `a` to the shape. True when the shape is no longer `a` applied to the old path, so
+    /// the caller must regenerate the path with [`LiveShape::to_path`].
+    ///
+    /// A rectangle keeps round corners whatever its proportions: when `a` scales it along its own
+    /// sides (any rotation or reflection, no shear), the scale goes into `w`/`h` and `xf` keeps
+    /// only the rotation, reflection and position. The radii scale by the mean scale (the square
+    /// root of the determinant), which [`LiveShape::keep_corners`] undoes for Scale Corners off.
+    /// A shear can't keep circular corners: `xf` takes it, as do moves (so files saved with a
+    /// scale in `xf` keep their exact geometry until they're next transformed). A polygon's or a
+    /// path's corner radii are document lengths: they scale by the mean scale and the corners are
+    /// cut again, circular whatever `a` does.
+    pub fn transform(&mut self, a: Affine) -> bool {
+        match self {
+            LiveShape::Rectangle { xf, .. } => {
+                *xf = a * *xf;
+                !moves_only(a) && self.fold_scale()
+            }
+            LiveShape::Ellipse { xf, .. } => {
+                *xf = a * *xf;
+                false
+            }
+            LiveShape::Polygon { xf, radii, .. } => {
+                *xf = a * *xf;
+                scale_radii(radii, a)
+            }
+            LiveShape::Path { base, radii, .. } => {
+                base.transform(a);
+                scale_radii(radii, a)
+            }
             LiveShape::Line { a: p, b } => {
                 *p = a * *p;
                 *b = a * *b;
+                false
             }
         }
     }
+    /// Move the scale of a rectangle's `xf` into `w`/`h` (and its radii, by the mean scale), so
+    /// `xf` keeps only a rotation or reflection plus a move and the corners are circular in the
+    /// document. False (and nothing changes) when there is no scale to move, when `xf` shears or
+    /// isn't finite, and for other shapes. Files saved before transforms did this (#291) carry an
+    /// uneven scale in `xf`: their corners are elliptical until this runs.
+    pub fn fold_scale(&mut self) -> bool {
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = self else { return false };
+        let [m0, m1, m2, m3, m4, m5] = xf.as_coeffs();
+        let (sx, sy) = (m0.hypot(m1), m2.hypot(m3));
+        let orthogonal = sx > 1e-12 && sy > 1e-12 && (m0 * m2 + m1 * m3).abs() <= 1e-9 * sx * sy;
+        let finite = xf.as_coeffs().iter().all(|c| c.is_finite()) && w.is_finite() && h.is_finite();
+        let unscaled = (sx - 1.0).abs() < 1e-12 && (sy - 1.0).abs() < 1e-12;
+        if !orthogonal || !finite || unscaled {
+            return false;
+        }
+        let k = (sx * sy).sqrt();
+        radii.iter_mut().for_each(|r| *r *= k);
+        *w *= sx;
+        *h *= sy;
+        *xf = Affine::new([m0 / sx, m1 / sx, m2 / sy, m3 / sy, m4, m5]);
+        true
+    }
+    /// This shape with [`LiveShape::fold_scale`] applied: a rectangle's size and radii in document
+    /// units (what Live Corners show and edit).
+    pub fn folded(&self) -> Self {
+        let mut s = self.clone();
+        s.fold_scale();
+        s
+    }
     /// Divide live corner radii by `k`, the mean scale of a transform just applied, so the corners
     /// keep their size (Scale Corners off). False when nothing changed.
     pub fn keep_corners(&mut self, k: f64) -> bool {
-        match self {
-            LiveShape::Rectangle { radii, .. } if radii.iter().any(|r| *r > 0.0) && k > 1e-12 => {
-                radii.iter_mut().for_each(|r| *r /= k);
-                true
-            }
-            _ => false,
+        let radii: &mut [f64] = match self {
+            LiveShape::Rectangle { radii, .. } => radii,
+            LiveShape::Polygon { radii, .. } | LiveShape::Path { radii, .. } => radii,
+            LiveShape::Ellipse { .. } | LiveShape::Line { .. } => return false,
+        };
+        if !radii.iter().any(|r| *r > 0.0) || k <= 1e-12 {
+            return false;
         }
+        radii.iter_mut().for_each(|r| *r /= k);
+        true
     }
     /// Rotation angle of the live shape in degrees (shown in the Properties panel).
     pub fn angle_deg(&self) -> f64 {
@@ -157,10 +261,33 @@ impl LiveShape {
                 c[1].atan2(c[0]).to_degrees()
             }
             LiveShape::Line { a, b } => (b.y - a.y).atan2(b.x - a.x).to_degrees(),
+            LiveShape::Path { .. } => 0.0,
         }
     }
 }
 
+fn all_round(kinds: &[CornerKind]) -> bool {
+    kinds.iter().all(|k| *k == CornerKind::Round)
+}
+
+/// Whether `a` only moves (no rotation, scale, shear or reflection).
+fn moves_only(a: Affine) -> bool {
+    let [a0, a1, a2, a3, _, _] = a.as_coeffs();
+    (a0 - 1.0).abs() < 1e-12 && a1.abs() < 1e-12 && a2.abs() < 1e-12 && (a3 - 1.0).abs() < 1e-12
+}
+
+/// Scale corner radii in document units by the mean scale of `a`, applied to their path. True
+/// when the path must be cut again: some corner is cut and `a` does more than move it (an
+/// uneven scale would otherwise make the cuts elliptical).
+fn scale_radii(radii: &mut [f64], a: Affine) -> bool {
+    if moves_only(a) || !radii.iter().any(|r| *r > 0.0) {
+        return false;
+    }
+    let k = a.determinant().abs().sqrt();
+    radii.iter_mut().for_each(|r| *r *= k);
+    true
+}
+
 /// What a transform scales besides geometry, by its mean scale (the square root of its
 /// determinant). `Scaling::default()` (and `false`) scales nothing else; `true` scales stroke
 /// weights and dashes only. Transforms the user asks for take theirs from Scale Strokes & Effects
@@ -175,6 +302,9 @@ pub struct Scaling {
     pub keep_type_strokes: bool,
     /// Live corner radii keep their size.
     pub keep_corners: bool,
+    /// Pattern fills and strokes move with the art (Transform Patterns; General › Transform
+    /// Pattern Tiles is its default): their tiles transform too, instead of staying put.
+    pub patterns: bool,
 }
 
 impl Scaling {
@@ -223,6 +353,14 @@ pub enum NodeKind {
         /// Layer clipping mask: the first (bottom-most) child clips the others, as in a clip group.
         #[serde(default, skip_serializing_if = "crate::skip::is_default")]
         clip: bool,
+        /// Layer Options → Preview: off, the layer's art is drawn (and clicked) in outline on screen
+        /// (Ctrl-click its eye in the Layers panel).
+        #[serde(default = "yes", skip_serializing_if = "crate::skip::is_true")]
+        preview: bool,
+        /// Layer Options → Dim Images to: on screen, images on the layer show faded to this
+        /// percentage (0–100); `None`: not dimmed.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        dim_images: Option<u8>,
     },
     /// A group. With `clip`, the first (bottom-most) child is the clipping path.
     Group {
@@ -285,6 +423,9 @@ pub enum NodeKind {
     Mesh(GradientMesh),
     /// Live Repeat (radial / grid / mirror) of source art.
     Repeat(RepeatSpec),
+    /// A placed document: an artboard of another VectorCraft file, linked and locked (see
+    /// [`crate::placed_document`]).
+    PlacedDocument(Box<crate::placed_document::PlacedDocument>),
 }
 
 fn yes() -> bool {
@@ -322,7 +463,8 @@ pub struct Node {
     /// Opacity mask (Transparency panel). Its art lives here, outside the layer tree.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub mask: Option<Box<OpacityMask>>,
-    /// Image Trace object: `{preset, params}` it was traced with (the Image Trace panel shows them).
+    /// Image Trace object: `{preset, params, view?}` it was traced with (the Image Trace panel shows
+    /// them; `view` is its [`crate::TraceView`] id, absent for the tracing result).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub trace: Option<Box<serde_json::Value>>,
     /// Object → Text Wrap: area type below this object (in the same layer) flows around it.
@@ -331,6 +473,9 @@ pub struct Node {
     /// Graph object: the group's children are generated from this spec (Object → Graph).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub graph: Option<Box<crate::graph::GraphSpec>>,
+    /// Editable Shaper composition; the original art is retained in its source child.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub shaper: Option<Box<crate::shaper::ShaperSpec>>,
     pub kind: NodeKind,
     /// The [`crate::GraphicStyle::id`] last applied to this object. It stays linked while it keeps
     /// that style's look: editing its appearance or transparency breaks the link.
@@ -395,6 +540,7 @@ impl Node {
             trace: None,
             wrap: None,
             graph: None,
+            shaper: None,
             kind,
             graphic_style: None,
             attrs: None,
@@ -412,7 +558,10 @@ impl Node {
         Self::new(id, NodeKind::Group { children, clip: false })
     }
     pub fn layer(id: NodeId, name: &str, color: LayerColor) -> Self {
-        let mut n = Self::new(id, NodeKind::Layer { color, template: false, printable: true, children: vec![], clip: false });
+        let mut n = Self::new(
+            id,
+            NodeKind::Layer { color, template: false, printable: true, children: vec![], clip: false, preview: true, dim_images: None },
+        );
         n.name = Some(name.to_string());
         n
     }
@@ -438,9 +587,39 @@ impl Node {
             _ => None,
         }
     }
+    /// Does this object or layer move with its artboard? Locked and hidden ones only with
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn rides_with_artboard(&self, locked_and_hidden: bool) -> bool {
+        locked_and_hidden || (!self.locked && self.visible)
+    }
     pub fn is_layer(&self) -> bool {
         matches!(self.kind, NodeKind::Layer { .. })
     }
+    /// A template layer (Layer Options → Template).
+    pub fn is_template(&self) -> bool {
+        matches!(self.kind, NodeKind::Layer { template: true, .. })
+    }
+    /// The art objects of this container: its children, looking through sublayers, which are not
+    /// objects (bottom first). With `editable`, only the visible, unlocked objects in visible,
+    /// unlocked, non-template sublayers.
+    pub fn layer_art(&self, editable: bool) -> Vec<NodeId> {
+        fn visit(n: &Node, editable: bool, out: &mut Vec<NodeId>) {
+            for c in n.children().into_iter().flatten() {
+                if editable && (!c.visible || c.locked || c.is_template()) {
+                    continue;
+                }
+                if c.is_layer() {
+                    visit(c, editable, out);
+                } else {
+                    out.push(c.id);
+                }
+            }
+        }
+        let mut out = vec![];
+        visit(self, editable, &mut out);
+        out
+    }
     pub fn is_container(&self) -> bool {
         self.children().is_some()
     }
@@ -471,6 +650,7 @@ impl Node {
             NodeKind::Envelope { .. } => "Envelope",
             NodeKind::Mesh(_) => "Mesh",
             NodeKind::Repeat(r) => r.kind.label(),
+            NodeKind::PlacedDocument(_) => "Placed Document",
         }
     }
     /// Name shown in the Layers panel: explicit name or `<Kind>`.
@@ -532,6 +712,7 @@ impl Node {
             }
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Compound { children, .. } => children
                 .iter()
+                .skip(usize::from(self.shaper.is_some()))
                 .filter(|c| c.visible || !matches!(self.kind, NodeKind::Layer { .. }))
                 .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.geometric_bounds())),
             NodeKind::Text(t) => self.projected(t.bounds()),
@@ -544,6 +725,7 @@ impl Node {
             NodeKind::Envelope { content, kind, frame, .. } => crate::live::envelope_bounds(content, kind, *frame),
             NodeKind::Mesh(m) => m.bounds(),
             NodeKind::Repeat(r) => r.bounds(),
+            NodeKind::PlacedDocument(p) => Some(p.bounds()),
         }
     }
     /// Visual bounds: what the object paints, its strokes included (paths and compound paths
@@ -562,7 +744,11 @@ impl Node {
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
                 // The container's own strokes paint around its members.
                 let o = self.appearance.outset();
-                children.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual_bounds())).map(|b| b.inflate(o, o))
+                children
+                    .iter()
+                    .skip(usize::from(self.shaper.is_some()))
+                    .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual_bounds()))
+                    .map(|b| b.inflate(o, o))
             }
             NodeKind::Blend { children, spec } => {
                 let b = children.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual_bounds()));
@@ -609,15 +795,17 @@ impl Node {
             }
         }
         self.appearance.transform_gradients(a);
+        if sc.patterns {
+            crate::pattern::transform_pattern_paints(self, a);
+        }
         match &mut self.kind {
             NodeKind::Path { path, live, .. } => {
                 path.transform(a);
                 if let Some(l) = live {
-                    l.transform(a);
-                    if sc.keep_corners
-                        && let Some(k) = k
-                        && l.keep_corners(k)
-                    {
+                    // A rectangle scaled unevenly keeps circular corners: its path is regenerated.
+                    let reshaped = l.transform(a);
+                    let kept = sc.keep_corners && k.is_some_and(|k| l.keep_corners(k));
+                    if reshaped || kept {
                         *path = l.to_path();
                     }
                 }
@@ -637,6 +825,7 @@ impl Node {
                 }
             }
             NodeKind::Image(im) => im.xf = a * im.xf,
+            NodeKind::PlacedDocument(p) => p.xf = a * p.xf,
             NodeKind::SymbolInstance { xf, .. } => *xf = a * *xf,
             NodeKind::Blend { children, spec } => {
                 for c in children.iter_mut() {
@@ -786,7 +975,7 @@ impl Node {
                 }
             }
             NodeKind::Group { children, .. } | NodeKind::Layer { children, .. } => {
-                for c in children.iter().filter(|c| c.visible) {
+                for c in children.iter().skip(usize::from(self.shaper.is_some())).filter(|c| c.visible) {
                     c.push_clip_shapes(text, out);
                 }
             }
@@ -799,6 +988,10 @@ impl Node {
                 let frame = shapes::rectangle(Rect::new(0.0, 0.0, im.width as f64, im.height as f64)).transformed(im.xf);
                 out.push((frame.to_bezpath(), FillRule::NonZero));
             }
+            NodeKind::PlacedDocument(p) => {
+                let frame = shapes::rectangle(p.natural()).transformed(p.xf);
+                out.push((frame.to_bezpath(), FillRule::NonZero));
+            }
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
                 crate::live::expand_deep(self, text).push_clip_shapes(text, out);
             }
@@ -1031,6 +1224,10 @@ pub struct ObjectAttributes {
     /// The note shown in the Attributes panel.
     #[serde(default, skip_serializing_if = "String::is_empty")]
     pub note: String,
+    /// The object's own data, in order: SVG's `data-*` attributes (`data-pivot="100,180"` is
+    /// `("pivot", "100,180")`), kept from import to export (`object.setProps {data}`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub data: Vec<(String, String)>,
 }
 
 /// The Attributes panel's Image Map shapes.
@@ -1074,7 +1271,7 @@ impl Node {
 
     /// Shapes drawn with the shape tools (live rectangles, ellipses and polygons) show their centre.
     pub fn shows_center_by_default(&self) -> bool {
-        matches!(&self.kind, NodeKind::Path { live: Some(l), .. } if !matches!(l, LiveShape::Line { .. }))
+        matches!(&self.kind, NodeKind::Path { live: Some(l), .. } if !matches!(l, LiveShape::Line { .. } | LiveShape::Path { .. }))
     }
 
     /// Change this object's attributes with `f`; all-default attributes are dropped.
@@ -1130,11 +1327,171 @@ mod tests {
 
     #[test]
     fn rect_live_shape_roundtrip() {
-        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], xf: Affine::translate((5.0, 5.0)) };
+        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], kinds: Default::default(), xf: Affine::translate((5.0, 5.0)) };
         assert_eq!(l.to_path().bounds(), Some(Rect::new(5.0, 5.0, 15.0, 25.0)));
         assert_eq!(l.label(), "Rectangle");
     }
 
+    #[test]
+    fn corner_kinds_save_only_when_some_corner_isnt_round() {
+        let mut l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
+        // Older files read as round.
+        let json = serde_json::to_value(&l).unwrap();
+        assert!(json.get("kinds").is_none(), "{json}");
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        if let LiveShape::Rectangle { kinds, .. } = &mut l {
+            kinds[1] = CornerKind::Chamfer;
+        }
+        let json = serde_json::to_value(&l).unwrap();
+        assert_eq!(json["kinds"], serde_json::json!(["round", "chamfer", "round", "round"]));
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        // Polygons saved before Live Corners cut theirs read as sharp; a live path round-trips.
+        let p: LiveShape =
+            serde_json::from_value(serde_json::json!({"shape": "polygon", "radius": 10.0, "sides": 5, "xf": [1, 0, 0, 1, 0, 0]})).unwrap();
+        assert_eq!(p, LiveShape::Polygon { radius: 10.0, sides: 5, xf: Affine::IDENTITY, radii: vec![], kinds: vec![] });
+        let star = shapes::star(Point::new(0.0, 0.0), 20.0, 10.0, 5, 0.0);
+        let path = LiveShape::Path { base: star, radii: vec![2.0; 10], kinds: vec![] };
+        let json = serde_json::to_value(&path).unwrap();
+        assert_eq!((json["shape"].as_str(), json.get("kinds")), (Some("path"), None));
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), path);
+        assert_eq!(path.label(), "Path");
+    }
+
+    /// A node holding a live rectangle (`w` × `h`, all radii `r`, placed by `xf`) and its path.
+    fn live_rect(w: f64, h: f64, r: f64, xf: Affine) -> Node {
+        let live = LiveShape::Rectangle { w, h, radii: [r; 4], kinds: Default::default(), xf };
+        let mut n = Node::path(NodeId(1), live.to_path(), Appearance::default_art());
+        if let NodeKind::Path { live: slot, .. } = &mut n.kind {
+            *slot = Some(live);
+        }
+        n
+    }
+
+    fn live_of(n: &Node) -> (f64, f64, [f64; 4], Affine) {
+        let NodeKind::Path { live: Some(LiveShape::Rectangle { w, h, radii, xf, .. }), .. } = &n.kind else { panic!("not a live rectangle") };
+        (*w, *h, *radii, *xf)
+    }
+
+    fn near(a: f64, b: f64) -> bool {
+        (a - b).abs() < 1e-9
+    }
+
+    fn near_xf(a: Affine, b: Affine) -> bool {
+        a.as_coeffs().iter().zip(b.as_coeffs()).all(|(x, y)| near(*x, y))
+    }
+
+    /// Size and radius of a live rectangle, within rounding.
+    fn assert_live(n: &Node, w: f64, h: f64, r: f64) {
+        let (lw, lh, radii, _) = live_of(n);
+        assert!(near(lw, w) && near(lh, h) && radii.iter().all(|x| near(*x, r)), "{lw} × {lh} r {radii:?}, want {w} × {h} r {r}");
+    }
+
+    /// Each corner arc of a rounded rectangle's path, mapped by `back` (to undo a rotation),
+    /// spans `r` along x and y: the corner is a circular arc of radius `r`.
+    fn assert_round_corners(n: &Node, back: Affine, r: f64) {
+        let NodeKind::Path { path, .. } = &n.kind else { panic!("not a path") };
+        let a: Vec<Point> = path.subpaths[0].anchors.iter().map(|a| back * a.p).collect();
+        assert_eq!(a.len(), 8, "a rounded rectangle");
+        // Anchors 1→2, 3→4, 5→6 and 7→0 are the arcs.
+        for (i, j) in [(1, 2), (3, 4), (5, 6), (7, 0)] {
+            let (x, y) = ((a[j].x - a[i].x).abs(), (a[j].y - a[i].y).abs());
+            assert!(near(x, r) && near(y, r), "corner spans {x} × {y}, want {r} × {r}");
+        }
+    }
+
+    const KEEP_CORNERS: Scaling = Scaling { strokes: false, effects: None, keep_type_strokes: false, keep_corners: true, patterns: false };
+
+    #[test]
+    fn uneven_scales_keep_live_corners_circular() {
+        // A 100 pt rounded square at (10, 10) stretched to 300 × 100 (#291).
+        let mut n = live_rect(100.0, 100.0, 20.0, Affine::translate((10.0, 10.0)));
+        let stretch = Affine::translate((10.0, 10.0)) * Affine::scale_non_uniform(3.0, 1.0) * Affine::translate((-10.0, -10.0));
+        n.transform(stretch, KEEP_CORNERS);
+        assert_live(&n, 300.0, 100.0, 20.0);
+        assert!(near_xf(live_of(&n).3, Affine::translate((10.0, 10.0))), "the scale went into the size");
+        let b = n.geometric_bounds().unwrap();
+        assert!(near(b.x0, 10.0) && near(b.y0, 10.0) && near(b.x1, 310.0) && near(b.y1, 110.0), "{b:?}");
+        assert_round_corners(&n, Affine::IDENTITY, 20.0);
+        // Scale Corners on: the radius scales by the mean scale, still circular.
+        let mut n = live_rect(100.0, 100.0, 20.0, Affine::IDENTITY);
+        n.transform(Affine::scale_non_uniform(4.0, 1.0), Scaling::default());
+        assert_live(&n, 400.0, 100.0, 40.0);
+        assert_round_corners(&n, Affine::IDENTITY, 40.0);
+        // Squashed below the radius, the short sides are fully round; stretched back, it returns.
+        n.transform(Affine::scale_non_uniform(1.0, 0.5), KEEP_CORNERS);
+        assert_round_corners(&n, Affine::IDENTITY, 25.0);
+        n.transform(Affine::scale_non_uniform(1.0, 2.0), KEEP_CORNERS);
+        assert_round_corners(&n, Affine::IDENTITY, 40.0);
+    }
+
+    #[test]
+    fn rotated_and_reflected_live_rectangles_scale_along_their_own_sides() {
+        let place = Affine::translate((200.0, 100.0)) * Affine::rotate(30f64.to_radians());
+        let mut n = live_rect(100.0, 50.0, 10.0, place);
+        // Stretched along its own width, as a bounding-box drag of a rotated shape does.
+        n.transform(place * Affine::scale_non_uniform(2.0, 1.0) * place.inverse(), KEEP_CORNERS);
+        assert_live(&n, 200.0, 50.0, 10.0);
+        assert!(near_xf(live_of(&n).3, place));
+        assert_round_corners(&n, place.inverse(), 10.0);
+        // A reflection stays in `xf`; the corners stay as they were.
+        n.transform(Affine::scale_non_uniform(-1.0, 1.0), KEEP_CORNERS);
+        assert_live(&n, 200.0, 50.0, 10.0);
+        let xf = live_of(&n).3;
+        assert!(near(xf.determinant(), -1.0));
+        assert_round_corners(&n, xf.inverse(), 10.0);
+    }
+
+    #[test]
+    fn shears_and_moves_keep_the_old_transform() {
+        // Scaling a rotated rectangle along the page axes shears it: `xf` takes it all, as before.
+        let rot = Affine::rotate(30f64.to_radians());
+        let mut n = live_rect(100.0, 50.0, 10.0, rot);
+        let before = n.clone();
+        let a = Affine::scale_non_uniform(2.0, 1.0);
+        n.transform(a, Scaling::default());
+        assert_eq!(live_of(&n), (100.0, 50.0, [10.0; 4], a * rot));
+        let (NodeKind::Path { path, .. }, NodeKind::Path { path: old, .. }) = (&n.kind, &before.kind) else { panic!() };
+        assert_eq!(*path, old.transformed(a));
+        // A file saved with an uneven scale in `xf` keeps its exact geometry when moved...
+        let legacy = Affine::translate((5.0, 5.0)) * Affine::scale_non_uniform(2.0, 1.0);
+        let mut n = live_rect(100.0, 100.0, 20.0, legacy);
+        n.transform(Affine::translate((10.0, 0.0)), KEEP_CORNERS);
+        assert_eq!(live_of(&n), (100.0, 100.0, [20.0; 4], Affine::translate((10.0, 0.0)) * legacy));
+        // ...and once scaled, has document units and circular corners of its mean radius.
+        n.transform(Affine::scale(2.0), Scaling::default());
+        assert_live(&n, 400.0, 200.0, 20.0 * 2f64.sqrt() * 2.0);
+        assert!(near(live_of(&n).3.determinant(), 1.0));
+        assert_round_corners(&n, Affine::IDENTITY, 20.0 * 2f64.sqrt() * 2.0);
+    }
+
+    /// A rectangle saved with an uneven scale in `xf` (before #291) has elliptical corners; Live
+    /// Corners see and edit it in document units, with circular corners (#442).
+    #[test]
+    fn a_scale_left_in_the_transform_folds_into_the_size() {
+        let legacy = Affine::translate((5.0, 5.0)) * Affine::scale_non_uniform(4.0, 1.0);
+        let n = live_rect(50.0, 80.0, 20.0, legacy);
+        let NodeKind::Path { live: Some(live), .. } = &n.kind else { panic!("not live") };
+        let folded = live.folded();
+        assert_eq!(live_of(&n).3, legacy, "folded() leaves the shape alone");
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = &folded else { panic!("not a rectangle") };
+        // Drawn 200 × 80 with 80 × 20 corners; folded, the corners are circles of the mean radius.
+        assert!(near(*w, 200.0) && near(*h, 80.0) && radii.iter().all(|r| near(*r, 40.0)), "{w} × {h} r {radii:?}");
+        assert!(near_xf(*xf, Affine::translate((5.0, 5.0))));
+        let (a, b) = (folded.to_path().bounds().unwrap(), live.to_path().bounds().unwrap());
+        assert!(near(a.x0, b.x0) && near(a.y0, b.y0) && near(a.x1, b.x1) && near(a.y1, b.y1), "same place and size: {a:?} {b:?}");
+        let corners = crate::LiveCorners::of(&n).unwrap();
+        assert_eq!(corners.style(&corners.all()).0, Some(40.0), "the radius in document units");
+        // Nothing to fold: a moved, rotated or reflected rectangle and a sheared one stay as they are.
+        let place = Affine::translate((5.0, 5.0)) * Affine::rotate(0.5) * Affine::scale_non_uniform(-1.0, 1.0);
+        let shear = Affine::new([1.0, 0.0, 0.5, 1.0, 0.0, 0.0]);
+        for xf in [place, shear] {
+            let mut l = live_rect(100.0, 160.0, 20.0, xf);
+            let NodeKind::Path { live: Some(live), .. } = &mut l.kind else { panic!("not live") };
+            assert!(!live.fold_scale());
+            assert_eq!(live_of(&l), (100.0, 160.0, [20.0; 4], xf));
+        }
+    }
+
     #[test]
     fn default_transparency() {
         let p = || Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());

crates/doc/src/placed_document.rs

@@ -0,0 +1,684 @@
+//! Placed documents: another VectorCraft file placed linked ([`PlacedDocument`]).
+//!
+//! The object keeps the link to the file and the file's bytes, stored like image data in
+//! [`Document::images`] (with a small preview a save writes instead, as for linked images), so the
+//! document shows correctly without the file. The art it shows is read from those bytes and never
+//! joins the object tree, so editing can't reach it: it is locked by design. Drawing and exporting
+//! expand it like a live object ([`crate::live::expanded`]).
+//!
+//! The file is read by the native format's loader, which lives above this crate and registers
+//! itself ([`set_loader`]); the art read is kept in a small cache by content. Before exporting,
+//! every exporter calls [`Document::with_placed_art`], which adds the resources the art uses
+//! (images, symbols, patterns) under names of their own ([`RESOURCE_PREFIX`]) to a temporary copy
+//! of the document, so they never meet the user's or show in panels. Placed documents inside a
+//! placed document are read the same way, up to [`MAX_DEPTH`] deep (documents that place each
+//! other stop there, showing their previews).
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+use std::sync::{Arc, Mutex, MutexGuard, OnceLock, PoisonError};
+
+use serde::{Deserialize, Serialize};
+use vectorcraft_geom::{Affine, Rect};
+
+use vectorcraft_color::Paint;
+
+use crate::{AppearanceItem, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeKind, PatternDef, PlacementOptions, Symbol};
+
+/// A placed document: an artboard of another VectorCraft file, shown as one locked object.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PlacedDocument {
+    /// The file (its `page` is the artboard shown, 1-based).
+    pub link: LinkInfo,
+    /// Key into [`Document::images`]: the file's bytes (see [`key_for`]).
+    pub key: String,
+    /// The art's bounds rather than the artboard (File › Place's `crop: "bounding"`).
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub bounding: bool,
+    /// The artboard's size (or the art's) at 100% (pt).
+    pub width: f64,
+    pub height: f64,
+    /// Maps the box (0..width, 0..height) into the document.
+    pub xf: Affine,
+    /// Links panel → Placement Options: how the file read again takes this object's place.
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub placement: PlacementOptions,
+}
+
+/// The images key of a file's bytes (`hash`, [`crate::links::hash_bytes`]) placed showing
+/// artboard `page` (`bounding`: its art's bounds): objects showing the same thing share a blob and
+/// its preview.
+pub fn key_for(hash: &str, page: u32, bounding: bool) -> String {
+    format!("{hash}-{page}{}", if bounding { "b" } else { "" })
+}
+
+impl PlacedDocument {
+    /// The artboard shown (1-based).
+    pub fn page(&self) -> u32 {
+        self.link.page.unwrap_or(1)
+    }
+
+    /// The box at 100%.
+    pub fn natural(&self) -> Rect {
+        Rect::new(0.0, 0.0, self.width, self.height)
+    }
+
+    /// The four corners of the box in the document.
+    pub fn corners(&self) -> [vectorcraft_geom::Point; 4] {
+        let r = self.natural();
+        [(r.x0, r.y0), (r.x1, r.y0), (r.x1, r.y1), (r.x0, r.y1)].map(|(x, y)| self.xf * vectorcraft_geom::Point::new(x, y))
+    }
+
+    /// The box in the document (axis-aligned).
+    pub fn bounds(&self) -> Rect {
+        self.xf.transform_rect_bbox(self.natural())
+    }
+
+    /// The transform from the file's coordinates (its artboard or art bounds `frame`) to the
+    /// document; `None` when either size is empty.
+    pub fn art_xf(&self, frame: Rect) -> Option<Affine> {
+        let ok = self.width > 0.0 && self.height > 0.0 && frame.width() > 0.0 && frame.height() > 0.0;
+        ok.then(|| {
+            self.xf * Affine::scale_non_uniform(self.width / frame.width(), self.height / frame.height()) * Affine::translate((-frame.x0, -frame.y0))
+        })
+    }
+
+    /// The art the object shows, as plain objects with `n`'s id: one group, its resources named
+    /// as [`Document::with_placed_art`] adds them (nothing until that has read it).
+    pub fn art(&self, n: &Node) -> Vec<Node> {
+        let prefix = prefix(&self.key);
+        read_cached(self).and_then(|e| self.art_node(n, &e, &prefix)).into_iter().collect()
+    }
+
+    /// Read `e`'s art placed as this object `n` shows it (`n`'s id), its resources renamed with
+    /// `prefix`.
+    fn art_node(&self, n: &Node, e: &ReadDocument, prefix: &str) -> Option<Node> {
+        let m = self.art_xf(e.frame)?;
+        let mut g = (*e.art).clone();
+        rename(&mut g, prefix);
+        g.transform(m, true);
+        each_mut(&mut g, &mut |c| crate::pattern::transform_pattern_paints(c, m));
+        g.id = n.id;
+        Some(g)
+    }
+
+    /// An image object showing preview `bytes` (stored under this object's key) in this object's
+    /// box: what it shows and outputs as when the file can't be read.
+    pub fn preview_image(&self, bytes: &[u8]) -> Option<ImageObject> {
+        let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+        let px = Affine::scale_non_uniform(self.width / w as f64, self.height / h as f64);
+        Some(ImageObject { key: self.key.clone(), width: w, height: h, xf: self.xf * px, link: None, placement: Default::default() })
+    }
+}
+
+/// The names the resources of the art stored under `key` take in a prepared document.
+fn prefix(key: &str) -> String {
+    format!("{RESOURCE_PREFIX}{key}/")
+}
+
+/// `n` and every descendant, opacity-mask art included.
+fn walk_all<'a>(n: &'a Node, f: &mut impl FnMut(&'a Node)) {
+    f(n);
+    if let Some(m) = &n.mask {
+        walk_all(&m.art, f);
+    }
+    for c in n.children().into_iter().flatten() {
+        walk_all(c, f);
+    }
+}
+
+/// The roots of `d`'s art: layers, symbol definitions and pattern swatches.
+fn roots(d: &Document) -> impl Iterator<Item = &Arc<Node>> {
+    d.layers.iter().chain(d.symbols.iter().map(|s| &s.art)).chain(d.patterns.iter().flat_map(|p| &p.art))
+}
+
+fn roots_mut(d: &mut Document) -> impl Iterator<Item = &mut Arc<Node>> {
+    d.layers.iter_mut().chain(d.symbols.iter_mut().map(|s| &mut s.art)).chain(d.patterns.iter_mut().flat_map(|p| &mut p.art))
+}
+
+impl Document {
+    /// Visit every placed document: in the layers, then in symbol definitions and pattern
+    /// swatches, opacity-mask art included.
+    pub fn visit_placed<'a>(&'a self, mut f: impl FnMut(&'a Node, &'a PlacedDocument)) {
+        for root in roots(self) {
+            walk_all(root, &mut |n| {
+                if let NodeKind::PlacedDocument(p) = &n.kind {
+                    f(n, p);
+                }
+            });
+        }
+    }
+
+    /// Does the document hold a placed document anywhere?
+    pub fn has_placed(&self) -> bool {
+        let mut any = false;
+        self.visit_placed(|_, _| any = true);
+        any
+    }
+
+    /// Every placed document (those in the art they show too) replaced by a plain group of that
+    /// art, for apps that don't know them: call it on [`Self::with_placed_art`]'s copy. Only the
+    /// subtrees holding one are copied.
+    pub fn placed_as_groups(&mut self) {
+        fn holds(n: &Node) -> bool {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(c.kind, NodeKind::PlacedDocument(_)));
+            hit
+        }
+        fn update(n: &mut Arc<Node>) {
+            if !holds(n) {
+                return;
+            }
+            if matches!(n.kind, NodeKind::PlacedDocument(_)) {
+                let mut g = crate::live::expanded_group(n, None);
+                g.appearance = n.appearance.clone();
+                *n = Arc::new(g);
+            }
+            // The art shown may hold placed documents too.
+            let n = Arc::make_mut(n);
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c);
+            }
+        }
+        for root in roots_mut(self) {
+            update(root);
+        }
+    }
+
+    /// Placed documents whose key is in `keys` replaced by images of their previews (for output
+    /// when their files can't be read).
+    pub fn placed_as_previews(&mut self, keys: &BTreeSet<String>) {
+        fn update(n: &mut Arc<Node>, keys: &BTreeSet<String>, images: &std::collections::BTreeMap<String, ImageBlob>) {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(&c.kind, NodeKind::PlacedDocument(p) if keys.contains(&p.key)));
+            if !hit {
+                return;
+            }
+            let n = Arc::make_mut(n);
+            if let NodeKind::PlacedDocument(p) = &n.kind
+                && keys.contains(&p.key)
+            {
+                if let Some(im) = images.get(&p.key).and_then(|b| p.preview_image(&b.bytes)) {
+                    n.kind = NodeKind::Image(im);
+                }
+                return;
+            }
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art, keys, images);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c, keys, images);
+            }
+        }
+        let images = self.images.clone();
+        for root in roots_mut(self) {
+            update(root, keys, &images);
+        }
+    }
+}
+
+// ---------- previews and the files' bytes ----------
+
+/// A placed document's preview: this many pixels per point of its box…
+pub const PREVIEW_PX_PER_PT: f64 = 1.0;
+/// …and at most this many on its longer side.
+pub const PREVIEW_MAX: u32 = 1024;
+/// How deep placed documents inside placed documents are read; deeper ones show their previews.
+pub const MAX_DEPTH: usize = 8;
+
+/// Reads `p`'s file again (`None`: not found, or changed since it was read). The engine registers
+/// one with [`set_file_reader`].
+pub type FileReader = fn(&PlacedDocument) -> Option<Vec<u8>>;
+
+static FILE_READER: OnceLock<FileReader> = OnceLock::new();
+
+/// Register how files are read again (the first registration stays).
+pub fn set_file_reader(f: FileReader) {
+    // Already set: the same engine, registered by another session.
+    let _ = FILE_READER.set(f);
+}
+
+/// The most bytes of files read again kept.
+const FULL_BYTES: usize = 512 << 20;
+
+/// Files read again, by key, the most recently read last.
+type FullFiles = Vec<(String, Arc<Vec<u8>>)>;
+
+static FULL: Mutex<FullFiles> = Mutex::new(Vec::new());
+
+fn full() -> MutexGuard<'static, FullFiles> {
+    // Entries are only pushed and removed: a panic while held leaves it whole.
+    FULL.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// The file's bytes when they are at hand: stored (`blob` isn't just the preview) or read again
+/// already. Never reads it.
+pub fn full_bytes_cached(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if !blob.is_proxy() {
+        return Some(blob.bytes.clone());
+    }
+    full().iter().rev().find(|(k, _)| *k == p.key).map(|(_, b)| b.clone())
+}
+
+/// The file's bytes: stored, read again already, or read again now ([`set_file_reader`]). `None`
+/// when only the preview can be had.
+pub fn full_bytes(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if let Some(b) = full_bytes_cached(p, blob) {
+        return Some(b);
+    }
+    let b = Arc::new(FILE_READER.get()?(p)?);
+    let mut c = full();
+    c.push((p.key.clone(), b.clone()));
+    let mut total: usize = c.iter().map(|(_, b)| b.len()).sum();
+    while total > FULL_BYTES && c.len() > 1 {
+        total = total.saturating_sub(c.remove(0).1.len());
+    }
+    Some(b)
+}
+
+/// The size in pixels of image bytes `bytes` (a preview), read from its header.
+pub fn image_size(bytes: &[u8]) -> Option<(u32, u32)> {
+    image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()
+}
+
+// ---------- reading files ----------
+
+/// The prefix of the names the resources of placed documents' art take in a prepared document:
+/// `placed:<key>/<name>`.
+pub const RESOURCE_PREFIX: &str = "placed:";
+
+/// Reads a placed document's file (its bytes) into what it shows: a document holding the
+/// resources (no layers), the art as one group in the file's coordinates, and the frame shown
+/// (the artboard, or the art's bounds). The native format lives above this crate, so the engine
+/// registers one with [`set_loader`].
+pub type Loader = fn(&PlacedDocument, &[u8]) -> Option<(Document, Node, Rect)>;
+
+static LOADER: OnceLock<Loader> = OnceLock::new();
+
+/// Register how files are read (the first registration stays).
+pub fn set_loader(l: Loader) {
+    // Already set: the same loader, registered by another session.
+    let _ = LOADER.set(l);
+}
+
+/// The most files kept read whatever their size.
+const CACHE_SIZE: usize = 64;
+/// Past [`CACHE_SIZE`], the most bytes of files kept read (their own sizes, standing for what
+/// reading them holds).
+const CACHE_BYTES: usize = 256 << 20;
+
+/// A placed document's file read: the art it shows, ready to draw with its own resources.
+pub struct ReadDocument {
+    key: String,
+    /// Read from the preview, not the file.
+    preview: bool,
+    /// The bytes read (what tells a cached read is still the one shown).
+    bytes: Arc<Vec<u8>>,
+    /// The artboard (or art bounds) shown: what the object's box shows.
+    pub frame: Rect,
+    /// The art as one group, in the file's coordinates. Its images, symbols and patterns are
+    /// `doc`'s, under their own names.
+    pub art: Arc<Node>,
+    /// The file's resources and setup (no layers: the art is `art`).
+    pub doc: Arc<Document>,
+}
+
+struct Entry {
+    e: Arc<ReadDocument>,
+    used: u64,
+}
+
+#[derive(Default)]
+struct Cache {
+    entries: std::collections::HashMap<(String, bool), Entry>,
+    clock: u64,
+}
+
+static CACHE: std::sync::LazyLock<Mutex<Cache>> = std::sync::LazyLock::new(Default::default);
+
+fn cache() -> MutexGuard<'static, Cache> {
+    // A panic while the cache was held leaves it whole (entries are only inserted and removed).
+    CACHE.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+impl Cache {
+    /// The read of `key` (its preview's when `preview`; made from `bytes` when given), marked used.
+    fn get(&mut self, key: &str, preview: bool, bytes: Option<&Arc<Vec<u8>>>) -> Option<Arc<ReadDocument>> {
+        self.clock += 1;
+        let clock = self.clock;
+        let e = self.entries.get_mut(&(key.to_string(), preview))?;
+        if bytes.is_some_and(|b| !Arc::ptr_eq(&e.e.bytes, b)) {
+            return None;
+        }
+        e.used = clock;
+        Some(e.e.clone())
+    }
+
+    fn insert(&mut self, e: Arc<ReadDocument>) {
+        self.clock += 1;
+        self.entries.insert((e.key.clone(), e.preview), Entry { e, used: self.clock });
+        // The least recently used go while over both limits.
+        let mut total: usize = self.entries.values().map(|x| x.e.bytes.len()).sum();
+        while self.entries.len() > CACHE_SIZE && total > CACHE_BYTES {
+            let Some(k) = self.entries.iter().min_by_key(|(_, x)| x.used).map(|(k, _)| k.clone()) else { break };
+            if let Some(x) = self.entries.remove(&k) {
+                total = total.saturating_sub(x.e.bytes.len());
+            }
+        }
+    }
+}
+
+/// `p`'s file (`bytes`) read, from the cache when it was read already: what the renderer draws a
+/// placed document from. `None` when it can't be read (or no loader is registered).
+pub fn read(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, false, Some(bytes)) {
+        return Some(e);
+    }
+    let loader = LOADER.get()?;
+    let (doc, art, frame) = loader(p, bytes)?;
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s preview (`bytes`) read as art: one image filling the box.
+fn read_preview(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, true, Some(bytes)) {
+        return Some(e);
+    }
+    let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+    let frame = p.natural();
+    let mut doc = Document::new(frame.width().max(1.0), frame.height().max(1.0));
+    doc.layers.clear();
+    doc.swatches.clear();
+    let mime = if bytes.starts_with(&[0xff, 0xd8]) { "image/jpeg" } else { "image/png" };
+    doc.images.insert("preview".into(), ImageBlob { mime: mime.into(), bytes: bytes.clone(), proxy: None });
+    let xf = Affine::scale_non_uniform(frame.width() / w as f64, frame.height() / h as f64);
+    let im = ImageObject { key: "preview".into(), width: w, height: h, xf, link: None, placement: Default::default() };
+    let art = Node::new(art_id(), NodeKind::Group { children: vec![Arc::new(Node::new(art_id(), NodeKind::Image(im)))], clip: false });
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: true, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s file as read already (else its preview's), without reading it.
+pub fn read_cached(p: &PlacedDocument) -> Option<Arc<ReadDocument>> {
+    let mut c = cache();
+    c.get(&p.key, false, None).or_else(|| c.get(&p.key, true, None))
+}
+
+/// Keep `read` (what [`Loader`] gives), just read from `bytes` for `p` (when it was placed), so
+/// drawing it doesn't read it again.
+pub fn prime(p: &PlacedDocument, bytes: Arc<Vec<u8>>, (doc, art, frame): (Document, Node, Rect)) {
+    cache().insert(Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes, frame, art: Arc::new(art), doc: Arc::new(doc) }));
+}
+
+/// The id the read art's own nodes take (their object's, once expanded).
+fn art_id() -> crate::NodeId {
+    crate::NodeId(0)
+}
+
+/// Visit `n` and every descendant (opacity-mask art included) mutably.
+fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
+    f(n);
+    if let Some(m) = &mut n.mask {
+        each_mut(Arc::make_mut(&mut m.art), f);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        each_mut(Arc::make_mut(c), f);
+    }
+}
+
+/// `n`'s references to images, symbols, patterns and placed files prefixed with `prefix`. Colours
+/// keep their swatch links (a spot colour stays a plate, one with the parent's spot of that name).
+fn rename(n: &mut Node, prefix: &str) {
+    let paint = |p: &mut Paint| {
+        if let Paint::Pattern { pattern, .. } = p {
+            *pattern = format!("{prefix}{pattern}");
+        }
+    };
+    each_mut(n, &mut |n| {
+        for it in &mut n.appearance.items {
+            match it {
+                AppearanceItem::Fill(f) => paint(&mut f.paint),
+                AppearanceItem::Stroke(s) => paint(&mut s.paint),
+            }
+        }
+        match &mut n.kind {
+            NodeKind::Text(t) => {
+                for r in &mut t.runs {
+                    paint(&mut r.style.fill);
+                    paint(&mut r.style.stroke);
+                }
+            }
+            NodeKind::Image(im) => im.key = format!("{prefix}{}", im.key),
+            NodeKind::PlacedDocument(p) => p.key = format!("{prefix}{}", p.key),
+            NodeKind::SymbolInstance { symbol, .. } => *symbol = format!("{prefix}{symbol}"),
+            _ => {}
+        }
+    });
+}
+
+impl Document {
+    /// This document ready to export its placed documents: their files read (the file read again
+    /// when only the preview is stored, else the preview), and the resources their art uses added
+    /// under names of their own ([`RESOURCE_PREFIX`]); the same for the placed documents in that
+    /// art, up to [`MAX_DEPTH`] deep. Borrowed when there is none. (The renderer draws them from
+    /// [`read`] instead.)
+    pub fn with_placed_art(&self) -> Cow<'_, Document> {
+        let mut queue: Vec<(PlacedDocument, usize)> = vec![];
+        let mut seen = BTreeSet::new();
+        self.visit_placed(|_, p| {
+            if seen.insert(p.key.clone()) {
+                queue.push((p.clone(), 0));
+            }
+        });
+        if queue.is_empty() {
+            return Cow::Borrowed(self);
+        }
+        let mut d = self.clone();
+        let mut found: Vec<Arc<ReadDocument>> = vec![];
+        while let Some((p, depth)) = queue.pop() {
+            let Some(blob) = d.images.get(&p.key).cloned() else { continue };
+            let full = if depth < MAX_DEPTH { full_bytes(&p, &blob) } else { None };
+            if full.and_then(|b| read(&p, &b)).is_none() {
+                let preview = if blob.is_proxy() { Some(blob.bytes.clone()) } else { blob.proxy.clone() };
+                if let Some(bytes) = preview {
+                    read_preview(&p, &bytes);
+                }
+            }
+            // What the art (`PlacedDocument::art`) will show.
+            let Some(e) = read_cached(&p) else { continue };
+            let prefix = prefix(&p.key);
+            add_resources(&mut d, &e.doc, &prefix);
+            // The placed documents in that art, under their names here.
+            let inner = std::iter::once(&e.art).chain(e.doc.symbols.iter().map(|s| &s.art)).chain(e.doc.patterns.iter().flat_map(|p| &p.art));
+            for root in inner {
+                walk_all(root, &mut |n| {
+                    if let NodeKind::PlacedDocument(q) = &n.kind {
+                        let key = format!("{prefix}{}", q.key);
+                        if seen.insert(key.clone()) {
+                            queue.push((PlacedDocument { key, ..(**q).clone() }, depth + 1));
+                        }
+                    }
+                });
+            }
+            found.push(e);
+        }
+        // Read last, so all stay read while the art is made (see `PlacedDocument::art`).
+        {
+            let mut c = cache();
+            for e in &found {
+                c.get(&e.key, e.preview, None);
+            }
+        }
+        Cow::Owned(d)
+    }
+
+    /// Drop the resources [`Self::with_placed_art`] added under its names (what a save leaves out).
+    pub fn drop_placed_resources(&mut self) {
+        self.symbols.retain(|s| !s.name.starts_with(RESOURCE_PREFIX));
+        self.patterns.retain(|p| !p.name.starts_with(RESOURCE_PREFIX));
+        self.images.retain(|k, _| !k.starts_with(RESOURCE_PREFIX));
+    }
+}
+
+/// The resources of `src` (a read file's) added to `d` under `prefix`: symbols, patterns, images;
+/// swatches by name, when `d` has none of that name.
+fn add_resources(d: &mut Document, src: &Document, prefix: &str) {
+    for s in &src.symbols {
+        let name = format!("{prefix}{}", s.name);
+        if !d.symbols.iter().any(|x| x.name == name) {
+            let mut s = s.clone();
+            rename(Arc::make_mut(&mut s.art), prefix);
+            d.symbols.push(Symbol { name, ..s });
+        }
+    }
+    for p in &src.patterns {
+        let name = format!("{prefix}{}", p.name);
+        if d.pattern(&name).is_none() {
+            let mut p = p.clone();
+            p.art.iter_mut().for_each(|a| rename(Arc::make_mut(a), prefix));
+            d.patterns.push(PatternDef { name, ..p });
+        }
+    }
+    for (k, b) in &src.images {
+        d.images.entry(format!("{prefix}{k}")).or_insert_with(|| b.clone());
+    }
+    for w in &src.swatches {
+        if d.swatch(&w.name).is_none() {
+            d.swatches.push(w.clone());
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::NodeId;
+
+    fn placed(key: &str) -> PlacedDocument {
+        PlacedDocument {
+            link: LinkInfo::new("/art/logo.vectorcraft"),
+            key: key.into(),
+            bounding: false,
+            width: 80.0,
+            height: 40.0,
+            xf: Affine::translate((10.0, 10.0)),
+            placement: Default::default(),
+        }
+    }
+
+    /// Whatever the bytes: a 40×20 artboard showing a symbol instance and, when the bytes say
+    /// `nest`, a placed document of key `inner`.
+    fn stub_loader(_: &PlacedDocument, bytes: &[u8]) -> Option<(Document, Node, Rect)> {
+        let mut d = Document::new(40.0, 20.0);
+        d.layers.clear();
+        let art = Node::new(
+            NodeId(50),
+            NodeKind::Image(ImageObject { key: "pic".into(), width: 1, height: 1, xf: Affine::IDENTITY, link: None, placement: Default::default() }),
+        );
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(art) });
+        d.images.insert("pic".into(), ImageBlob::new("image/png", vec![1, 2, 3]));
+        let mut children = vec![Arc::new(Node::new(NodeId(51), NodeKind::SymbolInstance { symbol: "Star".into(), xf: Affine::IDENTITY }))];
+        if bytes.starts_with(b"nest") {
+            d.images.insert("inner".into(), ImageBlob::new("application/json", b"leaf".to_vec()));
+            let inner = PlacedDocument { key: "inner".into(), width: 10.0, height: 10.0, xf: Affine::IDENTITY, ..placed("inner") };
+            children.push(Arc::new(Node::new(NodeId(52), NodeKind::PlacedDocument(Box::new(inner)))));
+        }
+        Some((d, Node::new(NodeId(0), NodeKind::Group { children, clip: false }), Rect::new(0.0, 0.0, 40.0, 20.0)))
+    }
+
+    #[test]
+    fn round_trips_through_json() {
+        let n = Node::new(NodeId(3), NodeKind::PlacedDocument(Box::new(placed("doc1-1"))));
+        let v = serde_json::to_value(&n).unwrap();
+        assert_eq!(v["kind"]["type"], "placeddocument");
+        assert_eq!(v["kind"]["link"]["path"], "/art/logo.vectorcraft");
+        let back: Node = serde_json::from_value(v).unwrap();
+        assert_eq!(back, n);
+        assert_eq!(key_for("img00", 2, true), "img00-2b");
+    }
+
+    #[test]
+    fn the_art_and_its_resources_join_only_a_prepared_copy_under_their_own_names() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(Node::new(NodeId(60), NodeKind::Group { children: vec![], clip: false })) });
+        d.images.insert("doc1-1".into(), ImageBlob::new("application/json", b"nest".to_vec()));
+        let p = placed("doc1-1");
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(p.clone())))).unwrap();
+        assert!(d.has_placed());
+        let prepared = d.with_placed_art();
+        let names: Vec<&str> = prepared.symbols.iter().map(|s| s.name.as_str()).collect();
+        // The placed document inside is read too, its resources under its own names.
+        assert_eq!(names, ["Star", "placed:doc1-1/Star", "placed:placed:doc1-1/inner/Star"]);
+        assert!(prepared.images.contains_key("placed:doc1-1/pic"));
+        assert_eq!(d.symbols.len(), 1, "the document itself is unchanged");
+        // The art: a group of the drawing, its resources renamed.
+        let n = d.node(NodeId(7)).unwrap();
+        let art = p.art(n);
+        let [g] = &art[..] else { panic!("{art:?}") };
+        let mut refs = vec![];
+        g.walk(&mut |c| match &c.kind {
+            NodeKind::SymbolInstance { symbol, .. } => refs.push(symbol.clone()),
+            NodeKind::PlacedDocument(q) => {
+                // Its 10×10 box at the file's origin, scaled ×2 into the box at (10, 10).
+                assert_eq!(q.bounds(), Rect::new(10.0, 10.0, 30.0, 30.0));
+                refs.push(q.key.clone())
+            }
+            _ => {}
+        });
+        assert_eq!(refs, ["placed:doc1-1/Star", "placed:doc1-1/inner"]);
+        // For older apps: plain groups all the way down.
+        let mut older = prepared.clone().into_owned();
+        older.placed_as_groups();
+        assert!(!older.has_placed());
+        let mut saved = prepared.into_owned();
+        saved.drop_placed_resources();
+        assert_eq!((saved.symbols.len(), saved.images.len()), (1, 1));
+    }
+
+    #[test]
+    fn more_files_than_the_cache_holds_all_draw() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        let layer = d.layers[0].id;
+        let n = CACHE_SIZE + 10;
+        for i in 0..n {
+            let key = format!("many{i}-1");
+            d.images.insert(key.clone(), ImageBlob::new("application/json", format!("doc {i}").into_bytes()));
+            d.insert(Some(layer), i, Node::new(NodeId(100 + i as u64), NodeKind::PlacedDocument(Box::new(placed(&key))))).unwrap();
+        }
+        let _prepared = d.with_placed_art();
+        let mut empty = 0;
+        d.visit_placed(|n, p| empty += usize::from(p.art(n).is_empty()));
+        assert_eq!(empty, 0, "every file of the document is kept read");
+    }
+
+    #[test]
+    fn a_file_that_cant_be_read_shows_its_preview() {
+        set_loader(stub_loader);
+        let mut png = vec![];
+        image::RgbaImage::from_pixel(8, 4, image::Rgba([0, 200, 0, 255]))
+            .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+            .unwrap();
+        let mut blob = ImageBlob::new("image/png", png);
+        blob.proxy = Some(blob.bytes.clone());
+        let mut d = Document::new(200.0, 200.0);
+        d.images.insert("gone-1".into(), blob);
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(placed("gone-1"))))).unwrap();
+        // No file reader: only the preview can be had.
+        let prepared = d.with_placed_art();
+        assert!(prepared.images.contains_key("placed:gone-1/preview"));
+        let n = d.node(NodeId(7)).unwrap();
+        let NodeKind::PlacedDocument(p) = &n.kind else { panic!("not a placed document") };
+        let art = p.art(n);
+        assert_eq!(art.first().and_then(Node::geometric_bounds), Some(Rect::new(10.0, 10.0, 90.0, 50.0)));
+    }
+}

crates/doc/src/selection.rs

@@ -1,4 +1,4 @@
-//! Selection state (objects and, for direct selection, individual anchors).
+//! Selection state (objects and, for direct selection, individual anchors; ruler guides).
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -29,12 +29,20 @@ pub struct Selection {
     /// clears them.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub slices: Vec<NodeId>,
+    /// Ruler guides selected with a selection tool, as indexes into [`Document::guides`]. They are
+    /// selected on their own: any change to the object selection clears them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub guides: Vec<usize>,
 }
 
 impl Selection {
     pub fn is_empty(&self) -> bool {
         self.objects.is_empty()
     }
+    /// Is anything selected that Delete and the arrow keys act on: objects or ruler guides?
+    pub fn has_objects_or_guides(&self) -> bool {
+        !self.objects.is_empty() || !self.guides.is_empty()
+    }
     pub fn len(&self) -> usize {
         self.objects.len()
     }
@@ -47,6 +55,7 @@ impl Selection {
         self.key = None;
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
     }
     pub fn set(&mut self, ids: impl IntoIterator<Item = NodeId>) {
         self.clear();
@@ -57,6 +66,7 @@ impl Selection {
     pub fn add(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         if !self.objects.contains(&id) {
             self.objects.push(id);
         }
@@ -64,6 +74,7 @@ impl Selection {
     pub fn remove(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         self.objects.retain(|x| *x != id);
         self.anchors.remove(&id);
         if self.key == Some(id) {
@@ -79,6 +90,15 @@ impl Selection {
             }
         }
     }
+    /// Select ruler guides `indexes` (see [`Selection::guides`]) and nothing else.
+    pub fn set_guides(&mut self, indexes: impl IntoIterator<Item = usize>) {
+        self.clear();
+        for i in indexes {
+            if !self.guides.contains(&i) {
+                self.guides.push(i);
+            }
+        }
+    }
     pub fn toggle(&mut self, id: NodeId) {
         if self.contains(id) { self.remove(id) } else { self.add(id) }
     }
@@ -97,12 +117,13 @@ impl Selection {
             self.target = None;
         }
         self.slices.retain(|id| doc.is_slice(*id));
+        self.guides.retain(|i| *i < doc.guides.len());
     }
-    /// Target `id` (see [`Selection::target`]): a layer gets its visible, unlocked art selected,
-    /// anything else is selected itself.
+    /// Target `id` (see [`Selection::target`]): a layer gets its visible, unlocked art selected
+    /// (the art of its sublayers too), anything else is selected itself.
     pub fn set_target(&mut self, doc: &Document, id: NodeId) {
         match doc.node(id) {
-            Some(n) if n.is_layer() => self.set(n.children().into_iter().flatten().filter(|c| c.visible && !c.locked).map(|c| c.id)),
+            Some(n) if n.is_layer() => self.set(n.layer_art(true)),
             _ => self.set([id]),
         }
         self.target = Some(id);
@@ -138,6 +159,23 @@ mod tests {
         assert!(s.is_empty());
     }
 
+    #[test]
+    fn guides_are_selected_on_their_own() {
+        let mut s = Selection::default();
+        s.add(NodeId(1));
+        s.set_guides([2, 0, 2]);
+        assert_eq!((s.objects.clone(), s.guides.clone()), (vec![], vec![2, 0]));
+        assert!(s.has_objects_or_guides() && s.is_empty());
+        s.add(NodeId(1));
+        assert!(s.guides.is_empty());
+        // Pruning drops guides the document no longer has.
+        let mut d = Document::new(100.0, 100.0);
+        d.guides.push(crate::Guide::new(true, 10.0));
+        s.set_guides([0, 1]);
+        s.prune(&d);
+        assert_eq!(s.guides, vec![0]);
+    }
+
     #[test]
     fn selection_changes_clear_the_target() {
         let mut s = Selection::default();

crates/doc/src/shaper.rs

@@ -0,0 +1,41 @@
+//! Persistent Shaper edits over retained source paths. Source indices (not document ids) keep
+//! recipes valid when a group is copied. Selector anchors use source-relative bounding boxes,
+//! so the intended face or stroke follows source art when it moves or resizes.
+use crate::Appearance;
+use serde::{Deserialize, Serialize};
+use vectorcraft_geom::Point;
+
+pub const SOURCES: &str = "Shaper Sources";
+pub const FILL_PREFIX: &str = "Shaper Fill ";
+pub const STROKE_PREFIX: &str = "Shaper Stroke ";
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ShaperSpec {
+    pub faces: Vec<FaceEdit>,
+    pub edges: Vec<EdgeEdit>,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct FaceSelector {
+    pub sources: Vec<usize>,
+    pub anchor: Point,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct FaceEdit {
+    pub selector: FaceSelector,
+    pub erase: bool,
+    pub erase_edges: bool,
+    pub paint_source: Option<usize>,
+    pub merge: Option<u64>,
+    pub paint: Option<Appearance>,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct EdgeEdit {
+    pub source: usize,
+    pub sides: [Vec<usize>; 2],
+    pub anchor: Point,
+    pub erase: bool,
+    pub paint: Option<Appearance>,
+}

crates/doc/src/tests_units.rs

@@ -60,6 +60,9 @@ fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");
     assert_eq!(Unit::Millimeters.readout(72.0), "25.40 mm");
     assert_eq!(Unit::Inches.readout(-36.0), "-0.50 in");
-    assert_eq!(Unit::Millimeters.number(1.0), "0.353");
-    assert_eq!(Unit::Points.number(-0.0001), "0");
+    assert_eq!(Unit::Millimeters.number(1.0), "0.3528");
+    // Four decimals for the large units, three for the small ones.
+    assert_eq!(Unit::Inches.number(0.5616), "0.0078");
+    assert_eq!((Unit::Inches.number(595.2756), Unit::Points.number(595.2756)), ("8.2677".into(), "595.276".into()));
+    assert_eq!(Unit::Points.number(-0.00001), "0");
 }