Test: the idle place test waits for the link scan in real time

tests_place::a_file_placed_while_idle_follows_its_changes failed at random in CI (twice on 2026-10-11): while the link scan ran on its worker thread, the test's clock moved on by whole simulated seconds per 5 ms of real time, so on a busy machine the 10 simulated seconds ran out before the scan had read the changed file. The clock now waits for the scan (up to 20 real seconds).
Merge pull request #1213 from storytold/fix/1197-compound-holes
2026-10-11 22:02:50 +07:00 · 2026-10-11 22:02:36 +07:00 · 2026-10-11 21:32:23 +07:00 · 2026-10-11 20:57:47 +07:00 · 2026-10-11 20:47:46 +07:00 · 2026-10-11 20:07:03 +07:00
47 changed files with 1121 additions and 118 deletions
@@ -35,7 +35,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - name: Build and test in a FreeBSD VM
        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
@@ -68,12 +68,12 @@ jobs:
    timeout-minutes: 150
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
      # Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - name: Package in a FreeBSD VM
        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
@@ -72,12 +72,12 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -131,12 +131,12 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -192,12 +192,12 @@ jobs:
      NFPM_VERSION: 2.47.0
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - name: Install build and packaging tools
        run: |
@@ -293,12 +293,12 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
      # Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - uses: dtolnay/rust-toolchain@stable
        if: inputs.version != ''
@@ -345,12 +345,12 @@ jobs:
      TRUNK_VERSION: 0.21.14
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -391,12 +391,12 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
      - uses: actions/checkout@v7
-      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
          path: craft-fonts
      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -1860,11 +1860,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
 "displaydoc",
 "litemap",
+ "serde",
 "tinystr",
 "writeable",
 "zerovec",
 ]

+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -1914,6 +1935,8 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
 "displaydoc",
 "icu_locale_core",
+ "serde",
+ "stable_deref_trait",
 "writeable",
 "yoke",
 "zerofrom",
@@ -1921,6 +1944,29 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "icu_segmenter"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
+dependencies = [
+ "core_maths",
+ "icu_collections",
+ "icu_locale_fallback",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "smallvec",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -3152,6 +3198,8 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
 "zerovec",
 ]

@@ -4133,6 +4181,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
 "displaydoc",
+ "serde_core",
 "zerovec",
 ]

@@ -4806,6 +4855,7 @@ name = "vectorcraft-text"
 version = "0.9.0"
 dependencies = [
 "harfrust 0.13.3",
+ "icu_segmenter",
 "kurbo 0.13.1",
 "log",
 "skrifa 0.47.0",
@@ -4813,6 +4863,7 @@ dependencies = [
 "unicode-bidi",
 "unicode-general-category",
 "unicode-script",
+ "unicode-segmentation",
 "vectorcraft-doc",
 "vectorcraft-geom",
 "windows-registry",
@@ -6183,6 +6234,7 @@ dependencies = [
 "displaydoc",
 "yoke",
 "zerofrom",
+ "zerovec",
 ]

 [[package]]
@@ -6191,6 +6243,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
+ "serde",
 "yoke",
 "zerofrom",
 "zerovec-derive",
@@ -127,7 +127,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap

 | Date | What landed |
 |---|---|
-| 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
+| 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
 | 2026-10-10 | Initial live Revolve (Effect › 3D and Materials, #846, #605), in its own `three-d` crate. Progress docs re-measured and restructured to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `ui-parity.md`, the format, hardware, localization, effects and type checklists). Same day: v0.8.0; Effect › Distort, Pixelate and Texture filters (13); German interface; Variables (data merge); Graph Type value axes and tick marks; restart when the first frame never reaches the screen (#964) |
 | 2026-10-09 | Radial Blur, Smart Blur, Unsharp Mask (gap 2 begins); 340 commits, the busiest day |
 | 2026-10-08 | v0.5.0–v0.7.0; community contributions: Pen and shape-tool modifiers, Layers, Artboards, Japanese composition, Hebrew/Arabic type, interface languages, saved selections |
@@ -94,6 +94,15 @@ fn mcp_automation_roots() {
    let svg = r#"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="30"><rect width="20" height="10"/></svg>"#;
    std::fs::write(base.join("in/a.svg"), svg).unwrap();
    std::fs::write(base.join("outside/b.svg"), svg).unwrap();
+    std::fs::write(base.join("outside/victim.png"), b"keep this file").unwrap();
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::symlink;
+        symlink(base.join("outside/b.svg"), base.join("in/escape.svg")).unwrap();
+        symlink(base.join("outside"), base.join("out/escape")).unwrap();
+        symlink(base.join("outside/victim.png"), base.join("out/victim.png")).unwrap();
+        symlink(base.join("outside/missing.png"), base.join("out/dangling.png")).unwrap();
+    }
    let dir = |d: &str| base.join(d).to_string_lossy().into_owned();
    let fails = |args: &[&str], why: &str| {
        let out = Command::new(BIN).args(args).stdin(Stdio::null()).output().unwrap();
@@ -114,15 +123,32 @@ fn mcp_automation_roots() {
        .unwrap();
    let call = |id: u64, name: &str, args: Value| json!({"jsonrpc":"2.0","id":id,"method":"tools/call","params":{"name":name,"arguments":args}});
    let file = |d: &str, f: &str| base.join(d).join(f).to_string_lossy().into_owned();
+    let mut calls = vec![
+        call(1, "open_file", json!({"path": file("in", "a.svg")})),
+        call(2, "open_file", json!({"path": file("outside", "b.svg")})),
+        call(3, "export", json!({"path": file("out", "a.png")})),
+        call(4, "export", json!({"path": file("in", "a.png")})),
+        call(5, "save_file", json!({"path": file("outside", "a.vectorcraft")})),
+        call(6, "open_file", json!({"path": file("in", "../outside/b.svg")})),
+        call(7, "export", json!({"path": file("out", "../outside/traversal.png")})),
+    ];
+    let mut expected_errors = vec![false, true, false, true, true, true, true];
+    #[cfg(unix)]
+    {
+        calls.extend([
+            call(8, "open_file", json!({"path": file("in", "escape.svg")})),
+            call(9, "export", json!({"path": file("out", "escape/escaped.png")})),
+            call(10, "export", json!({"path": file("out", "victim.png")})),
+            call(11, "export", json!({"path": file("out", "dangling.png")})),
+        ]);
+        expected_errors.extend([true; 4]);
+    }
+    // An access error is per request: the server continues and can still save inside its root.
+    calls.push(call(12, "save_file", json!({"path": file("out", "allowed.vectorcraft")})));
+    expected_errors.push(false);
    {
        let mut stdin = child.stdin.take().unwrap();
-        for m in [
-            call(1, "open_file", json!({"path": file("in", "a.svg")})),
-            call(2, "open_file", json!({"path": file("outside", "b.svg")})),
-            call(3, "export", json!({"path": file("out", "a.png")})),
-            call(4, "export", json!({"path": file("in", "a.png")})),
-            call(5, "save_file", json!({"path": file("outside", "a.vectorcraft")})),
-        ] {
+        for m in calls {
            writeln!(stdin, "{m}").unwrap();
        }
    }
@@ -130,9 +156,14 @@ fn mcp_automation_roots() {
    assert!(out.status.success());
    let replies: Vec<Value> = String::from_utf8(out.stdout).unwrap().lines().map(|l| serde_json::from_str(l).unwrap()).collect();
    let errors: Vec<bool> = replies.iter().map(|r| r["result"]["isError"] == true).collect();
-    assert_eq!(errors, [false, true, false, true, true], "{replies:?}");
+    assert_eq!(errors, expected_errors, "{replies:?}");
    assert!(replies[1]["result"]["content"][0]["text"].as_str().unwrap().contains("outside the read root"));
    assert!(base.join("out/a.png").is_file() && !base.join("in/a.png").exists() && !base.join("outside/a.vectorcraft").exists());
+    assert!(base.join("out/allowed.vectorcraft").is_file());
+    for denied in ["traversal.png", "escaped.png", "missing.png"] {
+        assert!(!base.join("outside").join(denied).exists(), "{denied}");
+    }
+    assert_eq!(std::fs::read(base.join("outside/victim.png")).unwrap(), b"keep this file");
 }

 /// End-to-end protocol sweep over stdio against the compiled binary. The in-process
@@ -0,0 +1,90 @@
+//! Parse automation roots before starting any desktop services. A malformed flag must not
+//! silently remove a root and leave the control channel unconfined.
+
+use std::path::PathBuf;
+
+pub struct AutomationArgs {
+    pub read_root: Option<PathBuf>,
+    pub write_root: Option<PathBuf>,
+    read_given: bool,
+    write_given: bool,
+}
+
+impl AutomationArgs {
+    pub fn new(read_root: Option<PathBuf>, write_root: Option<PathBuf>) -> Self {
+        Self { read_root, write_root, read_given: false, write_given: false }
+    }
+
+    /// Returns whether this argument is a root flag. CLI values override environment defaults
+    /// once; a second occurrence is an error, including when the two spellings are mixed.
+    pub fn consume(&mut self, arg: &str, args: &mut impl Iterator<Item = String>) -> Result<bool, String> {
+        let (flag, inline) = arg.split_once('=').map_or((arg, None), |(flag, value)| (flag, Some(value)));
+        let (root, given) = match flag {
+            "--automation-read-root" => (&mut self.read_root, &mut self.read_given),
+            "--automation-write-root" => (&mut self.write_root, &mut self.write_given),
+            _ => return Ok(false),
+        };
+        if *given {
+            return Err(format!("{flag} given twice"));
+        }
+        let value = match inline {
+            Some(value) => value.to_owned(),
+            None => {
+                let value = args.next().ok_or_else(|| format!("{flag} needs a folder"))?;
+                if value.starts_with('-') {
+                    return Err(format!("{flag} needs a folder; use {flag}=<dir> for a folder starting with '-'"));
+                }
+                value
+            }
+        };
+        if value.is_empty() {
+            return Err(format!("{flag} needs a non-empty folder"));
+        }
+        *root = Some(value.into());
+        *given = true;
+        Ok(true)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn roots_override_environment_once_and_leave_other_arguments() {
+        let mut roots = AutomationArgs::new(Some("environment".into()), None);
+        let mut args = ["a folder".to_owned(), "drawing.svg".to_owned()].into_iter();
+        assert!(roots.consume("--automation-read-root", &mut args).unwrap());
+        assert!(roots.consume("--automation-write-root=out", &mut args).unwrap());
+        assert!(!roots.consume("--in-window-menus", &mut args).unwrap());
+        assert_eq!(roots.read_root, Some("a folder".into()));
+        assert_eq!(roots.write_root, Some("out".into()));
+        assert_eq!(args.next().as_deref(), Some("drawing.svg"));
+        assert!(roots.consume("--automation-read-root=other", &mut args).is_err());
+        assert_eq!(roots.read_root, Some("a folder".into()));
+    }
+
+    #[test]
+    fn invalid_operands_preserve_environment_roots() {
+        for flag in ["--automation-read-root", "--automation-write-root"] {
+            for operand in [None, Some(""), Some("--version"), Some("--control"), Some("-folder")] {
+                let mut roots = AutomationArgs::new(Some("read".into()), Some("write".into()));
+                let mut args = operand.map(str::to_owned).into_iter();
+                assert!(roots.consume(flag, &mut args).is_err(), "{flag} {operand:?}");
+                assert_eq!(roots.read_root, Some("read".into()));
+                assert_eq!(roots.write_root, Some("write".into()));
+            }
+            let mut roots = AutomationArgs::new(None, None);
+            assert!(roots.consume(&format!("{flag}="), &mut std::iter::empty()).is_err());
+        }
+    }
+
+    #[test]
+    fn explicit_dash_folder_and_relative_dash_folder_are_valid() {
+        let mut roots = AutomationArgs::new(None, None);
+        assert!(roots.consume("--automation-read-root=-folder", &mut std::iter::empty()).unwrap());
+        assert!(roots.consume("--automation-write-root", &mut ["./-folder".to_owned()].into_iter()).unwrap());
+        assert_eq!(roots.read_root, Some("-folder".into()));
+        assert_eq!(roots.write_root, Some("./-folder".into()));
+    }
+}
@@ -21,6 +21,7 @@ compile_error!("windows7 requires --target x86_64-win7-windows-msvc; the ordinar
 #[cfg(all(target_vendor = "win7", not(feature = "windows7")))]
 compile_error!("the win7 target requires --no-default-features --features windows7");

+mod automation_args;
 mod clipboard;
 mod control_server;
 #[cfg(feature = "wgpu")]
@@ -586,7 +587,36 @@ fn native_options(custom_titlebar: bool) -> eframe::NativeOptions {
 }

 fn main() -> std::process::ExitCode {
-    // First, so every start-up warning is recorded (`logging`).
+    // Validate roots before logging, font scans, preferences or the window: a missing value
+    // must not clear an environment root and start the control channel without confinement.
+    let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
+    let root_env = |name: &str| std::env::var_os(name).filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
+    let mut roots_args =
+        automation_args::AutomationArgs::new(root_env("VECTORCRAFT_AUTOMATION_READ_ROOT"), root_env("VECTORCRAFT_AUTOMATION_WRITE_ROOT"));
+    let mut files = Vec::new();
+    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
+    let mut args = std::env::args().skip(1);
+    while let Some(a) = args.next() {
+        match roots_args.consume(&a, &mut args) {
+            Ok(true) => continue,
+            Ok(false) => {}
+            Err(e) => {
+                eprintln!("vectorcraft: {e}");
+                return std::process::ExitCode::FAILURE;
+            }
+        }
+        match a.as_str() {
+            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
+            "--in-window-menus" => in_window_menus = true,
+            "--version" => {
+                println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
+                return std::process::ExitCode::SUCCESS;
+            }
+            _ => files.push(a),
+        }
+    }
+    let automation_args::AutomationArgs { read_root, write_root, .. } = roots_args;
+    // Before desktop services, so every start-up warning is recorded (`logging`).
    let logger = logging::install();
    vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
    // Before the first font scan (the app's start): the fonts font services load (#579).
@@ -596,28 +626,6 @@ fn main() -> std::process::ExitCode {
    mac_fonts::install();
    // VectorCraft's own Fonts folder, which text.addFontFiles copies fonts into.
    prefs_dir::install_fonts();
-    let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
-    let root_env = |name: &str| std::env::var_os(name).filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
-    let mut read_root = root_env("VECTORCRAFT_AUTOMATION_READ_ROOT");
-    let mut write_root = root_env("VECTORCRAFT_AUTOMATION_WRITE_ROOT");
-    let mut files = Vec::new();
-    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match a.as_str() {
-            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
-            "--automation-read-root" => read_root = args.next().map(std::path::PathBuf::from),
-            "--automation-write-root" => write_root = args.next().map(std::path::PathBuf::from),
-            _ if a.starts_with("--automation-read-root=") => read_root = a.split_once('=').map(|(_, d)| d.into()),
-            _ if a.starts_with("--automation-write-root=") => write_root = a.split_once('=').map(|(_, d)| d.into()),
-            "--in-window-menus" => in_window_menus = true,
-            "--version" => {
-                println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
-                return std::process::ExitCode::SUCCESS;
-            }
-            _ => files.push(a),
-        }
-    }
    // The log file lives in the settings directory, next to the preferences; opened after the
    // arguments, so `--version` leaves no file behind. Records logged until now are written to it
    // first. Runs without preferences (agents' test runs) log to standard error only, so they
@@ -0,0 +1,70 @@
+// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+const BIN: &str = env!("CARGO_BIN_EXE_vectorcraft");
+
+/// Invalid roots must exit before desktop initialization on every platform, including a CI
+/// machine with no display. A regression must fail rather than hang with a window open.
+fn rejects(args: &[&str], message: &str) {
+    let mut child = Command::new(BIN)
+        .args(args)
+        .env_remove("VECTORCRAFT_CONTROL_PORT")
+        .env_remove("VECTORCRAFT_AUTOMATION_READ_ROOT")
+        .env_remove("VECTORCRAFT_AUTOMATION_WRITE_ROOT")
+        .env("VECTORCRAFT_NO_PREFS", "1")
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_secs(5);
+    let timed_out = loop {
+        if child.try_wait().unwrap().is_some() {
+            break false;
+        }
+        if Instant::now() >= deadline {
+            child.kill().unwrap();
+            break true;
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    };
+    let out = child.wait_with_output().unwrap();
+    assert!(!timed_out, "{args:?}: desktop started or did not exit promptly");
+    assert!(!out.status.success(), "{args:?}");
+    assert!(out.stdout.is_empty(), "{args:?}: {:?}", out.stdout);
+    // Exact stderr excludes unrelated startup warnings or display errors that could otherwise
+    // make a malformed invocation fail for an unrelated reason.
+    assert_eq!(String::from_utf8(out.stderr).unwrap(), format!("vectorcraft: {message}\n"), "{args:?}");
+}
+
+#[test]
+fn missing_empty_or_option_operands_fail_before_startup() {
+    for flag in ["--automation-read-root", "--automation-write-root"] {
+        rejects(&["--control", "7979", flag], &format!("{flag} needs a folder"));
+        rejects(&[flag], &format!("{flag} needs a folder"));
+        rejects(&["--control", "7979", &format!("{flag}=")], &format!("{flag} needs a non-empty folder"));
+        rejects(&[flag, ""], &format!("{flag} needs a non-empty folder"));
+        for next in ["--version", "--control", "--automation-write-root", "-folder"] {
+            rejects(&[flag, next], &format!("{flag} needs a folder; use {flag}=<dir> for a folder starting with '-'"));
+        }
+    }
+}
+
+#[test]
+fn duplicate_roots_fail_for_both_spellings() {
+    for flag in ["--automation-read-root", "--automation-write-root"] {
+        rejects(&[flag, ".", &format!("{flag}=.")], &format!("{flag} given twice"));
+        rejects(&[&format!("{flag}=."), flag, "."], &format!("{flag} given twice"));
+    }
+}
+
+#[test]
+fn explicit_dash_folder_does_not_consume_version() {
+    let out = Command::new(BIN).args(["--automation-read-root=-folder", "--automation-write-root", "./-folder", "--version"]).output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    assert_eq!(String::from_utf8(out.stdout).unwrap(), format!("vectorcraft {}\n", env!("CARGO_PKG_VERSION")));
+    assert!(out.stderr.is_empty());
+}
@@ -39,6 +39,24 @@ pub fn specs() -> Vec<CommandSpec> {
        ),
        cmd!("edit.undo", "Undo", ["Edit"], Some("Cmd+Z"), "{}", can_undo, undo),
        cmd!("edit.redo", "Redo", ["Edit"], Some("Cmd+Shift+Z"), "{}", can_redo, redo),
+        cmd!(
+            "edit.undoGroup.begin",
+            "Begin Undo Group",
+            [],
+            None,
+            "{label?: string} until edit.undoGroup.end, the edits made in the active document are one undo step, named `label` (else after its first edit): for automation, such as MCP command_batch with `atomic` (#1163)",
+            has_doc,
+            undo_group_begin
+        ),
+        cmd!(
+            "edit.undoGroup.end",
+            "End Undo Group",
+            [],
+            None,
+            "{cancel?: bool} close the undo group: its edits stay one undo step or, with `cancel`, are undone",
+            has_doc,
+            undo_group_end
+        ),
        cmd!("edit.cut", "Cut", ["Edit"], Some("Cmd+X"), "{} (the Artboard tool chosen: artboard.cut)", has_selection_or_artboard_tool, cut),
        cmd!("edit.copy", "Copy", ["Edit"], Some("Cmd+C"), "{} (the Artboard tool chosen: artboard.copy)", has_selection_or_artboard_tool, copy),
        cmd!(
@@ -167,6 +185,22 @@ pub(crate) fn typing_in_progress(s: &Session) -> bool {
    s.active().and_then(|d| d.interaction.as_ref()).is_some_and(|it| it.label == "Typing" && it.preview.is_some())
 }

+fn undo_group_begin(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "edit.undoGroup.begin";
+    let label = match p.get("label") {
+        None | Some(Value::Null) => None,
+        Some(Value::String(l)) if !l.trim().is_empty() && l.chars().count() <= 200 => Some(l.trim().to_string()),
+        Some(_) => return Err(bad(C, "`label` must be a non-empty name of at most 200 characters")),
+    };
+    s.begin_named_undo_group(label);
+    ok()
+}
+
+fn undo_group_end(s: &mut Session, p: &Value) -> Result<Value> {
+    s.end_undo_group(bool_or(p, "cancel", false));
+    ok()
+}
+
 fn undo(s: &mut Session, _: &Value) -> Result<Value> {
    // What is still in progress (typing, a drag) is the step to undo: keep it first, so Undo takes
    // back only that and Redo brings it back, instead of dropping it and undoing the step before.
@@ -87,6 +87,15 @@ pub fn specs() -> Vec<CommandSpec> {
            always,
            load::open
        ),
+        cmd!(
+            query "file.list",
+            "List Folder",
+            [],
+            None,
+            "{path} the files and folders in folder `path`, by name: what an agent may open there (held to the automation read root when one is in force) → {path, entries: [{name, kind: file|folder|link, size? (files, bytes)}], truncated (more than 5000 entries)} (#1163)",
+            always,
+            file_list
+        ),
        cmd!(
            query "document.serialize",
            "Serialize Document",
@@ -783,6 +792,48 @@ pub(crate) fn write_new_file(path: &str, bytes: &[u8]) -> Result<()> {
    })
 }

+/// The most entries `file.list` returns.
+const LIST_MAX: usize = 5000;
+
+fn file_list(_: &mut Session, p: &Value) -> Result<Value> {
+    let path = p.get("path").and_then(Value::as_str).filter(|s| !s.is_empty()).ok_or_else(|| bad("file.list", "missing `path`"))?;
+    let (entries, truncated) = list_dir(path, LIST_MAX)?;
+    Ok(json!({ "path": absolute_path(path), "entries": entries, "truncated": truncated }))
+}
+
+/// The entries of folder `path`, sorted by name: at most `max`, and whether there were more. A
+/// link isn't followed: its target may lie outside the automation roots.
+#[cfg(not(target_arch = "wasm32"))]
+fn list_dir(path: &str, max: usize) -> Result<(Vec<Value>, bool)> {
+    may_read(path)?;
+    let dir = std::fs::read_dir(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let mut entries: Vec<(String, Value)> = vec![];
+    let mut truncated = false;
+    for e in dir.flatten() {
+        if entries.len() == max {
+            truncated = true;
+            break;
+        }
+        let name = e.file_name().to_string_lossy().into_owned();
+        let Ok(t) = e.file_type() else { continue };
+        let entry = if t.is_symlink() {
+            json!({ "name": name, "kind": "link" })
+        } else if t.is_dir() {
+            json!({ "name": name, "kind": "folder" })
+        } else {
+            json!({ "name": name, "kind": "file", "size": e.metadata().map(|m| m.len()).ok() })
+        };
+        entries.push((name, entry));
+    }
+    entries.sort_by(|a, b| a.0.cmp(&b.0));
+    Ok((entries.into_iter().map(|(_, v)| v).collect(), truncated))
+}
+
+#[cfg(target_arch = "wasm32")]
+fn list_dir(_: &str, _: usize) -> Result<(Vec<Value>, bool)> {
+    Err(EngineError::Other("no file system here".into()))
+}
+
 /// A file's size (bytes) and modification time (ms since the Unix epoch, when the file system
 /// keeps one); `None` when there is no file at `path` (or automation may not read it).
 #[cfg(not(target_arch = "wasm32"))]
@@ -652,11 +652,19 @@ fn compound_make(s: &mut Session, _: &Value) -> Result<Value> {
            d.remove(*id)?;
        }
        let ch = d.node_mut(cid).and_then(|n| n.children_mut()).ok_or(EngineError::NoNode(cid))?;
-        for mut p in paths {
+        // The paths in front run against the backmost one, so where they overlap it they cut holes
+        // under the non-zero fill rule (#1197).
+        let direction = |n: &Node| n.path_data().and_then(|pd| pd.subpaths.first()).map_or(0.0, |sp| sp.signed_area().signum());
+        let back = paths.first().map_or(0.0, |p| direction(p));
+        for (i, mut p) in paths.into_iter().enumerate() {
            let pn = Arc::make_mut(&mut p);
            pn.appearance = Appearance::default();
-            if let NodeKind::Path { live, .. } = &mut pn.kind {
+            let flip = i > 0 && back != 0.0 && direction(pn) == back;
+            if let NodeKind::Path { path, live, .. } = &mut pn.kind {
                *live = None;
+                if flip {
+                    path.reverse();
+                }
            }
            ch.push(p);
        }
@@ -26,6 +26,9 @@ use vectorcraft_render::{AntiAlias, RenderOptions};

 use super::*;

+mod report;
+use report::FlattenReport;
+
 pub fn specs() -> Vec<CommandSpec> {
    vec![cmd!(
        "document.rasterEffectsSettings",
@@ -409,9 +412,9 @@ fn needs(n: &Node, which: Which) -> bool {
 }

 /// The art of `n`'s opacity mask with its raster effects as images.
-fn walk_mask(out: &mut Document, n: &mut Node, which: Which) {
+fn walk_mask(out: &mut Document, n: &mut Node, report: &mut FlattenReport) {
    if let Some(m) = n.mask.as_mut()
-        && let Some(art) = walk(out, &m.art, which)
+        && let Some(art) = walk(out, &m.art, report)
    {
        m.art = Arc::new(art);
    }
@@ -420,15 +423,23 @@ fn walk_mask(out: &mut Document, n: &mut Node, which: Which) {
 /// `n` with its raster effects (and its members' and its opacity mask's) as images, `None` when it
 /// has none. An object whose effects all paint below it keeps its vector art over an image of
 /// them; one whose effects change it (blur, feather, inner glow) becomes the image.
-fn walk(out: &mut Document, n: &Node, which: Which) -> Option<Node> {
+fn walk(out: &mut Document, n: &Node, report: &mut FlattenReport) -> Option<Node> {
+    let checkpoint = report.checkpoint();
+    let result = walk_inner(out, n, report);
+    report.attribute_since(checkpoint, n);
+    result
+}
+
+fn walk_inner(out: &mut Document, n: &Node, report: &mut FlattenReport) -> Option<Node> {
+    let which = report.which;
    if !needs(n, which) {
        return None;
    }
    if !imaged(n, which) {
        let mut m = n.clone();
-        walk_mask(out, &mut m, which);
+        walk_mask(out, &mut m, report);
        if is_container(&m)
-            && let Some(ch) = walk_all(out, n.children()?, which)
+            && let Some(ch) = walk_all(out, n.children()?, report)
            && let Some(slot) = m.children_mut()
        {
            *slot = ch;
@@ -436,33 +447,41 @@ fn walk(out: &mut Document, n: &Node, which: Which) -> Option<Node> {
        return Some(m);
    }
    if let Some(g) = placed_symbol(out, n) {
-        return Some(walk(out, &g, which).unwrap_or(g));
+        return Some(walk(out, &g, report).unwrap_or(g));
    }
    let below = below_only(n);
    if !below && let Some(g) = split_items(out, n) {
-        return Some(walk(out, &g, which).unwrap_or(g));
+        return Some(walk(out, &g, report).unwrap_or(g));
    }
    // An image that can't be made leaves the object as it is (the writer reports its effects).
    let mut v = n.clone();
    strip_raster(&mut v, false);
    let mut m = if below {
        let images = below_images(out, n)?;
-        let mut m = walk(out, &v, which).unwrap_or(v);
+        for image in &images {
+            report.record(n, image);
+        }
+        let mut m = walk(out, &v, report).unwrap_or(v);
        // Each goes in first: the last one put is the lowest.
        for image in images.into_iter().rev() {
            put_below(out, &mut m, image);
        }
        m
    } else {
-        replace_with_image(v, raster_image(out, n, false, false)?)
+        let image = raster_image(out, n, false, false)?;
+        report.record(n, &image);
+        replace_with_image(v, image)
    };
-    walk_mask(out, &mut m, which);
+    walk_mask(out, &mut m, report);
    Some(m)
 }

 /// `nodes` with their raster effects as images, `None` when none has any.
-fn walk_all(out: &mut Document, nodes: &[Arc<Node>], which: Which) -> Option<Vec<Arc<Node>>> {
-    nodes.iter().any(|n| needs(n, which)).then(|| nodes.iter().map(|n| walk(out, n, which).map(Arc::new).unwrap_or_else(|| n.clone())).collect())
+fn walk_all(out: &mut Document, nodes: &[Arc<Node>], report: &mut FlattenReport) -> Option<Vec<Arc<Node>>> {
+    nodes
+        .iter()
+        .any(|n| needs(n, report.which))
+        .then(|| nodes.iter().map(|n| walk(out, n, report).map(Arc::new).unwrap_or_else(|| n.clone())).collect())
 }

 /// A copy of `doc` with raster effects turned into images at the document's raster effects
@@ -470,17 +489,18 @@ fn walk_all(out: &mut Document, nodes: &[Arc<Node>], which: Which) -> Option<Vec
 /// type, images, symbol instances, live objects) and on single fills and strokes, in the layers,
 /// opacity masks, symbol definitions and pattern tiles.
 pub fn flatten_raster_effects(doc: &Document) -> Option<Document> {
-    flatten(doc, Which::All)
+    flatten(doc, &mut FlattenReport::new(Which::All, doc))
 }

 /// A copy of `doc` in which the objects with Photoshop-style raster effects (Radial Blur, Unsharp
 /// Mask…) are images as [`flatten_raster_effects`] makes them (SVG export: its filters draw the
 /// other raster effects live), or `None` when there are none.
 pub fn flatten_pixel_effects(doc: &Document) -> Option<Document> {
-    flatten(doc, Which::Pixel)
+    flatten(doc, &mut FlattenReport::new(Which::Pixel, doc))
 }

-fn flatten(doc: &Document, which: Which) -> Option<Document> {
+fn flatten(doc: &Document, report: &mut FlattenReport) -> Option<Document> {
+    let which = report.which;
    let any = |nodes: &[Arc<Node>]| nodes.iter().any(|n| needs(n, which));
    if !any(&doc.layers) && !doc.symbols.iter().any(|s| needs(&s.art, which)) && !doc.patterns.iter().any(|p| any(&p.art)) {
        return None;
@@ -489,18 +509,18 @@ fn flatten(doc: &Document, which: Which) -> Option<Document> {
    let baked = effects::bake_document(doc);
    let src = baked.as_ref().unwrap_or(doc);
    let mut out = src.clone();
-    if let Some(layers) = walk_all(&mut out, &src.layers, which) {
+    if let Some(layers) = walk_all(&mut out, &src.layers, report) {
        out.layers = layers;
    }
    for i in 0..out.symbols.len() {
-        if let Some(art) = out.symbols.get(i).map(|s| s.art.clone()).and_then(|a| walk(&mut out, &a, which))
+        if let Some(art) = out.symbols.get(i).map(|s| s.art.clone()).and_then(|a| walk(&mut out, &a, report))
            && let Some(s) = out.symbols.get_mut(i)
        {
            s.art = Arc::new(art);
        }
    }
    for i in 0..out.patterns.len() {
-        if let Some(art) = out.patterns.get(i).map(|p| p.art.clone()).and_then(|a| walk_all(&mut out, &a, which))
+        if let Some(art) = out.patterns.get(i).map(|p| p.art.clone()).and_then(|a| walk_all(&mut out, &a, report))
            && let Some(p) = out.patterns.get_mut(i)
        {
            p.art = art;
@@ -520,10 +540,11 @@ pub fn export_pdf_with_report(
    doc: &Document,
    opts: &vectorcraft_pdf::PdfOptions,
 ) -> std::result::Result<vectorcraft_pdf::ExportReport, vectorcraft_pdf::PdfError> {
-    match flatten_raster_effects(doc) {
-        Some(d) => vectorcraft_pdf::export_with_report(&d, opts),
-        None => vectorcraft_pdf::export_with_report(doc, opts),
-    }
+    let mut report = FlattenReport::new(Which::All, doc);
+    let flat = flatten(doc, &mut report);
+    let mut exported = vectorcraft_pdf::export_with_report(flat.as_ref().unwrap_or(doc), opts)?;
+    exported.warnings.extend(report.warnings());
+    Ok(exported)
 }

 #[cfg(test)]
@@ -0,0 +1,129 @@
+//! The PDF export warnings for raster effects whose images the 64 million pixel cap rendered below
+//! the document's raster effects resolution, one per object of the document.
+
+use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
+
+use super::Which;
+
+pub(super) struct FlattenReport {
+    pub which: Which,
+    requested_ppi: f64,
+    reductions: Vec<Reduction>,
+    /// Ids from here on are the flattening's own (split appearance items, groups under shadows).
+    first_new_id: u64,
+}
+
+struct Reduction {
+    id: NodeId,
+    name: Option<String>,
+    achieved_ppi: f64,
+}
+
+impl FlattenReport {
+    pub fn new(which: Which, doc: &Document) -> Self {
+        Self { which, requested_ppi: super::effects_scale(doc) * 72.0, reductions: vec![], first_new_id: doc.peek_next_id() }
+    }
+
+    /// Note `image` (made for the raster effects of `original`) when the cap lowered its resolution.
+    pub fn record(&mut self, original: &Node, image: &Node) {
+        if let NodeKind::Image(image) = &image.kind {
+            let [pixel_size, ..] = image.xf.as_coeffs();
+            let achieved_ppi = 72.0 / pixel_size;
+            if achieved_ppi + 1e-6 < self.requested_ppi {
+                self.reductions.push(Reduction { id: original.id, name: original.name.clone(), achieved_ppi });
+            }
+        }
+    }
+
+    pub fn checkpoint(&self) -> usize {
+        self.reductions.len()
+    }
+
+    /// Give the reductions recorded since `checkpoint` on pieces the flattening made to `original`,
+    /// a document object (the innermost one, as the walk returns from it).
+    pub fn attribute_since(&mut self, checkpoint: usize, original: &Node) {
+        let first_new_id = self.first_new_id;
+        if original.id.0 >= first_new_id {
+            return;
+        }
+        for reduction in self.reductions.iter_mut().skip(checkpoint) {
+            if reduction.id.0 >= first_new_id {
+                reduction.id = original.id;
+                reduction.name.clone_from(&original.name);
+            }
+        }
+    }
+
+    pub fn warnings(self) -> Vec<String> {
+        let mut lowest: Vec<Reduction> = vec![];
+        for reduction in self.reductions {
+            if let Some(existing) = lowest.iter_mut().find(|r| r.id == reduction.id) {
+                existing.achieved_ppi = existing.achieved_ppi.min(reduction.achieved_ppi);
+            } else {
+                lowest.push(reduction);
+            }
+        }
+        lowest
+            .into_iter()
+            .map(|r| {
+                let name = r.name.map(|name| format!(" ({name})")).unwrap_or_default();
+                format!(
+                    "raster effects on object {}{name}: requested {:.1} ppi, achieved {:.1} ppi due to the 64 million pixel cap",
+                    r.id.0, self.requested_ppi, r.achieved_ppi
+                )
+            })
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_doc::ImageObject;
+    use vectorcraft_geom::Affine;
+
+    fn image(ppi: f64) -> Node {
+        Node::new(
+            NodeId(999),
+            NodeKind::Image(ImageObject {
+                key: "effect".into(),
+                width: 8000,
+                height: 8000,
+                xf: Affine::scale(72.0 / ppi),
+                link: None,
+                placement: Default::default(),
+            }),
+        )
+    }
+
+    #[test]
+    fn lowest_resolution_is_reported_when_multiple_images_belong_to_one_object() {
+        let mut doc = Document::new(100.0, 100.0);
+        doc.raster_effects_ppi = 2400.0;
+        let original = &doc.layers[0];
+        let mut report = FlattenReport::new(Which::All, &doc);
+
+        for ppi in [1800.0, 1200.0, 1500.0] {
+            report.record(original, &image(ppi));
+        }
+
+        let warnings = report.warnings();
+        assert_eq!(warnings.len(), 1);
+        assert!(warnings[0].contains("achieved 1200.0 ppi"), "{:?}", warnings);
+    }
+
+    #[test]
+    fn parent_identity_is_reported_when_generated_pieces_are_attributed() {
+        let doc = Document::new(100.0, 100.0);
+        let original = &doc.layers[0];
+        let generated = Node::group(NodeId(998), vec![]);
+        let mut report = FlattenReport::new(Which::All, &doc);
+
+        report.record(&generated, &image(36.0));
+        report.attribute_since(0, original);
+
+        let warnings = report.warnings();
+        assert_eq!(warnings.len(), 1);
+        assert!(warnings[0].contains(&format!("object {}", original.id.0)), "{:?}", warnings);
+    }
+}
@@ -100,6 +100,8 @@ pub struct UndoGroup {
    first: Option<Arc<Document>>,
    /// The journal's length when the group began: a cancelled group drops the entries after it.
    journal: usize,
+    /// The undo step's name; else the first edit's.
+    label: Option<String>,
 }

 /// Per-document editing state.
@@ -285,13 +287,16 @@ impl DocState {
    }
    /// Record undo step `e` (the document before an edit). In an undo group only the group's first
    /// edit records one: the edits after it extend that step.
-    fn push_undo(&mut self, e: HistoryEntry) {
+    fn push_undo(&mut self, mut e: HistoryEntry) {
        if let Some(g) = &mut self.undo_group {
            let recorded = |first: &Arc<Document>| self.history.undo.last().is_some_and(|l| Arc::ptr_eq(&l.doc, first));
            if g.first.as_ref().is_some_and(recorded) {
                return;
            }
            g.first = Some(e.doc.clone());
+            if let Some(l) = &g.label {
+                e.label = l.clone();
+            }
        }
        self.history.undo.push(e);
        if self.history.undo.len() > self.history.limit {
@@ -1417,11 +1422,16 @@ impl Session {
    /// applies each value it passes as its own command, as a typed value is applied; the drag is
    /// one step.
    pub fn begin_undo_group(&mut self) {
+        self.begin_named_undo_group(None);
+    }
+
+    /// [`Session::begin_undo_group`] with the undo step named `label` (else after its first edit).
+    pub fn begin_named_undo_group(&mut self, label: Option<String>) {
        let journal = self.journal.len();
        if let Some(st) = self.active_mut()
            && st.undo_group.is_none()
        {
-            st.undo_group = Some(UndoGroup { first: None, journal });
+            st.undo_group = Some(UndoGroup { first: None, journal, label });
        }
    }

@@ -1670,3 +1670,48 @@ fn path_commands_reject_bad_anchors_before_modifying_geometry() {
    s.execute("path.setAnchors", &json!({"id": a.0, "subpaths": [{"anchors": [{"x": 0, "y": 0}, {"x": 30, "y": 40}], "closed": false}]})).unwrap();
    assert_eq!(s.doc().unwrap().doc.node(a).unwrap().path_data().unwrap().anchor_count(), 2);
 }
+
+/// #1163: `file.list` lists a folder's files and folders by name, held to the automation read root
+/// when one is in force.
+#[test]
+fn file_list_lists_a_folder_within_the_read_root() {
+    let base = std::env::temp_dir().join(format!("vc-file-list-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    for d in ["in/sub", "outside"] {
+        std::fs::create_dir_all(base.join(d)).unwrap();
+    }
+    std::fs::write(base.join("in/b.svg"), "<svg/>").unwrap();
+    std::fs::write(base.join("in/a.pdf"), "1234").unwrap();
+    let path = |d: &str| base.join(d).to_string_lossy().into_owned();
+    let mut s = Session::new();
+    let r = s.execute("file.list", &json!({"path": path("in")})).unwrap();
+    assert_eq!(
+        r["entries"],
+        json!([{"name": "a.pdf", "kind": "file", "size": 4}, {"name": "b.svg", "kind": "file", "size": 6}, {"name": "sub", "kind": "folder"}])
+    );
+    assert_eq!(r["truncated"], false);
+    let roots = crate::file_access::AutomationRoots::new(Some(&base.join("in")), None).unwrap().unwrap();
+    crate::file_access::confine(Some(&roots), || {
+        assert!(s.execute("file.list", &json!({"path": path("in/sub")})).is_ok());
+        assert!(s.execute("file.list", &json!({"path": path("outside")})).is_err(), "outside the read root");
+    });
+    assert!(s.execute("file.list", &json!({"path": path("in/b.svg")})).is_err(), "not a folder");
+    assert!(s.execute("file.list", &json!({})).is_err());
+    let _ = std::fs::remove_dir_all(base);
+}
+
+/// #1197: Make Compound Path cuts holes where the paths in front overlap the backmost one, also
+/// when they were drawn running the same way.
+#[test]
+fn a_compound_path_has_holes_where_its_paths_overlap() {
+    let mut s = session();
+    let square = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    let diamond = NodeId(s.execute("path.create", &json!({"d": "M50 -20 L120 50 L50 120 L-20 50 Z"})).unwrap()["id"].as_u64().unwrap());
+    s.execute("select.set", &json!({"ids": [square.0, diamond.0]})).unwrap();
+    let c = NodeId(s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap());
+    let hit =
+        |x: f64, y: f64| vectorcraft_doc::hit::hit_test(&s.doc().unwrap().doc, Point::new(x, y), Default::default()).map(|h| h.top_object(None));
+    assert_eq!(hit(50.0, 50.0), None, "the overlap is a hole");
+    assert_eq!(hit(3.0, 3.0), Some(c), "the square's corner is filled");
+    assert_eq!(hit(110.0, 50.0), Some(c), "the diamond's point outside the square is filled");
+}
@@ -182,3 +182,42 @@ fn shadows_and_glows_keep_their_blend_modes() {
        flat.layers[0].children().unwrap()[0].children().unwrap().iter().filter(|c| matches!(c.kind, NodeKind::Image(_))).map(|c| c.blend).collect();
    assert_eq!(modes, [vectorcraft_color::BlendMode::Multiply, vectorcraft_color::BlendMode::Screen]);
 }
+
+#[test]
+fn pdf_resolution_cap_warns_once_for_original_object_when_appearance_items_split() {
+    let mut d = Document::new(300.0, 300.0);
+    d.raster_effects_ppi = 2400.0;
+    d.raster_effects.anti_alias = false;
+    let mut n = Node::path(
+        d.alloc_id(),
+        shapes::rectangle(Rect::new(20.0, 20.0, 270.0, 270.0)),
+        Appearance::basic(Paint::solid(Color::BLACK), Paint::solid(Color::BLACK), 20.0),
+    );
+    let id = n.id;
+    n.name = Some("Large original".into());
+    for item in &mut n.appearance.items {
+        item.effects_mut().push(Effect { params: json!({"radius": 0.0}), ..blur() });
+    }
+    add(&mut d, n);
+
+    let r = crate::cmd::rasterfx::export_pdf_with_report(&d, &Default::default()).unwrap();
+
+    assert!(String::from_utf8_lossy(&r.bytes).contains("/Subtype/Image"));
+    assert_eq!(r.warnings.len(), 1, "{:?}", r.warnings);
+    let warning = &r.warnings[0];
+    assert!(warning.contains(&format!("object {}", id.0)) && warning.contains("Large original"), "{warning}");
+    assert!(warning.contains("requested 2400.0 ppi") && warning.contains("achieved 1268.7 ppi"), "{warning}");
+}
+
+#[test]
+fn pdf_resolution_cap_stays_quiet_when_small_effect_meets_requested_ppi() {
+    let mut d = Document::new(50.0, 50.0);
+    d.raster_effects_ppi = 300.0;
+    let n = with(rect(&mut d, Rect::new(10.0, 10.0, 30.0, 30.0), Color::BLACK), blur());
+    add(&mut d, n);
+
+    let r = crate::cmd::rasterfx::export_pdf_with_report(&d, &Default::default()).unwrap();
+
+    assert!(String::from_utf8_lossy(&r.bytes).contains("/Subtype/Image"));
+    assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+}
@@ -55,6 +55,18 @@ fn conventions_commands_batch_and_bounded_preview() {
        assert_eq!(p["failed"], 1);
        assert_eq!(p["completed"], total - 1);
    }
+    // atomic: the whole batch is one undo step, named by `label` (#1163).
+    let undo_steps = |s: &mut Server| payload(&call(s, "doc_inspect", json!({"depth":0})))["history"].as_array().map_or(0, Vec::len);
+    let before = undo_steps(&mut s);
+    let two = json!([{"id":"shape.rectangle","params":{"x":0,"y":0,"width":5,"height":5}}, {"id":"shape.ellipse","params":{"x":9,"y":0,"width":5,"height":5}}]);
+    let r = call(&mut s, "command_batch", json!({"steps":two,"atomic":true,"label":"Agent build"}));
+    assert_eq!(r["isError"], false, "{r}");
+    assert_eq!(undo_steps(&mut s), before + 1);
+    assert_eq!(payload(&call(&mut s, "run_command", json!({"command":"edit.undo"})))["undone"], "Agent build");
+    assert_eq!(undo_steps(&mut s), before);
+    for bad in [json!({"steps":two,"label":"x"}), json!({"steps":two,"atomic":"yes"}), json!({"steps":two,"atomic":true,"label":""})] {
+        assert_eq!(call(&mut s, "command_batch", bad.clone())["isError"], true, "{bad}");
+    }
    let before = call(&mut s, "doc_inspect", json!({}));
    let r = call(&mut s, "render_preview", json!({"max_side":64}));
    assert_eq!(r["isError"], false, "{r}");
@@ -65,6 +77,17 @@ fn conventions_commands_batch_and_bounded_preview() {
    for max in [json!(0), json!(4097), json!("64")] {
        assert_eq!(call(&mut s, "render_preview", json!({"max_side":max}))["isError"], true);
    }
+    // Another artboard, three times wider than tall, previews by its index (#1163).
+    let r = call(&mut s, "run_command", json!({"command":"artboard.new","params":{"x":2000,"y":0,"width":300,"height":100}}));
+    assert_eq!(r["isError"], false, "{r}");
+    let r = call(&mut s, "render_preview", json!({"max_side":60,"artboard":1}));
+    assert_eq!(r["isError"], false, "{r}");
+    let png = vectorcraft_format::base64_decode(r["content"][0]["data"].as_str().unwrap()).unwrap();
+    let img = image::load_from_memory(&png).unwrap();
+    assert_eq!((img.width(), img.height()), (60, 20));
+    for board in [json!(2), json!(-1), json!("1")] {
+        assert_eq!(call(&mut s, "render_preview", json!({"artboard":board}))["isError"], true, "{board}");
+    }
    for name in ["ui_inspect", "ui_screenshot"] {
        assert_eq!(call(&mut s, name, json!({}))["isError"], true);
    }
@@ -96,9 +96,9 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "command_batch",
            "Run several commands",
-            "Run steps in order; each edit is its own undo step. A param string that is exactly \"$N.path\" (N: 0-based step index) or \"$last.path\" takes that value from an earlier step's result, e.g. {\"id\":\"$1.id\"}; \"$$\" starts a literal \"$\". Returns completed, failed and results. Stops on the first error by default.",
+            "Run steps in order; each edit is its own undo step, or with atomic:true the whole batch is one (named `label`, else after its first edit). A param string that is exactly \"$N.path\" (N: 0-based step index) or \"$last.path\" takes that value from an earlier step's result, e.g. {\"id\":\"$1.id\"}; \"$$\" starts a literal \"$\". Returns completed, failed and results. Stops on the first error by default.",
            obj(
-                json!({"steps": {"type":"array", "items":obj(json!({"id":string("Command id"),"params":{"type":"object"}}), &["id"])}, "stop_on_error":{"type":"boolean", "default":true}}),
+                json!({"steps": {"type":"array", "items":obj(json!({"id":string("Command id"),"params":{"type":"object"}}), &["id"])}, "stop_on_error":{"type":"boolean", "default":true}, "atomic":{"type":"boolean", "default":false, "description":"Make the batch's edits one undo step (needs an open document)"}, "label":string("The undo step's name with atomic")}),
                &["steps"],
            ),
            false,
@@ -113,8 +113,11 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "render_preview",
            "Render a preview",
-            "Render the first artboard as inline PNG without changing the document. max_side defaults to 1024, limited to 1..4096.",
-            obj(json!({"max_side":{"type":"integer","minimum":1,"maximum":4096}}), &[]),
+            "Render an artboard (default the first) as inline PNG without changing the document. max_side defaults to 1024, limited to 1..4096.",
+            obj(
+                json!({"max_side":{"type":"integer","minimum":1,"maximum":4096},"artboard":{"type":"integer","minimum":0,"description":"0-based artboard (default 0)"}}),
+                &[],
+            ),
            true,
        ),
        tool("ui_inspect", "Inspect the interface", "Inspect the connected desktop interface; returns a tool error in headless mode.", empty(), true),
@@ -200,7 +203,7 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "draw_path",
            "Draw path",
-            "Create a path from points ([[x,y],…] or [{x,y,in?:[x,y],out?:[x,y]},…] with Bézier handles) or SVG path data `d`, then apply optional paint. Returns the new object id.",
+            "Create a path from points ([[x,y],…] or [{x,y,in?:[x,y],out?:[x,y]},…] with Bézier handles) or SVG path data `d`, then apply optional paint. Omitted paint fields inherit the current new-art appearance (initially white fill and 1 pt black stroke). For a filled path without an outline, pass an explicit fill and stroke:\"none\". Returns the new object id.",
            obj(
                json!({
                    "points": {"type": "array", "description": "Anchors: [x,y] pairs or {x, y, in?, out?, smooth?} objects", "items": {"anyOf": [{"type": "array", "items": {"type": "number"}, "minItems": 2}, {"type": "object"}]}},
@@ -217,7 +220,7 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "draw_shape",
            "Draw shape",
-            "Create a live shape and apply optional paint. rectangle/ellipse: x, y, width, height (rectangle: radius = corner radius). polygon: cx, cy, radius, sides. star: cx, cy, radius1, radius2, points. line: x1, y1, x2, y2. Returns the new object id.",
+            "Create a live shape and apply optional paint. rectangle/ellipse: x, y, width, height (rectangle: radius = corner radius). polygon: cx, cy, radius, sides. star: cx, cy, radius1, radius2, points. line: x1, y1, x2, y2. Omitted paint fields inherit the current new-art appearance (initially white fill and 1 pt black stroke); lines start with no fill and a visible stroke. For a filled shape without an outline, pass an explicit fill and stroke:\"none\". Returns the new object id.",
            obj(
                json!({
                    "shape": {"type": "string", "enum": ["rectangle", "ellipse", "polygon", "star", "line"]},
@@ -329,7 +332,7 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "export",
            "Export",
-            "Export the active document with the engine's document.export (the same bytes in the app and headless), in any format of the `format` enum: vectors (svg/svgz with the artboard as viewBox, eps, dxf, emf, wmf), pdf (one page per artboard: all, or `artboard` / `range`), rasters (one rendered artboard: png, jpg, webp, gif, png8 as an indexed .png, tiff, bmp, tga, psd with its layers), txt (the stories, back to front), vectorcraft or template (a native copy or template; the document keeps its path). run_command document.formats lists each format's options. `selection: true` exports only the selected objects, cropped to their bounds. Template layers are left out; live effects are kept (geometry baked, SVG filters for shadows/glows/blur). Without `path` the bytes come back as dataBase64.",
+            "Export the active document with the engine's document.export (the same bytes in the app and headless), in any format of the `format` enum: vectors (svg/svgz with the artboard as viewBox, eps, dxf, emf, wmf), pdf (one page per artboard: all, or `artboard` / `range`), rasters (one rendered artboard: png, jpg, webp, gif, png8 as an indexed .png, tiff, bmp, tga, psd with its layers), txt (the stories, back to front), vectorcraft or template (a native copy or template; the document keeps its path). run_command document.formats lists each format's options. For SVG/SVGZ, top-level `outlineText: true` writes text as paths; DXF takes it too (its type is outlined anyway unless `preserve: editability`). PDF instead uses `options.advanced.outlineText: true`, default false (live text). `selection: true` exports only the selected objects, cropped to their bounds. Template layers are left out; live effects are kept (geometry baked, SVG filters for shadows/glows/blur). Without `path` the bytes come back as dataBase64.",
            obj(
                json!({
                    "format": {"type": "string", "enum": FORMATS.iter().filter(|f| f.write).map(|f| f.id).collect::<Vec<_>>(), "description": "Default: from the path's extension"},
@@ -338,8 +341,8 @@ pub fn tool_definitions() -> Vec<Value> {
                    "artboard": {"type": "integer", "minimum": 0, "description": "0-based artboard (default: the first; PDF default: all)"},
                    "range": string("1-based artboards such as \"1-3, 5\" (PDF: one page each; other formats take one)"),
                    "selection": {"type": "boolean", "description": "Export only the selection, cropped to it"},
-                    "outlineText": {"type": "boolean", "description": "SVG: text as outlines (viewable without the fonts)"},
-                    "options": {"type": "object", "description": "More format options, passed through (see run_command document.formats), e.g. {\"quality\": 80} for jpg"},
+                    "outlineText": {"type": "boolean", "description": "SVG/SVGZ: true writes text as outlines (viewable without the fonts). DXF takes it too (type outlined anyway unless preserve: editability). PDF uses options.advanced.outlineText instead (default false: live text)"},
+                    "options": {"type": "object", "description": "More format options, passed through (see run_command document.formats), e.g. {\"quality\": 80} for jpg or {\"advanced\": {\"outlineText\": true}} for PDF text as outlines (default false: live text)"},
                }),
                &[],
            ),
@@ -902,6 +905,16 @@ fn command_batch(b: &mut dyn Backend, a: &Args) -> Result<ToolResult, String> {
        None => true,
        Some(v) => v.as_bool().ok_or("`stop_on_error` must be a boolean")?,
    };
+    let atomic = match a.get("atomic") {
+        None => false,
+        Some(v) => v.as_bool().ok_or("`atomic` must be a boolean")?,
+    };
+    if atomic {
+        let label = a.get("label").cloned().unwrap_or(Value::Null);
+        b.call("engine.execute", json!({"command":"edit.undoGroup.begin","params":{"label":label}}))?;
+    } else if a.get("label").is_some() {
+        return Err("`label` names the undo step of an atomic batch: give atomic:true too".into());
+    }
    let (mut completed, mut failed, mut results) = (0, 0, Vec::new());
    // Each step's result (null for a failed one), for later steps' `"$N.path"` references.
    let mut values: Vec<Value> = vec![];
@@ -936,6 +949,10 @@ fn command_batch(b: &mut dyn Backend, a: &Args) -> Result<ToolResult, String> {
            }
        }
    }
+    // The steps that ran stay, as one undo step.
+    if atomic {
+        b.call("engine.execute", json!({"command":"edit.undoGroup.end","params":{}}))?;
+    }
    let mut r = ToolResult::json(&json!({"completed":completed,"failed":failed,"results":results}));
    r.is_error = failed > 0;
    Ok(r)
@@ -946,8 +963,13 @@ fn render_preview(b: &mut dyn Backend, a: &Args) -> Result<ToolResult, String> {
        None => 1024,
        Some(v) => v.as_u64().filter(|v| (1..=4096).contains(v)).ok_or("`max_side` must be an integer in 1..4096")?,
    };
+    let index = match a.get("artboard") {
+        None => 0,
+        Some(v) => v.as_u64().ok_or("`artboard` must be a 0-based artboard index")?,
+    };
    let doc = b.call("document.inspect", json!({"depth":0}))?;
-    let board = doc.get("artboards").and_then(Value::as_array).and_then(|v| v.first()).ok_or("no such artboard")?;
+    let board =
+        doc.get("artboards").and_then(Value::as_array).and_then(|v| v.get(usize::try_from(index).ok()?)).ok_or(format!("no artboard {index}"))?;
    let width = board.get("width").and_then(Value::as_f64).ok_or("artboard has no width")?;
    let height = board.get("height").and_then(Value::as_f64).ok_or("artboard has no height")?;
    if !width.is_finite() || !height.is_finite() || width <= 0.0 || height <= 0.0 {
@@ -959,7 +981,7 @@ fn render_preview(b: &mut dyn Backend, a: &Args) -> Result<ToolResult, String> {
    if width.max(height) * scale > 4096.0 {
        return Err("artboard is too large for a bounded preview".into());
    }
-    let r = b.call("ui.render", json!({"scale":scale}))?;
+    let r = b.call("ui.render", json!({"scale":scale, "artboard": index}))?;
    let encoded = r.get("pngBase64").and_then(Value::as_str).ok_or("renderer returned no image")?;
    let png = vectorcraft_format::base64_decode(encoded).ok_or("renderer returned bad base64")?;
    let img = image::load_from_memory_with_format(&png, image::ImageFormat::Png).map_err(|e| format!("read preview: {e}"))?;
@@ -21,6 +21,13 @@ subsetter = { version = "0.2", default-features = false, features = ["variable-f
 unicode-bidi = "0.3.18"
 unicode-general-category = "1"
 unicode-script = "0.5"
+# Word boundaries in scripts written without spaces between words (Thai, Lao, Khmer, Myanmar), where
+# lines may break: ICU4X's line segmenter (Unicode-3.0, as icu_properties already in the build),
+# with its dictionaries on the desktop and its far smaller LSTM models on the web.
+icu_segmenter = "2.3"
+# Grapheme clusters (a Thai consonant with its vowel and tone marks, an accented letter, an emoji
+# sequence) for caret movement; MIT OR Apache-2.0, already in the build.
+unicode-segmentation = "1.13"
 # Builds a small variable font for tests (`test_fonts`; no font file is committed). MIT OR
 # Apache-2.0, already in the build through subsetter.
 write-fonts = { version = "0.48", optional = true }
@@ -1,8 +1,8 @@
 //! Fonts from the optional craft-fonts build input (<https://github.com/storytold/craft-fonts>).
 //!
 //! Built with `CRAFT_FONTS_DIR=<craft-fonts checkout>`, [`CRAFT_FONTS`] holds every font in its
-//! manifest (Japanese UI and document fonts, and Arabic fonts); built without it, it is empty and Japanese
-//! text falls back to the installed system fonts. Release builds always set it. See `build.rs`
+//! manifest (Japanese UI and document fonts, Arabic fonts and Noto Sans Thai); built without it,
+//! it is empty and that text falls back to the installed system fonts. Release builds always set it. See `build.rs`
 //! and craftrules `standards/fonts.md`.

 /// A font from the optional craft-fonts build input (empty unless built with `CRAFT_FONTS_DIR`).
@@ -39,6 +39,10 @@ impl CraftFont {
    pub fn is_arabic(&self) -> bool {
        self.scripts.contains(&"Arab")
    }
+    /// Is the font for Thai text?
+    pub fn is_thai(&self) -> bool {
+        self.scripts.contains(&"Thai")
+    }
    /// A serif (Mincho) family, for document text.
    pub fn is_mincho(&self) -> bool {
        self.family.contains("Mincho")
@@ -63,11 +67,13 @@ pub fn japanese_document_fonts() -> Vec<&'static CraftFont> {

 /// The craft-fonts faces the document font database loads: the Japanese ones in
 /// [`japanese_document_fonts`] order, then the Arabic ones in manifest order (Noto Sans Arabic
-/// first: the fallback for Arabic text; the other families are picked by name). Empty when built
-/// without craft-fonts.
+/// first: the fallback for Arabic text; the other families are picked by name), then the Thai ones
+/// (Noto Sans Thai: the fallback for Thai text where no Thai font is installed, and on the web).
+/// Empty when built without craft-fonts.
 pub fn document_fonts() -> Vec<&'static CraftFont> {
    let mut v = japanese_document_fonts();
    v.extend(CRAFT_FONTS.iter().filter(|f| f.is_arabic() && !f.is_japanese()));
+    v.extend(CRAFT_FONTS.iter().filter(|f| f.is_thai() && !f.is_japanese() && !f.is_arabic()));
    v
 }

@@ -104,8 +110,10 @@ mod tests {
            assert!(name.ends_with(".ttf") || name.ends_with(".otf"), "{}", w.url);
            assert!(w.integrity.starts_with("sha256-") && w.integrity.len() == "sha256-".len() + 44, "{}", w.integrity);
        }
+        // The fallbacks the first frame may need: Noto Sans Arabic and Noto Sans Thai, where the
+        // checkout has them.
        let startup: Vec<_> = WEB_FONTS.iter().filter(|w| w.startup).map(|w| w.family).collect();
-        let noto = CRAFT_FONTS.iter().any(|f| f.family == "Noto Sans Arabic");
-        assert_eq!(startup, if noto { vec!["Noto Sans Arabic"] } else { vec![] });
+        let expected: Vec<_> = ["Noto Sans Arabic", "Noto Sans Thai"].into_iter().filter(|n| CRAFT_FONTS.iter().any(|f| f.family == *n)).collect();
+        assert_eq!(startup, expected);
    }
 }
@@ -190,32 +190,64 @@ pub fn next_char(s: &str, i: usize) -> usize {
    s[i..].chars().next().map(|c| i + c.len_utf8()).unwrap_or(s.len())
 }

-fn is_word_char(c: char) -> bool {
-    c.is_alphanumeric() || c == '_' || c == '\'' || c == '’'
+/// The start of the grapheme cluster before `i` (Left arrow): a Thai consonant with its vowel and
+/// tone marks, an accented letter or an emoji sequence is passed over whole.
+pub fn prev_cluster(s: &str, i: usize) -> usize {
+    use unicode_segmentation::GraphemeCursor;
+    let i = floor_char(s, i);
+    GraphemeCursor::new(i, s.len(), true).prev_boundary(s, 0).ok().flatten().unwrap_or(0)
 }

-/// Start of the previous word (Cmd/Alt+Left).
+/// The end of the grapheme cluster at `i` (Right arrow, Delete): see [`prev_cluster`].
+pub fn next_cluster(s: &str, i: usize) -> usize {
+    use unicode_segmentation::GraphemeCursor;
+    let i = floor_char(s, i);
+    GraphemeCursor::new(i, s.len(), true).next_boundary(s, 0).ok().flatten().unwrap_or(s.len())
+}
+
+/// Part of a word: a letter, digit or mark (Thai vowel and tone marks, combining accents), an
+/// underscore or an apostrophe.
+fn is_word_char(c: char) -> bool {
+    use unicode_general_category::{GeneralCategory as G, get_general_category};
+    c.is_alphanumeric() || matches!(c, '_' | '\'' | '’') || matches!(get_general_category(c), G::NonspacingMark | G::SpacingMark | G::EnclosingMark)
+}
+
+/// Is byte `b` of `s` (with `breaks`, its [`crate::shape::unspaced_word_breaks`]) a boundary
+/// between two words of Thai, Lao, Khmer or Myanmar, which no space separates?
+fn inner_word_break(s: &str, breaks: &[usize], b: usize) -> bool {
+    use crate::shape::is_unspaced_script;
+    breaks.binary_search(&b).is_ok()
+        && s.get(b..).and_then(|t| t.chars().next()).is_some_and(is_unspaced_script)
+        && s.get(..b).and_then(|t| t.chars().next_back()).is_some_and(is_unspaced_script)
+}
+
+/// Start of the previous word (Cmd/Alt+Left). Thai (Lao, Khmer, Myanmar) words end where their
+/// script's word boundaries are, spaces or not.
 pub fn prev_word(s: &str, i: usize) -> usize {
    let i = floor_char(s, i);
+    let breaks = crate::shape::unspaced_word_breaks(s);
    let chars: Vec<(usize, char)> = s[..i].char_indices().collect();
    let mut k = chars.len();
    while k > 0 && !is_word_char(chars[k - 1].1) {
        k -= 1;
    }
-    while k > 0 && is_word_char(chars[k - 1].1) {
+    let end = k;
+    while k > 0 && is_word_char(chars[k - 1].1) && !(k < end && inner_word_break(s, &breaks, chars[k].0)) {
        k -= 1;
    }
    chars.get(k).map(|c| c.0).unwrap_or(i)
 }

-/// End of the next word (Cmd/Alt+Right).
+/// End of the next word (Cmd/Alt+Right): see [`prev_word`].
 pub fn next_word(s: &str, i: usize) -> usize {
    let i = floor_char(s, i);
+    let breaks = crate::shape::unspaced_word_breaks(s);
    let mut it = s[i..].char_indices().peekable();
    while it.peek().is_some_and(|(_, c)| !is_word_char(*c)) {
        it.next();
    }
-    while it.peek().is_some_and(|(_, c)| is_word_char(*c)) {
+    let start = it.peek().map(|(k, _)| i + k);
+    while it.peek().is_some_and(|(k, c)| is_word_char(*c) && !(Some(i + k) != start && inner_word_break(s, &breaks, i + k))) {
        it.next();
    }
    it.peek().map(|(k, _)| i + k).unwrap_or(s.len())
@@ -245,16 +277,18 @@ pub fn word_at(s: &str, i: usize) -> Range<usize> {
    if k == 2 {
        return at..at + c.len_utf8();
    }
+    // Thai (Lao, Khmer, Myanmar) words also end where their script's word boundaries are.
+    let breaks = if k == 0 { crate::shape::unspaced_word_breaks(s) } else { vec![] };
    let mut a = at;
    for (p, d) in s[..at].char_indices().rev() {
-        if class(d) != k {
+        if class(d) != k || inner_word_break(s, &breaks, a) {
            break;
        }
        a = p;
    }
    let mut b = at;
    for (p, d) in s[at..].char_indices() {
-        if class(d) != k {
+        if class(d) != k || (b > at && inner_word_break(s, &breaks, b)) {
            break;
        }
        b = at + p + d.len_utf8();
@@ -391,6 +391,36 @@ struct SysFallback {
    misses: std::collections::HashSet<char>,
 }

+/// Fonts made for Thai, tried first (when installed) for Thai the font in use lacks: Windows
+/// (Leelawadee UI; Tahoma before Windows 8), macOS (Thonburi, Sukhumvit Set) and Linux (Noto,
+/// TLWG).
+pub const THAI_FAMILIES: &[&str] = &[
+    "Leelawadee UI",
+    "Leelawadee",
+    "Tahoma",
+    "Thonburi",
+    "Sukhumvit Set",
+    "Noto Sans Thai",
+    "Noto Sans Thai UI",
+    "Noto Sans Thai Looped",
+    "Waree",
+    "Loma",
+    "Garuda",
+];
+
+/// The families tried first for character `c`, in a script whose text only fonts made for it set
+/// well (Thai, Lao, Khmer, Myanmar); none for other characters.
+fn script_families(c: char) -> &'static [&'static str] {
+    use unicode_script::{Script, UnicodeScript};
+    match c.script() {
+        Script::Thai => THAI_FAMILIES,
+        Script::Lao => &["Lao UI", "Leelawadee UI", "Lao Sangam MN", "Noto Sans Lao", "Noto Sans Lao UI", "Phetsarath OT"],
+        Script::Khmer => &["Khmer UI", "Khmer Sangam MN", "Noto Sans Khmer", "Noto Sans Khmer UI", "Khmer OS"],
+        Script::Myanmar => &["Myanmar Text", "Myanmar Sangam MN", "Noto Sans Myanmar", "Noto Sans Myanmar UI", "Padauk"],
+        _ => &[],
+    }
+}
+
 /// Families tried (when installed) for characters the loaded fonts lack: CJK, symbols, emoji.
 #[cfg(not(target_arch = "wasm32"))]
 const SYSTEM_FALLBACKS: &[&str] = &[
@@ -544,10 +574,12 @@ impl FontClass {
        [FontClass::Serif, FontClass::Sans, FontClass::Rounded, FontClass::Script, FontClass::Monospaced, FontClass::Decorative];
 }

-/// What a font menu filters on: whether a family sets Japanese, and its kind.
+/// What a font menu filters on: whether a family sets Japanese or Thai, and its kind.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct FontTraits {
    pub japanese: bool,
+    /// Its character map has Thai (ก and า).
+    pub thai: bool,
    pub class: FontClass,
 }

@@ -565,6 +597,7 @@ impl FontTraits {
        };
        // Hiragana (bit 49) or Katakana (bit 50) in the Unicode ranges, or the JIS code page.
        let japanese = ranges2 & (0b11 << 17) != 0 || codepages & (1 << 17) != 0 || has_japanese_name;
+        let thai = ['\u{0E01}', '\u{0E32}'].iter().all(|c| font.charmap().map(*c).is_some());
        let family_type = panose.first().copied().unwrap_or(0);
        let serif_style = panose.get(1).copied().unwrap_or(0);
        let proportion = panose.get(3).copied().unwrap_or(0);
@@ -662,7 +695,7 @@ impl FontTraits {
        } else {
            FontClass::Other
        };
-        FontTraits { japanese, class }
+        FontTraits { japanese, thai, class }
    }
 }

@@ -1917,6 +1950,18 @@ impl FontDb {
    /// First face (fallback family first, then load order) that covers `c`; on native, system
    /// fonts are loaded lazily the first time no loaded face covers a character.
    pub(crate) fn fallback_for(&self, c: char, exclude: u32) -> Option<Arc<FontFace>> {
+        // Thai (Lao, Khmer, Myanmar) takes a font made for it, when one is installed, rather than
+        // whichever face covering it happened to load first (a display face, say).
+        let prefer = script_families(c);
+        if let Some(f) = self.family_fallback(c, exclude, prefer) {
+            return Some(f);
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.load_families(c, prefer)
+            && let Some(f) = self.family_fallback(c, exclude, prefer)
+        {
+            return Some(f);
+        }
        if let Some(f) = self.loaded_fallback(c, exclude) {
            return Some(f);
        }
@@ -1934,6 +1979,28 @@ impl FontDb {
        self.fallback_for(c, 0)
    }

+    /// The loaded face of the first of `families` that covers `c` (upright, nearest Regular).
+    fn family_fallback(&self, c: char, exclude: u32, families: &[&str]) -> Option<Arc<FontFace>> {
+        let faces = self.read_faces();
+        families.iter().find_map(|fam| {
+            faces
+                .iter()
+                .filter(|f| f.id != exclude && f.family.eq_ignore_ascii_case(fam) && f.covers(c))
+                .min_by_key(|f| (f.italic, (f.weight - 400.0).abs() as i32))
+                .cloned()
+        })
+    }
+
+    /// Load the first of the installed `families` not loaded yet that covers `c` (with system
+    /// fallback on). Returns whether one was loaded.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn load_families(&self, c: char, families: &[&str]) -> bool {
+        if families.is_empty() || !self.sys.lock().unwrap_or_else(|e| e.into_inner()).enabled {
+            return false;
+        }
+        families.iter().any(|fam| !self.is_loaded(fam) && self.load_cataloged(fam) && self.family_fallback(c, 0, &[fam]).is_some())
+    }
+
    fn loaded_fallback(&self, c: char, exclude: u32) -> Option<Arc<FontFace>> {
        let faces = self.read_faces();
        let mut order: Vec<&Arc<FontFace>> = faces.iter().filter(|f| f.id != exclude).collect();
@@ -13,7 +13,8 @@ use crate::composer::{Breakpoint, Params, compose};
 use crate::fontdb::FontDb;
 use crate::hyphen::hyphen_points;
 use crate::shape::{
-    Punct, SGlyph, Tcy, cap_x_heights, hyphen_glyph, is_cjk, no_line_end, no_line_start, punct, shape_range, soft_line_start, style_metrics,
+    Punct, SGlyph, Tcy, cap_x_heights, hyphen_glyph, is_cjk, mark_word_ends, no_line_end, no_line_start, punct, shape_range, soft_line_start,
+    style_metrics,
 };
 use crate::{Composer, FirstBaseline, InlineGlyph, LayoutOptions, LineInfo, OtFeatures, PositionedGlyph, TextLayout, VerticalAlign};

@@ -1184,6 +1185,7 @@ mod wrapping_tests {
                ch,
                tcy: None,
                inline: None,
+                word_end: false,
                lead: 0.0,
                proportional: false,
                vpal: None,
@@ -1442,6 +1444,8 @@ fn flow(cx: &mut Ctx<'_>, paras: &[Range<usize>], t: &TextObject, regions: Optio
        let bidi = para_bidi(text.get(pr.clone()).unwrap_or_default(), para.direction);
        let rtl = is_rtl(bidi.as_ref());
        let mut sg = cx.shape_para(pr.clone(), bidi.as_ref());
+        // Thai, Lao, Khmer and Myanmar break lines between words, not at spaces.
+        mark_word_ends(text.get(pr.clone()).unwrap_or_default(), pr.start, &mut sg);
        // Japanese composition: consecutive punctuation shares one half-em space.
        let compressed = if para.mojikumi == Mojikumi::LineEndHalf { compress_punctuation(&mut sg) } else { vec![] };
        // …and a quarter em between Japanese and Latin text.
@@ -59,6 +59,9 @@ pub(crate) struct SGlyph {
    pub level: Level,
    /// An inline graphic ([`vectorcraft_doc::TextRun::inline`]) standing in for a glyph.
    pub inline: Option<InlineBox>,
+    /// A word of a script written without spaces (Thai, Lao, Khmer, Myanmar) ends after the
+    /// glyph's cluster, so a line may break there ([`mark_word_ends`]).
+    pub word_end: bool,
 }

 /// How `vpal` moves an upright glyph in vertical type and changes its length down the column, in
@@ -102,7 +105,7 @@ impl SGlyph {
    }
    /// A line may break after this glyph.
    pub fn break_after(&self) -> bool {
-        self.is_space() || matches!(self.ch, '-' | '\u{2010}' | '\u{2013}' | '\u{2014}' | '/' | SOFT_HYPHEN) || is_cjk(self.ch)
+        self.is_space() || self.word_end || matches!(self.ch, '-' | '\u{2010}' | '\u{2013}' | '\u{2014}' | '/' | SOFT_HYPHEN) || is_cjk(self.ch)
    }
    /// A soft (discretionary) hyphen: invisible unless a line breaks after it.
    pub fn is_soft_hyphen(&self) -> bool {
@@ -232,6 +235,43 @@ pub(crate) fn punct(c: char) -> Option<Punct> {
    }
 }

+/// Is `c` of a script written without spaces between words, whose line breaks need a model of its
+/// words: Thai, Lao, Khmer or Myanmar (UAX #14's class SA)?
+pub(crate) fn is_unspaced_script(c: char) -> bool {
+    matches!(c.script(), Script::Thai | Script::Lao | Script::Khmer | Script::Myanmar)
+}
+
+/// The byte offsets of `text` where a word of Thai, Lao, Khmer or Myanmar starts or ends: where a
+/// line may break, and where the caret stops word by word, in text without spaces between words.
+/// They come from ICU4X's line segmenter (its dictionaries on the desktop, its far smaller LSTM
+/// models on the web); empty when `text` has none of those scripts. Offsets elsewhere (around
+/// other text) are UAX #14's breaks.
+pub(crate) fn unspaced_word_breaks(text: &str) -> Vec<usize> {
+    #[cfg(not(target_arch = "wasm32"))]
+    static SEGMENTER: std::sync::LazyLock<icu_segmenter::LineSegmenterBorrowed<'static>> =
+        std::sync::LazyLock::new(|| icu_segmenter::LineSegmenter::new_dictionary(Default::default()));
+    #[cfg(target_arch = "wasm32")]
+    static SEGMENTER: std::sync::LazyLock<icu_segmenter::LineSegmenterBorrowed<'static>> =
+        std::sync::LazyLock::new(|| icu_segmenter::LineSegmenter::new_auto(Default::default()));
+    if !text.chars().any(is_unspaced_script) {
+        return vec![];
+    }
+    SEGMENTER.segment_str(text).collect()
+}
+
+/// Mark the glyphs of `sg` (shaped from `text`, which starts at byte `start` of the text the
+/// glyphs index) after which a word of Thai, Lao, Khmer or Myanmar ends ([`unspaced_word_breaks`]);
+/// other text keeps its own breaks.
+pub(crate) fn mark_word_ends(text: &str, start: usize, sg: &mut [SGlyph]) {
+    let breaks: Vec<usize> = unspaced_word_breaks(text).into_iter().map(|b| b + start).collect();
+    if breaks.is_empty() {
+        return;
+    }
+    for g in sg.iter_mut().filter(|g| g.inline.is_none() && is_unspaced_script(g.ch)) {
+        g.word_end = breaks.binary_search(&(g.byte + g.len)).is_ok();
+    }
+}
+
 pub(crate) fn is_cjk(c: char) -> bool {
    matches!(c as u32, 0x2E80..=0x9FFF | 0xAC00..=0xD7AF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF | 0x20000..=0x2FFFF)
 }
@@ -446,6 +486,7 @@ fn inline_glyph(face: &Arc<FontFace>, st: &CharStyle, art: &InlineArt, run: usiz
        // RTL text like any other glyph once the line is reordered.
        level,
        inline: Some(InlineBox { art: drawn, xf }),
+        word_end: false,
    }
 }

@@ -614,6 +655,7 @@ fn shape_segment(text: &str, context: &Range<usize>, seg: &Segment, feats: &OtFe
            vpal: vpal.get(gi).copied().flatten(),
            level: *level,
            inline: None,
+            word_end: false,
        });
    }
 }
@@ -728,3 +728,58 @@ fn burasagari_leaves_latin_commas_and_full_stops_inside_the_line() {
        }
    }
 }
+
+/// With craft-fonts and no installed fonts (the web), Thai is set in Noto Sans Thai, not as empty
+/// boxes. Skipped when built without craft-fonts or with a checkout that has no Thai font.
+#[test]
+fn thai_without_installed_fonts_takes_the_craft_fonts_thai_font() {
+    if !crate::CRAFT_FONTS.iter().any(|f| f.is_thai()) {
+        eprintln!("skipping: no Thai font in craft-fonts (set CRAFT_FONTS_DIR to a checkout that has one)");
+        return;
+    }
+    let l = layout(db(), &point("ภาษาไทย", style(20.0)));
+    assert!(!l.glyphs.is_empty() && l.glyphs.iter().all(|g| g.gid != 0), "no .notdef");
+    let families: Vec<String> = l.glyphs.iter().filter_map(|g| db().face_by_id(g.font_id)).map(|f| f.family.clone()).collect();
+    assert!(families.iter().all(|f| f == "Noto Sans Thai"), "{families:?}");
+}
+
+/// Thai is written without spaces between words: area type breaks its lines between words (as a
+/// model of Thai words finds them), never inside a word nor before a vowel or tone mark.
+#[test]
+fn thai_lines_break_between_words() {
+    let text = "สวัสดีครับ ภาษาไทยง่ายนิดเดียว";
+    // Narrower than the shortest words: each line holds one word.
+    let l = layout(db(), &area(text, style(12.0), Rect::new(0.0, 0.0, 70.0, 2000.0), Justify::Left));
+    let lines: Vec<&str> = l.lines.iter().map(|ln| &text[ln.start..ln.end]).collect();
+    assert!(lines.len() >= 3, "{lines:?}");
+    // Its words: สวัสดี ครับ, ภาษา ไทย ง่าย นิดเดียว ("hello", "the Thai language is very easy").
+    let words = ["สวัสดี", "ครับ ", "ภาษา", "ไทย", "ง่าย", "นิดเดียว"];
+    let ends: Vec<usize> = words
+        .iter()
+        .scan(0, |at, w| {
+            *at += w.len();
+            Some(*at)
+        })
+        .collect();
+    assert_eq!(ends.last(), Some(&text.len()));
+    for ln in &l.lines {
+        assert!(ends.contains(&ln.end), "a line ends inside a word: {lines:?}");
+    }
+    for w in l.lines.windows(2) {
+        assert_eq!(w[0].end, w[1].start, "lines tile the text");
+    }
+    let mark = |c: char| matches!(c, '\u{0E31}' | '\u{0E34}'..='\u{0E3A}' | '\u{0E47}'..='\u{0E4E}');
+    assert!(lines.iter().all(|s| s.chars().next().is_some_and(|c| !mark(c))), "a line starts with a mark: {lines:?}");
+}
+
+/// The desktop's dictionaries keep loanwords whole that a smaller model splits: โปรแกรม
+/// ("program").
+#[test]
+fn thai_loanwords_stay_whole() {
+    let text = "ยินดีต้อนรับสู่โปรแกรมวาดภาพเวกเตอร์";
+    let l = layout(db(), &area(text, style(12.0), Rect::new(0.0, 0.0, 70.0, 2000.0), Justify::Left));
+    let lines: Vec<&str> = l.lines.iter().map(|ln| &text[ln.start..ln.end]).collect();
+    // No line ends inside the word, whatever the Thai font's widths put beside it.
+    let word = text.find("โปรแกรม").unwrap();
+    assert!(l.lines.iter().all(|ln| ln.end <= word || ln.end >= word + "โปรแกรม".len()), "{lines:?}");
+}
@@ -569,3 +569,23 @@ fn family_display_name_follows_show_font_names_in_english() {
    let face = db.face("ヒラギノ角ゴシック", "Regular").unwrap();
    assert_eq!(face.family, "Hiragino Sans");
 }
+
+/// Thai typed in a font without Thai takes an installed font made for Thai (Leelawadee UI,
+/// Thonburi, Noto Sans Thai…), whatever other face covering Thai loaded first; Latin beside it keeps
+/// the font chosen. Skipped where none of those families is installed.
+#[test]
+fn thai_falls_back_to_a_font_made_for_thai() {
+    let db = FontDb::global();
+    let Some(thai) = crate::fontdb::THAI_FAMILIES.iter().find(|f| db.has_family(f)) else {
+        eprintln!("skipped: no Thai font installed");
+        return;
+    };
+    let st = vectorcraft_doc::CharStyle { size: 20.0, ..Default::default() };
+    let l = layout(db, &TextObject::point(kurbo::Point::ZERO, "Thai ภาษาไทย", st));
+    let family = |g: &PositionedGlyph| db.face_by_id(g.font_id).map(|f| f.family.clone()).unwrap_or_default();
+    let (latin, thai_glyphs) = l.glyphs.split_at(5);
+    assert!(latin.iter().all(|g| family(g) == FALLBACK_FAMILY), "{:?}", latin.iter().map(family).collect::<Vec<_>>());
+    let first = crate::fontdb::THAI_FAMILIES.iter().find(|f| thai_glyphs.iter().all(|g| family(g).eq_ignore_ascii_case(f)));
+    assert!(first.is_some(), "Thai drawn in {:?}; {thai} is installed", thai_glyphs.iter().map(family).collect::<Vec<_>>());
+    assert!(thai_glyphs.iter().all(|g| g.gid != 0), "no .notdef");
+}
@@ -791,3 +791,36 @@ fn proportional_metrics_set_full_width_glyphs_on_their_proportional_widths() {
    let moved = x0(&half)[1] - x0(&none)[1];
    assert!((moved - 10.0).abs() < 0.01, "〙's empty half goes past the line's end: あ moved {moved}");
 }
+
+/// The arrows pass a Thai consonant with its vowel and tone marks whole (น้ำ: no, mai tho, sara am),
+/// as an accented letter written with a combining mark; plain text moves a character at a time.
+#[test]
+fn caret_moves_over_whole_clusters() {
+    let s = "กน\u{0E49}\u{0E33}e\u{0301}x";
+    let stops: Vec<usize> = std::iter::successors(Some(0), |&i| (i < s.len()).then(|| edit::next_cluster(s, i))).collect();
+    assert_eq!(stops, [0, 3, 12, 15, 16]);
+    let back: Vec<usize> = std::iter::successors(Some(s.len()), |&i| (i > 0).then(|| edit::prev_cluster(s, i))).collect();
+    assert_eq!(back, [16, 15, 12, 3, 0]);
+    // Inside a cluster (a caret left there by a click), the arrows go to its edges.
+    assert_eq!((edit::prev_cluster(s, 6), edit::next_cluster(s, 6)), (3, 12));
+    assert_eq!((edit::next_cluster("", 0), edit::prev_cluster("ab", 99)), (0, 1));
+}
+
+/// Word steps and double-click stop between Thai words, which no space separates: ภาษา|ไทย|ง่าย.
+#[test]
+fn thai_words_are_words_to_the_caret() {
+    let s = "ภาษาไทยง่าย ok";
+    let (thai, easy) = ("ภาษา".len(), "ภาษาไทย".len());
+    let end = "ภาษาไทยง่าย".len();
+    assert_eq!(edit::next_word(s, 0), thai);
+    assert_eq!(edit::next_word(s, thai), easy);
+    assert_eq!(edit::next_word(s, easy), end);
+    assert_eq!(edit::prev_word(s, end), easy);
+    assert_eq!(edit::prev_word(s, easy), thai);
+    assert_eq!(edit::prev_word(s, thai), 0);
+    assert_eq!(edit::word_at(s, thai + 3), thai..easy, "double-click inside ไทย");
+    assert_eq!(edit::word_at(s, 0), 0..thai);
+    // Latin keeps its words.
+    assert_eq!(edit::word_at(s, s.len() - 1), end + 1..s.len());
+    assert_eq!(edit::next_word("hello world", 0), 5);
+}
@@ -4,6 +4,7 @@
 #   background = fetched after the app starts (fonts users pick by name)
 # Read by build.rs (the WEB_FONTS table) and `cargo xtask web-fonts` (copies the files, a Trunk hook).
 startup | Noto Sans Arabic | Regular
+startup | Noto Sans Thai | Regular
 background | Cairo | Regular
 background | Tajawal | ExtraLight
 background | Tajawal | Light
@@ -530,8 +530,10 @@ impl Tool for TypeTool {
                self.anchor = if word { edit::prev_word(&text, self.caret) } else { edit::prev_char(&text, self.caret) };
                self.replace(cx, "", None)
            }
+            // Backspace takes back one character (a mistyped Thai tone mark, say); Delete, the
+            // Left and Right arrows a whole cluster.
            ToolKey::Delete if self.caret < len => {
-                self.anchor = if word { edit::next_word(&text, self.caret) } else { edit::next_char(&text, self.caret) };
+                self.anchor = if word { edit::next_word(&text, self.caret) } else { edit::next_cluster(&text, self.caret) };
                self.replace(cx, "", None)
            }
            ToolKey::Left => {
@@ -549,7 +551,7 @@ impl Tool for TypeTool {
                    if lay.glyphs.iter().any(|g| g.rtl) {
                        vectorcraft_text::caret_horizontal(&lay, self.caret, false)
                    } else {
-                        edit::prev_char(&text, self.caret)
+                        edit::prev_cluster(&text, self.caret)
                    }
                };
                self.move_to(to, mods.shift)
@@ -569,7 +571,7 @@ impl Tool for TypeTool {
                    if lay.glyphs.iter().any(|g| g.rtl) {
                        vectorcraft_text::caret_horizontal(&lay, self.caret, true)
                    } else {
-                        edit::next_char(&text, self.caret)
+                        edit::next_cluster(&text, self.caret)
                    }
                };
                self.move_to(to, mods.shift)
@@ -84,17 +84,29 @@ const SAMPLES_PER_FRAME: usize = 4;
 const MAX_PENDING: usize = 8;
 /// What a sample shows when the font lacks the selected text's characters (or there is none).
 const FALLBACK_SAMPLE: &str = "Sample";
-/// The script filter's choices: all, Japanese, Latin.
-const SCRIPTS: usize = 3;
+/// The script filter's choices: all, Japanese, Latin, Thai.
+const SCRIPTS: usize = 4;

 fn script_label(i: usize) -> &'static str {
    match i {
        1 => tl!("Japanese"),
        2 => tl!("Latin"),
+        3 => tl!("Thai"),
        _ => tl!("All Scripts"),
    }
 }

+/// Does a family of `traits` pass script filter `script` ([`SCRIPTS`])? Latin: neither Japanese
+/// nor Thai.
+fn script_matches(script: usize, traits: vectorcraft_text::FontTraits) -> bool {
+    match script {
+        1 => traits.japanese,
+        2 => !traits.japanese && !traits.thai,
+        3 => traits.thai,
+        _ => true,
+    }
+}
+
 fn class_label(c: FontClass) -> &'static str {
    match c {
        FontClass::Serif => tl!("Serif / Mincho"),
@@ -283,7 +295,7 @@ fn list(ui: &mut Ui, state_id: egui::Id, st: &mut MenuState, current: &str, samp
                return true;
            }
            let traits = db.family_traits(f);
-            (st.script == 0 || (st.script == 1) == traits.japanese) && st.class.is_none_or(|c| c == traits.class)
+            script_matches(st.script, traits) && st.class.is_none_or(|c| c == traits.class)
        };
        let mut rows: Vec<Row> = vec![];
        for f in db.menu_family_list().iter().filter(|f| wanted(f)) {
@@ -748,6 +760,21 @@ pub(crate) fn sample_text(app: &VectorcraftApp) -> Option<String> {

 #[cfg(test)]
 mod tests {
+
+    /// The script filter: Thai lists families with Thai; Latin, those with neither Thai nor
+    /// Japanese.
+    #[test]
+    fn the_thai_filter_lists_fonts_with_thai() {
+        use vectorcraft_text::FontTraits;
+        let (thai, japanese, latin) =
+            (FontTraits { thai: true, ..Default::default() }, FontTraits { japanese: true, ..Default::default() }, FontTraits::default());
+        let passing = |t: FontTraits| (0..super::SCRIPTS).filter(|s| super::script_matches(*s, t)).collect::<Vec<_>>();
+        assert_eq!(passing(thai), [0, 3]);
+        assert_eq!(passing(japanese), [0, 1]);
+        assert_eq!(passing(latin), [0, 2]);
+        assert_eq!(super::script_label(3), "Thai");
+    }
+
    use super::{Row, remap_highlight};

    fn family(name: &str) -> Row {
@@ -1323,6 +1323,7 @@
 	Last Effect…	Letzter Effekt…
 	Last Page	Letzte Seite
 	Latin	Lateinisch
+	Thai	Thai
 	Latin Extended	Lateinisch, erweitert
 	Latin-1 Supplement	Lateinisch-1, Ergänzung
 	Layer	Ebene
@@ -2101,6 +2102,9 @@
 	Redefine Symbol	Symbol neu definieren
 	Redefine {kind} Style	{kind}format neu definieren
 	Redo	Wiederholen
+	List Folder	Ordner auflisten
+	Begin Undo Group	Rückgängig-Gruppe beginnen
+	End Undo Group	Rückgängig-Gruppe beenden
 	Redo {name}	Wiederholen: {name}
 	Redo {}	Wiederholen: {}
 	Reduce Colors	Farben reduzieren
@@ -1341,6 +1341,7 @@
 	Last Effect…	Último efecto…
 	Last Page	Última página
 	Latin	Latín
+	Thai	Tailandés
 	Latin Extended	Latín extendido
 	Latin-1 Supplement	Suplemento Latín-1
 	Layer	Capa
@@ -2152,6 +2153,9 @@
 	Redefine Symbol	Redefinir símbolo
 	Redefine {kind} Style	Redefinir estilo de {kind}
 	Redo	Rehacer
+	List Folder	Listar carpeta
+	Begin Undo Group	Iniciar grupo de deshacer
+	End Undo Group	Finalizar grupo de deshacer
 	Redo {name}	Rehacer {name}
 	Redo {}	Rehacer {}
 	Reduce Colors	Reducir colores
@@ -1340,6 +1340,7 @@
 	Last Effect…	Dernier effet…
 	Last Page	Dernière page
 	Latin	Latin
+	Thai	Thaï
 	Latin Extended	Latin étendu
 	Latin-1 Supplement	Supplément Latin-1
 	Layer	Calque
@@ -2149,6 +2150,9 @@
 	Redefine Symbol	Redéfinir le symbole
 	Redefine {kind} Style	Redéfinir le style de {kind}
 	Redo	Rétablir
+	List Folder	Lister le dossier
+	Begin Undo Group	Commencer un groupe d’annulation
+	End Undo Group	Terminer le groupe d’annulation
 	Redo {name}	Rétablir {name}
 	Redo {}	Rétablir {}
 	Reduce Colors	Réduire les couleurs
@@ -1341,6 +1341,7 @@
 	Last Effect…	Ultimo effetto…
 	Last Page	Ultima pagina
 	Latin	Latino
+	Thai	Thailandese
 	Latin Extended	Latino esteso
 	Latin-1 Supplement	Supplemento Latino-1
 	Layer	Livello
@@ -2152,6 +2153,9 @@
 	Redefine Symbol	Ridefinisci simbolo
 	Redefine {kind} Style	Ridefinisci stile {kind}
 	Redo	Ripeti
+	List Folder	Elenca cartella
+	Begin Undo Group	Inizia gruppo di annullamento
+	End Undo Group	Termina gruppo di annullamento
 	Redo {name}	Ripeti {name}
 	Redo {}	Ripeti {}
 	Reduce Colors	Riduci colori
@@ -48,6 +48,7 @@
 	Hard	強い禁則
 	Soft	弱い禁則
 	Latin	欧文
+	Thai	タイ文字
 	Monospaced	等幅
 	Roman Baseline	欧文ベースライン
 	Rounded	丸ゴシック
@@ -101,6 +102,9 @@
 	Edit	編集
 	Undo	取り消し
 	Redo	やり直し
+	List Folder	フォルダーの内容を一覧表示
+	Begin Undo Group	取り消しグループを開始
+	End Undo Group	取り消しグループを終了
 	Cut	切り取り
 	Copy	コピー
 	Paste	貼り付け
@@ -1339,6 +1339,7 @@
 	Last Effect…	Последний эффект…
 	Last Page	Последняя страница
 	Latin	Латиница
+	Thai	Тайская
 	Latin Extended	Расширенная латиница
 	Latin-1 Supplement	Дополнение Latin-1
 	Layer	Слой
@@ -2148,6 +2149,9 @@
 	Redefine Symbol	Переопределить символ
 	Redefine {kind} Style	Переопределить стиль {kind}
 	Redo	Повторить
+	List Folder	Показать содержимое папки
+	Begin Undo Group	Начать группу отмены
+	End Undo Group	Завершить группу отмены
 	Redo {name}	Повторить {name}
 	Redo {}	Повторить {}
 	Reduce Colors	Сократить число цветов
@@ -1335,6 +1335,7 @@
 	Last Effect…	Останній ефект…
 	Last Page	Остання сторінка
 	Latin	Латиниця
+	Thai	Тайська
 	Latin Extended	Розширена латиниця
 	Latin-1 Supplement	Додаток Latin-1
 	Layer	Шар
@@ -2144,6 +2145,9 @@
 	Redefine Symbol	Перевизначити символ
 	Redefine {kind} Style	Перевизначити стиль {kind}
 	Redo	Повторити
+	List Folder	Показати вміст теки
+	Begin Undo Group	Почати групу скасування
+	End Undo Group	Завершити групу скасування
 	Redo {name}	Повторити {name}
 	Redo {}	Повторити {}
 	Reduce Colors	Скоротити кількість кольорів
@@ -2077,6 +2077,9 @@
 	Redefine Symbol	重新定义符号
 	Redefine {kind} Style	重新定义{kind}样式
 	Redo	重做
+	List Folder	列出文件夹
+	Begin Undo Group	开始还原组
+	End Undo Group	结束还原组
 	Redo {name}	重做 {name}
 	Redo {}	重做 {}
 	Reduce Colors	减少颜色
@@ -3414,6 +3417,7 @@
 	Graphics: {adapter}	显卡：{adapter}
 	Japanese	日文
 	Latin	拉丁文
+	Thai	泰文
 	Layer Options	图层选项
 	Layers Panel Options	图层面板选项
 	Monospaced	等宽
@@ -1316,6 +1316,7 @@
 	Last Effect…	最後一次效果…
 	Last Page	最後一頁
 	Latin	拉丁文
+	Thai	泰文
 	Latin Extended	拉丁文擴充
 	Latin-1 Supplement	拉丁文-1 補充
 	Layer	圖層
@@ -2130,6 +2131,9 @@
 	Redefine Symbol	重新定義符號
 	Redefine {kind} Style	重新定義{kind}樣式
 	Redo	重做
+	List Folder	列出資料夾
+	Begin Undo Group	開始還原群組
+	End Undo Group	結束還原群組
 	Redo {name}	重做 {name}
 	Redo {}	重做 {}
 	Reduce Colors	縮減顏色
@@ -614,6 +614,7 @@ fn frame_at(app: &mut VectorcraftApp, ctx: &egui::Context, time: f64) -> std::ti
 /// for) or until `done` → whether it was.
 fn idle(app: &mut VectorcraftApp, ctx: &egui::Context, time: &mut f64, secs: f64, done: &dyn Fn(&VectorcraftApp) -> bool) -> bool {
    let end = *time + secs;
+    let real_end = std::time::Instant::now() + std::time::Duration::from_secs(20);
    loop {
        let wait = frame_at(app, ctx, *time);
        if done(app) {
@@ -624,9 +625,11 @@ fn idle(app: &mut VectorcraftApp, ctx: &egui::Context, time: &mut f64, secs: f64
            *time = end;
            return false;
        }
-        if app.session.link_scan.is_some() {
-            // The look runs on a worker thread, in real time.
+        // The look runs on a worker thread, in real time: the clock waits for it, else a busy
+        // machine's slow look outlasts the simulated seconds and the test fails at random.
+        if app.session.link_scan.is_some() && std::time::Instant::now() < real_end {
            std::thread::sleep(std::time::Duration::from_millis(5));
+            continue;
        }
        *time = next;
    }
@@ -36,6 +36,11 @@ nowhere and Windows device names are refused. A root left out grants none of its
 existing folders, or the app doesn't start; without `--control` they are ignored. See `docs/mcp.md`
 › Confining file access for the details.

+Each root flag may be given once; a command-line root overrides its environment default. Missing or
+empty values, another option used as a value, and duplicate flags stop the desktop before it starts
+any services, even without `--control`. For a folder name starting with `-`, use `--flag=-folder`
+or the relative path `./-folder`.
+
 What is confined: the requests themselves, the frames that carry input they inject (`ui.click`, `ui.key`,
 `ui.text`…, so a menu item an agent clicks is confined too), the background saves and exports they start,
 and window captures. The person at the keyboard is not: files opened from the command line, Finder or a
@@ -133,6 +133,8 @@ CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo xtask ci   # also runs the Japanese-
  embed everywhere, was 8.7 MB, so the web build is still smaller than before.
 - Document text: the Japanese faces join the font database after the bundled fonts (Mincho first),
  so they are the fallback for Japanese after the requested font; installed system fonts come after.
+  Noto Sans Thai (when the checkout has it) is the fallback for Thai where no Thai font is
+  installed, and the web build fetches it before the app starts (`crates/text/web-fonts.txt`).
 - UI: `theme::install_fonts` adds them at the end of every egui family (BIZ UDPGothic first), after
  the UI fonts and before the installed fonts `ui_fonts.rs` discovers for other scripts.
 - Tests that need Japanese glyphs skip with a message when built without craft-fonts. The FreeBSD
@@ -1,6 +1,6 @@
 # Effects parity

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (Zig Zag's dialog with sliders and radio buttons, #1133; earlier: Brush Strokes landed) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (PDF raster-effect resolution-cap warnings; Zig Zag's dialog with sliders and radio buttons, #1133; earlier: Brush Strokes landed) · **Target:** Adobe Illustrator 2026 (30.x)

 Every entry of Illustrator's Effect menu, by its public feature name, against VectorCraft's effects catalogue
 (`effect_catalog()` in `crates/effects/src/lib.rs`) and the Effect menu built from it
@@ -30,7 +30,9 @@ Part of [target-app-parity.md](target-app-parity.md); open work is in [gaps.md](
 | SVG Filters | Apply SVG Filter… and the filter list | 0/1 | the whole submenu (SVG filters on import round-trip already) |
 | Warp | Arc, Arc Lower, Arc Upper, Arch, Bulge, Shell Lower, Shell Upper, Flag, Wave, Fish, Rise, Fisheye, Inflate, Squeeze, Twist | 15/15 | warp point editing in envelopes |

-Document Raster Effects Settings exists.
+Document Raster Effects Settings exists. When the 64 million pixel cap on an effect image lowers
+its resolution, PDF export warns once per object with the requested and the lowest achieved ppi
+(`crates/engine/src/tests_pdfraster.rs`).

 ## Photoshop effects

@@ -72,6 +74,7 @@ rendering, Turntable, 3D export) is 45–75 h, still the largest single gap.

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | PDF cap warnings identify original objects after appearance splitting and report the lowest achieved ppi; cap/rendering and scores unchanged |
 | 2026-10-11 | minor | Zig Zag's dialog: Size and Ridges per segment sliders, Points as Smooth / Corner radio buttons (#1133) |
 | 2026-10-11 | minor | Brush Strokes landed (8 filters): 28/57 Photoshop effects |
 | 2026-10-10 | minor | Initial Revolve landed (#846) |
@@ -69,6 +69,7 @@ the suite) keep the agent to the folders you give it:
 - Every file a command writes must lie inside the **write root**: `save_file`, `export`, the save and
  export commands, Export for Screens, Package, Export for Web, print to file, `screenshot {path}`,
  library and preset saves to a path.
+- `file.list {path}` (through `run_command`) lists a folder's files and folders, held to the read root like any read, so an agent can see what it was given (#1163).
 - Read and write access are separate. Give the same folder twice for both; a root left out grants none
  of its access (with only `--automation-read-root`, nothing can be written to disk, though `export` and
  the save commands without a path still return the bytes). Without either flag nothing changes.
@@ -235,9 +236,9 @@ The older names below remain listed because existing workflows use them.
 |---|---|
 | `command_list` | Optional `filter`, `enabled_only`; returns the command array |
 | `command_run` | `id`, optional `params`; runs the command through the existing backend |
-| `command_batch` | `steps: [{id, params?}]`, optional `stop_on_error` (default true); returns `completed`, `failed`, `results: [{ok, result\|error}]`. Each edit has its own undo step; failures set `isError`. A param string `"$N.path"` or `"$last.path"` takes a value from an earlier step's result (see `run` below) |
+| `command_batch` | `steps: [{id, params?}]`, optional `stop_on_error` (default true), `atomic` and `label`; returns `completed`, `failed`, `results: [{ok, result\|error}]`. Each edit has its own undo step, or with `atomic: true` the batch's edits are one undo step named `label` (else after its first edit; `edit.undoGroup.begin`/`end` underneath); failures set `isError`. A param string `"$N.path"` or `"$last.path"` takes a value from an earlier step's result (see `run` below) |
 | `doc_inspect` | Optional `depth`, `childLimit`; same summary as `inspect_document` |
-| `render_preview` | Optional `max_side` (1–4096, default 1024); inline PNG of the first artboard without editing it. Artboards too large to render within the allocation bound return a tool error |
+| `render_preview` | Optional `max_side` (1–4096, default 1024) and `artboard` (0-based, default 0); inline PNG of that artboard without editing it. Artboards too large to render within the allocation bound return a tool error |
 | `ui_inspect`, `ui_screenshot` | Connected desktop state/window capture; tool errors in headless mode |

 Every tool declares read-only, destructive, idempotent and open-world hints. File-writing
@@ -253,6 +254,9 @@ explicit `ids`.

 Paint values (`fill`, `stroke`) accept `"#rrggbb"`, `"none"`, `[r,g,b]` (0..1), `{"c","m","y","k"}`, `{"gray"}`,
 or a full `paint.setFill` params object (`{"gradient": …}`, `{"swatch": "name"}`).
+For `draw_shape` and `draw_path`, omitted paint fields inherit the current [new-art appearance](#new-art).
+For a filled shape or path without an outline, pass an explicit `fill` and `stroke: "none"`.
+Lines start with no fill and a visible stroke.
 The Fill/Stroke proxy commands run through `run_command`: `paint.invert` and `paint.complement` recolour the active
 proxy keeping each colour's model, `paint.lastColor` / `paint.lastGradient` re-apply the last solid colour or gradient,
 and `paint.recent` returns the recent colours that every paint command (and the eyedropper) feeds.
@@ -286,6 +290,9 @@ objects' fills or strokes differ (`fillMixed` / `strokeMixed`, drawn as a "?" pr
 | `text_wrap` | `{ids?, offset?, invert?, release?}` | Area type below the objects (same layer) flows around them. |
 | `undo` / `redo` | `{}` | Many calls that change nothing record no undo step, for example `object.align` with nothing to move, `object.move` by 0 without `copy` and `object.showAll` with nothing hidden. `undo` (`edit.undo`) after such a call undoes the step before it. `inspect_document` lists the undo steps as `history`. |

+For SVG/SVGZ, `export`'s top-level `outlineText: true` writes text as paths; DXF takes it too (its type is outlined anyway unless `preserve: editability`).
+PDF instead uses `options: {"advanced": {"outlineText": true}}`; its default is false (live text).
+
 With `mods.shift`, a marquee dragged with the Selection tool toggles the objects it reaches (the selected ones leave
 the selection, the others join it, the rest stays), and one dragged with Direct or Group Selection toggles the anchors
 inside it (a path left with none leaves the selection, one with all of them is selected whole). The Lasso adds anchors
@@ -1693,6 +1700,7 @@ a pin back restores the original; every pin must be on the art's mesh, and empty

 ## New art

+Initially (and after `paint.default`) new art has a white fill and a 1 pt black stroke.
 New objects take the fill and stroke proxies (`paint.setFill` / `paint.setStroke` and the weight, whatever is
 selected) on top of a template. With nothing selected, `stroke.set` / `stroke.setAdvanced` (cap, join, dashes,
 arrowheads, profile…) and `graphicStyle.apply` (every fill, stroke and effect, opacity, blend mode and the link to the
@@ -1,6 +1,6 @@
 # Roadmap: milestones and what's next

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (G11 and Current focus: #893 fixed, #937 open; M7: accurate character controls after object/group scaling, #1034) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M9: PDF raster-effect cap warnings; G11: #893 fixed, #937 open; M7: accurate character controls after scaling, #1034; estimates unchanged) · **Target:** Adobe Illustrator 2026 (30.x)

 Forward-looking plan. Where VectorCraft stands is in [`ROADMAP.md`](../ROADMAP.md) and
 [target-app-parity.md](target-app-parity.md); the ranked work list is [gaps.md](gaps.md). Hours are Opus 5.5
@@ -56,7 +56,7 @@ Checked 2026-10-10 from the code, tests and open issues; no workflow fails, so V
 | M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
 | M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Document-point character controls after object/group scaling (#1034; optional font-size preservation remains separate), Character/Paragraph Styles, per-paragraph paragraph attributes, Area Type Options (with Width/Height, Auto Size and Shrink Text to Fit; overflow reported to agents and vertical Align), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel (Above Text floats it over the selected text, its ruler at the canvas zoom so stops line up with the columns, #729), inline symbols in text (beyond parity), Hebrew/Arabic bidirectional text, Paragraph Direction, Every-line/Single-line Composer per object (ragged text too) done; tab leaders, spell check, vertical type pending | 45–60 |
 | M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
-| M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder, Color Adjustments and Document Raster Effects Settings; initial Revolve only; SVG Filters, remaining raster effects and 3D pending | 81–130 |
+| M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder, Color Adjustments and Document Raster Effects Settings; PDF export warns when the pixel cap lowers raster-effect resolution; initial Revolve only; SVG Filters, remaining raster effects and 3D pending | 81–130 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
 | M11 | Artboards & views (artboard panel/tool with Move Artwork for X/Y fields and Artboard Options, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
 | M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (13 presets, 18 ms/1k² image; the Flat Logo mode places edges to a fraction of a pixel, restores sharp corners, snaps lines and circles, and refuses gradients), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, group-selected series colours persist through regenerate/save/open) done; graph Design/Column/Marker designs pending | 6–10 |
@@ -79,6 +79,7 @@ After placed documents (File › Place of a `.vectorcraft` file, linked), M4.14

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | M9: PDF raster-effect resolution-cap warnings verified with real capped/uncapped exports; scores and hours unchanged |
 | 2026-10-11 | minor | #893 (Shape Builder seams on grids of lines) fixed; G11 keeps #937 and its 8–15 h |
 | 2026-10-10 | minor | M7: document-point character sizes, leading and baseline shift, and resettable horizontal stretching after object/group scaling (#1034). Optional group font-size preservation remains separate; scores/hours unchanged. |
 | 2026-10-10 | minor | M9 row from main: initial Revolve |
@@ -1,6 +1,6 @@
 # Parity with Adobe Illustrator

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (Drawing tools: Live Corners round corners between curved sides, #1144; Type advanced: proportional vertical metrics (`vpal`) done, #966; Shape Builder: #893 fixed, merged regions of crossing lines no longer keep seams; scores unchanged while #937 is open; #1034: document-point character controls after object/group scaling; full readiness recomputed as the standard's additive weighted sum, ~62%; per-audience hours; essentials-user score ~75% added; ready-for-real-work re-examined: 50% → 55%, mainstream 65% added; earlier the same day: full re-measure against Illustrator 2026 30.x; merged the ROADMAP's parity estimate, honest assessment and "Shipped so far" into this file) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (PDF export warns when the pixel cap lowers raster-effect resolution; Drawing tools: Live Corners round corners between curved sides, #1144; Type advanced: proportional vertical metrics (`vpal`) done, #966; Shape Builder: #893 fixed, merged regions of crossing lines no longer keep seams; scores unchanged while #937 is open; #1034: document-point character controls after object/group scaling; full readiness recomputed as the standard's additive weighted sum, ~62%; per-audience hours; essentials-user score ~75% added; ready-for-real-work re-examined: 50% → 55%, mainstream 65% added; earlier the same day: full re-measure against Illustrator 2026 30.x; merged the ROADMAP's parity estimate, honest assessment and "Shipped so far" into this file) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026)

 The authoritative parity assessment. [`ROADMAP.md`](../ROADMAP.md) summarizes it; [`gaps.md`](gaps.md) is
 the work list made from it. Deep areas have their own checklists: [UI and interaction](ui-parity.md),
@@ -455,11 +455,13 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
 - **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so any GPU that can show the window will do. Preferences › Performance › Graphics Processor (`gpuPreference`) is Automatic by default: the power-saving GPU on Windows and macOS (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306), and the GPU the desktop runs on under Linux, where KWin on an NVIDIA GPU refused frames from a Ryzen's integrated GPU and 0.5.0 crashed at startup (#502). Power Saving and High Performance pick a kind of GPU; `WGPU_POWER_PREF`, `WGPU_ADAPTER_NAME` and `WGPU_BACKEND` override them. The app picks among the adapters that can present to the window (native backends before OpenGL, hardware before software, and on Windows a GPU's DX12 adapter before its Vulkan one: Intel's Vulkan driver made the whole window flicker black, #545), and if the window fails on one while starting up it starts again without it instead of crashing; Help › About, `ui.inspect` and the log name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).
+- **Raster-effect resolution in PDF:** when the 64 million pixel cap on an effect image renders an object's raster effects below the document's raster effects resolution, PDF export warns once per object with the requested and the lowest achieved ppi (`crates/engine/src/tests_pdfraster.rs`).

 ## Revision history

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | PDF raster-effect cap reductions are reported per original object with requested/achieved ppi; scores and hours unchanged |
 | 2026-10-11 | minor | Platforms: Preferences › Performance › Linux Display Server opens the window through XWayland, where file drops work (#1151); score unchanged (estimated) |
 | 2026-10-11 | minor | Drawing tools: Live Corners on corners between curved sides (#1144) leaves the missing list; score and hours unchanged at this rounding (estimated) |
 | 2026-10-11 | minor | Type advanced: Proportional Metrics in vertical type (`vpal`, #966) leaves the missing list; score and hours unchanged at this rounding (estimated) |
@@ -1,6 +1,6 @@
 # Type parity

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (Proportional Metrics in vertical type, `vpal`, #966; document-point character controls after object/group scaling, #1034) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (the font menu's script filter lists Thai fonts; Thai, Lao, Khmer and Myanmar lines break between words; the caret steps over whole clusters such as Thai consonants with their marks; Thai typed in a font without Thai falls back to a font made for Thai; earlier: Proportional Metrics in vertical type, `vpal`, #966) · **Target:** Adobe Illustrator 2026 (30.x)

 Type is Illustrator's largest single area by use (weight 13 of 105 across "Type core" and "Type advanced" in
 [target-app-parity.md](target-app-parity.md)). This checklist lists the features one by one. Status is from the
@@ -26,7 +26,9 @@ against Illustrator's public documentation; **estimated** unless noted.
 | Character size and horizontal scale after object/group scaling | done | #1034: fields and setters compensate the stored affine; point size follows the transformed em-height axis, not the glyph ink bounds. Range edits, keyboard increments, leading and baseline shift use document points; rotation, reflection and shear remain editable. |
 | Preserve font sizes while scaling a group | missing | Separate enhancement; scaling still scales text with the other artwork. |
 | OpenType panel, Glyphs panel, alternates | done | Highlight Alternate Glyphs preference unused (#394) |
+| Font menu: samples, live preview, filters, favourites; font matching by any name; Find Font | done | #339; script filter: Japanese, Latin, Thai |
 | Font menu: samples, live preview, filters, favourites; font matching by any name; Find Font | done | #339 |
+| Missing glyphs set in an installed font made for their script (Thai, Lao, Khmer, Myanmar first; then any font that has them) | done | Thai: Leelawadee UI, Tahoma, Thonburi, Sukhumvit Set, Noto Sans Thai, TLWG |
 | Variable fonts | partial | named instances as styles; axis sliders missing |
 | Colour fonts (OpenType SVG / COLR) | partial | |
 | Every-line and Single-line composers | done | tuned by eye, never compared side by side |
@@ -36,9 +38,11 @@ against Illustrator's public documentation; **estimated** unless noted.
 | Hidden characters (Show Hidden Characters) | done | `type.hiddenCharacters` |
 | Spell check (Check Spelling, Auto Spell Check, custom dictionary) | missing | menu stubs; needs an openly licensed dictionary |
 | Smart Punctuation, Change Case, Find & Replace | done | |
+| Caret: the arrows and Delete step over whole clusters (Thai consonant with its marks, combining accents, emoji); Backspace removes one character | done | |
 | Touch Type tool | missing | listed in the toolbar, not implemented |
 | Retype (identify fonts in outlines/images) | missing | Illustrator's uses a cloud model |
 | Snap to Glyph | missing | menu stub |
+| Thai, Lao, Khmer, Myanmar: shaping (marks, reordering), lines broken between words, word-by-word caret and double-click | done | words found by ICU4X's line segmenter: dictionaries on the desktop, LSTM models on the web |
 | Middle Eastern: bidirectional layout, Paragraph Direction | done | |
 | Middle Eastern: Character Direction, digit types, kashidas, Middle Eastern composers, split caret | missing | |
 | CJK: input methods (marked text, candidate window) | done | |
@@ -51,6 +55,11 @@ against Illustrator's public documentation; **estimated** unless noted.

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | Thai, Lao, Khmer and Myanmar words for the caret (Ctrl/Alt+arrows) and double-click; combining marks count as part of a word; score unchanged (estimated) |
+| 2026-10-11 | minor | Font menu: a Thai script filter beside Japanese and Latin; score unchanged (estimated) |
+| 2026-10-11 | minor | Thai, Lao, Khmer and Myanmar text breaks its lines between words (ICU4X line segmenter) instead of only at spaces; score unchanged (estimated) |
+| 2026-10-11 | minor | The Type tool's arrows and Delete move by grapheme cluster, never between a Thai consonant and its vowel or tone marks; score unchanged (estimated) |
+| 2026-10-11 | minor | Thai (Lao, Khmer, Myanmar) missing from the font in use falls back to an installed font made for the script instead of whichever face covering it loaded first; score unchanged (estimated) |
 | 2026-10-11 | minor | Proportional Metrics done: `palt` in horizontal type, `vpal` in vertical type (#966, #1082); ruby and manual tate-chu-yoko still missing |
 | 2026-10-10 | minor | #1034: transformed character controls and regression coverage; preserving group font sizes remains a separate enhancement. Scores/hours unchanged at this rounding. |
 | 2026-10-10 | major | First checklist, split out of the parity table's Type core and Type advanced rows |
Author	SHA1	Message	Date
bflatastic	6f4049494d	Test: the idle place test waits for the link scan in real time tests_place::a_file_placed_while_idle_follows_its_changes failed at random in CI (twice on 2026-10-11): while the link scan ran on its worker thread, the test's clock moved on by whole simulated seconds per 5 ms of real time, so on a busy machine the 10 simulated seconds ran out before the scan had read the changed file. The clock now waits for the scan (up to 20 real seconds).	2026-10-11 22:02:50 +07:00
BFlat	29bad213f8	Merge pull request #1213 from storytold/fix/1197-compound-holes #1197: Make Compound Path cuts holes where paths overlap	2026-10-11 22:02:36 +07:00
bflatastic	7f35522b15	#1197 : Make Compound Path cuts holes where paths overlap Make Compound Path kept each path's direction under the non-zero fill rule, so a shape drawn inside or across another, running the same way, left the overlap filled instead of making a hole. The paths in front of the backmost one now run against it, so where they overlap it they cut holes, as users expect from a compound path.	2026-10-11 21:32:23 +07:00
BFlat	3b60d0ceb6	Merge pull request #1204 from storytold/ci/craft-fonts-pin Release: embed the current craft-fonts (Thai, Arabic, Chinese)	2026-10-11 20:57:47 +07:00
bflatasticandClaude Opus 5.5	947b294f87	Release: embed the current craft-fonts (Thai, Arabic, Chinese) Releases pinned craft-fonts at its first commit, with the Japanese fonts only. The pin moves to its current main, as PdfCraft, LightCraft and WordCraft have moved theirs: desktop builds embed Noto Sans Thai, Noto Sans Arabic and Noto Sans CJK SC too (the web build still embeds only the UI font and fetches Thai and Arabic beside the wasm). Packages already copy every embedded font's licence. The Thai loanword test no longer assumes the bundled fonts' widths: it checks that no line ends inside โปรแกรม, whichever Thai font sets it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 20:47:46 +07:00
BFlat	434b47d9c4	Merge pull request #1195 from storytold/fix/thai-word-navigation Type: the caret and double-click take Thai word by word	2026-10-11 20:07:03 +07:00
bflatasticandClaude Opus 5.5	a08ca07c69	Type: the caret and double-click take Thai word by word Ctrl/Alt+arrows and double-click treated a run of Thai (Lao, Khmer, Myanmar) without spaces as one word, and stopped at a word's tone and vowel marks, which didn't count as part of a word. They now stop at the word boundaries the line segmenter finds in those scripts (shared with line breaking, so no more data ships), and combining marks count as part of a word, also for combining accents in other scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 20:06:39 +07:00
BFlat	d17c07f343	Merge pull request #1191 from storytold/fix/thai-craft-font Type: Noto Sans Thai from craft-fonts is the Thai fallback, on the web too	2026-10-11 19:52:51 +07:00
bflatasticandClaude Opus 5.5	70e99987e9	Type: Noto Sans Thai from craft-fonts is the Thai fallback, on the web too The web build has no installed fonts, so Thai there showed as empty boxes. With a craft-fonts checkout that has Noto Sans Thai, its Thai font joins the document font database after the Arabic ones (the fallback for Thai where no Thai font is installed) and the web build fetches it before the app starts, as it does Noto Sans Arabic. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 19:52:08 +07:00
BFlat	7a85f6050d	Merge pull request #1190 from storytold/fix/thai-font-filter Font menu: a Thai script filter	2026-10-11 19:51:53 +07:00
bflatasticandClaude Opus 5.5	cc2f45b129	Font menu: a Thai script filter The font menu's script filter offered Japanese and Latin only, so Thai fonts had to be found by name among every installed family. It now has Thai too: the families whose character map has Thai. Latin lists the families with neither Japanese nor Thai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 19:51:32 +07:00
BFlat	fe8af48fa7	Merge pull request #1188 from storytold/fix/thai-line-breaks Type: Thai, Lao, Khmer and Myanmar lines break between words	2026-10-11 19:33:29 +07:00
bflatasticandClaude Opus 5.5	5a855971aa	Type: Thai, Lao, Khmer and Myanmar lines break between words These scripts don't separate words with spaces, and lines only broke at spaces, hyphens and CJK characters, so a Thai paragraph in area type ran on to the next space (or was cut wherever it overflowed). Each paragraph's glyphs now carry the word ends ICU4X's line segmenter finds in text of those scripts (its dictionaries on the desktop, its far smaller LSTM models on the web), and a line may break after them as after a space. Other text keeps its own breaks, and clusters (a consonant with its vowel and tone marks) still never split. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 19:31:37 +07:00
BFlat	36494d0385	Merge pull request #1187 from storytold/docs/type-parity-status Docs: type parity has one status line again	2026-10-11 19:30:25 +07:00
bflatasticandClaude Opus 5.5	2cfee9b99b	Docs: type parity has one status line again Two branches' status lines both landed in a merge; they are one line again, naming both changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 19:30:12 +07:00
BFlat	90bd91986a	Merge pull request #1186 from storytold/fix/thai-caret-clusters Type: the caret steps over whole clusters (Thai marks, accents, emoji)	2026-10-11 19:29:37 +07:00
bflatasticandClaude Opus 5.5	3fb51869ac	Type: the caret steps over whole clusters (Thai marks, accents, emoji) The Type tool's Left and Right arrows and Delete moved one code point at a time, so the caret could stop between a Thai consonant and its vowel or tone marks (or inside an accented letter or emoji sequence), where typing or deleting splits the cluster. They now step over extended grapheme clusters. Backspace still takes back one character at a time, as Thai typists expect for a mistyped tone mark. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 19:29:16 +07:00
BFlat	436d7ecdd3	Merge pull request #1185 from storytold/fix/thai-font-fallback Type: Thai falls back to a font made for Thai	2026-10-11 19:28:58 +07:00
bflatasticandClaude Opus 5.5	fba3702103	Type: Thai falls back to a font made for Thai Thai typed in a font without Thai glyphs (Source Sans 3, a Latin font) took the first loaded face that had them, or the first installed file that did, in path order: on one Windows machine a display face (Kanit) rather than Leelawadee UI. Characters of Thai, Lao, Khmer and Myanmar now try fonts made for their script first, installed ones loaded on demand (Leelawadee UI, Tahoma, Thonburi, Sukhumvit Set, Noto Sans Thai, the TLWG fonts for Thai), then the fallback as before. Latin beside them keeps the font chosen. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:42:31 +07:00
BFlat	7c7a7dcdc9	Merge pull request #1181 from storytold/fix/1163-file-list #1163: file.list lists a folder for agents, held to the read root	2026-10-11 18:35:45 +07:00
bflatasticandClaude Opus 5.5	339b01f48b	#1163 : file.list lists a folder for agents, held to the read root An agent driving VectorCraft over the confined MCP server had no way to see which files it was given, so it guessed names. `file.list {path}` lists a folder's files (with their sizes) and folders by name, held to the automation read root like every read; links are listed as links and not followed. At most 5000 entries, with `truncated` saying when there were more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:35:23 +07:00
BFlat	6d07135456	Merge pull request #1179 from storytold/fix/1163-atomic-batch #1163: command_batch can be one undo step	2026-10-11 18:22:58 +07:00
bflatasticandClaude Opus 5.5	ed80181d70	#1163 : command_batch can be one undo step An agent's build over MCP left one undo step per batch step (about 280 for one job). `command_batch` takes `atomic: true` (and an optional `label` naming the step) to make the whole batch one undo step. It runs the batch in an undo group, opened and closed by the new commands `edit.undoGroup.begin {label?}` and `edit.undoGroup.end {cancel?}`, so every backend (headless or the connected app) supports it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:22:45 +07:00
BFlat	24eaf5e037	Merge pull request #1147 from KnottyDyes/squad/raster-effect-resolution-warning PDF export: warn when raster effects render below the requested resolution	2026-10-11 18:18:02 +07:00
bflatasticandClaude Opus 5.5	4603ebec7a	Review: report module beside rasterfx, ids checked without a tree walk, docs trimmed (#1147 ) The report module moves to cmd/rasterfx/report.rs (the crate's foo.rs + foo/ layout instead of #[path]). An object is the document's when its id is below the document's next id, so building the report no longer walks the whole document (and its symbols and patterns) on every PDF, SVG, print and clipboard export. The parity docs say what changed in the status line and one evidence bullet instead of a separate paragraph. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:17:25 +07:00
KnottyDyes	8d881cc0bc	PDF export: warn when raster effects render below the requested resolution The 64 million pixel cap can silently lower raster-effect resolution. Report each original object's id and name with requested and achieved ppi through the existing export warnings, retaining the lowest resolution across its images. Keep the cap and rendering unchanged, cover capped and uncapped exports, and record the evidence without changing parity scores.	2026-10-11 18:17:25 +07:00
BFlat	2ecc83e700	Merge pull request #1178 from storytold/review/1157-followup Review: house header for the root-argument integration test (#1157)	2026-10-11 18:17:11 +07:00
bflatasticandClaude Opus 5.5	731c30ff6d	Review: house header for the root-argument integration test (#1157 ) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:16:43 +07:00
BFlat	71b7ae3d56	Merge pull request #1157 from piero-83/ll-root-preflight Reject malformed desktop automation root arguments before startup	2026-10-11 18:15:54 +07:00
BFlat	6eaaccb717	Merge pull request #1148 from KnottyDyes/squad/new-art-paint-docs MCP: drawing tools describe inherited paint and export text options	2026-10-11 18:15:10 +07:00
bflatasticandClaude Opus 5.5	805d30e284	Review: DXF outlineText note and new-art wording in the MCP docs (#1148 ) DXF already outlines type unless preserve: editability, so say so next to the outlineText flag; reword the new-art sentence and point to paint.default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:14:25 +07:00
KnottyDyes	4505ccb20d	MCP: drawing tools describe inherited paint and export text options Omitted paint fields keep the current appearance, so agents can get a black outline when they only set a fill. Document the initial white fill and 1 pt black stroke and recommend explicit paint for outline-free art. Clarify SVG/SVGZ outlineText versus PDF options.advanced.outlineText and PDF's live-text default, noting DXF also accepts the top-level flag. Descriptions and documentation only; drawing and export behavior are unchanged.	2026-10-11 18:14:23 +07:00
BFlat	433c8d5aa7	Merge pull request #1177 from storytold/fix/1163-preview-artboard #1163: MCP render_preview takes an artboard index	2026-10-11 18:13:36 +07:00
bflatasticandClaude Opus 5.5	c3719b2e79	#1163 : MCP render_preview takes an artboard index render_preview only rendered the first artboard, so an agent couldn't look at pages 2 and on of a multi-artboard document without switching to screenshot. It now takes an optional 0-based `artboard` (as screenshot does) and refuses an index the document doesn't have. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 18:13:26 +07:00
BFlat	9aed6191d4	Merge pull request #1176 from storytold/fix/1163-release-subpaths #1163: Release splits a path of several subpaths into one path each	2026-10-11 17:58:25 +07:00
piero-83	87a9fb06cd	docs: explain strict automation root arguments	2026-10-11 11:18:49 +02:00
piero-83	dea33fe5b4	test(cli): preserve confinement after rejected paths	2026-10-11 11:18:43 +02:00
piero-83	d9c48bddef	test(app): reject root errors before initialization	2026-10-11 11:18:31 +02:00
piero-83	3d4caa917a	fix(app): reject malformed automation roots before startup	2026-10-11 11:17:58 +02:00