Fix #577: the gradient stop popover stays open after the click that opens it

The Gradient panel's colour chip opens the stop popover on a click. The
popover closes on a click elsewhere, and the opening click itself, which
is released in the frame the popover first draws and lies outside it,
counted as one: the popover closed at once (a double-click got through,
as the popover lets the double-click that opens it from the canvas pass).

The popover now records the frame it first drew in and only a click in a
later frame closes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/freebsd.yml

@@ -1,5 +1,6 @@
 # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
+# The `package` job checks packaging/freebsd/package.sh (the release job runs it for real).
 name: FreeBSD
 
 on:
@@ -11,6 +12,8 @@ on:
       - Cargo.lock
       - "**/Cargo.toml"
       - .github/workflows/freebsd.yml
+      - packaging/freebsd/**
+      - packaging/env.sh
   workflow_dispatch:
 
 concurrency:
@@ -55,3 +58,47 @@ jobs:
             export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
             CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
             CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
+
+  package:
+    name: FreeBSD 14 (package)
+    # The release build takes a while: only for PRs that touch FreeBSD packaging (or dependencies)
+    # and on demand, not on every push to main.
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 150
+    steps:
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      # Bump the commit deliberately; see craftrules standards/fonts.md.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - name: Package in a FreeBSD VM
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
+        with:
+          release: "14.3"
+          usesh: true
+          mem: 12288
+          prepare: |
+            pkg install -y bash curl git pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+          run: |
+            . "$HOME/.cargo/env"
+            git config --global --add safe.directory "$PWD"
+            # Build outside the checkout so only dist/ is copied back out of the VM.
+            # The craft-fonts checkout is synced into the VM with the workspace.
+            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
+            export CARGO_TARGET_DIR=/var/tmp/vectorcraft-target CARGO_BUILD_JOBS=4
+            bash packaging/freebsd/package.sh
+            # Every part the package must have, the craft-fonts licences included.
+            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz >/var/tmp/contents.txt
+            for want in '/bin/vectorcraft$' '/bin/vectorcraft-cli$' '/share/applications/.*\.desktop$' '/share/icons/hicolor/' '/share/doc/vectorcraft/NOTICE$' '/share/doc/vectorcraft/OFL-.*\.txt$'; do
+              grep -Eq "$want" /var/tmp/contents.txt || { echo "missing from the package: $want"; exit 1; }
+            done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: freebsd-package
+          path: dist/release/*
+          if-no-files-found: error

.github/workflows/packaging-lint.yml

@@ -54,4 +54,13 @@ jobs:
           desktop-file-validate packaging/linux/ai.storyteller.vectorcraft.desktop
           sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.vectorcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
           appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.vectorcraft.yml')); assert m['id'] == 'ai.storyteller.vectorcraft' and m['command'] == 'vectorcraft'"
+          python3 - <<'EOF'
+          import yaml
+          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.yml"))
+          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml"))
+          for m in (src, bundle):
+              assert m["id"] == "ai.storyteller.vectorcraft" and m["command"] == "vectorcraft", m["id"]
+          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
+              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
+          print("Flatpak manifests ok")
+          EOF

.github/workflows/release.yml

@@ -1,9 +1,11 @@
 # Release pipeline: every push to `release` builds signed installers for every platform and
 # creates or updates the draft GitHub Release "VectorCraft v<version>". See docs/releasing.md.
 #
-# All jobs run in the `release` environment (restricted to the `release` branch), which holds
-# the signing secrets. Every secret is optional: missing ones produce unsigned artifacts and a
-# warning, never a failed build.
+# Jobs that sign (macOS, Windows) and the job that creates the release run in the `release`
+# environment (restricted to the `release` branch), which holds the signing secrets. Every secret
+# is optional: missing ones produce unsigned artifacts and a warning, never a failed build. The
+# other jobs sign nothing and get no environment, so a `workflow_dispatch` on any branch is a dry
+# run: they build and upload artifacts, the signed jobs are refused, and no release is drafted.
 name: Release
 
 on:
@@ -35,7 +37,7 @@ jobs:
   version:
     name: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     outputs:
       version: ${{ steps.v.outputs.version }}
       date: ${{ steps.v.outputs.date }}
@@ -63,7 +65,7 @@ jobs:
   macos:
     name: macOS universal
     needs: version
-    runs-on: macos-15
+    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
     environment: release
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
@@ -175,7 +177,7 @@ jobs:
     # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
     # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
     runs-on: ${{ matrix.runner }}
-    environment: release
+    # No `environment: release`: Linux packages are not signed (checksums in SHA256SUMS.txt).
     strategy:
       fail-fast: false
       matrix:
@@ -200,7 +202,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml
+            desktop-file-utils appstream python3-yaml zsync
           curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
             "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
           sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
@@ -225,6 +227,12 @@ jobs:
           for appimage in dist/release/*.AppImage; do
             chmod +x "$appimage"
             APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
+            # Update information is embedded, and the .zsync for delta updates sits beside it.
+            # No APPIMAGE_EXTRACT_AND_RUN here: with it the runtime passes --appimage-* flags on
+            # to the app instead of answering them itself.
+            "$appimage" --appimage-updateinformation \
+              | grep -F "gh-releases-zsync|${GITHUB_REPOSITORY%%/*}|${GITHUB_REPOSITORY#*/}|latest|vectorcraft-*-linux-${{ matrix.arch }}.AppImage.zsync"
+            test -s "$appimage.zsync"
           done
       - uses: actions/upload-artifact@v4
         with:
@@ -232,11 +240,103 @@ jobs:
           path: dist/release/*
           if-no-files-found: error
 
+  flatpak:
+    name: Flatpak ${{ matrix.arch }}
+    needs: [version, linux]
+    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
+    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
+    runs-on: ${{ matrix.runner }}
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-24.04 }
+          - { arch: aarch64, runner: ubuntu-24.04-arm }
+    env:
+      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      - name: Install flatpak-builder
+        run: |
+          sudo apt-get update
+          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
+          # `appstreamcli compose`, which renders the scalable icon and fails without it.
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
+          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build the Flatpak bundle
+        run: packaging/linux/flatpak-bundle.sh "dist/linux/vectorcraft-$VECTORCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-flatpak-${{ matrix.arch }}
+          path: dist/release/*.flatpak
+          if-no-files-found: error
+
+  freebsd:
+    name: FreeBSD x86_64
+    needs: version
+    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM (same image and packages as
+    # freebsd.yml).
+    runs-on: ubuntu-latest
+    timeout-minutes: 150
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
+    env:
+      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      # Bump the commit deliberately; see craftrules standards/fonts.md.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - uses: dtolnay/rust-toolchain@stable
+        if: inputs.version != ''
+      - name: Apply version override
+        if: inputs.version != ''
+        run: cargo xtask version set "$VECTORCRAFT_VERSION"
+      - name: Build and package in a FreeBSD VM
+        # v1.5.9, pinned by commit.
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
+        with:
+          release: "14.3"
+          usesh: true
+          cpu: 4
+          mem: 12288
+          # Passed through by name; never templated into the script.
+          envs: "VECTORCRAFT_VERSION VECTORCRAFT_BUILD_DATE VECTORCRAFT_BUILD_SHA"
+          prepare: |
+            pkg install -y bash curl git pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+          run: |
+            . "$HOME/.cargo/env"
+            git config --global --add safe.directory "$PWD"
+            # Build outside the checkout so only dist/ is copied back out of the VM.
+            # The craft-fonts checkout is synced into the VM with the workspace.
+            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
+            export CARGO_TARGET_DIR=/var/tmp/vectorcraft-target CARGO_BUILD_JOBS=4
+            bash packaging/freebsd/package.sh
+            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz \
+              | grep -E '/bin/vectorcraft$|/bin/vectorcraft-cli$|/share/applications/ai\.storyteller\.vectorcraft\.desktop$'
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-freebsd
+          path: dist/release/*
+          if-no-files-found: error
+
   web:
     name: Web (wasm)
     needs: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -277,7 +377,9 @@ jobs:
 
   release:
     name: Draft GitHub Release
-    needs: [version, macos, windows, linux, web]
+    # Needs the signed jobs, so a branch dry run (where the environment refuses them) never
+    # drafts a release.
+    needs: [version, macos, windows, linux, flatpak, freebsd, web]
     runs-on: ubuntu-latest
     environment: release
     permissions:

.github/workflows/windows-arm64.yml

@@ -1,7 +1,7 @@
 # Windows on ARM: package the ARM64 release the way release.yml does (cross-compiled on an x64
 # runner, unsigned here), then install that MSI on a Windows 11 ARM64 runner, check the installed
 # binaries are ARM64, run the CLI natively, and uninstall. (A native ARM64 `cargo test` job is left
-# out for now: PrintCraft saw an intermittent access violation in egui UI tests there.)
+# out for now: PdfCraft saw an intermittent access violation in egui UI tests there.)
 name: Windows ARM64
 
 on:

.github/workflows/windows7.yml

@@ -0,0 +1,43 @@
+# Experimental, unsupported Windows 7 SP1 x64 portable build (docs/windows7.md). It runs by hand and
+# weekly, so ordinary PRs never wait on it, and the weekly run shows when a dependency update starts
+# importing a post-Windows-7 API. packaging/windows/windows7.ps1 does the work: it is the only build
+# that uses the patched vendor/windows-link. A modern Windows runner proves compilation and host
+# smoke tests only: run the checklist in docs/windows7.md on actual Windows 7 before claiming support.
+name: Windows 7 x64 compatibility
+
+on:
+  schedule:
+    - cron: "23 5 * * 1" # weekly
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  build:
+    runs-on: windows-2022
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+        with:
+          arch: x64
+      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # master
+        with:
+          toolchain: nightly-2026-10-01
+          components: rust-src
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows7-x64
+      - name: Build, check and test the portable package
+        shell: pwsh
+        run: ./packaging/windows/windows7.ps1 -Test
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vectorcraft-windows7-x64-portable
+          path: dist/release/vectorcraft-windows7-x64-portable.zip
+          if-no-files-found: error

AGENTS.md

@@ -1,18 +1,24 @@
 # VectorCraft — instructions for agents
 
-VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../printcraft` (Acrobat-class); same conventions.
+VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../pdfcraft` (Acrobat-class); same conventions.
 
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,5 +59,23 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.
+
+## Contributor credits (About window)
+
+- About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
+  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  themselves). See `docs/contributors.md`.
+- **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
+  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
+  whether they want to be credited by more than their username: a real name, a display name, and/or
+  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
+  (copy the template at the top of the file, or run
+  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  and include it in their PR, committed as them. If no, change nothing: they are credited as
+  `@username` anyway.
+- Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
+  GitHub profiles). Never hand-edit `contributors.json`.
+- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
+  re-verifies who wrote each `people.toml` entry; `--check` only verifies).

ASSETS.md

@@ -37,6 +37,9 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/app-icon/vectorcraft.icns` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.ico` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.svg` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
+| `packaging/macos/dmg/background.svg` | Xus Badia (contributed in #493) | Original artwork for VectorCraft's DMG window; links the app icon `assets/app-icon/vectorcraft-small.svg` | MIT OR Apache-2.0 (licensed by the contributor under the project licence) | DMG background source. Text in Inter and JetBrains Mono (OFL-1.1, `assets/fonts`), not embedded; paper grain generated by an SVG `feTurbulence` filter |
+| `packaging/macos/dmg/background.tiff` | Xus Badia (contributed in #493) | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | 1x + 2x DMG background; includes the app icon (see its rows), text rendered from OFL-1.1 fonts and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
+| `packaging/macos/dmg/DS_Store` | Xus Badia (layout, #493) | Written by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | Finder view settings for the DMG (window, icon size and positions, background alias); no machine data |
 | `assets/fonts/Inter-Medium.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-Regular.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-SemiBold.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
@@ -90,6 +93,7 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-alignto-key.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-alignto-selection.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-anchor.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-anchor-smooth.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-appearance.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arc.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arrow-down.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -166,11 +170,11 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-para-justify-left.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-justify-right.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-left.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-para-ltr.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-right.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-para-rtl.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-path-eraser.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pathfinder.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-pen-add.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-pen-delete.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-perspective.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pf-crop.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-pf-divide.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -263,6 +267,8 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/paintbrush.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/palette.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pen-tool.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
+| `assets/icons/pen-tool-add.svg` | Lucide Icons and Contributors; badge by VectorCraft contributors | https://lucide.dev (lucide-static v1.49.0 `pen-tool`; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) | Lucide's pen-tool with a plus badge |
+| `assets/icons/pen-tool-delete.svg` | Lucide Icons and Contributors; badge by VectorCraft contributors | https://lucide.dev (lucide-static v1.49.0 `pen-tool`; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) | Lucide's pen-tool with a minus badge |
 | `assets/icons/pencil.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pilcrow.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/pin.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
@@ -314,6 +320,7 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `docs/images/shot-2-ribbons.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/ribbons.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/shot-3-sheet.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/feature-sheet.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/shot-4-bezier.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/feature-sheet.vectorcraft` | MIT OR Apache-2.0 |  |
+| `docs/images/shot-5-perspective.png` | VectorCraft contributors | Screenshot of VectorCraft itself, editing `examples/perspective-city.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-neon-drive.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/neon-drive.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-ribbons.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/ribbons.vectorcraft` | MIT OR Apache-2.0 |  |
 | `docs/images/art-pathfinder.png` | VectorCraft contributors | Rendered by VectorCraft from `examples/feature-sheet.vectorcraft` (artboard 1) | MIT OR Apache-2.0 |  |
@@ -323,3 +330,4 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `examples/neon-drive.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
 | `examples/ribbons.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
 | `examples/feature-sheet.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |
+| `examples/perspective-city.vectorcraft` | VectorCraft contributors | Original artwork built through the VectorCraft command API | MIT OR Apache-2.0 |  |

CLAUDE.md

@@ -1,18 +1,24 @@
 # VectorCraft — instructions for agents
 
-VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../printcraft` (Acrobat-class); same conventions.
+VectorCraft is a clean-room, open-source, Rust-native vector illustration app targeting Adobe Illustrator parity (and beyond). It runs natively on macOS, Windows and Linux, and on the web via WASM. Siblings: `../photocraft` (Photoshop-class) and `../pdfcraft` (Acrobat-class); same conventions.
 
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,5 +59,5 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.

Cargo.lock

@@ -145,6 +145,21 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -202,6 +217,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "windows-sys 0.60.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -509,6 +525,27 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -916,6 +953,7 @@ dependencies = [
  "egui-wgpu",
  "egui-winit",
  "egui_glow",
+ "glow",
  "glutin",
  "glutin-winit",
  "image",
@@ -1205,6 +1243,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -1650,6 +1694,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
 dependencies = [
+ "brotli",
  "hayro-postscript",
 ]
 
@@ -2238,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "9a7b000cca0783af26837fe2ebd9ddf1c42279463c085b97622ee1d2f444b89e"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -2249,7 +2294,6 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
  "png 0.18.1",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
@@ -2329,6 +2373,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2716,6 +2769,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -2776,6 +2839,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -4029,6 +4103,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "ttf-parser"
 version = "0.25.1"
@@ -4211,15 +4296,19 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "arboard",
+ "block2 0.6.2",
  "clipboard-win",
  "eframe",
  "egui",
  "image",
  "log",
  "muda",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "rfd",
  "serde_json",
  "vectorcraft-engine",
@@ -4231,7 +4320,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-brush"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde",
@@ -4243,7 +4332,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cad"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4259,7 +4348,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cli"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "serde_json",
  "vectorcraft-color",
@@ -4275,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-color"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "kurbo 0.13.1",
  "moxcms",
@@ -4287,21 +4376,24 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-doc"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
+ "jpeg-encoder",
  "kurbo 0.13.1",
  "proptest",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
+ "tiff",
  "vectorcraft-color",
  "vectorcraft-geom",
+ "zune-jpeg",
 ]
 
 [[package]]
 name = "vectorcraft-effects"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde_json",
@@ -4315,7 +4407,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-engine"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "flate2",
  "image",
@@ -4347,7 +4439,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-eps"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "flate2",
  "image",
@@ -4357,6 +4449,7 @@ dependencies = [
  "vectorcraft-doc",
  "vectorcraft-effects",
  "vectorcraft-geom",
+ "vectorcraft-metafile",
  "vectorcraft-render",
  "vectorcraft-testkit",
  "vectorcraft-text",
@@ -4364,7 +4457,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-format"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4378,7 +4471,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-geom"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "kurbo 0.13.1",
  "proptest",
@@ -4390,7 +4483,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-mcp"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "log",
@@ -4409,7 +4502,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-metafile"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4423,7 +4516,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pathops"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "kurbo 0.13.1",
  "linesweeper",
@@ -4435,13 +4528,14 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pdf"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "aes",
  "flate2",
  "hayro-interpret",
  "hayro-syntax",
  "image",
+ "jpeg-encoder",
  "krilla",
  "kurbo 0.13.1",
  "log",
@@ -4449,6 +4543,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
+ "skrifa 0.47.0",
  "smallvec",
  "thiserror 2.0.21",
  "vectorcraft-brush",
@@ -4462,7 +4557,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-plugins"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4476,7 +4571,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-render"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "flate2",
  "gif",
@@ -4501,7 +4596,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-svg"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "flate2",
  "image",
@@ -4525,7 +4620,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-testkit"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4542,20 +4637,25 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-text"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "harfrust 0.13.3",
  "kurbo 0.13.1",
  "log",
  "skrifa 0.47.0",
  "subsetter",
+ "unicode-bidi",
+ "unicode-general-category",
+ "unicode-script",
  "vectorcraft-doc",
  "vectorcraft-geom",
+ "windows-registry",
+ "write-fonts",
 ]
 
 [[package]]
 name = "vectorcraft-tools"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4570,7 +4670,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-trace"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4583,7 +4683,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "egui",
  "egui_extras",
@@ -4591,6 +4691,7 @@ dependencies = [
  "log",
  "serde",
  "serde_json",
+ "toml",
  "vectorcraft-cad",
  "vectorcraft-color",
  "vectorcraft-doc",
@@ -4611,7 +4712,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-web"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "eframe",
  "egui",
@@ -5321,6 +5422,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -5589,6 +5701,24 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"
@@ -5685,7 +5815,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.3.1"
+version = "0.7.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.7.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -62,6 +62,10 @@ linesweeper = "0.4"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
+# CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG
+# decoders, read directly (the image crate converts CMYK to RGB).
+tiff = "0.11"
+zune-jpeg = "0.5"
 
 # ui
 egui = "0.36"

NOTICE

@@ -30,7 +30,45 @@ based in part on the work of the Independent JPEG Group.
 WebAssembly plug-ins run in the wasmi interpreter (MIT OR Apache-2.0); its wasmparser dependency is
 under the Apache License 2.0 with the LLVM exception.
 
+The experimental Windows 7 build (packaging/windows/windows7.ps1) compiles a modified copy of the
+windows-link crate 0.2.1 (vendor/windows-link; Microsoft, MIT OR Apache-2.0) that binds CoTaskMemFree
+through ole32.dll. Its license texts are in vendor/windows-link and ship in that build's ZIP; every
+other build uses the unmodified crate from crates.io.
+
 Builds made with craft-fonts (the CRAFT_FONTS_DIR build option; all official releases) embed the
-fonts listed in https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (today BIZ
-UDPGothic, Shippori Mincho and BIZ UDMincho; web builds BIZ UDPGothic Regular only) under the SIL
+fonts listed in https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic,
+Shippori Mincho, BIZ UDMincho, Noto Sans CJK SC and Noto Sans Arabic in the current manifest;
+web builds BIZ UDPGothic Regular only) under the SIL
 Open Font License 1.1. Their license texts ship with the release packages as OFL-<family>.txt.
+
+PDF import decodes CJK text with Adobe's CMap resources (https://github.com/adobe-type-tools/cmap-resources),
+compiled into the app through the hayro-cmap crate under the BSD 3-Clause License:
+
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -16,13 +16,13 @@
 
 <p align="center">
   A fast, open-source, clean-room take on the Adobe Illustrator workflow. It runs natively on
-  macOS, Windows and Linux, and in the browser via WebAssembly. Built by the ArtCraft team.
+  macOS, Windows, Linux and FreeBSD, and in the browser via WebAssembly. Built by the ArtCraft team.
 </p>
 
 <p align="center">
   <img alt="Status: in active development" src="https://img.shields.io/badge/status-in%20active%20development-e8573f">
   <img alt="Written in pure Rust" src="https://img.shields.io/badge/pure-Rust-b83a24?logo=rust&logoColor=white">
-  <img alt="Runs on macOS, Windows, Linux and the web" src="https://img.shields.io/badge/runs%20on-macOS%20%C2%B7%20Windows%20%C2%B7%20Linux%20%C2%B7%20Web-555555">
+  <img alt="Runs on macOS, Windows, Linux, FreeBSD and the web" src="https://img.shields.io/badge/runs%20on-macOS%20%C2%B7%20Windows%20%C2%B7%20Linux%20%C2%B7%20FreeBSD%20%C2%B7%20Web-555555">
   <img alt="MCP server for agents" src="https://img.shields.io/badge/agents-MCP%20server-555555">
   <img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-555555">
 </p>
@@ -40,7 +40,7 @@
 <br>
 
 <p align="center">
-  <img src="docs/images/shot-1-neon.png" alt="VectorCraft editing the Neon Drive poster: the title is selected, the Appearance panel shows its live Outer Glow, and the Properties panel shows its character settings" width="100%">
+  <img src="docs/images/shot-1-neon.png" alt="VectorCraft editing the Neon Drive poster: the title is selected, the Appearance panel shows the settings of its live Outer Glow, and the Properties panel shows its character settings" width="100%">
   <br><sub><b>Neon Drive</b>: a Pathfinder-cut sun, live Outer Glow on the type and grid, and clipping masks · <code>examples/neon-drive.vectorcraft</code></sub>
 </p>
 
@@ -54,6 +54,7 @@
   <a href="#why-vectorcraft">Why VectorCraft</a> ·
   <a href="#quick-start">Quick start</a> ·
   <a href="#status">Status</a> ·
+  <a href="#downloads">Downloads</a> ·
   <a href="#the-crafting-apps">The Crafting Apps</a> ·
   <a href="#license-and-credits">License</a>
 </p>
@@ -63,8 +64,8 @@
 <table>
 <tr>
 <td width="50%" valign="top">
-  <img src="docs/images/shot-2-ribbons.png" alt="Three live blend ribbons of 55 to 70 steps with smooth colour, clipped to the artboard, with the Layers panel open" width="100%">
-  <p align="center"><sub><b>Live Blends</b>: editable key paths and smooth colour, clipped to the artboard</sub></p>
+  <img src="docs/images/shot-2-ribbons.png" alt="Three live blend ribbons clipped to the artboard, one selected with its key paths showing; the Layers panel lists the clip group, the blends and the selected blend's two key paths" width="100%">
+  <p align="center"><sub><b>Live Blends and Layers</b>: editable key paths, smooth colour, every object a row</sub></p>
 </td>
 <td width="50%" valign="top">
   <img src="docs/images/shot-4-bezier.png" alt="Direct Selection tool showing anchor points and Bézier handles on a crescent built with Pathfinder, with the contextual task bar below it" width="100%">
@@ -72,7 +73,11 @@
 </td>
 </tr>
 <tr>
-<td colspan="2" valign="top">
+<td width="50%" valign="top">
+  <img src="docs/images/shot-5-perspective.png" alt="Two lit building facades drawn on the left and right planes of a two-point perspective grid at sunset, with the Perspective Selection tool and the Plane Switching Widget" width="100%">
+  <p align="center"><sub><b>Perspective Grid</b>: art attached to its planes stays editable in perspective · <code>examples/perspective-city.vectorcraft</code></sub></p>
+</td>
+<td width="50%" valign="top">
   <img src="docs/images/shot-3-sheet.png" alt="Four artboards in the light UI theme: Pathfinder, Gradient Mesh, radial Repeat and Envelope Distort" width="100%">
   <p align="center"><sub><b>Multiple artboards, light theme</b>: Pathfinder · Gradient Mesh · live radial Repeat · Envelope Distort · <code>examples/feature-sheet.vectorcraft</code></sub></p>
 </td>
@@ -158,6 +163,16 @@ Japanese fonts come from [storytold/craft-fonts](https://github.com/storytold/cr
 build input (releases always use it): `CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo run --release -p vectorcraft` (an absolute path).
 Without it, Japanese text uses the installed system fonts. See [`docs/development.md`](docs/development.md#fonts-craft-fonts-optional-build-input).
 
+On machines with two graphics processors, VectorCraft renders on the power-saving (integrated) one by default on
+Windows and macOS, and on the one the desktop runs on under Linux. To choose, use **Preferences › Performance ›
+Graphics Processor** and restart. If a graphics processor can't show the window, VectorCraft starts again on the
+next one. To pick one when starting the app, set `WGPU_POWER_PREF=high` (or `low`), or `WGPU_ADAPTER_NAME` to part of
+its name, such as `WGPU_ADAPTER_NAME=nvidia` (see [`docs/development.md`](docs/development.md#desktop-graphics-processor)).
+
+On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
+respond to it yet (#491). Start the app under XWayland instead: `WAYLAND_DISPLAY= vectorcraft` (see
+[`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
+
 ### Use it from Claude Code and other agents
 
 Register the MCP server with Claude Code:
@@ -168,15 +183,19 @@ claude mcp add vectorcraft -- /path/to/vectorcraft-cli mcp
 
 The details are in [`docs/mcp.md`](docs/mcp.md) and [`docs/control-protocol.md`](docs/control-protocol.md).
 
+For the experimental, unsupported 64-bit Windows 7 build, see [Windows 7 instructions](docs/windows7.md).
+
 ## Status
 
 VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) covers what ships today, the
 milestones, and honest time-to-parity estimates.
 
-**Where we are (2026-10-06):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
+**Where we are (2026-10-07):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
-Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles and threading, and
-files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The scores are
+Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
+files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish and Italian (and Czech and Brazilian Portuguese in the menus).
+The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 
 **What's missing:**
@@ -197,7 +216,53 @@ the UI can be swapped without touching the engine.
 
 Agent and contributor rules (clean-room, the asset policy, no panics in shipped code, quality gates) are in
 [`AGENTS.md`](AGENTS.md); [`docs/development.md`](docs/development.md#robustness-vectorcraft-never-crashes)
-explains how VectorCraft avoids crashing. Every bundled asset is listed with its licence in [`ASSETS.md`](ASSETS.md).
+explains how VectorCraft avoids crashing, and [`docs/releasing.md`](docs/releasing.md) how releases are built,
+signed and published. Every bundled asset is listed with its licence in [`ASSETS.md`](ASSETS.md).
+
+## Downloads
+
+**New to VectorCraft?** Download it from the [VectorCraft page on getartcraft.com](https://getartcraft.com/apps/vectorcraft). That's the easiest way to install it.
+
+**Want a specific build or format?** On GitHub, the [latest release](https://github.com/storytold/vectorcraft/releases/latest) has every build listed below, and [all releases](https://github.com/storytold/vectorcraft/releases) has earlier versions and their notes. `<ver>` in the file names is the version number, and `SHA256SUMS.txt` lists a checksum for every file.
+
+### Windows
+
+| Build | Installer | Portable |
+|---|---|---|
+| x64 (64-bit Intel/AMD) | `vectorcraft-<ver>-windows-x64.msi` | `vectorcraft-<ver>-windows-x64-portable.zip` |
+| arm64 (Snapdragon and other ARM PCs) | `vectorcraft-<ver>-windows-arm64.msi` | `vectorcraft-<ver>-windows-arm64-portable.zip` |
+| x86 (32-bit) | `vectorcraft-<ver>-windows-x86.msi` | `vectorcraft-<ver>-windows-x86-portable.zip` |
+
+Installers and executables are code-signed.
+
+### macOS
+
+| Build | File | Notes |
+|---|---|---|
+| App, universal (Apple silicon + Intel) | `vectorcraft-<ver>-macos-universal.dmg` | Signed and notarized |
+| Command-line tool, universal | `vectorcraft-cli-<ver>-macos-universal.zip` | Signed and notarized |
+
+### Linux
+
+| Format | x86_64 | aarch64 (ARM64) | Notes |
+|---|---|---|---|
+| AppImage | `vectorcraft-<ver>-linux-x86_64.AppImage` | `vectorcraft-<ver>-linux-aarch64.AppImage` | Runs anywhere; updates itself with [AppImageUpdate](https://github.com/AppImageCommunity/AppImageUpdate) (`.zsync` files) |
+| Flatpak | `vectorcraft-<ver>-linux-x86_64.flatpak` | `vectorcraft-<ver>-linux-aarch64.flatpak` | Sandboxed; `flatpak install --user <file>` |
+| Debian/Ubuntu | `vectorcraft-<ver>-linux-x86_64.deb` | `vectorcraft-<ver>-linux-aarch64.deb` | |
+| Fedora/RHEL/openSUSE | `vectorcraft-<ver>-linux-x86_64.rpm` | `vectorcraft-<ver>-linux-aarch64.rpm` | |
+| Tarball | `vectorcraft-<ver>-linux-x86_64.tar.gz` | `vectorcraft-<ver>-linux-aarch64.tar.gz` | Unpack anywhere |
+
+### FreeBSD
+
+| Build | File |
+|---|---|
+| x86_64 | `vectorcraft-<ver>-freebsd-x86_64.tar.gz` |
+
+### Web (WebAssembly)
+
+| Build | File | Notes |
+|---|---|---|
+| Static site | `vectorcraft-web-<ver>.zip` | Runs in a modern browser; host it on any static server |
 
 ## The Crafting Apps
 
@@ -211,7 +276,7 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/vectorcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.vectorcraft.png" alt="" width="32" height="32"> | **VectorCraft** | **Vector illustration · you are here** | [GitHub](https://github.com/storytold/vectorcraft) | [Website](https://getartcraft.com/apps/vectorcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/filmcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.filmcraft.png" alt="" width="32" height="32"> | **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/lightcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.lightcraft.png" alt="" width="32" height="32"> | **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/printcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.printcraft.png" alt="" width="32" height="32"> | **PrintCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/printcraft) | [Website](https://getartcraft.com/apps/printcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
 
@@ -239,6 +304,10 @@ And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video stud
   <a href="https://getartcraft.com/apps/vectorcraft">VectorCraft</a>
 </p>
 
+## Star history
+
+[![Star History Chart](https://api.star-history.com/svg?repos=storytold/vectorcraft&type=Date&legend=top-left)](https://www.star-history.com/?repos=storytold%2Fvectorcraft&type=date&legend=top-left)
+
 ## License and credits
 
 VectorCraft is dual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option.
@@ -246,8 +315,8 @@ Copyright (c) 2026 ArtCraft Team and the VectorCraft contributors. Required noti
 
 Bundled fonts, icons, images and other assets keep their own open licenses; each one is listed
 with its author, source and license in [ASSETS.md](ASSETS.md). Release builds also embed the
-Japanese fonts of [craft-fonts](https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md)
-(SIL Open Font License 1.1).
+fonts of [craft-fonts](https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md) (Japanese,
+Simplified Chinese and Arabic faces; SIL Open Font License 1.1).
 
 The app icon (an engraved dragon on VectorCraft red, `#e8573f`) is the owner's original artwork; its
 palette and files are in [`assets/app-icon/`](assets/app-icon/README.md).

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-06 (after M4.14–M4.98, M8.1–M8.20 and M14.4–M14.7; see [Honest assessment](#honest-assessment-2026-10-05))._
+_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
 
 ## Where we are
 
@@ -33,17 +33,18 @@ since 2026-10-01.
 
 | Dimension | Estimate | Evidence and what's missing |
 |---|---|---|
-| **Breadth:** menus, tools and panels exist | ~90% | 16 menu items still stubbed; every tool implemented except Touch Type; 51 panel modules |
+| **Breadth:** menus, tools and panels exist | ~90% | 13 menu items still stubbed; every tool implemented except Touch Type; 51 panel modules |
 | **Depth:** each feature behaves like Illustrator | ~69–75% | Strong: paint, appearance and colour (M3), Pathfinder and booleans, selection, drawing, files (M4). Weak: advanced type (~45%), brushes and symbols (in progress), raster effects (~20%) |
-| **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~1 of ~56 filters), SVG Filters, CJK composition (vertical type has initial support), Variables (data merge), scripting |
+| **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~1 of ~56 filters), SVG Filters, CJK composition (vertical type with kinsoku, tate-chu-yoko and the font's vertical metrics; ruby, mojikumi and proportional vertical metrics open), Variables (data merge), scripting |
 | **Interaction fidelity:** modifiers, cursors, small behaviours | ~30–40% | The dedicated pass hasn't started, and there has been no side-by-side session with Illustrator yet. A power user notices this first |
 | **Look & feel** | ~75–80% | Measured against Illustrator 2026 screenshots (2026-10-02); the panels added since haven't been re-measured |
 | **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Native `.ai` private data is out of scope by design; DWG has no open spec |
 | **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
 | **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
 | **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
-| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work; Windows/Linux packaging and accessibility are pending |
+| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); on macOS the menus are in the system menu bar, laid out as a Mac app's, with the in-window menus as a fallback (`--in-window-menus`; verified on Windows and by cross-compilation, not yet by hand on a Mac); hybrid-graphics laptops render on the power-saving GPU by default on Windows and macOS (#306), and Windows renders through DX12 before Vulkan (#545: Vulkan flickered black on an Intel GPU, DX12 and OpenGL didn't; verified by unit tests and the reporter's runs with `WGPU_BACKEND`), and Linux on the GPU the desktop runs on, since a Wayland compositor may refuse frames from the other one; a window that fails on its GPU while starting up starts again on the next one instead of crashing (#502; the dual-GPU Wayland case is verified by unit tests and cross-compilation, not on such hardware); web drops land in the document they were dropped on (#359); desktop drops carry no pointer position (winit 0.30), so a dropped document opens as a tab of its own and a picture or text is placed in the middle of the view, while the web places anything dropped on the canvas and opens what is dropped off it, as Illustrator does (#472); a web page that loses its WebGPU device or WebGL context restarts its graphics with the same documents (#369); on Linux/Wayland the clipboard reads the compositor's own (data-control) and copied image files paste, but files can't be dropped on the window under Wayland until eframe moves to winit 0.31 (#398; the Wayland side is verified by compilation only); on Linux the Paste menu checks the system clipboard on a background thread, so a clipboard owner that never answers no longer freezes the window, while Windows and macOS keep their quick in-line check (#510; the X11 hang verified by the contributor, here by headless tests); on KDE Plasma 6.3+ under Wayland, pens and pen displays reach the app only under XWayland (`WAYLAND_DISPLAY=`) or with KWin's `KWIN_WAYLAND_EMULATE_TABLET=1`, since winit 0.30 has no Wayland tablet input (#491, not verified on hardware); Windows/Linux packaging and accessibility are pending; an experimental, unsupported Windows 7 x64 OpenGL build exists (community-contributed, not verified by maintainers) |
 | **Agent automation** | beyond Illustrator | Every command, gesture and dialog is drivable over MCP, the CLI and the control channel |
+| **Scrubby numeric fields** | beyond Illustrator | As in Photoshop, dragging a numeric field's label (`W:`, `Opacity:`, the Character panel's icons) left or right steps its value live; one undo step per drag, Escape cancels (#400) |
 
 ### Where we're lacking (in priority order)
 
@@ -58,17 +59,18 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
 3. **3D and Materials:** Extrude & Bevel, Revolve, Inflate and Rotate with lighting and materials, using a software
    renderer in its own crate (layering allows it below L6), with output in SVG/PDF as rasters or projected vectors.
    The largest single gap. 50–80 h.
-4. **Advanced type:** CJK composition for vertical type (kinsoku, ruby, tate-chu-yoko, vertical font metrics,
-   mixed-script orientation), Optical Margin Alignment, the composer/hyphenation options, tab leaders, a
+4. **Advanced type:** CJK composition for vertical type (ruby, mojikumi, proportional vertical metrics, manual
+   tate-chu-yoko), Optical Margin Alignment, the composer/hyphenation options, tab leaders, a
    spell-check dictionary (open licence), Touch Type and Snap to Glyph. Vertical point, area and path type have
    initial support. 35–48 h across type core and advanced.
 5. **Brushes, symbols and libraries:** brush options depth; original brush, symbol and graphic-style libraries
-   generated in code (never Adobe's); dynamic symbols; Start Global Edit. 14–22 h.
+   generated in code (never Adobe's); dynamic symbols; Start Global Edit; brushes driven by pen tilt, bearing and
+   barrel rotation (6D art pens, #372), which needs tablet input beyond pressure on every platform. 20–32 h.
 6. **Automation:** Variables (data merge), a scripting surface over the command registry, batch. 8–12 h.
 7. **Views and windows:** multiple windows and arrange, Consolidate All Windows, video
    rulers. 15–25 h.
 8. **Hardening at scale:** a corpus of real-world SVG/PDF/EPS files, idle-machine perf budgets, Windows, Linux and
-   browser QA, accessibility, packaging. 50–80 h.
+   browser QA, pen tablets on Wayland and pen pressure beyond Windows (winit 0.31's tablet input, #491), accessibility, packaging. 50–80 h.
 
 ### Where we're going
 
@@ -88,50 +90,78 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Automation:**
   - Actions panel (record/playback, persisted), generic parameter dialogs for every "…" command.
   - JSON-lines control channel with real egui pointer and keyboard injection.
-  - MCP server with 25 tools (drawing, text, effects, Pathfinder, transforms, graphs, text wrap, export, screenshots, any command), attached to the running app or headless.
+  - MCP server with 25 tools (drawing, text, effects, Pathfinder, transforms, graphs, text wrap, export, screenshots, any command), attached to the running app or headless. Tool descriptions and replies agree with the engine: format lists come from its format table, `save_file` says it keeps the document's own format, `inspect_document` reports the paint type's characters show, and selection exports report the encoder's warnings.
+  - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
   - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`).
   - Actions panel that records and plays back commands.
 - **UI:** Illustrator 2026 layout restyled to measured values:
-  - Medium Dark theme, categorized and Advanced toolbars, 35 pt document tabs, 33 pt panel tabs.
+  - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
   - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
-  - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool.
+  - The contextual task bar's handle drags it anywhere on the canvas (kept whole on it as the window resizes); unpinned it keeps that offset as it follows the selection, and its More Options menu hides it, pins its position across selection changes (`window.taskBar.pin`), resets it under the selection (`window.taskBar.reset`) and shows the Properties panel. As in Illustrator the position isn't kept across launches. Not done: the bar's tool-specific variants (only the selection tools show it).
+  - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
+  - Panels undock (#495): a dock tab, a panel icon or a popped-out panel's title dragged out of the dock floats that panel inside the window, and the strip right of the dock's tabs floats the whole tabbed group. A floating group moves by its title bar, a tab dragged out of it floats on its own, and dropped on another group's title bar or tabs it stacks with that group; dropped on the dock, which lights up under the pointer, its panels go back where they live (the tabbed group or the icon column), as its × and the panel menus' Float Panel / Dock Panel do (`window.panel.float`, `window.panel.dock`). The Tools panel floats by its title bar and docks again on the window's left edge. Floating panels and the Tools panel's position are kept with the preferences and in user workspaces, and clamped into a smaller window. Not done: panels in separate OS windows, docking a panel into a dock group it doesn't belong to, reordering tabs by dragging, collapsing a floating group to icons, resizing floating panels.
+  - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish and Italian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool. Native menus explicitly end tracking on command selection, outside window presses and Escape; menu updates wait until tracking ends, and a dismissing press never starts a canvas gesture (M14.8).
+  - The macOS menu bar is built from the in-window menus (one model, `native_menu`) and laid out as a Mac app's: the VectorCraft menu holds About, Settings ▸ (each Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays Hide Edges), Hide Others, Show All and Quit; Window gains Minimize ⌃⌘M, Zoom and Bring All to Front, and Help the system's search field. Its key equivalents go back to egui as key presses, so user shortcuts, focused text fields and the Type tool's input method behave as in the window, and nothing fires twice; enabled, check marks and labels update in place. `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps the menus in the window; `ui.inspect` reports `nativeMenuBar`.
+  - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats. The DMG opens on a designed Finder window, VectorCraft.app beside the `Applications` link over a background with the app icon (#493).
+  - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
   - Save / Don't Save / Cancel before closing or quitting with unsaved documents (tabs, Close, Close All, Quit, window close).
   - Four brightness themes, persistent preferences.
-  - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content.
+  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap), then Construction Guides and their Angles (#506: a drawn point near a line at one of those angles through the point it leaves from lands on it). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. Then General › Show The Home Screen When No Documents Are Open (off, closing the last document leaves an empty window; the Home button still opens the screen). Then Units › Numbers Without Units Are Points (on by default: a number typed with no unit into a field in picas is read in points, a typed unit still wins; dimmed unless a unit is Picas). Then User Interface › Auto-Collapse Iconic Panels (off by default: on, a click away from a panel popped out of the icon column puts it away). They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 30 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Spacing Guides, performance, devices…).
+  - Dialogs move by dragging their heading (the band down from the top edge, as a title bar), stay on screen and keep where they were moved for the session; the form dialogs' choices are dropdowns (Offset Path's Joins, Average's and Shear's and Reflect's axis), and Offset Path lists Offset, Joins, Miter Limit and previews (#423).
+  - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…). Number fields in panels, the Control bar and dialogs (preferences too) step with Up/Down, or with the mouse wheel over the focused field (#485: a notch a step; the panel under it then stays put, and an unfocused field leaves the wheel to scrolling) (Shift: ten, Ctrl/Cmd: a tenth of their unit), applied at once.
+  - Scrubby labels (#400, beyond Illustrator, as in Photoshop): dragging a numeric field's label left or right (the ↔ cursor shows over it) steps the value one unit every 2 points (Shift: ten, Ctrl/Cmd: a tenth; counts stay whole), in the field's unit and within its limits, applied live as the art follows; the whole drag is one undo step and Escape puts the value back. A click on the label focuses the field; the text box itself never scrubs, and a field with no label doesn't. Text labels before a field (Transform, Properties, Control bar, Stroke, Transparency, form rows in dialogs) and the Character and Paragraph panels' icons act as labels. Preferences › General › Scrub Numeric Fields by Dragging (on by default) turns it off.
+  - The Control bar's underlined Transform link opens the Transform panel in a popover under it (reference point, X/Y/W/H, Rotate and Shear with their icons and angle presets, flips, shape properties, Scale Corners and Scale Strokes & Effects), as its Stroke link does the Stroke panel; X/Y/W/H also show inline while the bar has room. The reference point locator is nine squares, the outer eight joined around the box.
+  - Tab shows and hides the panels (in the Type tool it types a tab) without moving the keyboard focus onto a field, so the next shortcut or letter still works; in dialogs and panel fields it moves between fields.
+  - Cmd/Ctrl+A follows the keyboard: in a panel, dialog or search field it selects the field's text, while the Type tool edits it selects all of that text (also `select.all` over MCP), and only otherwise every object. On macOS the menu bar's Select All, Cut, Copy and Paste (keys or clicks) act on a focused field too, and elsewhere the in-window menus' do: the field that had the keyboard when the menu opened gets them, with its selection, and the keyboard back (#516). Not yet: Select All across threaded frames (one frame's text is selected).
+  - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content. As on a native menu bar, once one menu is open, moving the pointer onto another title opens that one.
 - **Tools:**
-  - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso.
-  - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join.
-  - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools.
+  - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso. A Shift-drag marquee toggles what it reaches: objects with the Selection tool, anchors with Direct and Group Selection (#483); the Lasso adds with Shift and subtracts with Alt. Dragging a path segment with Direct Selection bends it when it's curved (its anchors stay) and moves its two anchors when it's straight, one undo step; the fill, Shift or Alt still pick the whole path (Alt-drag copies it).
+  - **Saved selections:** Select ▸ Save Selection… asks for a name and keeps the selection in the document (saved with the file, undoable, up to 25); each one is listed at the bottom of the Select menu and a click selects its objects again; Edit Selection… lists them to rename or delete, applied together on OK. A file's saved selections are capped and checked against its objects when it opens. Not yet: Update Selection and the Layers panel's saved-selection menu.
+  - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join. Direction handles dragged with Direct Selection or the Anchor Point tool snap to smart guides, and Shift keeps them at 45° steps from their anchor. Every point a drawing tool places snaps to Smart Guides through one snapper (#506): the Pen's and Curvature tool's anchors, the Pencil's ends, the shape tools' start and dragged corner or radius (Rectangle, Rounded Rectangle, Ellipse, Polygon, Star, Line Segment, Arc, Spiral, the grids), the Type tool's click and frame, a new artboard's corners.
+  - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers).
   - **Cutting:** Eraser, Scissors, Knife, Mirror & Cut, Line Cut and Rectangle Cut (real geometry, compound paths keep their holes).
-  - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres), Reshape, Free Transform (distort/perspective).
-  - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout.
+  - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres; Alt-click opens the tool's dialog, and a drag with Alt down at the release, from the press or pressed mid-drag, transforms a copy), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
+  - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout; with Direct Selection, select corner anchors to show and round just those corners (#381). Each corner keeps its own radius and kind (Round, Inverted Round, Chamfer): Alt-click a widget to cycle the kind, double-click it for the Corners dialog, and the Properties and Transform radius fields set the selected corners (`object.setLiveShape {corners, radius, kind}`). Corners stay circular when the rectangle is scaled unevenly or along its own sides when rotated (the radius keeps its size, or scales by the mean scale with Scale Corners on); only a shear distorts them. On a rectangle that isn't square every corner is the same circle: a radius past half the shorter side stops there for all of them, the widgets sit on the corners as drawn and turn the edited corners red at that limit, CSS export writes the drawn radii, and rectangles saved stretched by older versions get circular corners when their corners are next set (#442). Live Corners work on any path's corners too, as on a rectangle's (#511): a star's, a live polygon's (which also shows them to the Selection tool, has a Corner Radius field in the Properties and Transform panels and keeps its radius as its sides change) and a pen path's, wherever two straight sides meet at an anchor. Direct Selection shows the widgets of every corner, or of the corners holding selected anchors; each corner is a circle tangent to both sides, drawn no larger than takes its cut halfway along its shorter side; a path keeps its uncut outline so its corners stay editable, and the same command, dialog, angle preference and View › Hide Corner Widget apply.
+  - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. A press on the first anchor of the path being drawn closes it whatever the drag then does: the drag shapes the closing curve (symmetric handles, Alt breaks them) and the release closes the path wherever it ends (#501). Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles, dragging a segment reshapes it; drawing then goes on. Cmd (Ctrl) held drags with the selection tool chosen last, Direct Selection until one is (handles, anchors and segments of the path being drawn or another), and the Pen then goes on drawing its path while that stays selected; the pointer shows that tool's while Cmd is held. The same holds for agents (`pointer_gesture` with `mods.cmd`), as the borrowing now lives in the engine (#494).
+  - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path).
   - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
-  - **Other:** Eyedropper, Gradient annotator, Artboard, Measure, Type, Hand, Zoom, Rotate View.
-- **Drawing aids:** Smart Guides and snapping, and Draw Normal / Behind / Inside modes.
+  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446), Measure, Type, Hand, Zoom, Rotate View.
+  - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
+  - **Temporary tools:** Cmd with any other tool drags with the selection tool used last (Selection, Direct Selection or Group Selection). Held Space pans and Cmd+Space zooms (Cmd+Alt+Space out) whatever the tool.
+  - **Panel drag and drop:** art dragged off the canvas onto the Symbols panel becomes a symbol, onto the Swatches panel a pattern swatch and onto the Brushes panel an Art brush; a symbol dragged onto the canvas places an instance where it is dropped, and a brush dragged onto a path is applied to it.
+  - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, the Selection, Direct Selection and Group Selection tools the Move dialog (Enter opens these seven tools' dialogs too), Gradient, Eyedropper, Blend and the Liquify tools their panels or options, and the Pencil, Paintbrush, Smooth, Blob Brush and Eraser tools their Tool Options (Fidelity, fill, the tolerances, the brush size).
+- **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies) and a dimmed copy of the row under the pointer (dropped on the trash rows are deleted, on New Layer duplicated, as in Illustrator), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets, each with a chip of its colour, or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting.
+- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H; drawn points, #506: hovering shows where the press goes, the point lands on the other objects' anchors, centres and paths ("anchor", "center", "path") or lines up with their anchors, edges and centres ("align"), the Pen's on the path being drawn too, near a construction guide through the anchor before it on that guide (Preferences › Smart Guides › Construction Guides and Angles), and with Shift kept to its 45° step or a square's diagonal it slides along that way into line; the targets are gathered once per document state, from the art in the window, and the anchors, centres and lines near the pointer are found by bisection, so hovering never rescans the document), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), a right-click on either ruler or the origin box to pick the document's units (the current one checked; `document.setUnits`, one undo step, #528), and Draw Normal / Behind / Inside modes.
+- **Views:** the status bar's artboard navigator (first, previous, next, last; `view.goToArtboard`) goes to an artboard and fits it, and Fit Artboard in Window and Actual Size show the navigator's artboard. The Artboards panel highlights that active artboard: clicking a row makes it active (the Artboard tool's too, while it is chosen) as does clicking an artboard with the Artboard tool, double-clicking its number also fits it in the window and double-clicking its name renames it. Duplicate Artboards, or a row dragged onto New Artboard, copies the artboard with its art (#446). Escape leaves Presentation Mode, F from it goes back to Normal Screen Mode, and the screen mode isn't saved with the preferences: the app always starts in Normal Screen Mode with its menus and panels (#472).
 - **Geometry and effects:**
-  - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below.
-  - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
-- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline.
-- **Japanese interface and vertical type:** VectorCraft ▸ Language switches the menus between English and Japanese (untranslated labels stay English) and persists; the bundled OFL Shippori Mincho gives Japanese glyphs without system fonts. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs with `vert`/`vrt2` alternates); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+  - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
+  - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
+- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale) and Italian (every `it-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish and Italian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish and Italian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
-- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type, Gradient Mesh, Shape Builder, Live Paint (every path an edge, open lines included), Image Trace (12 presets), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
   - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved and loaded as `.vcswatches`, `.gpl` or CSS. Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
-  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers, panels have their shortcuts, and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening.
+  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
   - **Gradients:** lossless, validated gradient params; gradients follow rotate, reflect, shear, non-uniform scale and distortions; the Gradient tool edits the fill or stroke of the active proxy, type included; an interactive on-canvas annotator (move, length/angle, rotate, add/move/delete/duplicate stops, midpoints, a stop popover, Delete and arrow keys). The Gradient panel has the Fill/Stroke proxy, a gradient-swatch dropdown with Save to Swatches, midpoint locations, Alt-drag to copy or swap stops, swatch drops on the ramp and a stop eyedropper; copied appearances and graphic styles place gradients on each target's own bounds; gradient handles snap and honour Constrain Angle. Gradient stops stay linked to global and spot swatches. Freeform gradients (points and lines) are edited on the canvas; radial gradients have an extent ellipse, an aspect handle and an off-centre focal point (SVG `fx`/`fy`, PDF two-point radials). A stroke's gradient runs within, along or across it. Object ▸ Expand turns gradients into N objects or a gradient mesh.
-  - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units, shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
-  - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups; Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
+  - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units (its weight presets are round values in that unit: `0.25 mm`, `0.0625 in`, `1 px`, #426; fields show four decimals in mm, cm and inches, three in points), shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
+  - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups, whose blend-mode list and opacity slider stay open inside them (#430; the Control bar's Stroke popover too); Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
   - **Masks and clipping:** opacity-mask controls work while the mask is being edited; transparency commands take ids and work without a selection; clipping sets clip by compound paths, even-odd paths, text and groups on screen and in raster export, matching SVG/PDF. Alt-click shows only the mask; SVG masks keep Clip and Invert; the transparency grid is per-document state; a clipping path's own fill and stroke paint behind and over the clipped art; layers can be clipping masks.
   - **Transparency:** three-state Knockout Group (on, neutral, off), Opacity & Mask Define Knockout Shape, Page Isolated Blending and Page Knockout Group, on screen and in SVG/PDF. Blend modes match the standard formulas on screen, in SVG and in PDF, and non-isolated groups blend with the art below. Flatten Transparency with presets, a dialog and a Flattener Preview panel.
   - **Graphic styles:** styles keep opacity and blend mode, capture groups and type, apply on top with Alt, and link to the objects using them; Redefine, Break Link, Graphic Style Options, Select All Unused, Sort by Name, and Select > Same Graphic Style / Appearance Attribute. The panel has list and thumbnail views with rendered previews, merge, reorder and drag and drop, plus a Control bar Style picker; six generated style libraries save and load as `.vcstyles`.
   - **Neutral wording:** labels, MCP tool text, docs and packaging use neutral names, and `cargo xtask brands` (part of `cargo xtask ci`) fails on vendor names.
 - **Colour, type and file workflows:** Recolor Artwork (dialog with harmonies), Edit Colors, Find & Replace, Change Case, Smart Punctuation, Guides, Lock/Hide Above, Transform Each, Rasterize.
+- **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
 - **Files (M4):**
-  - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash, background save and export.
-  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units; PDF and PDF-compatible `.ai` in and out (layers, masks, editable text, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3).
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export.
-  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours.
+  - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
+  - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
+  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
+- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so any GPU that can show the window will do. Preferences › Performance › Graphics Processor (`gpuPreference`) is Automatic by default: the power-saving GPU on Windows and macOS (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306), and the GPU the desktop runs on under Linux, where KWin on an NVIDIA GPU refused frames from a Ryzen's integrated GPU and 0.5.0 crashed at startup (#502). Power Saving and High Performance pick a kind of GPU; `WGPU_POWER_PREF`, `WGPU_ADAPTER_NAME` and `WGPU_BACKEND` override them. The app picks among the adapters that can present to the window (native backends before OpenGL, hardware before software, and on Windows a GPU's DX12 adapter before its Vulkan one: Intel's Vulkan driver made the whole window flicker black, #545), and if the window fails on one while starting up it starts again without it instead of crashing; Help › About, `ui.inspect` and the log name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).
 
 ## Milestones and estimates
@@ -140,19 +170,19 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 |---|---|---|---|
 | M0 | Skeleton + vertical slice | ✅ done | — |
 | M1 | Selection, transform, layers, MCP | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
-| M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging landed; Shaper, Pen modifier nuances) | 15–20 |
+| M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging and per-corner radii and kinds landed, on any path's corners; Shaper, the remaining Pen modifier nuances) | 15–20 |
 | M3 | Paint & appearance (swatches, color, gradient, stroke, appearance, transparency, styles) | ✅ done (M3.7–M3.98): swatches, groups, libraries, tints, Lab spots and Registration; Color Picker, Color panel, Color Guide, Color Themes, Edit Colors and Recolor Artwork; gradients that follow every transform, the annotator, linked stops, freeform gradients, focal points, gradients on strokes and Expand; stroke geometry, arrowheads, dashes fitted to corners, stroke on type, width profiles and the Width tool, Scale Strokes and preview bounds; Appearance targeting, container appearance, target circles, Expand Appearance; knockout, isolation, blend accuracy, CMYK blending, overprint, Attributes, masks and clipping, Flatten Transparency; graphic styles, links and libraries. Left: freeform and mixed spot/process gradients export as stops or process colours to SVG/PDF; confirm the Scale Strokes & Effects default | 4–8 |
 | M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info. Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, polish | 3–6 |
 | M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
-| M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder edge erase, large-offset bug open) | 3–6 |
-| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (searchable) and found by name on open/import, CJK names in the UI, Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects, tab stops + Tabs panel done; tab leaders, spell check, vertical type pending | 45–60 |
+| M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
+| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, Hebrew/Arabic bidirectional text and Paragraph Direction done; tab leaders, spell check, vertical type pending | 45–60 |
 | M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
 | M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
-| M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan and print tiling done; multiple windows, presentation polish) | 🟡 | 15–25 |
+| M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
 | M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (12 presets, 18 ms/1k² image), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
 | M13 | Automation (Actions ✅ record/playback, persisted; variables, scripting, batch) | 🟡 | 18–27 |
-| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor, workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs and menus that scroll when longer than the window done; accessibility, Windows/Linux packaging pending | 18–28 |
+| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs, menus that scroll when longer than the window and macOS native menu dismissal done (M14.8); an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
 | — | Interaction fidelity pass (every tool's modifiers, Properties panel per context, isolation, nuance) | ⬜ | 60–90 |
 | — | Hardening at scale (big-file corpus, fuzzing, cross-platform + browser QA) | 🟡 | 50–80 |
 | | **Total to full parity** (one agent; re-derived from the [Parity estimate](#parity-estimate) table) | | **~320–500** |
@@ -172,27 +202,27 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Area | Weight | Done | Missing (main items) | One agent (h) |
 |---|---:|---:|---|---:|
 | Selection, transform & align tools | 6 | 85% | Free Transform/Scale/Reflect along a rotated box, Start Global Edit, transform nuances (the rotated persistent bounding box is done) | 4–6 |
-| Drawing tools | 7 | 85% | Shaper Groups (merge/punch overlapping shapes), pen/pencil modifier nuances, Touch Type | 10–15 |
-| Path operations, Pathfinder, Shape Builder, Live Paint | 5 | 86% | Live Paint gap options, Shape Builder edge cases | 3–6 |
+| Drawing tools | 7 | 85% | Shaper Groups (merge/punch overlapping shapes), pencil and the remaining pen modifier nuances, the freehand Tool Options' Keep selected, Alt to the Smooth tool, Blob Brush Merge Only with Selection and brush angle/roundness, Touch Type, Live Corners on corners between curved sides (and Relative rounding) | 10–15 |
+| Path operations, Pathfinder, Shape Builder, Live Paint | 5 | 86% | Live Paint gap options, Shape Builder gap detection, options (Tool Options dialog, clicking a stroke in merge mode) and Shift-drag marquee | 3–6 |
 | Colour, swatches, gradients, patterns, mesh, recolor | 7 | 96% | freeform and mixed spot/process gradients in SVG/PDF (exported as stops or process colours), pattern fills in Expand | 2–4 |
-| Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code) | 6–10 |
+| Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code), brushes driven by pen tilt, bearing and barrel rotation (6D art pens) | 12–20 |
 | Appearance, transparency, graphic styles, masks | 5 | 98% | raster effect reach in preview bounds (flattener presets apply in PDF, EPS and print) | 1–2 |
 | Live vector effects | 5 | 85% | Outline Object, Pathfinder Hard/Soft Mix and Trap, SVG Filters | 6–10 |
 | Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 20% | ~55 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery; Document Raster Effects Settings and raster effects in PDF are done | 28–42 |
 | 3D and Materials | 4 | 0% | Extrude & Bevel, Revolve, Inflate, Rotate, lighting, materials (software renderer) | 50–80 |
-| Type core | 9 | 78% | composer/hyphenation options, Optical Margin Alignment, hidden characters | 15–20 |
-| Type advanced | 4 | 45% | CJK composition for vertical type (kinsoku, ruby, tate-chu-yoko, vertical metrics, mixed-script orientation), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
+| Type core | 9 | 79% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); composer/hyphenation options, Optical Margin Alignment, hidden characters, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 15–20 |
+| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko, Character Alignment on the ICF top and bottom), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
-| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (Vector Halftone is done) | 6–10 |
-| Layers, artboards, document setup | 5 | 80% | Layers panel options depth, artboard presets/rearrange polish (Document Setup and New Document are done) | 5–8 |
+| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), Image Trace View modes (Outlines, Source Image) (Vector Halftone is done) | 6–10 |
+| Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard presets/rearrange polish (Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
 | View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
-| Guides, grids, smart guides, snapping, rulers | 3 | 75% | global/video rulers, smart-guide preference depth | 4–8 |
-| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
+| Guides, grids, smart guides, snapping, rulers | 3 | 84% | global/video rulers, Spacing Guides, Smart Guides' angle and distance readouts while drawing, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451; the drawing tools snapping, with Construction Guides, #506) | 2–4 |
+| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
-| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows (Links, Asset Export, CSS Properties, Attributes are done) | 15–25 |
-| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done | 5–8 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | macOS native menu dismissal fixed (M14.8); remaining: Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 30 Preferences options stored but not yet acted on (#394: Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
+| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done; placed VectorCraft documents are done (linked by default, vectors in every output, previews, Break Link, Expand, Edit Original, refresh on save) | 5–8 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
 | Hardening (big-file corpus, fuzzing, cross-platform and browser QA, accessibility, packaging) | | | | 50–80 |
@@ -202,7 +232,7 @@ With 4–6 agents working on disjoint crates (as the layering allows) the wall-c
 (integration, review and shared files such as `menus.rs` serialize some work): **~55–95 h** to feature parity,
 **~80–145 h** to full parity.
 
-_Inventories (2026-10-05):_ 16 menu items still stubbed (`todo(…)` in `crates/ui-egui/src/menus.rs`); every tool
+_Inventories (2026-10-07):_ 13 menu items still stubbed (`todo(…)` in `crates/ui-egui/src/menus.rs`); every tool
 implemented except Touch Type; 51 panel modules; Illustrator-style live
 effects ~44/54, Photoshop-style raster effects ~1/56, 3D 0/5; ~2,840 tests; ~221k lines of Rust.
 
@@ -211,7 +241,7 @@ lossless SVG/PDF export of live effects with SVG filters, a documented JSON form
 command, gesture and dialog drivable by agents (MCP, CLI, control channel).
 
 ## Out of scope (by design or by law)
-- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance.
+- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 - **Adobe cloud services** (Libraries sync, Adobe Fonts, Firefly/generative): these are pluggable provider APIs, not built in.
 - **Adobe's bundled assets** (swatch/brush/symbol libraries, presets, icons): ours are original.
 

apps/vectorcraft-cli/src/main.rs

@@ -2,7 +2,7 @@
 //!
 //! ```text
 //! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless]
-//! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}']]... [--export out.svg|.png|.pdf|.jpg|.webp|.vectorcraft]... [--scale 2]
+//! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}']]... [--export out.svg]... [--scale 2]
 //! vectorcraft-cli commands
 //! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text]
 //! vectorcraft-cli info FILE
@@ -14,11 +14,41 @@
 use std::io::Write;
 use std::process::ExitCode;
 
+/// `println!` / `print!` that end the program quietly when stdout is closed
+/// (`vectorcraft-cli commands | head`) instead of panicking with "failed printing to stdout:
+/// Broken pipe (os error 32)".
+macro_rules! outln {
+    ($($arg:tt)*) => {{
+        use std::io::Write as _;
+        if let Err(e) = writeln!(std::io::stdout(), $($arg)*) {
+            $crate::stdout_failed(e);
+        }
+    }};
+}
+macro_rules! out {
+    ($($arg:tt)*) => {{
+        use std::io::Write as _;
+        if let Err(e) = write!(std::io::stdout(), $($arg)*) {
+            $crate::stdout_failed(e);
+        }
+    }};
+}
+
 mod perf;
 
 use serde_json::{Value, json};
 use vectorcraft_mcp::{Backend, DEFAULT_ADDR, Headless, Remote, Server};
 
+/// stdout went away. A reader that stopped early (a closed pipe) ends the program quietly, as
+/// ripgrep does; any other write error is reported.
+fn stdout_failed(e: std::io::Error) -> ! {
+    if e.kind() == std::io::ErrorKind::BrokenPipe {
+        std::process::exit(0);
+    }
+    eprintln!("vectorcraft-cli: can't write to stdout: {e}");
+    std::process::exit(1);
+}
+
 const USAGE: &str = "\
 vectorcraft-cli — VectorCraft automation
 
@@ -29,19 +59,22 @@ USAGE:
 
   vectorcraft-cli run [--in FILE] [--cmd ID [--params JSON]]... [--export FILE]... [--scale N]
       Headless batch: open FILE (any readable format) or start a new document, run commands in
-      order, export (.svg, .png, .pdf, .jpg, .webp, .vectorcraft by extension). Prints one JSON result per step.
+      order, export each FILE in the format its extension picks (see Writable formats). Prints one
+      JSON result per step.
 
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
   vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text]
-      Open IN (any readable format) and export OUT by extension (.svg, .pdf, .png, .jpg, .webp,
-      .vectorcraft). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
-      unless one of them is given, the other formats the first. Live effects are kept;
-      --outline-text writes SVG text as paths.
+      Open IN (any readable format) and export OUT in the format its extension picks (see Writable
+      formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
+      unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
+      Live effects are kept; --outline-text writes SVG text as paths.
 
   vectorcraft-cli info FILE
-      Print a JSON summary: title, colour mode, units, artboards, object counts by kind, fonts.
+      Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
+      read from its preview and why), title, colour mode, units, artboards, object counts by
+      kind, fonts.
 
   vectorcraft-cli bench FILE [--size WxH] [--iters N]
       Render FILE (any readable format) fitted to WxH (default 2880x1800) and print ms per frame
@@ -52,9 +85,10 @@ USAGE:
       synthetic N-path document (default 50000). Exits non-zero if a budget is exceeded.
 ";
 
-/// The usage text plus the formats `document.open` reads.
+/// The usage text plus the formats `document.open` reads and `document.export` writes.
 fn usage() -> String {
-    format!("{USAGE}\nReadable formats: .{}\n", vectorcraft_engine::cmd::fileio::OPEN_EXTS.join(", ."))
+    use vectorcraft_engine::cmd::fileio::{OPEN_EXTS, export_extensions};
+    format!("{USAGE}\nReadable formats: .{}\nWritable formats: .{}\n", OPEN_EXTS.join(", ."), export_extensions().join(", ."))
 }
 
 fn main() -> ExitCode {
@@ -68,11 +102,11 @@ fn main() -> ExitCode {
         Some("bench") => bench(&args[1..]),
         Some("perf") => perf::run(&args[1..]),
         Some("-h" | "--help" | "help") | None => {
-            print!("{}", usage());
+            out!("{}", usage());
             Ok(())
         }
         Some("-V" | "--version") => {
-            println!("vectorcraft-cli {}", env!("CARGO_PKG_VERSION"));
+            outln!("vectorcraft-cli {}", env!("CARGO_PKG_VERSION"));
             Ok(())
         }
         Some(other) => Err(format!("unknown subcommand `{other}`\n\n{}", usage())),
@@ -112,6 +146,9 @@ fn mcp(args: &[String]) -> Result<(), String> {
         }
     };
     eprintln!("vectorcraft-cli: MCP server on stdio ({})", backend.describe());
+    // The binary owns the logger, not the library: installing one here keeps an embedder that
+    // uses `vectorcraft_mcp` free to bring its own. Silent until a client sends logging/setLevel.
+    vectorcraft_mcp::logging::install();
     let stdin = std::io::stdin();
     let stdout = std::io::stdout();
     Server::new(backend).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
@@ -120,7 +157,7 @@ fn mcp(args: &[String]) -> Result<(), String> {
 fn commands() -> Result<(), String> {
     let mut h = Headless::new();
     let v = h.call("engine.commands", json!({}))?;
-    println!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
+    outln!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
     Ok(())
 }
 
@@ -146,14 +183,14 @@ fn convert(args: &[String]) -> Result<(), String> {
             json!({"command": "document.export", "params": {"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text}}),
         )
         .map_err(|e| format!("export {output}: {e}"))?;
-    println!("{r}");
+    outln!("{r}");
     Ok(())
 }
 
 fn info(args: &[String]) -> Result<(), String> {
     let file = args.first().ok_or("info needs a FILE")?;
     let mut h = Headless::new();
-    h.call("app.open", json!({"path": file})).map_err(|e| format!("open {file}: {e}"))?;
+    let opened = h.call("app.open", json!({"path": file})).map_err(|e| format!("open {file}: {e}"))?;
     let base = h.call("engine.execute", json!({"command": "file.info", "params": {}}))?;
     let doc = h.session.doc().map_err(|e| e.to_string())?.doc.clone();
     let mut kinds: std::collections::BTreeMap<&'static str, usize> = Default::default();
@@ -161,8 +198,9 @@ fn info(args: &[String]) -> Result<(), String> {
     let fonts = h.call("engine.execute", json!({"command": "text.fonts", "params": {}})).unwrap_or(Value::Null);
     let artboards: Vec<Value> =
         doc.artboards.iter().map(|a| json!({"name": a.name, "rect": [a.rect.x0, a.rect.y0, a.rect.width(), a.rect.height()]})).collect();
-    let v = json!({"file": file, "info": base, "artboards": artboards, "kinds": kinds, "fonts": fonts});
-    println!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
+    // What didn't come in as it was (an EPS read from its preview says why).
+    let v = json!({"file": file, "warnings": opened["warnings"], "info": base, "artboards": artboards, "kinds": kinds, "fonts": fonts});
+    outln!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
     Ok(())
 }
 
@@ -252,7 +290,7 @@ fn bench(args: &[String]) -> Result<(), String> {
         * vectorcraft_geom::Affine::scale(z)
         * vectorcraft_geom::Affine::translate(-b.center().to_vec2());
     let opts = vectorcraft_render::RenderOptions::default();
-    println!("{file}: {} nodes, {w}x{h}", doc.layers.iter().map(|l| l.count()).sum::<usize>());
+    outln!("{file}: {} nodes, {w}x{h}", doc.layers.iter().map(|l| l.count()).sum::<usize>());
     for threads in [vectorcraft_render::default_threads(), 0] {
         let mut r = vectorcraft_render::Renderer::new();
         r.threads = threads;
@@ -261,7 +299,7 @@ fn bench(args: &[String]) -> Result<(), String> {
         for _ in 0..iters {
             r.render(&doc, w, h, view, &opts);
         }
-        println!(
+        outln!(
             "  threads {threads}: {:.1} ms/frame (drawn {}, culled {})",
             t.elapsed().as_secs_f64() * 1000.0 / iters as f64,
             r.stats.drawn,

apps/vectorcraft-cli/src/perf.rs

@@ -70,6 +70,49 @@ fn load_average() -> Option<f64> {
     text.split_whitespace().map(|t| t.trim_matches(|c| c == '{' || c == '}')).find_map(|t| t.parse().ok())
 }
 
+/// Milliseconds per pointer move of a Direct Selection drag of a handle, then of a segment, of a
+/// 5,000-anchor wave of smooth anchors added on top of the synthetic `n`-path document.
+fn edit_drags(n: usize) -> Result<(f64, f64), String> {
+    use vectorcraft_engine::tools::{Mods, PointerEvent, PointerKind};
+    use vectorcraft_geom::{Anchor, PathData, SubPath, Vec2};
+    let mut doc = synthetic(n)?;
+    let l = doc.layers.first().map(|l| l.id);
+    let id = doc.alloc_id();
+    // Anchors 2 pt apart, up and down by 20 pt, their handles 0.6 pt long.
+    let anchor = |i: usize| {
+        let p = Point::new(i as f64 * 2.0, if i.is_multiple_of(2) { 500.0 } else { 520.0 });
+        Anchor::smooth(p, p + Vec2::new(0.6, 0.0))
+    };
+    let path = PathData::single(SubPath::new((0..5000).map(anchor).collect(), false));
+    doc.insert(l, usize::MAX, Node::path(id, path, Appearance::default_art())).map_err(|e| e.to_string())?;
+    let mut s = vectorcraft_engine::Session::new();
+    s.add_document(doc, None);
+    let view = vectorcraft_engine::ViewInfo { zoom: 8.0, ..Default::default() };
+    let err = |e: vectorcraft_engine::EngineError| e.to_string();
+    let mut drag = |down: Point| -> Result<f64, String> {
+        let ev = |kind, y: f64| PointerEvent { kind, pos: down + Vec2::new(0.0, y), mods: Mods::default(), pressure: 1.0 };
+        s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 400]]})).map_err(err)?;
+        s.select_tool("directSelection", view).map_err(err)?;
+        let undo = s.doc().map_err(err)?.history.undo.len();
+        s.pointer(&ev(PointerKind::Down, 0.0), view).map_err(err)?;
+        let mut y = 0.0;
+        let ms = median_ms(9, || {
+            y += 3.0;
+            // A failed move shows as the missing undo step below.
+            let _ = s.pointer(&ev(PointerKind::Drag, y), view);
+        });
+        s.pointer(&ev(PointerKind::Up, y), view).map_err(err)?;
+        if s.doc().map_err(err)?.history.undo.len() != undo + 1 {
+            return Err(format!("the drag from {down:?} made no undo step"));
+        }
+        Ok(ms)
+    };
+    // Anchor 400 is at (800, 500): its outgoing handle's end, then its segment to anchor 401.
+    let handle = drag(Point::new(800.6, 500.0))?;
+    let segment = drag(Point::new(801.0, 510.0))?;
+    Ok((handle, segment))
+}
+
 pub fn run(args: &[String]) -> Result<(), String> {
     let mut n = 50_000usize;
     let mut it = args.iter();
@@ -81,14 +124,14 @@ pub fn run(args: &[String]) -> Result<(), String> {
     }
     let cores = std::thread::available_parallelism().map_or(1, |c| c.get());
     let load = load_average();
-    println!("VectorCraft performance budgets — {n} paths, {cores} cores, load average {}", load.map_or("?".into(), |l| format!("{l:.1}")));
+    outln!("VectorCraft performance budgets — {n} paths, {cores} cores, load average {}", load.map_or("?".into(), |l| format!("{l:.1}")));
     let noisy = load.is_some_and(|l| l > cores as f64 * 0.75);
     if noisy {
-        println!("WARNING: the machine is busy; wall-clock timings below are not trustworthy.");
+        outln!("WARNING: the machine is busy; wall-clock timings below are not trustworthy.");
     }
     let t = Instant::now();
     let doc = synthetic(n)?;
-    println!("  (built in {:.0} ms)", t.elapsed().as_secs_f64() * 1000.0);
+    outln!("  (built in {:.0} ms)", t.elapsed().as_secs_f64() * 1000.0);
 
     let mut rows: Vec<(&str, f64, f64)> = vec![];
     let opts = RenderOptions::default();
@@ -145,21 +188,30 @@ pub fn run(args: &[String]) -> Result<(), String> {
         }
     });
     rows.push(("Pathfinder Unite, 1,000 paths", unite, 150.0));
+
+    // Path editing: one pointer move of a Direct Selection drag (the tool event and the preview it
+    // applies), on a 5,000-anchor path among the synthetic paths.
+    let (handle, segment) = edit_drags(n).unwrap_or_else(|e| {
+        failed = Some(e);
+        (0.0, 0.0)
+    });
+    rows.push(("handle drag, 5,000-anchor path (per move)", handle, 8.0));
+    rows.push(("segment drag, 5,000-anchor path (per move)", segment, 8.0));
     if let Some(e) = failed {
         return Err(e);
     }
 
     let mut over = 0;
-    println!("  {:<40} {:>10} {:>10}", "", "measured", "budget");
+    outln!("  {:<40} {:>10} {:>10}", "", "measured", "budget");
     for (name, ms, budget) in &rows {
         let ok = ms <= budget;
         over += usize::from(!ok);
-        println!("  {name:<40} {ms:>8.2} ms {budget:>7.0} ms  {}", if ok { "ok" } else { "OVER" });
+        outln!("  {name:<40} {ms:>8.2} ms {budget:>7.0} ms  {}", if ok { "ok" } else { "OVER" });
     }
     match (over, noisy) {
         (0, _) => Ok(()),
         (_, true) => {
-            println!("{over} over budget, but the machine is busy: re-run when idle.");
+            outln!("{over} over budget, but the machine is busy: re-run when idle.");
             Ok(())
         }
         _ => Err(format!("{over} budget(s) exceeded")),

apps/vectorcraft-cli/tests/cli.rs

@@ -82,3 +82,166 @@ fn mcp_headless_over_stdio() {
     assert_eq!(replies[2]["result"]["isError"], false);
     assert_eq!(replies[3]["result"]["content"][0]["type"], "image");
 }
+
+/// End-to-end protocol sweep over stdio against the compiled binary. The in-process
+/// tests drive `Server::handle_line` directly, so the binary's own wiring (argument
+/// parsing, logger install, stdout pollution, notification order) is untested: this
+/// drives the real `mcp --headless` process through prompts, completions, resource
+/// templates, logging and the error taxonomy instead.
+#[test]
+fn mcp_protocol_over_stdio() {
+    use std::io::{BufRead, BufReader};
+    let mut child =
+        Command::new(BIN).args(["mcp", "--headless"]).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut lines = BufReader::new(child.stdout.take().unwrap()).lines();
+    let mut notes = vec![];
+
+    fn send(stdin: &mut std::process::ChildStdin, v: Value) {
+        writeln!(stdin, "{v}").unwrap();
+    }
+    // Next reply with this id; notifications (no id) are stashed for later.
+    fn recv(lines: &mut std::io::Lines<BufReader<std::process::ChildStdout>>, notes: &mut Vec<Value>, id: u64) -> Value {
+        loop {
+            let line = lines.next().unwrap().unwrap();
+            let v: Value = serde_json::from_str(&line).unwrap();
+            assert_eq!(v["jsonrpc"], "2.0", "{v}");
+            if v.get("id").and_then(|i| i.as_u64()) == Some(id) {
+                return v;
+            }
+            notes.push(v);
+        }
+    }
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"0"}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 1);
+    assert_eq!(r["result"]["serverInfo"]["name"], "vectorcraft");
+    assert!(r["result"]["capabilities"]["prompts"].is_object(), "{r}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","method":"notifications/initialized"}));
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":2,"method":"prompts/list","params":{}}));
+    let r = recv(&mut lines, &mut notes, 2);
+    assert!(r["result"]["prompts"].as_array().is_some_and(|p| !p.is_empty()), "{r}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":3,"method":"prompts/get","params":{"name":"poster","arguments":{"brief":"a jazz festival"}}}));
+    let r = recv(&mut lines, &mut notes, 3);
+    assert!(r["result"]["messages"][0]["content"]["text"].as_str().is_some_and(|t| t.contains("a jazz festival")), "{r}");
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":4,"method":"completion/complete","params":{"ref":{"type":"ref/prompt","name":"export-set"},"argument":{"name":"formats","value":"sv"}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 4);
+    assert!(r["result"]["completion"]["values"].as_array().is_some_and(|v| v.contains(&json!("svg"))), "{r}");
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":5,"method":"resources/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 2));
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":6,"method":"resources/templates/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 6)["result"]["resourceTemplates"].as_array().is_some_and(|v| v.len() >= 4));
+
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":7,"method":"tools/call","params":{"name":"draw_shape","arguments":{"shape":"rectangle","x":10,"y":10,"width":60,"height":40}}}),
+    );
+    let r = recv(&mut lines, &mut notes, 7);
+    assert_eq!(r["result"]["isError"], false, "{r}");
+    let id: i64 = serde_json::from_str::<Value>(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap()["id"].as_i64().unwrap();
+
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":8,"method":"resources/read","params":{"uri": format!("vectorcraft://object/{id}")}}));
+    let r = recv(&mut lines, &mut notes, 8);
+    let body: Value = serde_json::from_str(r["result"]["contents"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(body["id"].as_i64(), Some(id), "{body}");
+
+    // Unknown resources (-32002) and bad template values (-32602) stay apart.
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":9,"method":"resources/read","params":{"uri":"vectorcraft://nope" }}));
+    assert_eq!(recv(&mut lines, &mut notes, 9)["error"]["code"], -32002);
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":10,"method":"resources/read","params":{"uri":"vectorcraft://object/"}}));
+    assert_eq!(recv(&mut lines, &mut notes, 10)["error"]["code"], -32602);
+
+    // Large containers slice through run_command document.node: a truncated level reports
+    // childCount, and a bad limit is a tool error, not a crash or a full read.
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":20,"method":"tools/call","params":{"name":"draw_shape","arguments":{"shape":"ellipse","x":90,"y":10,"width":30,"height":30}}}),
+    );
+    assert_eq!(recv(&mut lines, &mut notes, 20)["result"]["isError"], false);
+    let run = |id: u64, command: &str, params: Value| json!({"jsonrpc":"2.0","id":id,"method":"tools/call","params":{"name":"run_command","arguments":{"command":command,"params":params}}});
+    send(&mut stdin, run(21, "select.all", json!({})));
+    recv(&mut lines, &mut notes, 21);
+    send(&mut stdin, run(22, "object.group", json!({})));
+    let r = recv(&mut lines, &mut notes, 22);
+    let group = serde_json::from_str::<Value>(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap()["id"].clone();
+    send(&mut stdin, run(23, "document.node", json!({"id": group, "summary": true, "childLimit": 1})));
+    let r = recv(&mut lines, &mut notes, 23);
+    let sliced: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(sliced["children"].as_array().map(Vec::len), Some(1), "{sliced}");
+    assert_eq!(sliced["childCount"], 2, "{sliced}");
+    send(&mut stdin, run(24, "document.node", json!({"id": group, "summary": true, "depth": -1})));
+    assert_eq!(recv(&mut lines, &mut notes, 24)["result"]["isError"], true);
+
+    // Skeleton then drill: a depth-0 inspect is the layer skeleton with counts, and
+    // document.find locates nodes without dumping the tree.
+    send(&mut stdin, run(25, "document.inspect", json!({"depth": 0})));
+    let r = recv(&mut lines, &mut notes, 25);
+    let skel: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert!(skel["layers"][0].get("children").is_none(), "{skel}");
+    assert!(skel["artboards"].as_array().is_some_and(|a| !a.is_empty()), "{skel}");
+    send(&mut stdin, run(26, "document.find", json!({"kind": "ellipse"})));
+    let r = recv(&mut lines, &mut notes, 26);
+    let found: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(found["total"], 1, "{found}");
+    assert!(found["matches"][0]["path"].as_array().is_some_and(|p| !p.is_empty()), "{found}");
+    send(&mut stdin, run(27, "document.find", json!({})));
+    assert_eq!(recv(&mut lines, &mut notes, 27)["result"]["isError"], true);
+
+    // The binary installed its logger: records arrive as notifications/message, and only
+    // after the client asked for them.
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":11,"method":"logging/setLevel","params":{"level":"debug"}}));
+    assert!(recv(&mut lines, &mut notes, 11).get("error").is_none());
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":12,"method":"tools/list","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 12)["result"]["tools"].as_array().is_some_and(|v| !v.is_empty()));
+
+    // Malformed input is a parse error, and the server keeps serving afterwards.
+    stdin.write_all(b"{not json\n").unwrap();
+    let parse_err: Value = loop {
+        let line = lines.next().unwrap().unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        if v.get("error").is_some() {
+            break v;
+        }
+        notes.push(v);
+    };
+    assert_eq!(parse_err["error"]["code"], -32700);
+    assert!(parse_err["id"].is_null(), "{parse_err}");
+    send(&mut stdin, json!({"jsonrpc":"2.0","id":13,"method":"ping","params":{}}));
+    assert!(recv(&mut lines, &mut notes, 13).get("error").is_none());
+    drop(stdin);
+    // Drain whatever the debug window queued; every line off the protocol stream parses.
+    for line in lines.by_ref() {
+        let line = line.unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        assert_eq!(v["jsonrpc"], "2.0", "{v}");
+        notes.push(v);
+    }
+    let out = child.wait_with_output().unwrap();
+    assert!(out.status.success());
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("panicked"));
+    let messages = notes.iter().filter(|n| n["method"] == "notifications/message").count();
+    assert!(messages > 0, "no log records after logging/setLevel: {notes:?}");
+}
+
+/// `vectorcraft-cli commands | head -1` panicked with "failed printing to
+/// stdout: Broken pipe (os error 32)" and exit status 101.
+#[test]
+fn closed_stdout_ends_quietly() {
+    use std::io::Read;
+    let mut child = Command::new(BIN).arg("commands").stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let mut first = [0u8; 16];
+    child.stdout.as_mut().unwrap().read_exact(&mut first).unwrap();
+    drop(child.stdout.take());
+    let out = child.wait_with_output().unwrap();
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(out.status.success() && !err.contains("panicked"), "{:?}: {err}", out.status);
+}

apps/vectorcraft-cli/tests/fileio.rs

@@ -82,3 +82,14 @@ fn help_lists_readable_formats() {
     let out = ok(&["--help"]);
     assert!(out.contains("Readable formats: .vectorcraft") && out.contains(".ait") && out.contains(".webp"), "{out}");
 }
+
+/// `info` reports the import warnings: an EPS read only up to an error names it.
+#[test]
+fn info_reports_why_an_eps_read_partly() {
+    let eps = tmp("partial.eps");
+    std::fs::write(&eps, "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n0 0 10 10 rectfill frobnicate\n%%EOF\n").unwrap();
+    let v = info(&eps);
+    let w = v["warnings"][0].as_str().unwrap_or_default();
+    assert!(w.contains("`frobnicate`"), "{v}");
+    assert_eq!(v["kinds"]["Path"], 1, "{v}");
+}

apps/vectorcraft-web/Cargo.toml

@@ -27,4 +27,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator"] }

apps/vectorcraft-web/src/locks.rs

@@ -0,0 +1,122 @@
+//! The browser's Web Locks (`navigator.locks`), which tell Data Recovery whether another tab still
+//! runs ([`vectorcraft_engine::cmd::recovery::RecoveryStore::announce`]). A tab holds a lock named
+//! after its recovery area for as long as it lives; the browser releases it only when the tab is
+//! gone (closed, crashed or reloaded), not while its timers are paused in the background, which a
+//! heartbeat can't tell apart.
+//!
+//! web-sys has Web Locks only as an unstable API, so they are reached through `js_sys::Reflect`.
+//! Pages that aren't secure (plain `http://` other than localhost) and older browsers have none:
+//! heartbeats alone decide there.
+
+use std::cell::RefCell;
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::{Arc, Mutex};
+
+use js_sys::{Function, Promise, Reflect};
+use vectorcraft_engine::cmd::recovery::Hold;
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+
+/// How often the snapshot of the locks held is refreshed (ms).
+const REFRESH_MS: i32 = 10_000;
+/// How old a snapshot may be and still be trusted (ms). A lock asked for after the snapshot was
+/// taken comes with a heartbeat, which stays fresh for at least three minutes, so anything under
+/// that is safe; an older snapshot counts every area as held.
+const FRESH_MS: f64 = 60_000.0;
+
+thread_local! {
+    /// What releases each lock this tab holds, by name: it resolves the promise the lock is held
+    /// by (wasm runs on one thread).
+    static RELEASE: RefCell<BTreeMap<String, Function>> = const { RefCell::new(BTreeMap::new()) };
+}
+
+/// The locks of the page, named `<prefix><area>`.
+#[derive(Clone)]
+pub struct WebLocks {
+    prefix: &'static str,
+    /// The areas whose locks were held at the last snapshot, and when it was asked for (ms since
+    /// the epoch). `navigator.locks.query()` is asynchronous, so the snapshot is refreshed every
+    /// [`REFRESH_MS`] and read from here.
+    seen: Arc<Mutex<(f64, BTreeSet<String>)>>,
+}
+
+/// `navigator.locks`, if the browser has it here.
+fn manager() -> Option<JsValue> {
+    let locks = Reflect::get(&web_sys::window()?.navigator(), &"locks".into()).ok()?;
+    locks.is_object().then_some(locks)
+}
+
+/// Method `name` of `obj`.
+fn method(obj: &JsValue, name: &str) -> Option<Function> {
+    Reflect::get(obj, &name.into()).ok()?.dyn_into().ok()
+}
+
+impl WebLocks {
+    /// The page's Web Locks with a first snapshot of them, kept fresh from then on; `None` when
+    /// the browser has none or won't say which are held (heartbeats alone decide then).
+    pub async fn start(prefix: &'static str) -> Option<Self> {
+        let locks = Self { prefix, seen: Arc::new(Mutex::new((f64::NEG_INFINITY, BTreeSet::new()))) };
+        locks.refresh().await?;
+        let again = locks.clone();
+        let tick = Closure::<dyn FnMut()>::new(move || {
+            let locks = again.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                // A failed refresh leaves the snapshot to age, and every area counts as held.
+                let _ = locks.refresh().await;
+            });
+        });
+        web_sys::window()?.set_interval_with_callback_and_timeout_and_arguments_0(tick.as_ref().unchecked_ref(), REFRESH_MS).ok()?;
+        // The timer lives as long as the page.
+        tick.forget();
+        Some(locks)
+    }
+
+    /// Take a new snapshot of the locks held.
+    async fn refresh(&self) -> Option<()> {
+        let m = manager()?;
+        let asked = js_sys::Date::now();
+        let query: Promise = method(&m, "query")?.call0(&m).ok()?.dyn_into().ok()?;
+        let snapshot = wasm_bindgen_futures::JsFuture::from(query).await.ok()?;
+        let held = js_sys::Array::from(&Reflect::get(&snapshot, &"held".into()).ok()?);
+        let areas = held
+            .iter()
+            .filter_map(|l| Reflect::get(&l, &"name".into()).ok()?.as_string())
+            .filter_map(|n| n.strip_prefix(self.prefix).map(str::to_string))
+            .collect();
+        *self.seen.lock().unwrap_or_else(|e| e.into_inner()) = (asked, areas);
+        Some(())
+    }
+
+    /// Does a tab hold `area`'s lock? Yes when the last snapshot is too old to tell.
+    pub fn held(&self, area: &str) -> bool {
+        let seen = self.seen.lock().unwrap_or_else(|e| e.into_inner());
+        js_sys::Date::now() - seen.0 > FRESH_MS || seen.1.contains(area)
+    }
+
+    /// Hold `area`'s lock until the returned hold is dropped (or the page goes).
+    pub fn hold(&self, area: &str) -> Option<Hold> {
+        let m = manager()?;
+        let name = format!("{}{area}", self.prefix);
+        // The lock is held until this promise resolves: when the hold is dropped.
+        let mut release = None;
+        let until = Promise::new(&mut |resolve, _| release = Some(resolve));
+        let release = release?;
+        let granted = Closure::once_into_js(move |_lock: JsValue| until);
+        method(&m, "request")?.call2(&m, &name.clone().into(), &granted).ok()?;
+        RELEASE.with(|r| r.borrow_mut().insert(name.clone(), release));
+        Some(Box::new(LockHold(name)))
+    }
+}
+
+/// A lock this tab holds (by name), released when dropped.
+struct LockHold(String);
+
+impl Drop for LockHold {
+    fn drop(&mut self) {
+        if let Some(resolve) = RELEASE.with(|r| r.borrow_mut().remove(&self.0)) {
+            // Resolving can't fail in a way worth reporting: the lock goes with the page anyway.
+            let _ = resolve.call0(&JsValue::NULL);
+        }
+    }
+}

apps/vectorcraft-web/src/main.rs

@@ -11,8 +11,11 @@
 //! - Save / Export trigger a browser download;
 //! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox.
 //!
-//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
+//! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod locks;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/web.rs

@@ -1,76 +1,183 @@
-//! The browser shell: web `Services`, drag-and-drop, and the eframe web runner.
+//! The browser shell: web `Services`, drag-and-drop, pasted pictures and files, the eframe web
+//! runner, and starting again with new graphics when the page loses them (#369).
 
-use std::cell::Cell;
+use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 
 use vectorcraft_engine::Session;
+use vectorcraft_engine::cmd::clipboard::{FILE_HEAD, Flavour, PASTE_ORDER, file_flavour};
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_engine::cmd::recovery::RecoveryStore;
+use vectorcraft_engine::cmd::recovery::{self, Hold, RecoveryStore};
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
+use vectorcraft_ui_egui::i18n;
 use vectorcraft_ui_egui::place::{DropTarget, PlaceArrival, PlaceInbox};
 use vectorcraft_ui_egui::print::{PrintJob, PrintService, Printer};
 use vectorcraft_ui_egui::{Services, VectorcraftApp};
 use wasm_bindgen::JsCast as _;
 
+use crate::locks::WebLocks;
+
 type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
 type DragPos = Rc<Cell<Option<(f32, f32, bool)>>>;
 
+/// A picture or file pasted into the page, read and waiting for the next frame with the modifiers
+/// held at the paste, and the context to wake for it (the current runner's).
+#[derive(Default)]
+struct Pasted {
+    flavour: Option<(Flavour, egui::Modifiers)>,
+    ctx: Option<egui::Context>,
+}
+
 const CANVAS_ID: &str = "vectorcraft_canvas";
 const LOADING_ID: &str = "vectorcraft_loading";
 
+/// How many times the page starts again with new graphics after losing them before it gives up
+/// (a GPU that keeps failing).
+const MAX_RESTARTS: u32 = 3;
+
+/// What the page keeps while the app runs, across graphics restarts.
+#[derive(Clone)]
+struct Host {
+    runner: eframe::WebRunner,
+    inbox: Inbox,
+    place_inbox: PlaceInbox,
+    drag: DragPos,
+    pasted: Rc<RefCell<Pasted>>,
+    /// The page's Web Locks for Data Recovery, started once before the first frame: a graphics
+    /// restart keeps them, so the tab stays the owner of its recovery area.
+    locks: Option<WebLocks>,
+    /// Graphics restarts so far.
+    restarts: u32,
+}
+
 pub fn start() {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
-    wasm_bindgen_futures::spawn_local(async {
-        let Some(document) = web_sys::window().and_then(|w| w.document()) else {
-            log::error!("no document");
-            return;
+    let Some(canvas) = element(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
+        log::error!("missing <canvas id=\"{CANVAS_ID}\">");
+        return;
+    };
+    detect_language();
+    wasm_bindgen_futures::spawn_local(async move {
+        // Before the first frame, which looks for copies a crash left behind.
+        let locks = WebLocks::start(RECOVERY_PREFIX).await;
+        let host = Host {
+            runner: eframe::WebRunner::new(),
+            inbox: Arc::default(),
+            place_inbox: Arc::default(),
+            drag: DragPos::default(),
+            pasted: Rc::default(),
+            locks,
+            restarts: 0,
         };
-        let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
-            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
-            return;
-        };
-        let drag = track_drag(&canvas);
-        let mut options = eframe::WebOptions::default();
-        if query().contains("webgl")
-            && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
-        {
-            create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
-        }
-        let result = eframe::WebRunner::new()
-            .start(
-                canvas,
-                options,
-                Box::new(move |cc| {
-                    if let Some(rs) = &cc.wgpu_render_state {
-                        log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+        track_paste(&host.pasted);
+        run(host, canvas, None).await;
+    });
+}
+
+/// An app whose graphics were lost, on its way to new ones.
+struct Moving {
+    app: VectorcraftApp,
+    /// Its unsaved changes are kept in recovery copies ([`VectorcraftApp::graphics_lost`]).
+    kept: bool,
+}
+
+/// Run the app on `canvas`: the `moving` one when starting again after losing the graphics, else
+/// a new one.
+async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Moving>) {
+    track_drag(&canvas, &host.drag);
+    let kept = moving.as_ref().map(|m| m.kept);
+    // The app until the new runner takes it (still here if starting fails before).
+    let slot = Rc::new(RefCell::new(moving.map(|m| m.app)));
+    let (runner, taken, page) = (host.runner.clone(), slot.clone(), canvas.clone());
+    let result = runner
+        .start(
+            canvas,
+            web_options(),
+            Box::new(move |cc| {
+                let ctx = &cc.egui_ctx;
+                let loss = GraphicsLoss::default();
+                watch_canvas(&page, &loss, ctx);
+                if let Some(rs) = &cc.wgpu_render_state {
+                    log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+                    let (loss, ctx) = (loss.clone(), ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                host.pasted.borrow_mut().ctx = Some(ctx.clone());
+                let services = services(host.inbox.clone(), host.place_inbox.clone(), ctx.clone(), host.locks.clone());
+                let app = match taken.borrow_mut().take() {
+                    Some(mut app) => {
+                        // The old services asked the old context for frames.
+                        app.services = services;
+                        app.status("The graphics were lost and have been restarted");
+                        app
                     }
-                    let inbox: Inbox = Arc::default();
-                    let place_inbox: PlaceInbox = Arc::default();
-                    let app = VectorcraftApp::new(Session::new(), services(inbox.clone(), place_inbox.clone(), cc.egui_ctx.clone()));
-                    Ok(Box::new(WebShell { app, inbox, place_inbox, drag }))
-                }),
-            )
-            .await;
-        if let Some(el) = document.get_element_by_id(LOADING_ID) {
-            match result {
-                Ok(()) => el.remove(),
-                Err(e) => el.set_inner_html(&format!("<p>VectorCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>")),
+                    None => VectorcraftApp::new(Session::new(), services),
+                };
+                Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
+            }),
+        )
+        .await;
+    match (result, kept) {
+        (Ok(()), _) => {
+            if let Some(el) = element(LOADING_ID) {
+                el.remove();
             }
         }
-    });
+        (Err(e), None) => notice(&[&format!("VectorCraft failed to start: {}", js_err(e)), "A browser with WebGPU or WebGL2 is required."]),
+        (Err(e), Some(kept)) => {
+            log::error!("vectorcraft-web: couldn't restart the graphics: {}", js_err(e));
+            give_up(slot.borrow_mut().take(), kept);
+        }
+    }
+}
+
+/// The runner's options: wgpu (WebGPU where available, else WebGL2; `?webgl` forces WebGL2).
+fn web_options() -> eframe::WebOptions {
+    let mut options = eframe::WebOptions::default();
+    if query().contains("webgl")
+        && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
+    {
+        create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
+    }
+    options
+}
+
+/// Tell the UI the browser's languages (`?lang=es` in the address first, as `VECTORCRAFT_LOCALE`
+/// does on the desktop) before the first frame, so the Automatic interface language follows the
+/// browser; and show the loading text in that language.
+fn detect_language() {
+    let mut tags: Vec<String> = query_param("lang").into_iter().collect();
+    if let Some(navigator) = web_sys::window().map(|w| w.navigator()) {
+        tags.extend(navigator.languages().iter().filter_map(|v| v.as_string()));
+        tags.extend(navigator.language());
+    }
+    i18n::set_system_locales(tags.as_slice());
+    if let Some(el) = element(LOADING_ID) {
+        el.set_text_content(Some(i18n::message(i18n::system_lang(), "Loading VectorCraft…").as_str()));
+    }
+}
+
+/// The value of `name=` in the address's query, if given.
+fn query_param(name: &str) -> Option<String> {
+    let query = query();
+    query.trim_start_matches('?').split('&').find_map(|kv| kv.strip_prefix(name)?.strip_prefix('=').map(str::to_string)).filter(|v| !v.is_empty())
 }
 
 fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
-/// Follow file drags over the canvas: drag events carry the pointer position, which egui doesn't
-/// get during a drag.
-fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
-    let pos = DragPos::default();
+fn element(id: &str) -> Option<web_sys::Element> {
+    web_sys::window()?.document()?.get_element_by_id(id)
+}
+
+/// Follow file drags over `canvas` into `pos`: drag events carry the pointer position, which egui
+/// doesn't get during a drag.
+fn track_drag(canvas: &web_sys::HtmlCanvasElement, pos: &DragPos) {
     let p = pos.clone();
     let on_drag = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::DragEvent)>::new(move |e: web_sys::DragEvent| {
         p.set(Some((e.offset_x() as f32, e.offset_y() as f32, e.shift_key())));
@@ -80,36 +187,179 @@ fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
             log::error!("couldn't follow {kind} events: {e:?}");
         }
     }
-    // The listener lives as long as the page.
+    // The listener lives as long as the canvas.
     on_drag.forget();
-    pos
+}
+
+/// Take pictures and files pasted into the page (egui reads a paste's text only): a paste without
+/// text hands the first of its files that is art (a bitmap, SVG, PDF, a metafile) to the next
+/// frame. Text, SVG markup among it, is left to egui.
+fn track_paste(pasted: &Rc<RefCell<Pasted>>) {
+    let Some(window) = web_sys::window() else { return };
+    let pasted = pasted.clone();
+    let on_paste = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::ClipboardEvent)>::new(move |e: web_sys::ClipboardEvent| {
+        let Some(data) = e.clipboard_data() else { return };
+        let Some(files) = data.files().filter(|f| f.length() > 0) else { return };
+        if data.get_data("text").is_ok_and(|t| !t.is_empty()) {
+            return;
+        }
+        e.prevent_default();
+        let held = pasted.borrow().ctx.as_ref().map(|c| c.input(|i| i.modifiers)).unwrap_or_default();
+        let files: Vec<web_sys::File> = (0..files.length()).filter_map(|i| files.get(i)).collect();
+        let pasted = pasted.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            for file in files {
+                let bytes = match wasm_bindgen_futures::JsFuture::from(file.array_buffer()).await {
+                    Ok(buf) => js_sys::Uint8Array::new(&buf).to_vec(),
+                    Err(e) => {
+                        log::error!("couldn't read the pasted file {}: {}", file.name(), js_err(e));
+                        continue;
+                    }
+                };
+                if let Some(mime) = file_flavour(&file.name(), bytes.get(..FILE_HEAD).unwrap_or(&bytes), &PASTE_ORDER) {
+                    let mut p = pasted.borrow_mut();
+                    p.flavour = Some((Flavour { mime, data: bytes }, held));
+                    if let Some(ctx) = &p.ctx {
+                        ctx.request_repaint();
+                    }
+                    return;
+                }
+            }
+        });
+    });
+    // Captured before eframe's own listener, which stops the event.
+    if let Err(e) = window.add_event_listener_with_callback_and_bool("paste", on_paste.as_ref().unchecked_ref(), true) {
+        log::error!("couldn't follow paste events: {e:?}");
+    }
+    // The listener lives as long as the page.
+    on_paste.forget();
+}
+
+/// Report the loss of `canvas`'s WebGL context to `loss` (WebGPU devices report theirs through
+/// wgpu).
+fn watch_canvas(canvas: &web_sys::HtmlCanvasElement, loss: &GraphicsLoss, ctx: &egui::Context) {
+    let (loss, ctx) = (loss.clone(), ctx.clone());
+    let on_lost = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::Event)>::new(move |_: web_sys::Event| {
+        loss.report(&ctx, "the WebGL context was lost");
+    });
+    if let Err(e) = canvas.add_event_listener_with_callback("webglcontextlost", on_lost.as_ref().unchecked_ref()) {
+        log::error!("couldn't watch for a lost WebGL context: {e:?}");
+    }
+    // The listener lives as long as the canvas.
+    on_lost.forget();
+}
+
+/// A new canvas in place of `old`, whose graphics were lost (a canvas whose WebGL context is lost
+/// can't get another).
+fn fresh_canvas(old: &web_sys::HtmlCanvasElement) -> Result<web_sys::HtmlCanvasElement, String> {
+    let new: web_sys::HtmlCanvasElement = old.clone_node().map_err(js_err)?.dyn_into().map_err(|_| "not a canvas")?;
+    old.replace_with_with_node_1(&new).map_err(js_err)?;
+    Ok(new)
+}
+
+/// The graphics are lost for good: the dead canvas goes (it would show a stale picture), the app
+/// (if still here) lets go of its recovery copies so the reloaded page offers them at once, and
+/// the page says what to do.
+fn give_up(app: Option<VectorcraftApp>, kept: bool) {
+    if let Some(mut app) = app {
+        recovery::leave(&mut app.session);
+    }
+    if let Some(canvas) = element(CANVAS_ID) {
+        canvas.remove();
+    }
+    notice(&[
+        "The graphics were lost and couldn't be restarted.",
+        if kept {
+            "Your unsaved changes are kept in this browser: reload the page to get them back."
+        } else {
+            "Reload the page to go on (changes not saved yet may be lost)."
+        },
+    ]);
+}
+
+/// Show `lines` in the middle of the page (where the loading message was).
+fn notice(lines: &[&str]) {
+    let Some(document) = web_sys::window().and_then(|w| w.document()) else { return };
+    let el = match document.get_element_by_id(LOADING_ID) {
+        Some(el) => el,
+        None => {
+            let Ok(el) = document.create_element("div") else { return };
+            el.set_id(LOADING_ID);
+            let Some(body) = document.body() else { return };
+            if let Err(e) = body.append_child(&el) {
+                log::error!("couldn't show a message: {e:?}");
+            }
+            el
+        }
+    };
+    el.set_text_content(None);
+    for line in lines {
+        if let Ok(p) = document.create_element("p") {
+            p.set_text_content(Some(i18n::message(i18n::system_lang(), line).as_str()));
+            // Best effort: the log has the message too.
+            el.append_child(&p).ok();
+        }
+    }
 }
 
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
 /// and feed them through the inboxes: placed where they were dropped on the canvas, else opened.
+/// When the graphics are lost it hands the app to a new runner on a new canvas.
 struct WebShell {
-    app: VectorcraftApp,
-    inbox: Inbox,
-    place_inbox: PlaceInbox,
-    drag: DragPos,
+    /// `None` once handed on.
+    app: Option<VectorcraftApp>,
+    host: Host,
+    canvas: web_sys::HtmlCanvasElement,
+    loss: GraphicsLoss,
+}
+
+impl WebShell {
+    /// The graphics were lost (`why`): keep recovery copies, then start again on a new canvas
+    /// with the same app once this frame is over (the runner is busy with it until then).
+    fn restart(&mut self, why: &str) {
+        let Some(mut app) = self.app.take() else { return };
+        let kept = app.graphics_lost(why);
+        let mut host = self.host.clone();
+        host.restarts += 1;
+        let canvas =
+            if host.restarts > MAX_RESTARTS { Err(format!("the graphics were lost {MAX_RESTARTS} times")) } else { fresh_canvas(&self.canvas) };
+        match canvas {
+            Ok(canvas) => wasm_bindgen_futures::spawn_local(run(host, canvas, Some(Moving { app, kept }))),
+            Err(e) => {
+                log::error!("vectorcraft-web: giving up on the graphics: {e}");
+                let runner = host.runner;
+                wasm_bindgen_futures::spawn_local(async move { runner.destroy() });
+                give_up(Some(app), kept);
+            }
+        }
+    }
 }
 
 impl eframe::App for WebShell {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if let Some(why) = self.loss.take() {
+            self.restart(&why);
+        }
+        let Some(app) = &mut self.app else { return };
+        let pasted = self.host.pasted.borrow_mut().flavour.take();
+        if let Some((f, held)) = pasted {
+            app.paste_from_host(ctx, f, held);
+        }
         let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
         if !dropped.is_empty() {
-            let at = self.drag.take();
+            let at = self.host.drag.take();
             let z = ctx.zoom_factor();
-            let target = self.app.drop_target(at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
+            let (pos, shift) = (at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
             for f in dropped {
-                let (inbox, place_inbox, ctx) = (self.inbox.clone(), self.place_inbox.clone(), ctx.clone());
+                let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
+                let target = app.drop_target(&name, pos, shift);
+                let (inbox, place_inbox, ctx) = (self.host.inbox.clone(), self.host.place_inbox.clone(), ctx.clone());
                 wasm_bindgen_futures::spawn_local(async move {
-                    let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
                     match f.bytes_async().await {
                         Ok(bytes) => {
                             match target {
-                                DropTarget::Place { at, embed } => {
-                                    place_inbox.lock().unwrap_or_else(|e| e.into_inner()).push(PlaceArrival { name, bytes, drop: Some((at, embed)) })
+                                DropTarget::Place(d) => {
+                                    place_inbox.lock().unwrap_or_else(|e| e.into_inner()).push(PlaceArrival { name, bytes, drop: Some(d) })
                                 }
                                 DropTarget::Open => inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes)),
                             }
@@ -120,19 +370,23 @@ impl eframe::App for WebShell {
                 });
             }
         }
-        self.app.logic(ctx);
+        app.logic(ctx);
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.app.raw_input_hook(raw);
+        if let Some(app) = &mut self.app {
+            app.raw_input_hook(raw);
+        }
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.app.ui(ui);
+        if let Some(app) = &mut self.app {
+            app.ui(ui);
+        }
     }
 }
 
-fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Services {
+fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Option<WebLocks>) -> Services {
     let open_inbox = inbox.clone();
     let picked = place_inbox.clone();
     let place_ctx = ctx.clone();
@@ -174,7 +428,7 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
             }
         })),
         inbox: Some(inbox),
-        recovery_store: Some(Arc::new(BrowserStore)),
+        recovery_store: Some(Arc::new(BrowserStore { locks })),
         // File → Print: the browser's print dialog.
         print: Some(Box::new(BrowserPrint)),
         ..Default::default()
@@ -183,8 +437,12 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
 
 /// Data Recovery's store on the web: the browser's local storage (kept across visits and shared by
 /// the site's tabs), each entry as base64 under [`RECOVERY_PREFIX`]`<area>/<name>`. It has no
-/// locks: each tab holds its area with a heartbeat, judged by the browser's clock.
-struct BrowserStore;
+/// locks: each tab holds its area with a heartbeat, judged by the browser's clock, and with a Web
+/// Lock named after it where the browser has them (`locks`), which a tab whose timers are paused
+/// in the background keeps.
+struct BrowserStore {
+    locks: Option<WebLocks>,
+}
 
 const RECOVERY_PREFIX: &str = "vectorcraft-recovery/";
 
@@ -220,6 +478,12 @@ impl RecoveryStore for BrowserStore {
     fn now(&self) -> Option<i64> {
         Some((js_sys::Date::now() / 1000.0) as i64)
     }
+    fn announce(&self, area: &str) -> Option<Hold> {
+        self.locks.as_ref()?.hold(area)
+    }
+    fn announced(&self, area: &str) -> Option<bool> {
+        self.locks.as_ref().map(|l| l.held(area))
+    }
 }
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.

apps/vectorcraft/Cargo.toml

@@ -9,17 +9,25 @@ default-run = "vectorcraft"
 [lints]
 workspace = true
 
+[features]
+default = ["wgpu", "accessibility"]
+wgpu = ["eframe/wgpu"]
+accessibility = ["eframe/accesskit"]
+# Build with --no-default-features --features windows7 and the win7 Rust target.
+windows7 = ["eframe/glow"]
+
 [dependencies]
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+# wayland-data-control: native Wayland clipboard (Linux; X11 through XWayland only sees what X11 apps copied).
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
 image = { workspace = true }
 webbrowser = { workspace = true }
 # The window's monitors, size and position (the same winit eframe runs on).
@@ -29,7 +37,14 @@ winit = { version = "0.30", default-features = false }
 clipboard-win = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
-muda = { version = "0.21", default-features = false }
+# The macOS menu bar (src/mac_menu.rs): Tauri's menu crate, AppKit menus behind a safe API (no GTK
+# with default features off). Pinned exactly: review the diff before bumping.
+muda = { version = "=0.21.1", default-features = false }
+objc2 = "0.6"
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSMenu", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
+# Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+block2 = "0.6"
 
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.

apps/vectorcraft/src/clipboard.rs

@@ -2,13 +2,20 @@
 //! (`Services::system_clipboard`).
 //!
 //! - Windows: text, SVG, PDF, PNG and an opaque bitmap (for apps that don't read PNG) in one go;
-//!   Paste reads each of them.
+//!   Paste reads each of them, a bitmap as PNG, else as the device-independent bitmap that
+//!   screenshots and most apps copy (`CF_DIBV5`, `CF_DIB`; the system makes them of a `CF_BITMAP`).
 //! - macOS and Linux: one format at a time, the text (a type-only copy's text or the SVG markup),
-//!   else the PNG as a bitmap; Paste reads text and bitmaps.
+//!   else the PNG as a bitmap; Paste reads text and bitmaps (on macOS the pasteboard's PNG or TIFF
+//!   as they are, as screenshots copy them). On Wayland, arboard's data-control
+//!   backend reads the compositor's clipboard (X11 through XWayland only sees what X11 apps
+//!   copied), falling back to X11 where the compositor lacks the protocol.
+//! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, a
+//!   metafile or a bitmap), before the clipboard's other formats (the files' paths as text).
 
-use std::io::Cursor;
+use std::io::{Cursor, Read};
+use std::path::PathBuf;
 
-use vectorcraft_engine::cmd::clipboard::{BITMAP, Flavour, PNG, TEXT};
+use vectorcraft_engine::cmd::clipboard::{BITMAP, FILE_HEAD, Flavour, PNG, TEXT, file_flavour};
 use vectorcraft_ui_egui::SystemClipboard;
 
 /// This platform's system clipboard.
@@ -25,10 +32,96 @@ fn text_of(flavours: &[Flavour]) -> Option<String> {
     flavours.iter().find(|f| f.mime == TEXT).map(|f| String::from_utf8_lossy(&f.data).into_owned())
 }
 
+/// Most pixels a side of a bitmap another app put on the clipboard (untrusted data).
+const MAX_SIDE: u32 = 32_768;
+
 fn decode_png(png: &[u8]) -> Option<image::RgbaImage> {
     Some(image::load_from_memory_with_format(png, image::ImageFormat::Png).ok()?.to_rgba8())
 }
 
+/// `img` as a PNG flavour.
+fn png_flavour(img: &image::RgbaImage) -> Option<Flavour> {
+    let mut data = vec![];
+    img.write_to(&mut Cursor::new(&mut data), image::ImageFormat::Png).ok()?;
+    Some(Flavour { mime: PNG, data })
+}
+
+/// A Windows device-independent bitmap (`CF_DIB`, `CF_DIBV5`: a BITMAPINFO header, the colour
+/// masks of a BITMAPINFOHEADER, the colour table, then the pixels) as a BMP file, whose header
+/// says where the pixels start. `None` when the header is cut short or out of range.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_file(dib: &[u8]) -> Option<Vec<u8>> {
+    const BI_BITFIELDS: u32 = 3;
+    const BI_ALPHABITFIELDS: u32 = 6;
+    let u16_at = |i: usize| Some(u16::from_le_bytes(dib.get(i..i + 2)?.try_into().ok()?));
+    let u32_at = |i: usize| Some(u32::from_le_bytes(dib.get(i..i + 4)?.try_into().ok()?));
+    let header = u32_at(0)?;
+    // BITMAPCOREHEADER has 16-bit fields and 3-byte colours; the others 32-bit fields, 4-byte
+    // colours and a count of them (0: all a palette of the depth has), the 40-byte one its masks
+    // after it.
+    let (bits, used, entry, masks) = match header {
+        12 => (u16_at(10)?, 0, 3, 0),
+        _ => {
+            let masks = match (header, u32_at(16)?) {
+                (40, BI_BITFIELDS) => 12,
+                (40, BI_ALPHABITFIELDS) => 16,
+                _ => 0,
+            };
+            (u16_at(14)?, u32_at(32)?, 4, masks)
+        }
+    };
+    let colours = match used {
+        0 if bits <= 8 => 1 << bits,
+        n if n <= 256 => n,
+        _ => return None,
+    };
+    let offset = [header, masks, colours * entry].into_iter().try_fold(14u32, u32::checked_add)?;
+    let size = u32::try_from(dib.len()).ok()?.checked_add(14)?;
+    if offset > size {
+        return None;
+    }
+    let mut bmp = Vec::with_capacity(dib.len() + 14);
+    bmp.extend_from_slice(b"BM");
+    bmp.extend_from_slice(&size.to_le_bytes());
+    bmp.extend_from_slice(&[0; 4]);
+    bmp.extend_from_slice(&offset.to_le_bytes());
+    bmp.extend_from_slice(dib);
+    Some(bmp)
+}
+
+/// A device-independent bitmap as an image, at most [`MAX_SIDE`] pixels a side. It is opaque when
+/// its alpha is zero throughout: screenshots and most apps leave the fourth byte of a 32-bit pixel
+/// at zero, even under an alpha mask.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_image(dib: &[u8]) -> Option<image::RgbaImage> {
+    let mut reader = image::ImageReader::with_format(Cursor::new(dib_file(dib)?), image::ImageFormat::Bmp);
+    let mut limits = image::Limits::default();
+    (limits.max_image_width, limits.max_image_height) = (Some(MAX_SIDE), Some(MAX_SIDE));
+    reader.limits(limits);
+    let mut img = reader.decode().ok()?.into_rgba8();
+    if img.pixels().all(|p| p.0[3] == 0) {
+        img.pixels_mut().for_each(|p| p.0[3] = u8::MAX);
+    }
+    Some(img)
+}
+
+/// The first of `paths` (files copied in a file manager) that pastes as one of `mimes`, read
+/// whole. Only its first bytes are read to tell, so other files cost little.
+fn copied_file(paths: Vec<PathBuf>, mimes: &[&'static str]) -> Option<Flavour> {
+    paths.into_iter().find_map(|path| {
+        // text/uri-list lines end in CRLF (RFC 2483), but arboard splits them on LF only.
+        let path = match path.to_str() {
+            Some(p) if p.ends_with('\r') => PathBuf::from(p.trim_end_matches('\r')),
+            _ => path,
+        };
+        let mut head = Vec::with_capacity(FILE_HEAD);
+        std::fs::File::open(&path).ok()?.take(FILE_HEAD as u64).read_to_end(&mut head).ok()?;
+        let mime = file_flavour(&path.to_string_lossy(), &head, mimes)?;
+        let data = std::fs::read(&path).ok()?;
+        (!data.is_empty()).then_some(Flavour { mime, data })
+    })
+}
+
 #[cfg(windows)]
 mod win {
     use std::num::NonZeroU32;
@@ -49,6 +142,10 @@ mod win {
         }
     }
 
+    /// The device-independent bitmaps, the one that carries alpha first. Each is there whenever the
+    /// other or a `CF_BITMAP` is: the system converts between them.
+    const DIBS: [u32; 2] = [formats::CF_DIBV5, formats::CF_DIB];
+
     fn formats_of(mime: &str) -> impl Iterator<Item = u32> {
         names(mime).iter().filter_map(|n| raw::register_format(n)).map(NonZeroU32::get)
     }
@@ -123,16 +220,26 @@ mod win {
         }
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
-            let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
-            mimes.iter().find_map(|m| read_one(m))
+            let mut files = vec![];
+            {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                // None copied when the clipboard holds no file list.
+                let _ = raw::get_file_list_path(&mut files);
+            }
+            // The files are read with the clipboard closed again, not keeping other apps waiting.
+            copied_file(files, mimes).or_else(|| {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                mimes.iter().find_map(|m| read_one(m))
+            })
         }
 
         fn has(&mut self, mimes: &[&'static str]) -> bool {
-            mimes.iter().any(|m| match *m {
-                TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
-                BITMAP => raw::is_format_avail(formats::CF_BITMAP) || formats_of(PNG).any(raw::is_format_avail),
-                m => formats_of(m).any(raw::is_format_avail),
-            })
+            raw::is_format_avail(formats::CF_HDROP)
+                || mimes.iter().any(|m| match *m {
+                    TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
+                    BITMAP => DIBS.into_iter().chain(formats_of(PNG)).any(raw::is_format_avail),
+                    m => formats_of(m).any(raw::is_format_avail),
+                })
         }
     }
 
@@ -150,9 +257,11 @@ mod win {
         let mime = match mime {
             BITMAP if read_registered(PNG, &mut data) => PNG,
             BITMAP => {
-                data.clear();
-                raw::get_bitmap(&mut data).ok()?;
-                "image/bmp"
+                return DIBS.into_iter().find_map(|id| {
+                    data.clear();
+                    raw::get_vec(id, &mut data).ok()?;
+                    png_flavour(&dib_image(&data)?)
+                });
             }
             TEXT => {
                 raw::get_string(&mut data).ok()?;
@@ -178,13 +287,6 @@ mod portable {
 
     use super::*;
 
-    /// `img` as PNG bytes.
-    fn encode_png(img: &image::RgbaImage) -> Option<Vec<u8>> {
-        let mut out = vec![];
-        img.write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).ok()?;
-        Some(out)
-    }
-
     /// What our last write put on the clipboard.
     enum Ours {
         Text(String),
@@ -245,20 +347,203 @@ mod portable {
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
             let cb = self.cb().ok()?;
+            if let Some(f) = cb.get().file_list().ok().and_then(|paths| copied_file(paths, mimes)) {
+                return Some(f);
+            }
             mimes.iter().find_map(|m| match *m {
                 TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
                 BITMAP => {
+                    #[cfg(target_os = "macos")]
+                    if let Some(f) = super::mac::bitmap() {
+                        return Some(f);
+                    }
                     let img = cb.get_image().ok()?;
                     let rgba = image::RgbaImage::from_raw(u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?, img.bytes.into_owned())?;
-                    encode_png(&rgba).map(|data| Flavour { mime: PNG, data })
+                    png_flavour(&rgba)
                 }
                 _ => None,
             })
         }
 
-        /// Text only: reading a bitmap costs as much as pasting it.
+        /// Text, and on macOS a bitmap (by the pasteboard's types). Linux has no cheap way to ask
+        /// for a bitmap (reading one costs as much as pasting it): the paste keys take it, the
+        /// menu item waits for text.
         fn has(&mut self, mimes: &[&'static str]) -> bool {
+            #[cfg(target_os = "macos")]
+            if mimes.contains(&BITMAP) && super::mac::has_bitmap() {
+                return true;
+            }
             mimes.contains(&TEXT) && self.cb().is_ok_and(|cb| cb.get_text().is_ok_and(|t| !t.is_empty()))
         }
     }
 }
+
+/// The macOS pasteboard's bitmaps as they are (arboard reads TIFF only, and decodes it).
+#[cfg(target_os = "macos")]
+mod mac {
+    use objc2::rc::autoreleasepool;
+    use objc2_app_kit::NSPasteboard;
+    use objc2_foundation::{NSArray, NSString};
+
+    use super::*;
+
+    /// The bitmap types Paste reads, best first (the values of `NSPasteboardTypePNG` and
+    /// `NSPasteboardTypeTIFF`), with their MIME types.
+    const TYPES: [(&str, &str); 2] = [("public.png", PNG), ("public.tiff", "image/tiff")];
+
+    /// Does the pasteboard hold a bitmap? Asks for its types only.
+    pub fn has_bitmap() -> bool {
+        autoreleasepool(|_| {
+            let types = TYPES.map(|(t, _)| NSString::from_str(t));
+            let types: Vec<&NSString> = types.iter().map(|t| &**t).collect();
+            NSPasteboard::generalPasteboard().availableTypeFromArray(&NSArray::from_slice(&types)).is_some()
+        })
+    }
+
+    /// The pasteboard's bitmap, PNG before TIFF.
+    pub fn bitmap() -> Option<Flavour> {
+        autoreleasepool(|_| {
+            let pasteboard = NSPasteboard::generalPasteboard();
+            TYPES.into_iter().find_map(|(t, mime)| {
+                let data = pasteboard.dataForType(&NSString::from_str(t))?.to_vec();
+                (!data.is_empty()).then_some(Flavour { mime, data })
+            })
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use vectorcraft_engine::cmd::clipboard::{PASTE_ORDER, SVG};
+
+    use super::*;
+
+    fn dir(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("vectorcraft-clipboard-{name}-{}", std::process::id()));
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    fn png(w: u32, h: u32) -> Vec<u8> {
+        let mut out = vec![];
+        image::RgbaImage::new(w, h).write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).unwrap();
+        out
+    }
+
+    #[test]
+    fn the_first_copied_file_that_is_art_pastes() {
+        let d = dir("art");
+        let (notes, red, art) = (d.join("notes.txt"), d.join("red image.png"), d.join("art.svg"));
+        std::fs::write(&notes, "not art").unwrap();
+        std::fs::write(&red, png(3, 2)).unwrap();
+        std::fs::write(&art, "<svg xmlns=\"http://www.w3.org/2000/svg\"/>").unwrap();
+        // Missing files, folders and text are skipped.
+        let f = copied_file(vec![d.join("gone.png"), d.clone(), notes.clone(), red.clone(), art.clone()], &PASTE_ORDER).unwrap();
+        assert_eq!((f.mime, f.data), (PNG, png(3, 2)));
+        assert_eq!(copied_file(vec![art.clone(), red.clone()], &PASTE_ORDER).map(|f| f.mime), Some(SVG));
+        // Only what Paste asks for.
+        assert_eq!(copied_file(vec![art, red.clone()], &[BITMAP]).map(|f| f.mime), Some(PNG));
+        assert!(copied_file(vec![red], &[TEXT]).is_none());
+        assert!(copied_file(vec![notes], &PASTE_ORDER).is_none());
+        assert!(copied_file(vec![], &PASTE_ORDER).is_none());
+    }
+
+    #[test]
+    fn a_crlf_left_by_the_uri_list_is_ignored() {
+        let red = dir("crlf").join("red.png");
+        std::fs::write(&red, png(2, 2)).unwrap();
+        let with_cr = PathBuf::from(format!("{}\r", red.display()));
+        assert_eq!(copied_file(vec![with_cr], &PASTE_ORDER).map(|f| f.mime), Some(PNG));
+    }
+
+    /// A DIB of `w`×`h` pixels (top row first when `h` is negative): a `header`-byte header (40,
+    /// or 124 for a BITMAPV5HEADER with BGRA masks), `extra` (the masks after a 40-byte header, a
+    /// colour table), then `rows`, each padded to 4 bytes.
+    fn dib(header: u32, w: i32, h: i32, bits: u16, compression: u32, extra: &[u8], rows: &[u8]) -> Vec<u8> {
+        let mut d = vec![];
+        d.extend(header.to_le_bytes());
+        d.extend(w.to_le_bytes());
+        d.extend(h.to_le_bytes());
+        d.extend(1u16.to_le_bytes());
+        d.extend(bits.to_le_bytes());
+        d.extend(compression.to_le_bytes());
+        d.extend((rows.len() as u32).to_le_bytes());
+        // 96 ppi, every colour of the table used.
+        d.extend([3780u32, 3780, 0, 0].iter().flat_map(|v| v.to_le_bytes()));
+        if header == 124 {
+            d.extend([0x00FF_0000u32, 0xFF00, 0xFF, 0xFF00_0000, 0x7352_4742].iter().flat_map(|v| v.to_le_bytes()));
+            d.resize(124, 0);
+        }
+        d.extend_from_slice(extra);
+        d.extend_from_slice(rows);
+        d
+    }
+
+    /// 32-bit BGRA rows of `px` (top row first).
+    fn bgra(px: &[[u8; 4]]) -> Vec<u8> {
+        px.iter().flat_map(|[r, g, b, a]| [*b, *g, *r, *a]).collect()
+    }
+
+    const RED: [u8; 4] = [255, 0, 0, 255];
+    const BLUE: [u8; 4] = [0, 0, 255, 255];
+
+    fn pixels(img: &image::RgbaImage) -> Vec<[u8; 4]> {
+        img.pixels().map(|p| p.0).collect()
+    }
+
+    #[test]
+    fn a_screenshot_dib_pastes_opaque_and_upright() {
+        // CF_DIB as screenshots copy it: 32-bit BI_RGB, bottom row first, the fourth byte zero.
+        let rows = bgra(&[[0, 0, 255, 0], [0, 0, 255, 0], [255, 0, 0, 0], [255, 0, 0, 0]]);
+        let img = dib_image(&dib(40, 2, 2, 32, 0, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [RED, RED, BLUE, BLUE]);
+        // The same bitmap with an alpha mask (CF_DIBV5), alpha still zero throughout: opaque too.
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &bgra(&[[255, 0, 0, 0]; 4]))).unwrap();
+        assert_eq!(pixels(&img), [RED; 4]);
+    }
+
+    #[test]
+    fn a_dibv5_keeps_its_alpha_top_down() {
+        // A negative height: top row first.
+        let rows = bgra(&[[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], [0, 0, 255, 255]]);
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], BLUE]);
+    }
+
+    #[test]
+    fn masks_and_colour_tables_come_before_the_pixels() {
+        // BI_BITFIELDS after a 40-byte header: three masks between it and the pixels.
+        let masks: Vec<u8> = [0x00FF_0000u32, 0xFF00, 0xFF].iter().flat_map(|v| v.to_le_bytes()).collect();
+        let img = dib_image(&dib(40, 1, 1, 32, 3, &masks, &bgra(&[[0, 0, 255, 0]]))).unwrap();
+        assert_eq!(pixels(&img), [BLUE]);
+        // 8-bit, two colours used, rows padded to 4 bytes, bottom row first.
+        let mut table = bgra(&[RED, BLUE]);
+        table[3] = 0;
+        let mut d = dib(40, 3, 2, 8, 0, &table, &[1, 1, 1, 0, 0, 1, 0, 0]);
+        d[32..36].copy_from_slice(&2u32.to_le_bytes());
+        assert_eq!(pixels(&dib_image(&d).unwrap()), [RED, BLUE, RED, BLUE, BLUE, BLUE]);
+        // 24-bit, rows padded.
+        let img = dib_image(&dib(40, 1, 2, 24, 0, &[], &[255, 0, 0, 0, 0, 0, 255, 0])).unwrap();
+        assert_eq!(pixels(&img), [RED, BLUE]);
+    }
+
+    #[test]
+    fn untrusted_dibs_are_refused_not_trusted() {
+        let one = bgra(&[RED]);
+        // Too large a side (the pixels aren't even there), cut short, a header or a colour count
+        // out of range, no pixels.
+        assert!(dib_image(&dib(40, MAX_SIDE as i32 + 1, 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 1, -(MAX_SIDE as i32) - 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 4096, 4096, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&[40, 0, 0]).is_none());
+        assert!(dib_image(&[]).is_none());
+        let mut d = dib(40, 1, 1, 32, 0, &[], &one);
+        d[0..4].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_image(&d).is_none());
+        let mut d = dib(40, 1, 1, 8, 0, &[], &[0; 4]);
+        d[32..36].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_file(&d).is_none());
+        assert!(dib_image(&dib(40, 1, 1, 32, 0, &[], &[])).is_none());
+        assert!(dib_image(&dib(40, 0, 0, 32, 0, &[], &[])).is_none());
+    }
+}

apps/vectorcraft/src/control_server.rs

@@ -1,14 +1,28 @@
 //! Loopback JSON-lines control server: one request per line, one reply per line.
 //! This is the transport the MCP server (`vectorcraft mcp --connect`) wraps.
+//!
+//! The server only ever reads requests: a line that is not a JSON object with a string `method`
+//! (an HTTP request line from a browser's cross-origin `fetch`, a stray `nc`, binary junk) gets
+//! one error reply and the connection is closed, so nothing after it is executed. Lines are
+//! bounded ([`MAX_LINE`]) and so is the number of open connections ([`MAX_CONNECTIONS`]); junk
+//! never reaches the UI thread. See `docs/control-protocol.md`.
 
-use std::io::{BufRead, BufReader, Write};
+use std::io::{BufRead, BufReader, Read, Write};
 use std::net::{TcpListener, TcpStream};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::mpsc::{Receiver, Sender, channel};
 use std::time::Duration;
 
 use serde_json::{Value, json};
 use vectorcraft_ui_egui::ControlRequest;
 
+/// Longest accepted request line (bytes, without the newline). Requests are small JSON objects;
+/// anything longer is refused and the connection closed.
+pub const MAX_LINE: usize = 4 * 1024 * 1024;
+/// Connections served at once; further ones get an error line and are closed.
+pub const MAX_CONNECTIONS: usize = 16;
+
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
@@ -19,44 +33,249 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
         }
     };
     eprintln!("vectorcraft: control server listening on 127.0.0.1:{port}");
-    std::thread::spawn(move || {
-        for stream in listener.incoming().flatten() {
-            let tx = tx.clone();
-            let ctx = ctx.clone();
-            std::thread::spawn(move || serve(stream, tx, ctx));
-        }
-    });
+    std::thread::spawn(move || accept_loop(listener, tx, ctx));
     rx
 }
 
-fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
-    let Ok(read) = stream.try_clone() else { return };
-    let mut out = stream;
-    for line in BufReader::new(read).lines() {
-        let Ok(line) = line else { break };
-        if line.trim().is_empty() {
+fn accept_loop(listener: TcpListener, tx: Sender<ControlRequest>, ctx: egui::Context) {
+    let open = Arc::new(AtomicUsize::new(0));
+    for mut stream in listener.incoming().flatten() {
+        if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
+            open.fetch_sub(1, Ordering::SeqCst);
+            // Best effort: the connection is dropped either way, and a peer that can't read the reason loses nothing.
+            let _ = writeln!(stream, "{}", json!({"ok": false, "error": "too many control connections"}));
             continue;
         }
-        let reply = match serde_json::from_str::<Value>(&line) {
-            Ok(msg) => {
-                let id = msg.get("id").cloned().unwrap_or(Value::Null);
-                let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
-                let params = msg.get("params").cloned().unwrap_or(json!({}));
-                let (req, rrx) = ControlRequest::new(method, params);
-                if tx.send(req).is_err() {
-                    break;
-                }
-                ctx.request_repaint();
-                let mut r = rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"}));
-                if let Some(o) = r.as_object_mut() {
-                    o.insert("id".into(), id);
+        let tx = tx.clone();
+        let ctx = ctx.clone();
+        let open = Arc::clone(&open);
+        std::thread::spawn(move || {
+            serve(stream, &tx, &ctx);
+            open.fetch_sub(1, Ordering::SeqCst);
+        });
+    }
+}
+
+fn serve(stream: TcpStream, tx: &Sender<ControlRequest>, ctx: &egui::Context) {
+    let Ok(read) = stream.try_clone() else { return };
+    serve_lines(read, stream, |method, params| {
+        let (req, rrx) = ControlRequest::new(method, params);
+        tx.send(req).ok()?;
+        ctx.request_repaint();
+        Some(rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"})))
+    });
+}
+
+/// One parsed line.
+enum Line {
+    Request {
+        id: Value,
+        method: String,
+        params: Value,
+    },
+    Blank,
+    /// Not a request: reply with this error and close the connection.
+    Reject(String),
+}
+
+fn parse_line(bytes: &[u8]) -> Line {
+    let Ok(text) = std::str::from_utf8(bytes) else {
+        return Line::Reject("not a control request (invalid UTF-8); closing the connection".into());
+    };
+    let text = text.trim();
+    if text.is_empty() {
+        return Line::Blank;
+    }
+    let msg = match serde_json::from_str::<Value>(text) {
+        Ok(v) => v,
+        Err(e) => return Line::Reject(format!("bad JSON ({e}); expected one JSON request object per line; closing the connection")),
+    };
+    let Some(obj) = msg.as_object() else {
+        return Line::Reject("not a control request (expected a JSON object); closing the connection".into());
+    };
+    let Some(method) = obj.get("method").and_then(Value::as_str) else {
+        return Line::Reject("not a control request (missing string `method`); closing the connection".into());
+    };
+    Line::Request {
+        id: obj.get("id").cloned().unwrap_or(Value::Null),
+        method: method.to_string(),
+        params: obj.get("params").cloned().unwrap_or(json!({})),
+    }
+}
+
+/// Read one `\n`-terminated line of at most `max` bytes into `buf` (newline stripped).
+/// `Ok(false)` at end of stream; `Err` when the line is too long or the read fails.
+fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -> Result<bool, String> {
+    buf.clear();
+    // `take` bounds the bytes buffered for one line: a peer can't make us allocate more than `max`.
+    let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
+    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| e.to_string())?;
+    if n == 0 {
+        return Ok(false);
+    }
+    if buf.last() == Some(&b'\n') {
+        buf.pop();
+        if buf.last() == Some(&b'\r') {
+            buf.pop();
+        }
+        return Ok(true);
+    }
+    if buf.len() > max {
+        return Err(format!("request line longer than {max} bytes; closing the connection"));
+    }
+    // Last line without a newline, then end of stream.
+    Ok(true)
+}
+
+/// Serve requests from `read`, answering on `out`, until the peer closes, sends something that is
+/// not a request, or `handle` returns `None` (app gone). `handle` gets `(method, params)` and
+/// returns the reply object (the request's `id` is added here).
+fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(String, Value) -> Option<Value>) {
+    let mut reader = BufReader::new(read);
+    let mut buf = Vec::new();
+    loop {
+        let reject = match read_bounded_line(&mut reader, &mut buf, MAX_LINE) {
+            Ok(false) => return,
+            Err(e) => e,
+            Ok(true) => match parse_line(&buf) {
+                Line::Blank => continue,
+                Line::Reject(e) => e,
+                Line::Request { id, method, params } => {
+                    let Some(mut r) = handle(method, params) else { return };
+                    if let Some(o) = r.as_object_mut() {
+                        o.insert("id".into(), id);
+                    }
+                    if writeln!(out, "{r}").and_then(|()| out.flush()).is_err() {
+                        return;
+                    }
+                    continue;
                 }
-                r
-            }
-            Err(e) => json!({"ok": false, "error": format!("bad JSON: {e}")}),
+            },
         };
-        if writeln!(out, "{reply}").is_err() {
-            break;
+        // Best effort: the connection closes either way, and a peer that can't read the reason loses nothing.
+        let _ = writeln!(out, "{}", json!({"ok": false, "error": reject})).and_then(|()| out.flush());
+        return;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn run(input: &[u8]) -> (Vec<Value>, Vec<String>) {
+        let mut out = Vec::new();
+        let mut calls = Vec::new();
+        serve_lines(input, &mut out, |m, _p| {
+            calls.push(m);
+            Some(json!({"ok": true, "result": null}))
+        });
+        let replies = String::from_utf8(out).unwrap().lines().map(|l| serde_json::from_str::<Value>(l).unwrap()).collect();
+        (replies, calls)
+    }
+
+    #[test]
+    fn requests_are_answered_in_order_with_ids() {
+        let (r, calls) = run(b"{\"id\":1,\"method\":\"a\"}\n\n{\"id\":2,\"method\":\"b\",\"params\":{}}\r\n{\"method\":\"c\"}");
+        assert_eq!(calls, ["a", "b", "c"]);
+        assert_eq!(r.len(), 3);
+        assert_eq!(r[0]["id"], 1);
+        assert_eq!(r[1]["id"], 2);
+        assert_eq!(r[2]["id"], Value::Null);
+    }
+
+    #[test]
+    fn http_request_closes_before_the_body_runs() {
+        // A browser's cross-origin `fetch` POST: the request line is rejected and the
+        // connection closed, so the JSON body is never executed.
+        let http = b"POST / HTTP/1.1\r\nHost: 127.0.0.1:7979\r\nOrigin: https://attacker.example\r\nContent-Type: text/plain\r\n\r\n\
+            {\"id\":7,\"method\":\"engine.execute\",\"params\":{\"command\":\"file.new\",\"params\":{}}}\n";
+        let (r, calls) = run(http);
+        assert!(calls.is_empty(), "nothing may run: {calls:?}");
+        assert_eq!(r.len(), 1);
+        assert_eq!(r[0]["ok"], false);
+        assert!(r[0]["error"].as_str().unwrap().contains("closing the connection"));
+    }
+
+    #[test]
+    fn non_request_json_closes_the_connection() {
+        for junk in [
+            &b"[1,2]\n{\"method\":\"a\"}\n"[..],
+            b"{\"id\":1}\n{\"method\":\"a\"}\n",
+            b"{\"method\":5}\n{\"method\":\"a\"}\n",
+            b"\xff\xfe\n{\"method\":\"a\"}\n",
+        ] {
+            let (r, calls) = run(junk);
+            assert!(calls.is_empty(), "{calls:?}");
+            assert_eq!(r.len(), 1);
+            assert_eq!(r[0]["ok"], false);
         }
+    }
+
+    #[test]
+    fn a_request_before_junk_still_runs() {
+        let (r, calls) = run(b"{\"method\":\"a\"}\nGET / HTTP/1.1\n{\"method\":\"b\"}\n");
+        assert_eq!(calls, ["a"]);
+        assert_eq!(r.len(), 2);
+        assert_eq!(r[1]["ok"], false);
+    }
+
+    #[test]
+    fn overlong_line_is_refused() {
+        // One byte over the limit, then a valid request: neither runs.
+        let mut input = vec![b'x'; MAX_LINE + 1];
+        input.extend_from_slice(b"\n{\"method\":\"a\"}\n");
+        let (r, calls) = run(&input);
+        assert!(calls.is_empty(), "{calls:?}");
+        assert_eq!(r.len(), 1);
+        assert!(r[0]["error"].as_str().unwrap().contains("longer than"));
+    }
+
+    #[test]
+    fn line_at_the_limit_is_accepted() {
+        let mut buf = Vec::new();
+        let line = vec![b'a'; 10];
+        let mut input = line.clone();
+        input.push(b'\n');
+        assert_eq!(read_bounded_line(&mut &input[..], &mut buf, 10), Ok(true));
+        assert_eq!(buf, line);
+        assert!(read_bounded_line(&mut &[b'a'; 11][..], &mut buf, 10).is_err());
+    }
+
+    #[test]
+    fn tcp_connection_is_closed_after_junk() {
+        // End to end over a real loopback socket (the transport the app uses).
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let server = std::thread::spawn(move || {
+            let (s, _) = listener.accept().unwrap();
+            let read = s.try_clone().unwrap();
+            serve_lines(read, s, |_, _| Some(json!({"ok": true})));
+        });
+        let mut c = TcpStream::connect(addr).unwrap();
+        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        c.write_all(b"{\"id\":7,\"method\":\"x\"}\nhello\n{\"method\":\"y\"}\n").unwrap();
+        let mut text = String::new();
+        c.read_to_string(&mut text).unwrap(); // returns at EOF: the server closed the connection
+        server.join().unwrap();
+        let lines: Vec<&str> = text.lines().collect();
+        assert_eq!(lines.len(), 2, "{text}");
+        assert!(lines[0].contains("\"id\":7"));
+        assert!(lines[1].contains("closing the connection"));
+    }
+
+    #[test]
+    fn extra_connections_are_refused() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, _rx) = channel::<ControlRequest>();
+        std::thread::spawn(move || accept_loop(listener, tx, egui::Context::default()));
+        // Idle connections are accepted in order and held open.
+        let held: Vec<TcpStream> = (0..16).map(|_| TcpStream::connect(addr).unwrap()).collect();
+        let mut extra = TcpStream::connect(addr).unwrap();
+        extra.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        let mut line = String::new();
+        BufReader::new(&mut extra).read_line(&mut line).unwrap();
+        assert!(line.contains("too many control connections"), "{line}");
+        drop(held);
     }
 }

apps/vectorcraft/src/gpu.rs

@@ -0,0 +1,489 @@
+//! Which graphics adapter the window renders with (#306, #502), and what happens when it can't
+//! show the window.
+//!
+//! The canvas is rasterized on the CPU; the GPU only composites it and draws the UI, so any
+//! adapter that can present to the window will do. [`adapter_order`] ranks the adapters: those that
+//! can't present to the window's surface never, then the one `WGPU_ADAPTER_NAME` names, hardware
+//! before software, the native backends (Vulkan, Metal, DX12) before OpenGL, the power preference
+//! ([`power_preference`]) among the rest, and a GPU's DX12 adapter before its Vulkan one (#545).
+//! eframe is handed [`selector`], which takes the first of that order.
+//!
+//! An adapter can report that it presents to the window and still fail once it does: on a hybrid
+//! Linux desktop under Wayland, the compositor runs on one GPU and may refuse the frame buffers
+//! another GPU allocates, which kills the window's Wayland connection; egui-wgpu then panics while
+//! configuring the surface (#502). Nothing in the process can show a window after that, so when
+//! the graphics fail while the window is starting up, [`finish`] starts the app again without
+//! that adapter, as the next one in the order would be tried. Each restart leaves out one more
+//! adapter, so it ends when none is left.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, OnceLock};
+
+use eframe::egui_wgpu::NativeAdapterSelectorMethod;
+use eframe::wgpu::{self, Backend, DeviceType, PowerPreference};
+
+/// The adapters a restart leaves out, those the window failed on, as comma-separated
+/// `backend:vendor:device` keys (`Vulkan:1002:164e`). Set by the app itself when it starts again.
+pub const SKIP_ENV: &str = "VECTORCRAFT_GPU_SKIP";
+
+/// wgpu's variable for choosing an adapter by (part of) its name, any case.
+const NAME_ENV: &str = "WGPU_ADAPTER_NAME";
+
+/// Where to read how to choose another adapter, for the error that ends the app.
+const HELP: &str =
+    "to choose a graphics adapter, see https://github.com/storytold/vectorcraft/blob/main/docs/development.md#desktop-graphics-processor";
+
+/// Frames the UI ran before the failure, below which it was still starting up. The failure in
+/// #502 came on the first or second frame; later, the adapter has proved itself, and a lost
+/// window is something else (such as the compositor restarting).
+const STARTUP_FRAMES: u64 = 10;
+
+/// The preference used when Preferences say Automatic. Windows and macOS show frames from any GPU
+/// (the integrated one avoids the flicker of #306). Elsewhere, the system's own order: Mesa's
+/// device-select layer puts the GPU the desktop runs on first (the integrated one on hybrid
+/// laptops), and a Wayland compositor may not show frames from another GPU (#502).
+pub const AUTOMATIC: PowerPreference = if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None };
+
+/// The power preference that orders the adapters: the `WGPU_POWER_PREF` environment variable
+/// (`low`, `high`, `none`) when set, otherwise Preferences › Performance › Graphics Processor
+/// (`gpuPreference`). Automatic, and any value this version doesn't know (0.5.0's default
+/// `powerSaving`, a newer or damaged preference file), is [`AUTOMATIC`].
+pub fn power_preference(pref: Option<&str>, env: Option<PowerPreference>) -> PowerPreference {
+    match (env, pref) {
+        (Some(p), _) => p,
+        (None, Some("highPerformance")) => PowerPreference::HighPerformance,
+        (None, Some("lowPower")) => PowerPreference::LowPower,
+        (None, _) => AUTOMATIC,
+    }
+}
+
+/// One adapter, as [`adapter_order`] sees it.
+#[derive(Clone, Debug)]
+pub struct Candidate {
+    /// Identifies the adapter across a restart: `backend:vendor:device` ([`key`]).
+    pub key: String,
+    pub name: String,
+    pub backend: Backend,
+    pub device_type: DeviceType,
+    /// Reports that it can present to the window's surface.
+    pub presents: bool,
+}
+
+impl Candidate {
+    fn new(adapter: &wgpu::Adapter, surface: Option<&wgpu::Surface<'_>>) -> Self {
+        let info = adapter.get_info();
+        Self {
+            key: key(info.backend, info.vendor, info.device),
+            presents: surface.is_none_or(|s| adapter.is_surface_supported(s)),
+            name: info.name,
+            backend: info.backend,
+            device_type: info.device_type,
+        }
+    }
+}
+
+/// `backend:vendor:device`, e.g. `Vulkan:1002:164e` (PCI ids, as `MESA_VK_DEVICE_SELECT` takes them).
+fn key(backend: Backend, vendor: u32, device: u32) -> String {
+    format!("{backend:?}:{vendor:04x}:{device:04x}")
+}
+
+/// The order to try `candidates` in (their indices): only those that present to the window and
+/// aren't in `skip`; the one whose name contains `named` (any case) first; hardware before
+/// software; native backends before OpenGL; then by `power`; then DX12 before Vulkan, keeping the
+/// system's order among equals (all of it for [`PowerPreference::None`]). Windows lists each GPU
+/// under both, and Intel's Vulkan driver made the whole window flicker black where DX12 and OpenGL
+/// didn't (#545); elsewhere there is no DX12 adapter, so the order is unchanged.
+pub fn adapter_order(candidates: &[Candidate], power: PowerPreference, named: Option<&str>, skip: &[String]) -> Vec<usize> {
+    let named = named.map(str::to_lowercase).filter(|n| !n.is_empty());
+    let mut order: Vec<(usize, &Candidate)> = candidates.iter().enumerate().filter(|(_, c)| c.presents && !skip.contains(&c.key)).collect();
+    // Stable, so equals keep the system's order.
+    order.sort_by_key(|(_, c)| {
+        let unnamed = named.as_ref().is_some_and(|n| !c.name.to_lowercase().contains(n));
+        (unnamed, c.device_type == DeviceType::Cpu, c.backend == Backend::Gl, power_rank(c.device_type, power), c.backend == Backend::Vulkan)
+    });
+    order.into_iter().map(|(i, _)| i).collect()
+}
+
+/// wgpu's own ranking for a power preference: the preferred kind of GPU, the other kind, unknown,
+/// virtual, software.
+fn power_rank(t: DeviceType, power: PowerPreference) -> u8 {
+    match (power, t) {
+        (PowerPreference::None, _) => 0,
+        (PowerPreference::LowPower, DeviceType::IntegratedGpu) | (PowerPreference::HighPerformance, DeviceType::DiscreteGpu) => 0,
+        (_, DeviceType::IntegratedGpu | DeviceType::DiscreteGpu) => 1,
+        (_, DeviceType::Other) => 2,
+        (_, DeviceType::VirtualGpu) => 3,
+        (_, DeviceType::Cpu) => 4,
+    }
+}
+
+/// The adapters [`SKIP_ENV`] lists.
+pub fn skipped() -> Vec<String> {
+    std::env::var(SKIP_ENV).map(|v| parse_skip(&v)).unwrap_or_default()
+}
+
+fn parse_skip(v: &str) -> Vec<String> {
+    v.split(',').map(str::trim).filter(|k| !k.is_empty()).map(String::from).collect()
+}
+
+/// What the window's start-up leaves for [`finish`].
+#[derive(Default)]
+pub struct Startup {
+    /// The key of the adapter [`selector`] picked.
+    adapter: OnceLock<String>,
+    /// The UI's context, which counts the frames run.
+    ui: OnceLock<egui::Context>,
+}
+
+impl Startup {
+    /// The app was created on `ctx`.
+    pub fn created(&self, ctx: &egui::Context) {
+        // Set once; the window is created once.
+        let _ = self.ui.set(ctx.clone());
+    }
+}
+
+/// eframe's adapter choice: the first of [`adapter_order`] for `power`, `WGPU_ADAPTER_NAME` and the
+/// adapters a restart left out. Every adapter and the choice are logged, for bug reports.
+pub fn selector(power: PowerPreference, startup: Arc<Startup>) -> NativeAdapterSelectorMethod {
+    let named = std::env::var(NAME_ENV).ok();
+    let skip = skipped();
+    Arc::new(move |adapters, surface| {
+        let candidates: Vec<Candidate> = adapters.iter().map(|a| Candidate::new(a, surface)).collect();
+        let order = adapter_order(&candidates, power, named.as_deref(), &skip);
+        let listed: Vec<String> = candidates
+            .iter()
+            .map(|c| {
+                let note = if !c.presents {
+                    ", can't show the window"
+                } else if skip.contains(&c.key) {
+                    ", failed before"
+                } else {
+                    ""
+                };
+                format!("{} ({:?}, {:?}, {}{note})", c.name.trim(), c.backend, c.device_type, c.key)
+            })
+            .collect();
+        log::info!("graphics adapters: {}", listed.join("; "));
+        let first = order.first().and_then(|&i| adapters.get(i).zip(candidates.get(i)));
+        let Some((adapter, chosen)) = first else {
+            return Err(format!("no graphics adapter can show the window (power preference {power:?}, {} adapters)", adapters.len()));
+        };
+        // Set once; eframe picks the adapter once.
+        let _ = startup.adapter.set(chosen.key.clone());
+        Ok(adapter.clone())
+    })
+}
+
+/// The last panic came from the graphics stack (see [`watch_panics`]).
+static GRAPHICS_PANIC: AtomicBool = AtomicBool::new(false);
+
+/// Note whether each panic comes from the graphics stack, so [`finish`] can tell a failing adapter
+/// from a bug. The default hook still prints it.
+pub fn watch_panics() {
+    let default = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        GRAPHICS_PANIC.store(info.location().is_some_and(|l| in_graphics_stack(l.file())), Ordering::Relaxed);
+        default(info);
+    }));
+}
+
+/// A source file of wgpu (`wgpu-core-30.0.1/src/…`, `wgpu-hal-…`), egui-wgpu or naga.
+fn in_graphics_stack(file: &str) -> bool {
+    file.split(['/', '\\']).any(|dir| ["wgpu-", "egui-wgpu-", "naga-"].iter().any(|p| dir.starts_with(p)))
+}
+
+/// The adapter to start again without: the one picked, when the graphics failed while the window
+/// was starting up and it wasn't already left out.
+fn restart_without<'a>(graphics_failed: bool, frames: u64, picked: Option<&'a str>, skip: &[String]) -> Option<&'a str> {
+    picked.filter(|p| graphics_failed && frames < STARTUP_FRAMES && !skip.iter().any(|s| s == p))
+}
+
+/// After the window's run: `Ok` when it closed normally or the app started again (see the module
+/// docs), otherwise why it failed. `outcome` is eframe's result, or the message of a panic that
+/// ended it.
+pub fn finish(outcome: Result<eframe::Result, String>, startup: &Startup) -> Result<(), String> {
+    let (why, graphics_failed) = match outcome {
+        Ok(Ok(())) => return Ok(()),
+        Ok(Err(e @ eframe::Error::Wgpu(_))) => (e.to_string(), true),
+        Ok(Err(e)) => (e.to_string(), false),
+        Err(panic) => (panic, GRAPHICS_PANIC.load(Ordering::Relaxed)),
+    };
+    let frames = startup.ui.get().map_or(0, egui::Context::cumulative_frame_nr);
+    let mut skip = skipped();
+    let Some(failed) = restart_without(graphics_failed, frames, startup.adapter.get().map(String::as_str), &skip) else {
+        return Err(if graphics_failed { format!("{why} ({HELP})") } else { why });
+    };
+    log::error!("the window failed on graphics adapter {failed} ({why}): starting again without it");
+    skip.push(failed.to_string());
+    restart(&skip.join(",")).map_err(|e| format!("{why}; starting again failed: {e}"))
+}
+
+/// Start the app again with the same arguments, leaving out the adapters in `skip`. On Unix the
+/// new app replaces this process (same process id, so an AppImage keeps its files mounted), and
+/// this returns only on failure; on Windows it starts beside this one, which then exits.
+fn restart(skip: &str) -> std::io::Result<()> {
+    log::logger().flush();
+    let mut c = std::process::Command::new(std::env::current_exe()?);
+    c.args(std::env::args_os().skip(1)).env(SKIP_ENV, skip);
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt as _;
+        Err(c.exec())
+    }
+    #[cfg(not(unix))]
+    c.spawn().map(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn gpu(name: &str, backend: Backend, device_type: DeviceType) -> Candidate {
+        Candidate { key: format!("{backend:?}:{name}"), name: name.into(), backend, device_type, presents: true }
+    }
+
+    fn names(c: &[Candidate], order: &[usize]) -> Vec<String> {
+        order.iter().map(|&i| c[i].name.clone()).collect()
+    }
+
+    /// The machine of #502 as Vulkan lists it with Mesa's device-select layer: the GPU KDE's
+    /// compositor runs on (NVIDIA) first, then the Ryzen's integrated GPU, Mesa's software
+    /// renderer, and OpenGL.
+    fn issue_502() -> Vec<Candidate> {
+        vec![
+            gpu("NVIDIA GeForce RTX 5070", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("llvmpipe (LLVM 20.1.8, 256 bits)", Backend::Vulkan, DeviceType::Cpu),
+            gpu("NVIDIA GeForce RTX 5070/PCIe/SSE2", Backend::Gl, DeviceType::Other),
+        ]
+    }
+
+    #[test]
+    fn automatic_keeps_the_systems_order_on_linux_and_saves_power_elsewhere() {
+        let c = issue_502();
+        let order = adapter_order(&c, power_preference(None, None), None, &[]);
+        let first = &c[order[0]].name;
+        if cfg!(any(windows, target_os = "macos")) {
+            assert_eq!(first, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        } else {
+            // #502: the integrated GPU couldn't show frames to a compositor on the NVIDIA GPU.
+            assert_eq!(first, "NVIDIA GeForce RTX 5070");
+        }
+    }
+
+    #[test]
+    fn each_preference_orders_the_adapters_then_falls_back_to_opengl_and_software() {
+        let c = issue_502();
+        let order = |power| names(&c, &adapter_order(&c, power, None, &[]));
+        assert_eq!(
+            order(PowerPreference::None),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::LowPower),
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::HighPerformance),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    /// A restart leaves out the adapter the window failed on, so Power Saving on the machine of
+    /// #502 ends up on the NVIDIA GPU, and once every adapter failed there is nothing to try.
+    #[test]
+    fn a_restart_tries_the_next_adapter() {
+        let c = issue_502();
+        let mut skip = vec![];
+        let mut tried = vec![];
+        while let Some(&i) = adapter_order(&c, PowerPreference::LowPower, None, &skip).first() {
+            tried.push(c[i].name.clone());
+            skip.push(c[i].key.clone());
+        }
+        assert_eq!(
+            tried,
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    #[test]
+    fn adapters_that_cannot_present_to_the_window_are_never_tried() {
+        let mut c = issue_502();
+        c[0].presents = false;
+        c[3].presents = false;
+        for power in [PowerPreference::None, PowerPreference::LowPower, PowerPreference::HighPerformance] {
+            let order = adapter_order(&c, power, None, &[]);
+            assert!(!order.contains(&0) && !order.contains(&3), "{power:?}: {order:?}");
+            assert_eq!(order.len(), 2);
+        }
+        for p in &mut c {
+            p.presents = false;
+        }
+        assert!(adapter_order(&c, PowerPreference::None, None, &[]).is_empty());
+        assert!(adapter_order(&[], PowerPreference::HighPerformance, None, &[]).is_empty());
+    }
+
+    #[test]
+    fn wgpu_adapter_name_picks_an_adapter_first_and_the_rest_stay_as_fallbacks() {
+        let c = issue_502();
+        let order = adapter_order(&c, PowerPreference::HighPerformance, Some("radv"), &[]);
+        assert_eq!(c[order[0]].name, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        assert_eq!(order.len(), 4);
+        // Any case; every match comes before the rest, natively first.
+        let order = adapter_order(&c, PowerPreference::LowPower, Some("GeForce"), &[]);
+        assert_eq!(names(&c, &order[..2]), ["NVIDIA GeForce RTX 5070", "NVIDIA GeForce RTX 5070/PCIe/SSE2"]);
+        // An empty name or one nothing matches changes nothing.
+        for named in ["", "no such gpu"] {
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, Some(named), &[]), adapter_order(&c, PowerPreference::LowPower, None, &[]));
+        }
+        // A named adapter that failed is left out like any other.
+        let skip = vec![c[1].key.clone()];
+        assert_eq!(adapter_order(&c, PowerPreference::None, Some("radv"), &skip)[0], 0);
+    }
+
+    /// A Windows machine lists every GPU twice (Vulkan and DX12): power saving still takes the
+    /// integrated GPU first, as wgpu's own choice did (#306), each GPU through DX12 first (#545).
+    #[test]
+    fn hybrid_laptop_on_windows_renders_on_the_integrated_gpu_with_power_saving() {
+        let c = vec![
+            gpu("Intel(R) Arc(TM) A370M", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("Intel(R) Arc(TM) A370M", Backend::Dx12, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
+            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
+        ];
+        let order = adapter_order(&c, PowerPreference::LowPower, None, &[]);
+        assert_eq!(order, [3, 1, 2, 0, 4]);
+        assert_eq!(adapter_order(&c, PowerPreference::HighPerformance, None, &[]), [2, 0, 3, 1, 4]);
+    }
+
+    /// The machine of #545: one Intel GPU, whose Vulkan driver made the window flicker black.
+    /// DX12 comes first whatever the preference; Vulkan stays a fallback, and `WGPU_ADAPTER_NAME`
+    /// or a restart leaving DX12 out still reach it.
+    #[test]
+    fn a_windows_gpu_renders_through_dx12_before_vulkan() {
+        let c = vec![
+            gpu("Intel(R) Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("Intel(R) Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
+            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
+            gpu("Intel(R) Graphics", Backend::Gl, DeviceType::Other),
+        ];
+        for power in [PowerPreference::LowPower, PowerPreference::HighPerformance, PowerPreference::None] {
+            assert_eq!(adapter_order(&c, power, None, &[]), [1, 0, 3, 2], "{power:?}");
+        }
+        assert_eq!(adapter_order(&c, PowerPreference::LowPower, None, &[c[1].key.clone()]), [0, 3, 2], "DX12 failed: Vulkan next");
+    }
+
+    #[test]
+    fn power_preference_follows_the_environment_then_the_preference() {
+        assert_eq!(power_preference(None, None), AUTOMATIC);
+        assert_eq!(power_preference(Some("automatic"), None), AUTOMATIC);
+        assert_eq!(power_preference(Some("lowPower"), None), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("highPerformance"), None), PowerPreference::HighPerformance);
+        // 0.5.0's default, and values this version doesn't know (a newer or damaged file).
+        for old in ["powerSaving", "turbo", ""] {
+            assert_eq!(power_preference(Some(old), None), AUTOMATIC, "{old}");
+        }
+        // WGPU_POWER_PREF wins over the preference, either way.
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::HighPerformance)), PowerPreference::HighPerformance);
+        assert_eq!(power_preference(Some("highPerformance"), Some(PowerPreference::LowPower)), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::None)), PowerPreference::None);
+        assert_eq!(AUTOMATIC, if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None });
+    }
+
+    /// The preference the engine saves is the one the app reads back before the window opens.
+    #[test]
+    fn the_saved_engine_preference_is_found() {
+        let mut prefs = vectorcraft_engine::Prefs::default();
+        let saved = prefs.to_json();
+        assert_eq!(saved.get("gpuPreference").and_then(serde_json::Value::as_str), Some("automatic"));
+        for (value, power) in [("lowPower", PowerPreference::LowPower), ("highPerformance", PowerPreference::HighPerformance)] {
+            prefs.gpu_preference = value.into();
+            let saved = prefs.to_json();
+            assert_eq!(power_preference(saved.get("gpuPreference").and_then(serde_json::Value::as_str), None), power);
+        }
+        // Every choice Preferences offer means something here.
+        for (value, _) in vectorcraft_engine::cmd::prefscmds::GPU_PREFERENCES {
+            assert!(["automatic", "lowPower", "highPerformance"].contains(value), "{value}");
+        }
+    }
+
+    #[test]
+    fn skipped_adapters_parse_from_a_comma_separated_list() {
+        assert_eq!(parse_skip("Vulkan:1002:164e, Gl:10de:2f04,,"), ["Vulkan:1002:164e", "Gl:10de:2f04"]);
+        assert!(parse_skip("").is_empty());
+        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e), "Vulkan:1002:164e");
+        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04), "Gl:10de:2f04");
+    }
+
+    #[test]
+    fn panics_in_wgpu_egui_wgpu_and_naga_are_graphics_failures() {
+        for file in [
+            "/home/u/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/egui-wgpu-0.36.2/src/winit.rs",
+            r"C:\Users\u\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\wgpu-core-30.0.1\src\device\mod.rs",
+            "/rustc/deps/wgpu-hal-30.0.1/src/vulkan/adapter.rs",
+            "naga-30.0.0/src/back/spv/writer.rs",
+        ] {
+            assert!(in_graphics_stack(file), "{file}");
+        }
+        for file in [
+            "apps/vectorcraft/src/main.rs",
+            "/home/wgpu/vectorcraft/crates/ui-egui/src/lib.rs",
+            "egui-0.36.2/src/context.rs",
+            "winit-0.30.12/src/x.rs",
+        ] {
+            assert!(!in_graphics_stack(file), "{file}");
+        }
+    }
+
+    #[test]
+    fn only_a_graphics_failure_while_starting_up_restarts_without_the_adapter() {
+        let amd = Some("Vulkan:1002:164e");
+        assert_eq!(restart_without(true, 0, amd, &[]), amd);
+        assert_eq!(restart_without(true, STARTUP_FRAMES - 1, amd, &[]), amd);
+        // After start-up the adapter has shown frames; a lost window is something else.
+        assert_eq!(restart_without(true, STARTUP_FRAMES, amd, &[]), None);
+        // A bug outside the graphics, or no adapter picked: nothing another adapter would change.
+        assert_eq!(restart_without(false, 0, amd, &[]), None);
+        assert_eq!(restart_without(true, 0, None, &[]), None);
+        // Never the same adapter twice, so restarts end.
+        assert_eq!(restart_without(true, 0, amd, &["Vulkan:1002:164e".into()]), None);
+    }
+
+    #[test]
+    fn a_normal_exit_or_another_failure_does_not_restart() {
+        let startup = Startup::default();
+        assert_eq!(finish(Ok(Ok(())), &startup), Ok(()));
+        // No adapter was picked (none can show the window): the error is returned, nothing restarts.
+        let none =
+            eframe::Error::Wgpu(eframe::egui_wgpu::WgpuError::CustomNativeAdapterSelectionError("no graphics adapter can show the window".into()));
+        assert_eq!(
+            finish(Ok(Err(none)), &startup),
+            Err(format!("WGPU error: Adapter selection failed: no graphics adapter can show the window ({HELP})"))
+        );
+        let _ = startup.adapter.set("Vulkan:1002:164e".into());
+        GRAPHICS_PANIC.store(false, Ordering::Relaxed);
+        assert_eq!(finish(Err("a bug".into()), &startup), Err("a bug".into()));
+    }
+}

apps/vectorcraft/src/logging.rs

@@ -0,0 +1,582 @@
+//! The desktop app's logger: `log::` records go to standard error and to a log file.
+//!
+//! Without a logger every `log::warn!`/`log::error!` in the workspace (the graphics adapter, a
+//! lost graphics device, a panic the engine's guard recovered from) vanished. A launch from a desktop menu
+//! has no terminal, so the file is what a bug report can attach: `<settings dir>/logs/vectorcraft.log`,
+//! next to the preferences (`prefs_path` in `main.rs`). Each start moves the previous log to
+//! `vectorcraft.1.log` (and that one to `.2`), so the log of a run that crashed survives the next
+//! launch. Runs without preferences (`VECTORCRAFT_NO_PREFS`) log to standard error only.
+//!
+//! Levels: `info` for VectorCraft's own crates, `warn` for everything else (wgpu and naga are
+//! chatty). `RUST_LOG` replaces that with env_logger-style directives: `debug`,
+//! `warn,vectorcraft_render=trace`, `wgpu_core=info`. A directive ending in `*` matches every
+//! target that starts with it (`vectorcraft*=debug`).
+//!
+//! Records logged before the settings directory is known are kept (up to [`MAX_PENDING`]) and
+//! written once the file is attached. Writing never panics: a file that can't be created or
+//! written leaves standard error as the only sink.
+//!
+//! This is the desktop app's logger only. `vectorcraft-cli mcp` installs its own
+//! (`vectorcraft_mcp::logging`, MCP `notifications/message`); the two never share a process.
+
+use std::fs::File;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock, PoisonError};
+use std::time::SystemTime;
+
+use log::LevelFilter;
+
+/// The current log file's name inside the log directory.
+pub const LOG_FILE: &str = "vectorcraft.log";
+/// How many previous logs are kept (`vectorcraft.1.log` … `vectorcraft.<KEEP>.log`).
+pub const KEEP: usize = 2;
+/// The log file stops growing past this size (a runaway warning can't fill the disk).
+pub const MAX_FILE_BYTES: u64 = 16 * 1024 * 1024;
+/// Records kept in memory until the log file is attached.
+pub const MAX_PENDING: usize = 512;
+/// The built-in filter when `RUST_LOG` is unset or empty.
+pub const DEFAULT_FILTER: &str = "warn,vectorcraft*=info";
+
+/// Per-target level filter parsed from env_logger-style directives.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Filter {
+    default: LevelFilter,
+    directives: Vec<(String, LevelFilter)>,
+}
+
+impl Filter {
+    /// Parse `spec`; unknown levels and empty parts are skipped. Without a bare level, targets no
+    /// directive names log errors only.
+    pub fn parse(spec: &str) -> Filter {
+        let mut f = Filter { default: LevelFilter::Error, directives: Vec::new() };
+        for part in spec.split(',').map(str::trim).filter(|p| !p.is_empty()) {
+            match part.split_once('=') {
+                Some((name, level)) => {
+                    let name = name.trim();
+                    if let (false, Some(level)) = (name.is_empty(), parse_level(level)) {
+                        f.directives.push((name.to_owned(), level));
+                    }
+                }
+                None => match parse_level(part) {
+                    Some(level) => f.default = level,
+                    // A bare target name: everything from it (env_logger does the same).
+                    None => f.directives.push((part.to_owned(), LevelFilter::Trace)),
+                },
+            }
+        }
+        f
+    }
+
+    /// The level that applies to `target` (the most specific matching directive wins).
+    pub fn level_for(&self, target: &str) -> LevelFilter {
+        self.directives.iter().filter(|(name, _)| matches(name, target)).max_by_key(|(name, _)| name.len()).map_or(self.default, |(_, level)| *level)
+    }
+
+    /// The most verbose level any target can reach (for `log::set_max_level`).
+    pub fn max(&self) -> LevelFilter {
+        self.directives.iter().map(|(_, level)| *level).fold(self.default, Ord::max)
+    }
+}
+
+fn parse_level(s: &str) -> Option<LevelFilter> {
+    s.trim().parse().ok()
+}
+
+/// `name` matches `target` itself and its submodules (`a` matches `a` and `a::b`, not `ab`);
+/// `name*` matches every target starting with `name`.
+fn matches(name: &str, target: &str) -> bool {
+    match name.strip_suffix('*') {
+        Some(prefix) => target.starts_with(prefix),
+        None => target.strip_prefix(name).is_some_and(|rest| rest.is_empty() || rest.starts_with("::")),
+    }
+}
+
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+pub fn timestamp(t: SystemTime) -> String {
+    let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
+    let secs = since.as_secs();
+    let (days, rem) = (secs / 86_400, secs % 86_400);
+    let (y, m, d) = civil_from_days(days);
+    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
+}
+
+/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
+/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch). Saturating, so no clock
+/// value can overflow it.
+fn civil_from_days(days: u64) -> (u64, u64, u64) {
+    let z = days.saturating_add(719_468);
+    let era = z / 146_097;
+    let doe = z % 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
+    (y, m, d)
+}
+
+fn numbered(dir: &Path, n: usize) -> PathBuf {
+    if n == 0 { dir.join(LOG_FILE) } else { dir.join(format!("vectorcraft.{n}.log")) }
+}
+
+/// Shift the previous logs up one (`.log` → `.1.log` → … → `.<KEEP>.log`, the oldest dropped)
+/// and create a fresh, empty log file in `dir` (created if missing).
+pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
+    std::fs::create_dir_all(dir)?;
+    for n in (1..=KEEP).rev() {
+        match std::fs::rename(numbered(dir, n - 1), numbered(dir, n)) {
+            Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(e),
+            _ => {}
+        }
+    }
+    let path = numbered(dir, 0);
+    let file = File::create(&path)?;
+    Ok((path, file))
+}
+
+/// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
+pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
+    let message = message.strip_suffix('\n').unwrap_or(message);
+    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
+}
+
+/// Where formatted lines go besides standard error: kept in memory until a file is attached,
+/// then appended to it until it reaches its size cap.
+pub struct Sink {
+    file: Option<File>,
+    pending: Vec<String>,
+    dropped: usize,
+    written: u64,
+    max_bytes: u64,
+    capped: bool,
+}
+
+impl Sink {
+    pub fn new(max_bytes: u64) -> Sink {
+        Sink { file: None, pending: Vec::new(), dropped: 0, written: 0, max_bytes, capped: false }
+    }
+
+    /// Append `line` to the file, or keep it until [`Sink::attach`].
+    pub fn write(&mut self, line: &str) {
+        if self.file.is_none() {
+            if self.capped {
+                // No file is coming ([`Sink::no_file`]): standard error had the line.
+            } else if self.pending.len() < MAX_PENDING {
+                self.pending.push(line.to_owned());
+            } else {
+                self.dropped = self.dropped.saturating_add(1);
+            }
+            return;
+        }
+        self.append(line);
+    }
+
+    /// Start writing to `file` (a fresh one: the size cap starts over), first the lines kept so far.
+    pub fn attach(&mut self, file: File) {
+        self.file = Some(file);
+        self.written = 0;
+        self.capped = false;
+        for line in std::mem::take(&mut self.pending) {
+            self.append(&line);
+        }
+        if self.dropped > 0 {
+            let note = format!("{} earlier log lines were dropped before the log file was opened\n", self.dropped);
+            self.dropped = 0;
+            self.append(&note);
+        }
+    }
+
+    /// There will be no log file: forget the lines kept for it and keep no more.
+    pub fn no_file(&mut self) {
+        self.pending = Vec::new();
+        self.dropped = 0;
+        self.capped = true;
+    }
+
+    fn append(&mut self, line: &str) {
+        if self.capped {
+            return;
+        }
+        let Some(file) = self.file.as_mut() else { return };
+        let len = u64::try_from(line.len()).unwrap_or(u64::MAX);
+        let text = if self.written.saturating_add(len) > self.max_bytes {
+            self.capped = true;
+            format!("log file reached {} bytes; later records go to standard error only\n", self.max_bytes)
+        } else {
+            self.written = self.written.saturating_add(len);
+            line.to_owned()
+        };
+        // A full disk or a vanished file must not take the app down: drop the file sink.
+        if file.write_all(text.as_bytes()).is_err() {
+            self.file = None;
+            self.capped = true;
+        }
+    }
+}
+
+/// The installed logger: a [`Filter`], standard error and a [`Sink`].
+pub struct AppLogger {
+    filter: Filter,
+    stderr: bool,
+    sink: Mutex<Sink>,
+}
+
+impl AppLogger {
+    pub fn new(filter: Filter, stderr: bool) -> AppLogger {
+        AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)) }
+    }
+
+    /// Rotate the logs in `dir` and send records to the fresh file; returns its path. On an error
+    /// standard error stays the only sink.
+    pub fn attach_dir(&self, dir: &Path) -> Result<PathBuf, String> {
+        // A thread that panicked while logging leaves the sink usable: take it back.
+        let mut sink = self.sink.lock().unwrap_or_else(PoisonError::into_inner);
+        match rotate(dir) {
+            Ok((path, file)) => {
+                sink.attach(file);
+                Ok(path)
+            }
+            Err(e) => {
+                sink.no_file();
+                Err(format!("{}: {e}", dir.display()))
+            }
+        }
+    }
+
+    /// No log file for this run (runs without preferences): log to standard error only.
+    pub fn no_file(&self) {
+        self.sink.lock().unwrap_or_else(PoisonError::into_inner).no_file();
+    }
+}
+
+impl log::Log for AppLogger {
+    fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
+        metadata.level() <= self.filter.level_for(metadata.target())
+    }
+
+    fn log(&self, record: &log::Record<'_>) {
+        if !self.enabled(record.metadata()) {
+            return;
+        }
+        // Formatted before the sink is locked, so a message that logs while it is formatted can't deadlock.
+        let thread = std::thread::current();
+        let line =
+            format_line(&timestamp(SystemTime::now()), record.level(), thread.name().unwrap_or("?"), record.target(), &record.args().to_string());
+        if self.stderr {
+            // No terminal (a Windows GUI build, a closed pipe) is not an error worth reporting.
+            let _ = std::io::stderr().write_all(line.as_bytes());
+        }
+        self.sink.lock().unwrap_or_else(PoisonError::into_inner).write(&line);
+    }
+
+    fn flush(&self) {}
+}
+
+/// Install the logger (filter from `RUST_LOG`, else [`DEFAULT_FILTER`]); `None` when another
+/// logger was installed first. Call [`AppLogger::attach_dir`] once the settings directory is known.
+pub fn install() -> Option<&'static AppLogger> {
+    static LOGGER: OnceLock<AppLogger> = OnceLock::new();
+    let spec = std::env::var("RUST_LOG").ok().filter(|s| !s.trim().is_empty());
+    let filter = Filter::parse(spec.as_deref().unwrap_or(DEFAULT_FILTER));
+    let max = filter.max();
+    let logger = LOGGER.get_or_init(|| AppLogger::new(filter, true));
+    log::set_logger(logger).ok()?;
+    log::set_max_level(max);
+    Some(logger)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::time::{Duration, UNIX_EPOCH};
+
+    fn temp_dir(tag: &str) -> PathBuf {
+        static N: AtomicUsize = AtomicUsize::new(0);
+        let d = std::env::temp_dir().join(format!("vectorcraft-logging-{tag}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&d);
+        d
+    }
+
+    fn read(path: &Path) -> String {
+        std::fs::read_to_string(path).expect("read log")
+    }
+
+    #[test]
+    fn the_default_filter_shows_vectorcraft_info_and_other_crates_warnings() {
+        let f = Filter::parse(DEFAULT_FILTER);
+        assert_eq!(f.level_for("vectorcraft"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft::window"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft_engine::guard"), LevelFilter::Info);
+        assert_eq!(f.level_for("vectorcraft_ui_egui::io"), LevelFilter::Info);
+        assert_eq!(f.level_for("wgpu_core::device"), LevelFilter::Warn);
+        assert_eq!(f.level_for("naga"), LevelFilter::Warn);
+        assert_eq!(f.max(), LevelFilter::Info);
+    }
+
+    #[test]
+    fn directives_follow_env_logger_and_the_most_specific_one_wins() {
+        let f = Filter::parse("info,wgpu_core=error,vectorcraft_render=trace,vectorcraft_render::tiles=off");
+        assert_eq!(f.level_for("eframe"), LevelFilter::Info);
+        assert_eq!(f.level_for("wgpu_core::instance"), LevelFilter::Error);
+        assert_eq!(f.level_for("vectorcraft_render::canvas"), LevelFilter::Trace);
+        assert_eq!(f.level_for("vectorcraft_render::tiles"), LevelFilter::Off);
+        assert_eq!(f.max(), LevelFilter::Trace);
+        // A module name is matched at `::` boundaries, not as a bare prefix.
+        assert_eq!(f.level_for("wgpu_core_extra"), LevelFilter::Info);
+        // A trailing `*` is a prefix.
+        assert_eq!(Filter::parse("vectorcraft*=debug").level_for("vectorcraft_text::shape"), LevelFilter::Debug);
+        assert_eq!(Filter::parse("vectorcraft*=debug").level_for("eframe"), LevelFilter::Error);
+        // A bare target name sets that target to the most verbose level, as env_logger does.
+        assert_eq!(Filter::parse("naga").level_for("naga::front"), LevelFilter::Trace);
+        assert_eq!(Filter::parse("naga").level_for("eframe"), LevelFilter::Error);
+        // Levels are case-insensitive and surrounding blanks are ignored.
+        assert_eq!(Filter::parse(" WARN , vectorcraft = Debug ").level_for("vectorcraft"), LevelFilter::Debug);
+        assert_eq!(Filter::parse(" WARN , vectorcraft = Debug ").level_for("eframe"), LevelFilter::Warn);
+    }
+
+    #[test]
+    fn hostile_specs_never_panic_and_fall_back_sensibly() {
+        let long = "x".repeat(100_000);
+        let many = "a=info,".repeat(10_000);
+        for spec in [
+            "",
+            ",,,",
+            "=",
+            "==",
+            "=debug",
+            "vectorcraft=",
+            "nonsense=loud",
+            "🦀=info",
+            "*",
+            "*=",
+            "=*",
+            "a=b=c",
+            "warn,,vectorcraft=DEBUG",
+            "\0",
+            "é::ü=trace",
+            &long,
+            &many,
+        ] {
+            let f = Filter::parse(spec);
+            for target in ["", "vectorcraft", "🦀", "a::b", "*"] {
+                let _ = f.level_for(target);
+            }
+            let _ = f.max();
+        }
+        assert_eq!(Filter::parse("warn,,vectorcraft=DEBUG").level_for("vectorcraft"), LevelFilter::Debug);
+        // An unknown level is skipped: that target keeps the default.
+        assert_eq!(Filter::parse("nonsense=loud").level_for("nonsense"), LevelFilter::Error);
+        assert_eq!(Filter::parse("vectorcraft=").level_for("vectorcraft"), LevelFilter::Error);
+        assert_eq!(Filter::parse("=debug").max(), LevelFilter::Error);
+        assert_eq!(Filter::parse("🦀=info").level_for("🦀::claw"), LevelFilter::Info);
+    }
+
+    #[test]
+    fn timestamps_are_utc_with_milliseconds() {
+        assert_eq!(timestamp(UNIX_EPOCH), "1970-01-01T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_millis(1_791_446_357_728)), "2026-10-08T07:59:17.728Z");
+        // Leap day, and the day after it.
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_164_800)), "2024-02-29T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_251_199)), "2024-02-29T23:59:59.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(1_709_251_200)), "2024-03-01T00:00:00.000Z");
+        // 2000 is a leap year (divisible by 400), 2100 is not.
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(951_782_400)), "2000-02-29T00:00:00.000Z");
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
+        // Before the epoch (a clock set wrong) clamps instead of panicking.
+        assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+    }
+
+    #[test]
+    fn a_line_carries_time_level_thread_target_and_message() {
+        assert_eq!(
+            format_line("2026-10-08T07:59:17.728Z", log::Level::Info, "main", "vectorcraft", "rendering with Mesa (Vulkan, IntegratedGpu)"),
+            "2026-10-08T07:59:17.728Z INFO  [main] vectorcraft: rendering with Mesa (Vulkan, IntegratedGpu)\n"
+        );
+        // A multi-line message keeps its lines; the record still ends in one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
+    }
+
+    #[test]
+    fn rotation_keeps_the_previous_logs_and_starts_an_empty_file() {
+        let dir = temp_dir("rotate");
+        for run in 1..=4 {
+            let (path, _file) = rotate(&dir).expect("rotate");
+            assert_eq!(path, dir.join(LOG_FILE));
+            assert_eq!(read(&path), "");
+            std::fs::write(&path, format!("run {run}")).expect("write");
+        }
+        assert_eq!(read(&dir.join(LOG_FILE)), "run 4");
+        assert_eq!(read(&dir.join("vectorcraft.1.log")), "run 3");
+        assert_eq!(read(&dir.join("vectorcraft.2.log")), "run 2");
+        assert!(!dir.join("vectorcraft.3.log").exists(), "only {KEEP} old logs are kept");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn rotation_into_an_unusable_directory_is_an_error_not_a_panic() {
+        let dir = temp_dir("blocked");
+        std::fs::create_dir_all(dir.parent().expect("parent")).expect("tmp");
+        std::fs::write(&dir, "a file where the directory should be").expect("block");
+        assert!(rotate(&dir).is_err());
+        let _ = std::fs::remove_file(&dir);
+    }
+
+    #[test]
+    fn lines_logged_before_the_file_exists_are_written_when_it_is_attached() {
+        let dir = temp_dir("pending");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        sink.write("early 1\n");
+        sink.write("early 2\n");
+        sink.attach(file);
+        sink.write("late\n");
+        assert_eq!(read(&path), "early 1\nearly 2\nlate\n");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_pending_buffer_is_bounded_and_says_how_much_it_dropped() {
+        let dir = temp_dir("bounded");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        for i in 0..MAX_PENDING + 5 {
+            sink.write(&format!("line {i}\n"));
+        }
+        sink.attach(file);
+        let text = read(&path);
+        assert_eq!(text.lines().filter(|l| l.starts_with("line ")).count(), MAX_PENDING);
+        assert!(text.contains("5 earlier log lines were dropped"), "{text}");
+        assert!(text.contains("line 0\n") && !text.contains(&format!("line {MAX_PENDING}\n")));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn exactly_a_full_pending_buffer_drops_nothing() {
+        let dir = temp_dir("full");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        for i in 0..MAX_PENDING {
+            sink.write(&format!("line {i}\n"));
+        }
+        sink.attach(file);
+        let text = read(&path);
+        assert_eq!(text.lines().count(), MAX_PENDING);
+        assert!(!text.contains("dropped"), "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn without_a_file_nothing_is_kept_in_memory() {
+        let mut sink = Sink::new(MAX_FILE_BYTES);
+        sink.write("early\n");
+        sink.no_file();
+        sink.write("late\n");
+        assert!(sink.pending.is_empty() && sink.dropped == 0);
+    }
+
+    #[test]
+    fn the_file_stops_at_its_size_cap_with_one_note() {
+        let dir = temp_dir("cap");
+        let (path, file) = rotate(&dir).expect("rotate");
+        let mut sink = Sink::new(100);
+        sink.attach(file);
+        for i in 0..50 {
+            sink.write(&format!("line {i:02} with some padding\n"));
+        }
+        let text = read(&path);
+        assert_eq!(text.lines().filter(|l| l.starts_with("line ")).count(), 3, "{text}");
+        assert_eq!(text.matches("log file reached").count(), 1, "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_logger_filters_records_and_writes_them_to_the_attached_file() {
+        use log::Log;
+        let dir = temp_dir("logger");
+        let logger = AppLogger::new(Filter::parse(DEFAULT_FILTER), false);
+        let record = |level, target: &'static str, msg: &'static str| {
+            logger.log(&log::Record::builder().level(level).target(target).args(format_args!("{msg}")).build());
+        };
+        record(log::Level::Info, "vectorcraft", "before the settings directory");
+        record(log::Level::Info, "wgpu_core::device", "too chatty");
+        let path = logger.attach_dir(&dir).expect("attach");
+        assert_eq!(path, dir.join(LOG_FILE));
+        record(log::Level::Warn, "wgpu_hal::vulkan", "a real warning");
+        record(log::Level::Error, "vectorcraft_engine::guard", "recovered from a panic: boom");
+        record(log::Level::Debug, "vectorcraft", "below info");
+        let text = read(&path);
+        let lines: Vec<&str> = text.lines().collect();
+        assert_eq!(lines.len(), 3, "{text}");
+        assert!(lines[0].contains(" INFO  [") && lines[0].ends_with("vectorcraft: before the settings directory"), "{text}");
+        assert!(lines[1].ends_with("wgpu_hal::vulkan: a real warning"), "{text}");
+        assert!(lines[2].contains(" ERROR [") && lines[2].ends_with("vectorcraft_engine::guard: recovered from a panic: boom"), "{text}");
+        assert!(logger.enabled(&log::Metadata::builder().level(log::Level::Info).target("vectorcraft_ui_egui").build()));
+        assert!(!logger.enabled(&log::Metadata::builder().level(log::Level::Info).target("naga").build()));
+        // Attaching again rotates: the first log becomes `.1`.
+        logger.attach_dir(&dir).expect("attach again");
+        assert_eq!(read(&dir.join("vectorcraft.1.log")), text);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn records_from_many_threads_are_whole_lines() {
+        use log::Log;
+        let dir = temp_dir("threads");
+        let logger = std::sync::Arc::new(AppLogger::new(Filter::parse("info"), false));
+        let path = logger.attach_dir(&dir).expect("attach");
+        let workers: Vec<_> = (0..8)
+            .map(|t| {
+                let l = std::sync::Arc::clone(&logger);
+                std::thread::spawn(move || {
+                    for i in 0..100 {
+                        l.log(
+                            &log::Record::builder().level(log::Level::Info).target("vectorcraft").args(format_args!("thread {t} record {i}")).build(),
+                        );
+                    }
+                })
+            })
+            .collect();
+        for w in workers {
+            w.join().expect("worker");
+        }
+        let text = read(&path);
+        assert_eq!(text.lines().count(), 800);
+        assert!(text.lines().all(|l| l.contains(" vectorcraft: thread ")), "{text}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn attaching_to_an_unusable_directory_reports_an_error_and_keeps_logging() {
+        use log::Log;
+        let dir = temp_dir("unusable");
+        std::fs::create_dir_all(dir.parent().expect("parent")).expect("tmp");
+        std::fs::write(&dir, "not a directory").expect("block");
+        let logger = AppLogger::new(Filter::parse("info"), false);
+        assert!(logger.attach_dir(&dir).is_err());
+        logger.log(&log::Record::builder().level(log::Level::Error).target("x").args(format_args!("still fine")).build());
+        // Nothing waits in memory for a file that won't come.
+        assert!(logger.sink.lock().expect("sink").pending.is_empty());
+        let _ = std::fs::remove_file(&dir);
+    }
+
+    #[test]
+    fn a_poisoned_sink_still_logs() {
+        use log::Log;
+        let dir = temp_dir("poison");
+        let logger = std::sync::Arc::new(AppLogger::new(Filter::parse("info"), false));
+        let l = std::sync::Arc::clone(&logger);
+        let _ = std::thread::spawn(move || {
+            let _guard = l.sink.lock().expect("lock");
+            panic!("poison the sink");
+        })
+        .join();
+        assert!(logger.sink.is_poisoned());
+        let path = logger.attach_dir(&dir).expect("attach");
+        logger.log(&log::Record::builder().level(log::Level::Warn).target("vectorcraft").args(format_args!("after the poison")).build());
+        assert!(read(&path).contains("vectorcraft: after the poison"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

apps/vectorcraft/src/mac_menu.rs

@@ -0,0 +1,487 @@
+//! The macOS menu bar, through muda (Tauri's menu crate: AppKit menus behind a safe API, no GTK
+//! with default features off). The menus, their Mac layout and how their keys reach VectorCraft
+//! are in `vectorcraft_ui_egui::native_menu`; this file only builds and updates the `NSMenu`s.
+//!
+//! - Item ids are the items' places (`vc12`, depth first): one command can run from several items
+//!   (each language of VectorCraft › Language is `app.language` with its own code).
+//! - A structure change (a recent file added, the language or a shortcut changed) rebuilds the
+//!   menu; labels, enabled and checked are updated in place.
+//! - A chosen item is a click or a key equivalent: AppKit's current event says which. A key
+//!   equivalent goes back to egui as the key press that was made (the event's modifiers, not the
+//!   item's: AppKit may match ⌘R to a ⇧⌘R item), so VectorCraft's key rules still apply.
+//! - Hide and Hide Others are items of ours calling `NSApplication`: AppKit's own always take ⌘H
+//!   (View › Hide Edges) and ⌥⌘H.
+
+use std::sync::Once;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{Receiver, channel};
+
+use block2::RcBlock;
+
+use egui::{Key, KeyboardShortcut};
+use muda::accelerator::{Accelerator, Code, Modifiers};
+use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use objc2::MainThreadMarker;
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType, NSMenuDidBeginTrackingNotification, NSMenuDidEndTrackingNotification};
+use objc2_foundation::{NSNotification, NSNotificationCenter};
+use vectorcraft_ui_egui::VectorcraftApp;
+use vectorcraft_ui_egui::native_menu::{self, Backend, Event, MenuBar, MenuRole, Node, Standard};
+
+// AppKit can deliver window input while its system menu is still tracking (especially with
+// asynchronous menu presentation). Keep the native tracking state separate from egui popups.
+static TRACKING: AtomicBool = AtomicBool::new(false);
+
+fn observe_tracking(ctx: &egui::Context) {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        // SAFETY: AppKit initializes these immutable notification-name constants.
+        #[allow(unsafe_code)]
+        let notifications = unsafe { [(NSMenuDidBeginTrackingNotification, true), (NSMenuDidEndTrackingNotification, false)] };
+        for (name, tracking) in notifications {
+            let repaint = ctx.clone();
+            let block = RcBlock::new(move |_: std::ptr::NonNull<NSNotification>| {
+                TRACKING.store(tracking, Ordering::Relaxed);
+                // Apply any deferred menu updates as soon as the tracking session ends.
+                if !tracking {
+                    repaint.request_repaint();
+                }
+            });
+            // SAFETY: these are AppKit's notification names. The notification center retains
+            // the observer and block for the application's lifetime; callbacks update an atomic and request repaint.
+            #[allow(unsafe_code)]
+            unsafe {
+                NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(Some(name), None, None, &block);
+            }
+        }
+    });
+}
+
+fn cancel_tracking() {
+    if let Some(mtm) = MainThreadMarker::new()
+        && let Some(menu) = NSApplication::sharedApplication(mtm).mainMenu()
+    {
+        menu.cancelTracking();
+    }
+    TRACKING.store(false, Ordering::Relaxed);
+}
+
+/// A dismissing click belongs to the menu, so the canvas and panel controls must not see it.
+fn dismiss_input(raw: &mut egui::RawInput, tracking: bool) -> bool {
+    if !raw
+        .events
+        .iter()
+        .any(|e| matches!(e, egui::Event::PointerButton { pressed: true, .. } | egui::Event::Key { key: egui::Key::Escape, pressed: true, .. }))
+    {
+        return false;
+    }
+    if tracking {
+        raw.events.retain(|e| !matches!(e, egui::Event::PointerButton { .. } | egui::Event::Key { key: egui::Key::Escape, .. }));
+    }
+    true
+}
+
+/// Inspect real window input before native key equivalents and control events are added.
+pub fn raw_input_hook(raw: &mut egui::RawInput) {
+    // Asynchronous menu presentation may leave a displayed menu after its tracking notification.
+    // Still cancel it, but consume the dismissing input only during a reported tracking session.
+    if dismiss_input(raw, TRACKING.load(Ordering::Relaxed)) {
+        cancel_tracking();
+    }
+}
+
+enum Handle {
+    Plain(MenuItem),
+    Check(CheckMenuItem),
+}
+
+/// One native item, in the order of [`MenuBar::items`].
+struct Entry {
+    handle: Handle,
+    item: native_menu::Item,
+    /// Its shortcut, when it is a key equivalent.
+    chord: Option<KeyboardShortcut>,
+}
+
+/// How an item was chosen, read from AppKit's current event while it calls the handler.
+struct Chosen {
+    id: String,
+    /// A key press (not a mouse click), and the modifiers held: ⌘, ⌃, ⌥, ⇧.
+    key: bool,
+    mods: [bool; 4],
+}
+
+pub struct MacMenu {
+    menu: Option<Menu>,
+    entries: Vec<Entry>,
+    rx: Receiver<Chosen>,
+    structure: u64,
+    /// Latest menu state to apply after AppKit finishes tracking; item ids stay stable meanwhile.
+    pending: Option<MenuBar>,
+}
+
+impl MacMenu {
+    fn new(ctx: &egui::Context) -> MacMenu {
+        observe_tracking(ctx);
+        let (tx, rx) = channel();
+        let repaint = ctx.clone();
+        MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
+            // AppKit calls this on the main thread, from the event that chose the item: a key
+            // equivalent is a key-down, a click a mouse-up (or ↩ inside the open menu).
+            let event = MainThreadMarker::new().and_then(|mtm| NSApplication::sharedApplication(mtm).currentEvent());
+            let key = event.as_ref().is_some_and(|ev| ev.r#type() == NSEventType::KeyDown);
+            let flags = event.as_ref().map_or(NSEventModifierFlags::empty(), |ev| ev.modifierFlags());
+            let mods = [NSEventModifierFlags::Command, NSEventModifierFlags::Control, NSEventModifierFlags::Option, NSEventModifierFlags::Shift]
+                .map(|m| flags.contains(m));
+            // The receiver only goes away with the app.
+            let _ = tx.send(Chosen { id: e.id.0, key, mods });
+            // Wake egui, so the item runs now rather than on the next mouse move.
+            repaint.request_repaint();
+        }));
+        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0, pending: None }
+    }
+
+    /// Build the menus of `bar` and make them the app's, in place of the ones before.
+    fn build(&mut self, bar: &MenuBar) -> muda::Result<()> {
+        let mut entries = Vec::new();
+        let menu = Menu::new();
+        let mut special = Vec::new();
+        for m in &bar.menus {
+            let sub = Submenu::new(escape(&m.title), true);
+            append(&sub, &m.children, &mut entries)?;
+            menu.append(&sub)?;
+            if matches!(m.role, MenuRole::Window | MenuRole::Help) {
+                special.push((m.role, sub));
+            }
+        }
+        if let Some(old) = self.menu.take() {
+            old.remove_for_nsapp();
+        }
+        menu.init_for_nsapp();
+        // Only once the menu is the app's: muda looks the submenus up in the installed main menu.
+        for (role, sub) in special {
+            match role {
+                MenuRole::Window => sub.set_as_windows_menu_for_nsapp(),
+                _ => sub.set_as_help_menu_for_nsapp(),
+            }
+        }
+        self.menu = Some(menu);
+        self.entries = entries;
+        self.structure = native_menu::structure_key(bar);
+        Ok(())
+    }
+}
+
+fn append(sub: &Submenu, nodes: &[Node], entries: &mut Vec<Entry>) -> muda::Result<()> {
+    for n in nodes {
+        match n {
+            Node::Separator => sub.append(&PredefinedMenuItem::separator())?,
+            Node::Header(label) => sub.append(&MenuItem::new(escape(label), false, None))?,
+            Node::Submenu { label, children } => {
+                let s = Submenu::new(escape(label), !children.is_empty());
+                append(&s, children, entries)?;
+                sub.append(&s)?;
+            }
+            Node::Standard(item) => {
+                let text = Some(vectorcraft_ui_egui::i18n::t(item.label()));
+                let p = match item {
+                    Standard::Services => PredefinedMenuItem::services(text),
+                    Standard::ShowAll => PredefinedMenuItem::show_all(text),
+                    Standard::Zoom => PredefinedMenuItem::maximize(text),
+                    Standard::BringAllToFront => PredefinedMenuItem::bring_all_to_front(text),
+                };
+                sub.append(&p)?;
+            }
+            Node::Item(it) => {
+                let id = format!("vc{}", entries.len());
+                let chord = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok);
+                let accel = chord.as_ref().and_then(accelerator);
+                let handle = match it.checked {
+                    Some(c) => {
+                        let h = CheckMenuItem::with_id(id, escape(&it.label), it.enabled, c, accel);
+                        sub.append(&h)?;
+                        Handle::Check(h)
+                    }
+                    None => {
+                        let h = MenuItem::with_id(id, escape(&it.label), it.enabled, accel);
+                        sub.append(&h)?;
+                        Handle::Plain(h)
+                    }
+                };
+                entries.push(Entry { handle, item: it.clone(), chord });
+            }
+        }
+    }
+    Ok(())
+}
+
+impl Backend for MacMenu {
+    fn sync(&mut self, bar: &MenuBar) {
+        // Replacing or mutating an NSMenu during tracking can strand its displayed menu. Keep
+        // the latest state: the shared model considers this sync complete and may not resend it.
+        if TRACKING.load(Ordering::Relaxed) {
+            self.pending = Some(bar.clone());
+            return;
+        }
+        self.pending = None;
+        let items = bar.items();
+        if self.menu.is_none() || native_menu::structure_key(bar) != self.structure || items.len() != self.entries.len() {
+            if let Err(e) = self.build(bar) {
+                // The menus as they were stay up (a failed build changed nothing).
+                log::warn!("couldn't rebuild the macOS menu bar: {e}");
+            }
+            return;
+        }
+        for (e, it) in self.entries.iter_mut().zip(items) {
+            if e.item.label != it.label {
+                let text = escape(&it.label);
+                match &e.handle {
+                    Handle::Plain(h) => h.set_text(text),
+                    Handle::Check(h) => h.set_text(text),
+                }
+            }
+            if e.item.enabled != it.enabled {
+                match &e.handle {
+                    Handle::Plain(h) => h.set_enabled(it.enabled),
+                    Handle::Check(h) => h.set_enabled(it.enabled),
+                }
+            }
+            // Compare with AppKit's own state: muda toggles a check item when it's clicked.
+            if let (Handle::Check(h), Some(c)) = (&e.handle, it.checked)
+                && h.is_checked() != c
+            {
+                h.set_checked(c);
+            }
+            if e.item != *it {
+                e.item = it.clone();
+            }
+        }
+    }
+
+    fn drain(&mut self) -> Vec<Event> {
+        let mut out = Vec::new();
+        while let Ok(chosen) = self.rx.try_recv() {
+            cancel_tracking();
+            // Ids that aren't ours are AppKit's own items (Services, Zoom…), already handled.
+            let Some(e) = chosen.id.strip_prefix("vc").and_then(|n| n.parse::<usize>().ok()).and_then(|i| self.entries.get(i)) else { continue };
+            if let Some(command @ (native_menu::HIDE | native_menu::HIDE_OTHERS)) = e.item.command {
+                if let Some(mtm) = MainThreadMarker::new() {
+                    let app = NSApplication::sharedApplication(mtm);
+                    if command == native_menu::HIDE { app.hide(None) } else { app.hideOtherApplications(None) }
+                }
+                continue;
+            }
+            // A key-down chose it: its key equivalent, unless it was ↩ or Space inside the open
+            // menu (no ⌘ or ⌃ while the item's shortcut has one). The key is the item's (AppKit
+            // matched on it); the modifiers are the ones held.
+            let [cmd, ctrl, alt, shift] = chosen.mods;
+            let key = e
+                .chord
+                .filter(|c| {
+                    chosen.key && e.item.command != Some(native_menu::MINIMIZE) && (cmd || ctrl || !(c.modifiers.command || c.modifiers.ctrl))
+                })
+                .map(|c| KeyboardShortcut::new(egui::Modifiers { alt, ctrl, shift, mac_cmd: cmd, command: cmd }, c.logical_key));
+            out.push(match key {
+                Some(k) => Event::Key(k),
+                None => Event::Click(e.item.clone()),
+            });
+        }
+        // Drain against the old item ids before a deferred structure change replaces them.
+        if !TRACKING.load(Ordering::Relaxed)
+            && let Some(bar) = self.pending.take()
+        {
+            self.sync(&bar);
+        }
+        out
+    }
+}
+
+/// Install the menu bar (in eframe's creator closure, so winit's default menu doesn't stay up).
+/// `None` keeps the menus in the window: AppKit refused them (logged), never a crash.
+pub fn install(ctx: &egui::Context, app: &VectorcraftApp) -> Option<native_menu::NativeMenu> {
+    vectorcraft_ui_egui::i18n::set_current(app.ui_language());
+    let bar = native_menu::layout(app).bar;
+    let built = vectorcraft_engine::guard::catch_panic(|| {
+        let mut menu = MacMenu::new(ctx);
+        menu.build(&bar).map(|()| menu)
+    });
+    match built {
+        Ok(Ok(menu)) => Some(native_menu::NativeMenu::new(Box::new(menu))),
+        Ok(Err(e)) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+        Err(e) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+    }
+}
+
+/// `&` marks a mnemonic in muda labels: "Fill & Stroke" keeps its ampersand.
+fn escape(s: &str) -> String {
+    s.replace('&', "&&")
+}
+
+/// A key equivalent for AppKit. `Cmd` is ⌘ (`META`) and `Ctrl` is ⌃: never folded together.
+fn accelerator(c: &KeyboardShortcut) -> Option<Accelerator> {
+    let m = c.modifiers;
+    let mut mods = Modifiers::empty();
+    for (on, flag) in [(m.command || m.mac_cmd, Modifiers::META), (m.ctrl, Modifiers::CONTROL), (m.alt, Modifiers::ALT), (m.shift, Modifiers::SHIFT)]
+    {
+        if on {
+            mods |= flag;
+        }
+    }
+    Some(Accelerator::new(mods, code(c.logical_key)?))
+}
+
+/// The key code AppKit matches for an egui key.
+fn code(key: Key) -> Option<Code> {
+    Some(match key {
+        Key::A => Code::KeyA,
+        Key::B => Code::KeyB,
+        Key::C => Code::KeyC,
+        Key::D => Code::KeyD,
+        Key::E => Code::KeyE,
+        Key::F => Code::KeyF,
+        Key::G => Code::KeyG,
+        Key::H => Code::KeyH,
+        Key::I => Code::KeyI,
+        Key::J => Code::KeyJ,
+        Key::K => Code::KeyK,
+        Key::L => Code::KeyL,
+        Key::M => Code::KeyM,
+        Key::N => Code::KeyN,
+        Key::O => Code::KeyO,
+        Key::P => Code::KeyP,
+        Key::Q => Code::KeyQ,
+        Key::R => Code::KeyR,
+        Key::S => Code::KeyS,
+        Key::T => Code::KeyT,
+        Key::U => Code::KeyU,
+        Key::V => Code::KeyV,
+        Key::W => Code::KeyW,
+        Key::X => Code::KeyX,
+        Key::Y => Code::KeyY,
+        Key::Z => Code::KeyZ,
+        Key::Num0 => Code::Digit0,
+        Key::Num1 => Code::Digit1,
+        Key::Num2 => Code::Digit2,
+        Key::Num3 => Code::Digit3,
+        Key::Num4 => Code::Digit4,
+        Key::Num5 => Code::Digit5,
+        Key::Num6 => Code::Digit6,
+        Key::Num7 => Code::Digit7,
+        Key::Num8 => Code::Digit8,
+        Key::Num9 => Code::Digit9,
+        Key::F1 => Code::F1,
+        Key::F2 => Code::F2,
+        Key::F3 => Code::F3,
+        Key::F4 => Code::F4,
+        Key::F5 => Code::F5,
+        Key::F6 => Code::F6,
+        Key::F7 => Code::F7,
+        Key::F8 => Code::F8,
+        Key::F9 => Code::F9,
+        Key::F10 => Code::F10,
+        Key::F11 => Code::F11,
+        Key::F12 => Code::F12,
+        Key::F13 => Code::F13,
+        Key::F14 => Code::F14,
+        Key::F15 => Code::F15,
+        Key::F16 => Code::F16,
+        Key::F17 => Code::F17,
+        Key::F18 => Code::F18,
+        Key::F19 => Code::F19,
+        Key::F20 => Code::F20,
+        Key::F21 => Code::F21,
+        Key::F22 => Code::F22,
+        Key::F23 => Code::F23,
+        Key::F24 => Code::F24,
+        Key::OpenBracket => Code::BracketLeft,
+        Key::CloseBracket => Code::BracketRight,
+        Key::Backslash => Code::Backslash,
+        Key::Slash => Code::Slash,
+        // `+` is Shift+`=` on the keyboards AppKit matches by key: Zoom In shows ⌘=.
+        Key::Equals | Key::Plus => Code::Equal,
+        Key::Minus => Code::Minus,
+        Key::Quote => Code::Quote,
+        Key::Semicolon => Code::Semicolon,
+        Key::Comma => Code::Comma,
+        Key::Period => Code::Period,
+        Key::Backtick => Code::Backquote,
+        Key::Backspace => Code::Backspace,
+        Key::Delete => Code::Delete,
+        Key::Enter => Code::Enter,
+        Key::Tab => Code::Tab,
+        Key::Space => Code::Space,
+        Key::Escape => Code::Escape,
+        Key::ArrowLeft => Code::ArrowLeft,
+        Key::ArrowRight => Code::ArrowRight,
+        Key::ArrowUp => Code::ArrowUp,
+        Key::ArrowDown => Code::ArrowDown,
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every shortcut the Mac menu shows as a key equivalent has one AppKit can match.
+    #[test]
+    fn every_menu_shortcut_maps_to_a_key_equivalent() {
+        let app = VectorcraftApp::new(vectorcraft_engine::Session::new(), Default::default());
+        let bar = native_menu::layout(&app).bar;
+        let mut native = 0;
+        for it in bar.items() {
+            let Some(c) = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok) else { continue };
+            assert!(accelerator(&c).is_some(), "{:?} ({:?}) has no key equivalent", it.shortcut, it.command);
+            native += 1;
+        }
+        assert!(native > 70, "{native} key equivalents");
+    }
+
+    #[test]
+    fn control_and_command_stay_distinct() {
+        let parse = |s| vectorcraft_ui_egui::shortcuts::parse(s).and_then(|c| accelerator(&c));
+        assert_ne!(parse("Cmd+M"), parse("Ctrl+Cmd+M"));
+        assert!(parse("Cmd+M").is_some());
+    }
+
+    fn press() -> egui::Event {
+        egui::Event::PointerButton {
+            pos: egui::pos2(300.0, 200.0),
+            button: egui::PointerButton::Primary,
+            pressed: true,
+            modifiers: Default::default(),
+        }
+    }
+
+    #[test]
+    fn outside_press_dismisses_without_starting_a_canvas_gesture() {
+        let moved = egui::Event::PointerMoved(egui::pos2(300.0, 200.0));
+        let mut raw = egui::RawInput { events: vec![moved.clone(), press()], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert_eq!(raw.events, [moved]);
+        assert!(!dismiss_input(&mut raw, true));
+        raw.events.push(press());
+        assert!(dismiss_input(&mut raw, false));
+        assert_eq!(raw.events.len(), 2, "ordinary canvas presses still reach egui");
+    }
+
+    #[test]
+    fn escape_dismisses_without_reaching_the_active_tool() {
+        let escape = |pressed| egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed, repeat: false, modifiers: Default::default() };
+        let mut raw = egui::RawInput { events: vec![escape(true), escape(false)], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert!(raw.events.is_empty());
+    }
+
+    #[test]
+    fn moving_the_pointer_does_not_dismiss_a_tracking_menu() {
+        let mut raw = egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(300.0, 200.0))], ..Default::default() };
+        assert!(!dismiss_input(&mut raw, true));
+        assert_eq!(raw.events.len(), 1);
+    }
+}

apps/vectorcraft/src/main.rs

@@ -1,50 +1,115 @@
 //! VectorCraft desktop app.
 //!
-//! Usage: `vectorcraft [--control <port>] [files…]`
+//! Usage: `vectorcraft [--control <port>] [--in-window-menus] [files…]`
+//!
+//! `--in-window-menus` (or `VECTORCRAFT_IN_WINDOW_MENUS=1`) keeps the menus inside the window on
+//! macOS instead of the macOS menu bar (`mac_menu`).
 //!
 //! `--control <port>` (or `VECTORCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"ui.inspect","params":{}}` → `{"id":1,"ok":true,"result":…}`.
 //! See `vectorcraft_ui_egui::control` for the methods.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
+#[cfg(all(feature = "windows7", any(feature = "wgpu", feature = "accessibility")))]
+compile_error!("windows7 requires --no-default-features (wgpu and accessibility must be disabled)");
+#[cfg(all(windows, feature = "windows7", not(target_vendor = "win7")))]
+compile_error!("windows7 requires --target x86_64-win7-windows-msvc; the ordinary Windows target still imports newer APIs");
+#[cfg(all(target_vendor = "win7", not(feature = "windows7")))]
+compile_error!("the win7 target requires --no-default-features --features windows7");
+
 mod clipboard;
 mod control_server;
+#[cfg(feature = "wgpu")]
+mod gpu;
+mod logging;
 #[cfg(target_os = "macos")]
-mod native_menu;
+mod mac_menu;
+#[cfg(target_os = "macos")]
+mod open_documents;
 mod printing;
 mod window;
 
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_ui_egui::{FilePick, Services, VectorcraftApp};
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
+use vectorcraft_ui_egui::{ClipboardProbeFactory, FilePick, Services, VectorcraftApp};
 
-struct App(VectorcraftApp, #[cfg(target_os = "macos")] Option<native_menu::NativeMenu>);
+struct App {
+    app: VectorcraftApp,
+    /// Reported by wgpu when the window's graphics device is lost (a driver reset).
+    graphics_loss: GraphicsLoss,
+    /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
+    graphics_lost: bool,
+}
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        #[cfg(target_os = "macos")]
-        {
-            if self.1.is_none() && std::env::var_os("VECTORCRAFT_NO_NATIVE_MENU").is_none() {
-                self.1 = Some(native_menu::NativeMenu::install(&mut self.0));
-            }
-            if let Some(m) = &mut self.1 {
-                m.poll(&mut self.0);
-            }
+        if let Some(why) = self.graphics_loss.take() {
+            // eframe can't give a window a new device: the user saves and starts again.
+            self.graphics_lost = self.app.graphics_lost(&why);
+            self.app.status(if self.graphics_lost {
+                "The graphics device was lost: unsaved changes are kept for Data Recovery. Save your documents and restart VectorCraft"
+            } else {
+                "The graphics device was lost: save your documents and restart VectorCraft"
+            });
         }
-        self.0.logic(ctx);
-        window::track(ctx, &mut self.0.ui.window);
-        if self.0.ui.status == "quit" {
+        if self.graphics_lost && ctx.input(|i| i.viewport().close_requested()) {
+            // The window can't show the Save Changes question: it closes, and the next launch
+            // offers the changes back.
+            vectorcraft_ui_egui::background::wait_all(&mut self.app);
+            return;
+        }
+        #[cfg(target_os = "macos")]
+        open_files(&mut self.app, open_documents::take());
+        self.app.logic(ctx);
+        window::track(ctx, &mut self.app.ui.window);
+        if self.app.ui.status == "quit" {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+        #[cfg(target_os = "macos")]
+        if self.app.services.native_menu.is_some() {
+            mac_menu::raw_input_hook(raw);
+        }
+        self.app.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.0.ui(ui);
+        self.app.ui(ui);
+        #[cfg(target_os = "macos")]
+        if self.app.take_ime_discard() {
+            discard_marked_text();
+        }
     }
+    #[cfg(not(feature = "windows7"))]
     fn on_exit(&mut self) {
-        save_prefs(&self.0);
+        save_prefs(&self.app);
+    }
+    #[cfg(feature = "windows7")]
+    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        save_prefs(&self.app);
+    }
+}
+
+/// Open files handed to the app (command line, macOS Finder and Dock) as documents. A file that
+/// can't be opened is reported in the status bar and on stderr; the others still open.
+fn open_files(app: &mut VectorcraftApp, files: Vec<String>) {
+    for f in files {
+        if let Err(e) = vectorcraft_ui_egui::io::open_path(app, &f) {
+            eprintln!("vectorcraft: {f}: {e}");
+            app.status(format!("Couldn't open {}: {e}", fileio::file_name(&f)));
+        }
+    }
+}
+
+/// Tell the macOS input method to drop its composition (the Type tool kept the marked text as
+/// typed). winit's IME toggle only clears its own copy, so the IME would type it again.
+#[cfg(target_os = "macos")]
+fn discard_marked_text() {
+    if let Some(mtm) = objc2::MainThreadMarker::new()
+        && let Some(ic) = objc2_app_kit::NSTextInputContext::currentInputContext(mtm)
+    {
+        ic.discardMarkedText();
     }
 }
 
@@ -74,6 +139,11 @@ fn prefs_path_for(name: &str, lower: &str) -> Option<std::path::PathBuf> {
     base.map(|b| b.join("ui.json"))
 }
 
+/// Where the log files live: `logs` in the preferences folder (see `logging`).
+fn log_dir() -> Option<std::path::PathBuf> {
+    Some(prefs_path()?.parent()?.join("logs"))
+}
+
 /// Runs without preferences (`VECTORCRAFT_NO_PREFS`, agents' test runs) neither read nor write them.
 fn prefs_enabled() -> bool {
     std::env::var_os("VECTORCRAFT_NO_PREFS").is_none()
@@ -183,6 +253,10 @@ fn services() -> Services {
         write_shared: Some(std::sync::Arc::new(write_file)),
         // Every format Copy offers and Paste reads (menu-bar Paste never sees egui's Paste event).
         system_clipboard: Some(clipboard::system_clipboard()),
+        // Linux checks whether Paste has something to take on a background thread: an X11 clipboard
+        // owner that never answers holds a read for up to 4 s. Windows only asks which formats the
+        // clipboard holds and macOS asks the pasteboard server, so they check in line.
+        clipboard_probe: cfg!(target_os = "linux").then(|| Box::new(clipboard::system_clipboard) as ClipboardProbeFactory),
         // Help → Discord / website / GitHub, the Discord button, About and Home links.
         open_url: Some(Box::new(|url: &str| {
             let _ = webbrowser::open(url);
@@ -226,26 +300,57 @@ fn app_icon() -> egui::IconData {
     eframe::icon_data::from_png_bytes(png).unwrap_or_default()
 }
 
+/// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
+#[cfg(feature = "wgpu")]
+fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
+    format!("{} ({:?}, {:?})", info.name.trim(), info.backend, info.device_type)
+}
+
 /// Windows and Linux: no OS title bar; the app bar is the title bar (`vectorcraft_ui_egui::titlebar`).
 /// macOS keeps its traffic lights over the integrated title strip.
 const CUSTOM_TITLEBAR: bool = !cfg!(target_os = "macos");
 
-fn main() -> eframe::Result {
+fn main() -> std::process::ExitCode {
+    // First, so every start-up warning is recorded (`logging`).
+    let logger = logging::install();
+    vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
     let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
     let mut files = Vec::new();
+    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
     let mut args = std::env::args().skip(1);
     while let Some(a) = args.next() {
         match a.as_str() {
             "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
+            "--in-window-menus" => in_window_menus = true,
             "--version" => {
                 println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
-                return Ok(());
+                return std::process::ExitCode::SUCCESS;
             }
             _ => files.push(a),
         }
     }
+    // The log file lives in the settings directory, next to the preferences; opened after the
+    // arguments, so `--version` leaves no file behind. Records logged until now are written to it
+    // first. Runs without preferences (agents' test runs) log to standard error only, so they
+    // don't rotate away the user's own logs.
+    if let Some(logger) = logger {
+        match log_dir().filter(|_| prefs_enabled()) {
+            Some(dir) => match logger.attach_dir(&dir) {
+                Ok(path) => log::info!("VectorCraft {}, log file {}", env!("CARGO_PKG_VERSION"), path.display()),
+                // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
+                Err(e) => log::warn!("no log file: {e}"),
+            },
+            None => logger.no_file(),
+        }
+    }
     let saved = read_prefs();
     let saved_window = saved.as_ref().and_then(|ui| ui.window);
+    #[cfg(feature = "wgpu")]
+    let gpu_pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("gpuPreference")).and_then(serde_json::Value::as_str);
+    #[cfg(feature = "wgpu")]
+    let power = gpu::power_preference(gpu_pref, eframe::wgpu::PowerPreference::from_env());
+    #[cfg(feature = "wgpu")]
+    let startup = std::sync::Arc::new(gpu::Startup::default());
     let options = eframe::NativeOptions {
         viewport: egui::ViewportBuilder::default()
             .with_title("VectorCraft")
@@ -258,45 +363,133 @@ fn main() -> eframe::Result {
             .with_title_shown(false)
             .with_icon(app_icon())
             .with_app_id("ai.storyteller.vectorcraft"),
+        #[cfg(feature = "windows7")]
+        renderer: eframe::Renderer::Glow,
         ..Default::default()
     };
-    eframe::run_native(
-        "VectorCraft",
-        options,
-        Box::new(move |cc| {
-            let mut app = VectorcraftApp::new(Session::new(), services());
-            load_prefs(&mut app, saved);
-            // Fit the window to its monitor, or put it back where it was (still hidden).
-            if let Some(w) = cc.winit_window() {
-                app.ui.window = Some(window::restore(w, saved_window));
-            }
-            // User Defined swatch and graphic style libraries live next to the preferences.
-            let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
-            app.session.swatch_libraries.set_user_dir(swatches);
-            let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
-            app.session.style_libraries.set_user_dir(styles);
-            // Data Recovery copies live next to the preferences too (none for runs without
-            // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
-            if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
-                let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
-                app.session.recovery.set_default_folder(recovery);
-            }
-            app.integrated_titlebar = cfg!(target_os = "macos");
-            app.custom_titlebar = CUSTOM_TITLEBAR;
-            if let Some(port) = control_port {
-                let rx = control_server::start(port, cc.egui_ctx.clone());
-                app = app.with_control(rx);
-            }
-            for f in files {
-                if let Err(e) = vectorcraft_ui_egui::io::open_path(&mut app, &f) {
-                    eprintln!("vectorcraft: {f}: {e}");
+    #[cfg(feature = "wgpu")]
+    let options = {
+        let mut options = options;
+        // One frame queued, not two: the canvas is rasterized on the CPU and the GPU only
+        // composites it, so the window answers the pointer a frame sooner (#444).
+        options.wgpu_options.surface = eframe::egui_wgpu::SurfaceConfig::LOW_LATENCY;
+        // Only adapters that can show the window, in the order `gpu` gives (#306, #502).
+        if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
+            create.native_adapter_selector = Some(gpu::selector(power, startup.clone()));
+        }
+        options
+    };
+    #[cfg(feature = "wgpu")]
+    gpu::watch_panics();
+    // Files opened from Finder and the Dock arrive as events, not arguments.
+    #[cfg(target_os = "macos")]
+    open_documents::install();
+    #[cfg(feature = "wgpu")]
+    let created = startup.clone();
+    // A panic that ends the window (egui-wgpu's own, #502) is caught here: never a crash.
+    let outcome = vectorcraft_engine::guard::catch_panic(|| {
+        eframe::run_native(
+            "VectorCraft",
+            options,
+            Box::new(move |cc| {
+                let mut app = VectorcraftApp::new(Session::new(), services());
+                load_prefs(&mut app, saved);
+                // Fit the window to its monitor, or put it back where it was (still hidden).
+                if let Some(w) = cc.winit_window() {
+                    app.ui.window = Some(window::restore(w, saved_window));
+                }
+                // User Defined swatch and graphic style libraries live next to the preferences.
+                let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
+                app.session.swatch_libraries.set_user_dir(swatches);
+                let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
+                app.session.style_libraries.set_user_dir(styles);
+                // Data Recovery copies live next to the preferences too (none for runs without
+                // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
+                if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
+                    let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
+                    app.session.recovery.set_default_folder(recovery);
+                }
+                let graphics_loss = GraphicsLoss::default();
+                #[cfg(feature = "wgpu")]
+                if let Some(rs) = &cc.wgpu_render_state {
+                    let summary = adapter_summary(&rs.adapter.get_info());
+                    log::info!("rendering with {summary} (power preference {power:?})");
+                    created.created(&cc.egui_ctx);
+                    if !gpu::skipped().is_empty() {
+                        app.status(format!("The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}"));
+                    }
+                    app.graphics_adapter = Some(summary);
+                    let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                #[cfg(feature = "windows7")]
+                {
+                    app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
+                }
+                app.integrated_titlebar = cfg!(target_os = "macos");
+                app.custom_titlebar = CUSTOM_TITLEBAR;
+                if let Some(port) = control_port {
+                    let rx = control_server::start(port, cc.egui_ctx.clone());
+                    app = app.with_control(rx);
                 }
-            }
-            Ok(Box::new(App(
-                app,
                 #[cfg(target_os = "macos")]
-                None,
-            )))
-        }),
-    )
+                {
+                    open_documents::set_ui(&cc.egui_ctx);
+                    // The macOS menu bar, installed now so winit's default menu doesn't stay up.
+                    if !in_window_menus {
+                        app.services.native_menu = mac_menu::install(&cc.egui_ctx, &app);
+                    }
+                }
+                #[cfg(not(target_os = "macos"))]
+                let _ = in_window_menus;
+                open_files(&mut app, files);
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false }))
+            }),
+        )
+    });
+    #[cfg(feature = "wgpu")]
+    let outcome = gpu::finish(outcome, &startup);
+    #[cfg(not(feature = "wgpu"))]
+    let outcome = outcome.and_then(|r| r.map_err(|e| e.to_string()));
+    match outcome {
+        Ok(()) => std::process::ExitCode::SUCCESS,
+        Err(e) => {
+            log::error!("VectorCraft stopped: {e}");
+            std::process::ExitCode::FAILURE
+        }
+    }
+}
+
+#[cfg(all(test, feature = "wgpu"))]
+mod tests {
+    use super::*;
+
+    /// The file extensions the macOS bundle declares: its document types and its own exported type.
+    fn plist_extensions(plist: &str) -> Vec<&str> {
+        ["<key>CFBundleTypeExtensions</key>", "<key>public.filename-extension</key>"]
+            .iter()
+            .flat_map(|key| plist.split(key).skip(1))
+            .filter_map(|rest| rest.split("</array>").next())
+            .flat_map(|array| array.split("<string>").skip(1))
+            .filter_map(|s| s.split("</string>").next())
+            .collect()
+    }
+
+    /// Finder offers the app for every file File › Open reads (#295, #354), takes over no other
+    /// app's files, and hands them to the app rather than to AppKit's document machinery.
+    #[test]
+    fn the_macos_bundle_opens_every_readable_format() {
+        let plist = include_str!("../../../packaging/macos/Info.plist.in");
+        let declared = plist_extensions(plist);
+        for e in fileio::OPEN_EXTS {
+            assert!(declared.contains(e), "Info.plist.in doesn't declare .{e}");
+        }
+        for e in &declared {
+            assert!(fileio::OPEN_EXTS.contains(e), "Info.plist.in declares .{e}, which the app doesn't open");
+        }
+        assert!(!plist.contains("<key>NSDocumentClass</key>"), "not an NSDocument app: AppKit would refuse the files");
+        let types = plist.matches("<key>CFBundleTypeName</key>").count();
+        assert!(types > 1 && plist.matches("<key>LSHandlerRank</key>").count() == types, "every document type has a rank");
+        assert_eq!(plist.matches("<string>Owner</string>").count(), 2, "only VectorCraft documents and templates are owned");
+    }
 }

apps/vectorcraft/src/native_menu.rs

@@ -1,180 +0,0 @@
-//! macOS: VectorCraft's menu tree as the native system menu bar (like Illustrator on the Mac).
-//! Items dispatch through the same command path as the in-window menus; enablement, check marks
-//! and dynamic labels ("Undo Move") are refreshed a few times per second, and the menu is rebuilt
-//! when saved views or recent files come and go.
-
-use std::collections::HashMap;
-use std::str::FromStr;
-
-use muda::accelerator::Accelerator;
-use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
-use serde_json::Value;
-use vectorcraft_ui_egui::VectorcraftApp;
-use vectorcraft_ui_egui::menus::{self, Item};
-
-enum Handle {
-    Plain(MenuItem),
-    Check(CheckMenuItem),
-}
-
-pub struct NativeMenu {
-    language: vectorcraft_ui_egui::i18n::Language,
-    _menu: Menu,
-    items: HashMap<String, (String, Value, Handle, String)>,
-    last_refresh: f64,
-    /// Shortcut-override / workspace-list generation the menu was built for.
-    generation: u64,
-    /// Saved views and recent files listed (empty slots are left out, so a change rebuilds).
-    slots: usize,
-    /// Plug-in registry revision the Plug-ins submenus were built for.
-    plugins: u64,
-}
-
-/// Accelerator for a shortcut like "Cmd+Shift+]" (modifier-less shortcuts stay in the app so they
-/// don't steal keys from text fields).
-fn accel(sc: &str) -> Option<Accelerator> {
-    if !(sc.contains("Cmd") || sc.contains("Ctrl") || sc.contains("Alt") || sc.starts_with('F')) {
-        return None;
-    }
-    Accelerator::from_str(&sc.replace("Cmd", "CMD").replace("Alt", "ALT").replace("Shift", "SHIFT").replace("Ctrl", "CTRL")).ok()
-}
-
-impl NativeMenu {
-    pub fn install(app: &mut VectorcraftApp) -> Self {
-        // Accelerators come from `shortcut_of`, which honours the user's overrides.
-        vectorcraft_ui_egui::shortcut_editor::sync(&app.ui);
-        let generation = vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed);
-        let menu = Menu::new();
-        let mut items = HashMap::new();
-        let mut counter = 0usize;
-        for (title, entries) in menus::menu_tree() {
-            let sub = Submenu::new(app.ui.language.tr(title), true);
-            build(app, &sub, &entries, &mut items, &mut counter);
-            let _ = menu.append(&sub);
-        }
-        menu.init_for_nsapp();
-        app.native_menu = true;
-        app.native_shortcuts = items
-            .values()
-            .filter(|(_, p, _, c)| (p.is_null() || p.as_object().is_some_and(|o| o.is_empty())) && menus::shortcut_of(c).and_then(accel).is_some())
-            .map(|(_, _, _, c)| c.clone())
-            .collect();
-        Self {
-            _menu: menu,
-            items,
-            last_refresh: 0.0,
-            generation,
-            slots: menus::listed_slots(app),
-            plugins: menus::plugin_revision(),
-            language: app.ui.language,
-        }
-    }
-
-    /// Dispatch clicked items and refresh state.
-    pub fn poll(&mut self, app: &mut VectorcraftApp) {
-        while let Ok(ev) = MenuEvent::receiver().try_recv() {
-            if let Some((cmd, params, _, _)) = self.items.get(ev.id.as_ref()) {
-                let p = if params.is_null() { serde_json::json!({}) } else { params.clone() };
-                menus::invoke(app, cmd, p);
-            }
-        }
-        let now = vectorcraft_ui_egui::now_ms();
-        if now - self.last_refresh < 250.0 {
-            return;
-        }
-        self.last_refresh = now;
-        // Shortcuts edited, workspaces added, saved views, recent files or plug-ins changed: rebuild so
-        // accelerators and lists are current.
-        if vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed) != self.generation
-            || menus::listed_slots(app) != self.slots
-            || menus::plugin_revision() != self.plugins
-            || app.ui.language != self.language
-        {
-            *self = NativeMenu::install(app);
-            return;
-        }
-        for (run, rp, h, cmd) in self.items.values() {
-            let null = Value::Null;
-            let params = if run == cmd { rp } else { &null };
-            let en = menus::enabled(app, cmd);
-            match h {
-                Handle::Plain(i) => {
-                    i.set_enabled(en);
-                    if matches!(
-                        cmd.as_str(),
-                        "edit.undo"
-                            | "edit.redo"
-                            | "view.outline"
-                            | "view.rulers"
-                            | "view.guides"
-                            | "view.grid"
-                            | "view.edges"
-                            | "view.artboards"
-                            | "view.boundingBox"
-                            | "view.transparencyGrid"
-                            | "window.workspace.reset"
-                    ) || cmd.starts_with("file.openRecent")
-                        || cmd.starts_with("type.recentFont")
-                        || cmd.starts_with("view.goto")
-                        || matches!(
-                            cmd.as_str(),
-                            "view.cornerWidget" | "view.textThreads" | "view.gradientAnnotator" | "effect.last" | "type.hiddenCharacters"
-                        )
-                    {
-                        i.set_text(app.ui.language.tr(&menus::dynamic_label(app, cmd, "")));
-                    }
-                }
-                Handle::Check(c) => {
-                    c.set_enabled(en);
-                    c.set_checked(menus::checked(app, cmd, params).unwrap_or(false));
-                }
-            }
-        }
-    }
-}
-
-fn build(
-    app: &VectorcraftApp,
-    parent: &Submenu,
-    entries: &[Item],
-    items: &mut HashMap<String, (String, Value, Handle, String)>,
-    counter: &mut usize,
-) {
-    for e in entries {
-        match e {
-            Item::Sep => {
-                let _ = parent.append(&PredefinedMenuItem::separator());
-            }
-            Item::Header(h) => {
-                let _ = parent.append(&MenuItem::new(app.ui.language.tr(h), false, None));
-            }
-            Item::Todo(label, sc) => {
-                let _ = parent.append(&MenuItem::new(app.ui.language.tr(label), false, accel(sc)));
-            }
-            Item::Sub(label, children) => {
-                let sub = Submenu::new(app.ui.language.tr(label), true);
-                build(app, &sub, children, items, counter);
-                let _ = parent.append(&sub);
-            }
-            // Unused saved-view and recent-file slots are left out, as in the in-window menus.
-            Item::Cmd(_, cmd, _) if menus::hidden_slot(app, cmd) => {}
-            Item::Cmd(label, cmd, params) => {
-                *counter += 1;
-                let id = format!("dc{counter}");
-                let sc = if params.is_null() { menus::shortcut_of(cmd).and_then(accel) } else { None };
-                let handle = if menus::checked(app, cmd, params).is_some() {
-                    let c = CheckMenuItem::with_id(id.clone(), app.ui.language.tr(label), true, false, sc);
-                    let _ = parent.append(&c);
-                    Handle::Check(c)
-                } else {
-                    let i = MenuItem::with_id(id.clone(), app.ui.language.tr(label), true, sc);
-                    let _ = parent.append(&i);
-                    Handle::Plain(i)
-                };
-                let (run, run_params) = menus::click_target(label, cmd, params);
-                let _ = &run_params;
-                items.insert(id, (run, run_params, handle, cmd.to_string()));
-            }
-        }
-    }
-}

apps/vectorcraft/src/open_documents.rs

@@ -0,0 +1,106 @@
+//! macOS: files opened from Finder (double-click, Open With, a drop on the Dock icon) or with
+//! `open -a VectorCraft file`.
+//!
+//! macOS doesn't pass these on the command line: AppKit hands them to the application delegate's
+//! `application:openURLs:`, and when the delegate has no such method it asks `NSDocumentController`,
+//! which fails with "VectorCraft cannot open files in the … format" because VectorCraft isn't an
+//! `NSDocument` app. winit 0.30's delegate doesn't implement the method, so [`install`] adds it to
+//! the delegate's class when the app is about to finish launching: after winit set the delegate and
+//! before AppKit delivers the files the app was launched with. The handler queues the paths and
+//! wakes the UI, which opens them with [`take`] like files named on the command line.
+//!
+//! Adding a method to another crate's Objective-C class has no safe API, hence the scoped
+//! `unsafe_code` allowance (winit overrides `sendEvent:` on `NSApplication` the same way).
+#![allow(unsafe_code)]
+
+use std::ptr::NonNull;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+use block2::RcBlock;
+use objc2::MainThreadMarker;
+use objc2::runtime::{AnyObject, Imp, Sel};
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSApplicationWillFinishLaunchingNotification};
+use objc2_foundation::{NSArray, NSNotification, NSNotificationCenter, NSURL};
+
+/// Paths that arrived and haven't been opened yet.
+static PENDING: Mutex<Vec<String>> = Mutex::new(Vec::new());
+/// The UI to wake when files arrive (unset until the window exists; the first frame opens them).
+static UI: OnceLock<egui::Context> = OnceLock::new();
+
+/// Handle open-document events from now on. Call before the event loop runs.
+pub fn install() {
+    let block = RcBlock::new(|_: NonNull<NSNotification>| add_open_urls_method());
+    // SAFETY: the name is AppKit's notification constant; no object or queue filter, so the block
+    // runs on the posting thread (AppKit posts it on the main thread). The notification center
+    // keeps the registration (and the block) for the life of the app.
+    unsafe {
+        NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(
+            Some(NSApplicationWillFinishLaunchingNotification),
+            None,
+            None,
+            &block,
+        );
+    }
+}
+
+/// Wake `ctx` when files arrive while the app runs.
+pub fn set_ui(ctx: &egui::Context) {
+    // Set once; a second call would hand over the same context.
+    let _ = UI.set(ctx.clone());
+}
+
+/// The paths that arrived since the last call.
+pub fn take() -> Vec<String> {
+    std::mem::take(&mut *PENDING.lock().unwrap_or_else(PoisonError::into_inner))
+}
+
+/// `application:openURLs:` on the application delegate's class.
+fn add_open_urls_method() {
+    let Some(mtm) = MainThreadMarker::new() else { return };
+    let Some(delegate) = NSApplication::sharedApplication(mtm).delegate() else {
+        log::warn!("no application delegate; files opened from Finder won't open");
+        return;
+    };
+    let class = AsRef::<AnyObject>::as_ref(&*delegate).class();
+    let handler: extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>) = open_urls;
+    // SAFETY: `Imp` is the untyped form of a method implementation; the Objective-C runtime calls
+    // it with the arguments the type encoding declares, which match `open_urls`: no return value
+    // (`v`), the receiver (`@`), the selector (`:`), the application (`@`) and the URL array (`@`).
+    let added = unsafe {
+        let imp = std::mem::transmute::<extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>), Imp>(handler);
+        objc2::ffi::class_addMethod(std::ptr::from_ref(class).cast_mut(), sel!(application:openURLs:), imp, c"v@:@@".as_ptr())
+    };
+    if !added.as_bool() {
+        log::warn!("the application delegate already handles open-document events");
+    }
+}
+
+/// Queue the files among `urls` and wake the UI. Never panics: it runs inside AppKit.
+extern "C-unwind" fn open_urls(_delegate: &AnyObject, _cmd: Sel, _app: &AnyObject, urls: &NSArray<NSURL>) {
+    // Only file URLs: macOS 27 turns an https URL's path into a file path too (#433).
+    let paths = urls.iter().filter(|u| u.isFileURL()).filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
+    PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(paths);
+    if let Some(ctx) = UI.get() {
+        ctx.request_repaint();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2::runtime::NSObject;
+    use objc2_foundation::NSString;
+
+    use super::*;
+
+    /// Files queue until the UI takes them; URLs that aren't files are left out.
+    #[test]
+    fn opened_files_wait_for_the_ui() {
+        let web = NSURL::URLWithString(&NSString::from_str("https://example.com/a.svg")).unwrap();
+        let urls = NSArray::from_retained_slice(&[NSURL::from_file_path("/tmp/a b.pdf").unwrap(), web, NSURL::from_file_path("/tmp/c.ai").unwrap()]);
+        let any = NSObject::new();
+        open_urls(&any, sel!(application:openURLs:), &any, &urls);
+        assert_eq!(take(), ["/tmp/a b.pdf", "/tmp/c.ai"]);
+        assert!(take().is_empty());
+    }
+}

apps/vectorcraft/src/printing.rs

@@ -156,6 +156,9 @@ mod system {
     }
 
     pub fn printers() -> Vec<Printer> {
+        #[cfg(feature = "windows7")]
+        let script = "Get-WmiObject Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
+        #[cfg(not(feature = "windows7"))]
         let script = "Get-CimInstance Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
         output(&mut powershell(script)).map(|t| windows_printers(&t)).unwrap_or_default()
     }
@@ -174,7 +177,19 @@ mod system {
     }
 
     pub fn setup(_printer: Option<&str>) -> Result<(), String> {
-        Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+        #[cfg(feature = "windows7")]
+        let mut command = {
+            let mut command = Command::new("control.exe");
+            command.arg("printers");
+            command
+        };
+        #[cfg(not(feature = "windows7"))]
+        let mut command = {
+            let mut command = Command::new("explorer");
+            command.arg("ms-settings:printers");
+            command
+        };
+        command.spawn().map(|_| ()).map_err(|e| e.to_string())
     }
 }
 

assets/icons/dc-anchor-smooth.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3 20 C5 11 8 7 12 7 S19 11 21 20"/><path d="M5 7 H19"/><circle cx="5" cy="7" r="1.4" fill="currentColor"/><circle cx="19" cy="7" r="1.4" fill="currentColor"/><rect x="10" y="5" width="4" height="4" fill="currentColor"/></svg>

assets/icons/dc-para-ltr.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M11 3V14" /><path d="M14 3V14" /><path d="M16 3H9.5a3 3 0 0 0 0 6H11" /><path d="M4 19H20" /><path d="M17 16L20 19L17 22" /></svg>

assets/icons/dc-para-rtl.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M13 3V14" /><path d="M10 3V14" /><path d="M8 3H14.5a3 3 0 0 1 0 6H13" /><path d="M20 19H4" /><path d="M7 16L4 19L7 22" /></svg>

assets/icons/dc-pen-add.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 19l-7-7 3-6 8 3 3 7-7 3z" /><path d="M5 12l5-5"/><circle cx="11" cy="11" r="1.5"/><path d="M19 3v5M16.5 5.5h5"/></svg>

assets/icons/dc-pen-delete.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 19l-7-7 3-6 8 3 3 7-7 3z" /><path d="M5 12l5-5"/><circle cx="11" cy="11" r="1.5"/><path d="M16.5 5.5h5"/></svg>

assets/icons/pen-tool-add.svg

@@ -0,0 +1,19 @@
+<!-- @license lucide-static v1.49.0 - ISC -->
+<!-- Lucide's pen-tool with a plus badge added for VectorCraft -->
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M15.707 21.293a1 1 0 0 1-1.414 0l-1.586-1.586a1 1 0 0 1 0-1.414l5.586-5.586a1 1 0 0 1 1.414 0l1.586 1.586a1 1 0 0 1 0 1.414z" />
+  <path d="m18 13-1.375-6.874a1 1 0 0 0-.746-.776L3.235 2.028a1 1 0 0 0-1.207 1.207L5.35 15.879a1 1 0 0 0 .776.746L13 18" />
+  <path d="m2.3 2.3 7.286 7.286" />
+  <circle cx="11" cy="11" r="2" />
+  <path d="M4 18.3v4.4M1.8 20.5h4.4" />
+</svg>

assets/icons/pen-tool-delete.svg

@@ -0,0 +1,19 @@
+<!-- @license lucide-static v1.49.0 - ISC -->
+<!-- Lucide's pen-tool with a minus badge added for VectorCraft -->
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M15.707 21.293a1 1 0 0 1-1.414 0l-1.586-1.586a1 1 0 0 1 0-1.414l5.586-5.586a1 1 0 0 1 1.414 0l1.586 1.586a1 1 0 0 1 0 1.414z" />
+  <path d="m18 13-1.375-6.874a1 1 0 0 0-.746-.776L3.235 2.028a1 1 0 0 0-1.207 1.207L5.35 15.879a1 1 0 0 0 .776.746L13 18" />
+  <path d="m2.3 2.3 7.286 7.286" />
+  <circle cx="11" cy="11" r="2" />
+  <path d="M1.8 20.5h4.4" />
+</svg>

contributors/contributors.json

@@ -0,0 +1,348 @@
+{
+  "schema": 1,
+  "repo": "storytold/vectorcraft",
+  "branch": "main",
+  "head": "fe9f3afcb7d32032e8f332b0594692a03e275b84",
+  "head_date": "2026-10-08T00:36:16Z",
+  "commits": 607,
+  "unattributed_commits": 0,
+  "contributors": [
+    {
+      "login": "echelon",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 15,
+      "commits": 119,
+      "lines_added": 172276,
+      "lines_deleted": 40329,
+      "binary_added": 37,
+      "binary_deleted": 2,
+      "first_commit": "2026-09-30T09:12:46Z",
+      "last_commit": "2026-10-07T22:04:30Z"
+    },
+    {
+      "login": "bflatastic",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 176,
+      "commits": 394,
+      "lines_added": 212929,
+      "lines_deleted": 24160,
+      "binary_added": 2,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-02T15:22:29Z",
+      "last_commit": "2026-10-08T00:36:16Z"
+    },
+    {
+      "login": "storybored379",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 7,
+      "commits": 7,
+      "lines_added": 456,
+      "lines_deleted": 49,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-04T06:45:57Z",
+      "last_commit": "2026-10-04T08:14:20Z"
+    },
+    {
+      "login": "theironchef",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 38,
+      "commits": 41,
+      "lines_added": 2803,
+      "lines_deleted": 232,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T14:40:20Z",
+      "last_commit": "2026-10-07T22:39:00Z"
+    },
+    {
+      "login": "midasdf",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 2,
+      "lines_added": 579,
+      "lines_deleted": 43,
+      "binary_added": 1,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T16:10:37Z",
+      "last_commit": "2026-10-07T20:53:30Z"
+    },
+    {
+      "login": "japbcoelho",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 57,
+      "lines_deleted": 13,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T01:45:49Z",
+      "last_commit": "2026-10-06T01:45:49Z"
+    },
+    {
+      "login": "p0lyg0n",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 6,
+      "lines_added": 780,
+      "lines_deleted": 69,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T09:22:46Z",
+      "last_commit": "2026-10-07T04:33:45Z"
+    },
+    {
+      "login": "imachus",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 12,
+      "commits": 12,
+      "lines_added": 6302,
+      "lines_deleted": 212,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T10:06:18Z",
+      "last_commit": "2026-10-07T22:20:10Z"
+    },
+    {
+      "login": "petrleocompel",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 784,
+      "lines_deleted": 36,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:23:11Z",
+      "last_commit": "2026-10-06T12:23:11Z"
+    },
+    {
+      "login": "fahrim",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 3,
+      "commits": 6,
+      "lines_added": 1964,
+      "lines_deleted": 76,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:48:28Z",
+      "last_commit": "2026-10-07T23:36:17Z"
+    },
+    {
+      "login": "EthanSuquet",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 4,
+      "lines_added": 413,
+      "lines_deleted": 71,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T19:30:49Z",
+      "last_commit": "2026-10-07T14:24:14Z"
+    },
+    {
+      "login": "realwitt",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 607,
+      "lines_deleted": 3,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:12:52Z",
+      "last_commit": "2026-10-07T00:12:52Z"
+    },
+    {
+      "login": "WildfootW",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 6809,
+      "lines_deleted": 2627,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:37:02Z",
+      "last_commit": "2026-10-07T00:37:02Z"
+    },
+    {
+      "login": "coygeek",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 4,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:29:03Z",
+      "last_commit": "2026-10-07T02:29:03Z"
+    },
+    {
+      "login": "Luskish",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 261,
+      "lines_deleted": 32,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:50:35Z",
+      "last_commit": "2026-10-07T02:50:35Z"
+    },
+    {
+      "login": "daniel-efrat",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 547,
+      "lines_deleted": 43,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T08:13:19Z",
+      "last_commit": "2026-10-07T08:13:19Z"
+    },
+    {
+      "login": "Pengjingyu1992",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 3132,
+      "lines_deleted": 4,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T09:56:23Z",
+      "last_commit": "2026-10-07T09:56:23Z"
+    },
+    {
+      "login": "MillhioreBT",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 564,
+      "lines_deleted": 41,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T12:58:33Z",
+      "last_commit": "2026-10-07T12:58:33Z"
+    },
+    {
+      "login": "fabian-co",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 270,
+      "lines_deleted": 48,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:05:26Z",
+      "last_commit": "2026-10-07T19:32:11Z"
+    },
+    {
+      "login": "Haven-King",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 467,
+      "lines_deleted": 76,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:10:39Z",
+      "last_commit": "2026-10-07T18:40:49Z"
+    },
+    {
+      "login": "njmueller",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 619,
+      "lines_deleted": 11,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:14:42Z",
+      "last_commit": "2026-10-07T21:14:42Z"
+    },
+    {
+      "login": "RicSchonfelder",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2592,
+      "lines_deleted": 9,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:44:42Z",
+      "last_commit": "2026-10-07T21:44:42Z"
+    },
+    {
+      "login": "DWAA1660",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 76,
+      "lines_deleted": 21,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T23:09:37Z",
+      "last_commit": "2026-10-07T23:09:37Z"
+    }
+  ],
+  "models": [
+    {
+      "id": "anthropic/claude-opus/5.5",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "5.5",
+      "commits": 567,
+      "lines_added": 382239,
+      "lines_deleted": 67174
+    },
+    {
+      "id": "anthropic/claude-sonnet/5.5",
+      "company": "Anthropic",
+      "model": "Claude Sonnet",
+      "version": "5.5",
+      "commits": 6,
+      "lines_added": 660,
+      "lines_deleted": 34
+    },
+    {
+      "id": "anthropic/claude-opus/4.8",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "4.8",
+      "commits": 3,
+      "lines_added": 1672,
+      "lines_deleted": 42
+    },
+    {
+      "id": "anthropic/claude-fable/5.1",
+      "company": "Anthropic",
+      "model": "Claude Fable",
+      "version": "5.1",
+      "commits": 1,
+      "lines_added": 6809,
+      "lines_deleted": 2627
+    }
+  ]
+}

contributors/people.toml

@@ -0,0 +1,30 @@
+# Contributor names for the About window (craftrules standards/contributors.md).
+#
+# Everyone who contributes is credited by GitHub username automatically. Anything more is up to
+# you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
+# maintainer may add a person only when that person asked, recording where in consent_source.
+#
+# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
+#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
+#
+# Or copy this block, replacing your-github-username (every field is optional):
+#
+#   [people.your-github-username]
+#   real_name = "Your Name"        # shown when the viewer picks "Real name"
+#   display_name = "Nickname"      # shown when the viewer picks "Display name"
+#   sync_github_name = true        # or: use the name on your public GitHub profile as display name
+#
+# To remove your names, delete your entry (or set fields empty) in a PR. The next
+# contributors.py run, and the next build, drop them.
+
+[people.echelon]
+real_name = "Brandon Thomas"
+display_name = "Brandon Thomas"
+sync_github_name = false
+
+[people.callmeBalloch]
+real_name = "Riccardo Balloch"
+sync_github_name = false
+
+[people.mo0kid]
+sync_github_name = true

crates/cad/src/import/build.rs

@@ -13,7 +13,7 @@ use vectorcraft_doc::{Appearance, AppearanceItem, CharStyle, Dash, Document, LAY
 use vectorcraft_geom::{Affine, FillRule, PathData, Point, Rect};
 
 use super::ImportOptions;
-use super::entity::{Alpha, Col, Converter, Geom, InsertItem, Item, Lw, Props, TextItem};
+use super::entity::{Alpha, Col, Converter, Geom, InsertItem, Item, Lw, Props, Span, TextItem};
 use super::reader::{Drawing, LayoutDef};
 use crate::{CAP_HEIGHT, MAX_NEST};
 
@@ -244,14 +244,18 @@ impl<'d, 'a> Build<'d, 'a> {
             Geom::Text(t) => {
                 let lines = t.text.lines().count().max(1) as f64;
                 let longest = t.text.lines().map(|l| l.chars().count()).max().unwrap_or(0) as f64;
-                let w = longest * t.height * 0.9 * t.width;
+                let natural = longest * t.height * 0.9 * t.width;
+                // Fit and aligned text run their span; aligned text's height scales with it.
+                let k = t.span.and_then(|sp| sp.scale(natural)).unwrap_or(1.0);
+                let height = if matches!(t.span, Some(Span::Aligned(_))) { t.height * k } else { t.height };
+                let w = natural * k;
                 let x0 = match t.justify {
                     vectorcraft_doc::Justify::Center => -w / 2.0,
                     vectorcraft_doc::Justify::Right => -w,
                     _ => 0.0,
                 };
-                let below = (lines - 1.0) * t.leading.unwrap_or(0.0) + t.height * 0.3;
-                Some(t.xf.transform_rect_bbox(Rect::new(x0, -below, x0 + w, t.height)))
+                let below = (lines - 1.0) * t.leading.unwrap_or(0.0) + height * 0.3;
+                Some(t.xf.transform_rect_bbox(Rect::new(x0, -below, x0 + w, height)))
             }
             Geom::Insert(ins) => {
                 let b = self.block_bounds(&ins.block, depth);
@@ -502,6 +506,9 @@ impl<'d, 'a> Build<'d, 'a> {
         let mut obj = TextObject::point(Point::ZERO, &t.text, style);
         obj.xf = m * Affine::scale(1.0 / s);
         obj.para.justify = t.justify;
+        if let Some(span) = t.span {
+            fill_span(&mut obj, span, s);
+        }
         Some(Node::new(self.doc.alloc_id(), NodeKind::Text(Box::new(obj))))
     }
 
@@ -581,6 +588,20 @@ impl<'d, 'a> Build<'d, 'a> {
     }
 }
 
+/// Fit text stretched or squeezed across, aligned text scaled as a whole, to run its span
+/// (`s`: points per drawing unit), measured in the font it is set in.
+fn fill_span(obj: &mut TextObject, span: Span, s: f64) {
+    let layout = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), obj);
+    let natural = layout.lines.iter().map(|l| l.x1 - l.x0).fold(0.0, f64::max);
+    let Some(k) = span.scale(natural / s) else { return };
+    for r in &mut obj.runs {
+        match span {
+            Span::Fit(_) => r.style.h_scale *= k,
+            Span::Aligned(_) => r.style.size *= k,
+        }
+    }
+}
+
 fn rgb_color([r, g, b]: [u8; 3]) -> Color {
     Color::rgb8(r, g, b)
 }

crates/cad/src/import/entity.rs

@@ -19,6 +19,9 @@ const LINE_SPACING: f64 = 5.0 / 3.0;
 const MAX_CELLS: i64 = 10_000;
 /// Art farther than this from the origin (drawing units) is damaged data, left out.
 const MAX_COORD: f64 = 1e12;
+/// How far fit and aligned text may be squeezed or stretched to span their two points: at width
+/// factor 1, the 1 to 10,000% horizontal scale the Character panel allows.
+const SPAN_SCALE: (f64, f64) = (0.01, 100.0);
 
 /// The colour of index `i` on paper: index 7 (white on a CAD screen) is black.
 pub(crate) fn aci_paper(i: u64) -> [u8; 3] {
@@ -121,6 +124,27 @@ pub(crate) struct TextItem {
     pub family: Option<String>,
     /// Baseline-to-baseline distance (drawing units), for several lines.
     pub leading: Option<f64>,
+    /// The distance aligned and fit text run along their baseline.
+    pub span: Option<Span>,
+}
+
+/// How text fills the distance between its two points (drawing units).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Span {
+    /// Stretched or squeezed across, its height kept.
+    Fit(f64),
+    /// Scaled as a whole, height included.
+    Aligned(f64),
+}
+
+impl Span {
+    /// The scale that makes text `natural` long run the span, within [`SPAN_SCALE`] (None when
+    /// either length is degenerate).
+    pub fn scale(self, natural: f64) -> Option<f64> {
+        let (Self::Fit(d) | Self::Aligned(d)) = self;
+        let k = d / natural;
+        (k.is_finite() && k > 0.0).then(|| k.clamp(SPAN_SCALE.0, SPAN_SCALE.1))
+    }
 }
 
 /// A block reference: one transform per copy (an array insert makes several), each from the
@@ -608,10 +632,13 @@ fn text(g: &[Pair<'_>], attrib: bool) -> Option<TextItem> {
     let (h, v) = (g.int_or(72, 0), g.int_or(if attrib { 74 } else { 73 }, 0));
     let (p1, p2) = (g.point(10), g.point_opt(11));
     let mut angle = g.num_or(50, 0.0).to_radians();
+    let mut span = None;
     // Aligned and fit text run from the first point to the second.
     let anchor = match (h, p2) {
         (3 | 5, Some(p)) => {
             angle = (p - p1).atan2();
+            let d = p1.distance(p);
+            span = (d > 1e-12).then_some(if h == 3 { Span::Aligned(d) } else { Span::Fit(d) });
             p1
         }
         (0, _) if v == 0 => p1,
@@ -636,6 +663,7 @@ fn text(g: &[Pair<'_>], attrib: bool) -> Option<TextItem> {
         style: g.name(7).unwrap_or("STANDARD").to_uppercase(),
         family: None,
         leading: None,
+        span,
     })
 }
 
@@ -662,5 +690,15 @@ fn mtext(g: &[Pair<'_>]) -> Option<TextItem> {
     let direction = g.point_opt(11).map(|p| p.to_vec2()).filter(|d| d.hypot() > 1e-12);
     let angle = direction.map_or_else(|| g.num_or(50, 0.0), |d| d.atan2());
     let xf = Affine::translate(g.point(10).to_vec2()) * Affine::rotate(angle) * Affine::translate((0.0, first));
-    Some(TextItem { text: s, height, xf, width: 1.0, justify, style: g.name(7).unwrap_or("STANDARD").to_uppercase(), family, leading: Some(leading) })
+    Some(TextItem {
+        text: s,
+        height,
+        xf,
+        width: 1.0,
+        justify,
+        style: g.name(7).unwrap_or("STANDARD").to_uppercase(),
+        family,
+        leading: Some(leading),
+        span: None,
+    })
 }

crates/cad/src/import/tests.rs

@@ -397,6 +397,167 @@ fn text_and_multiline_text() {
     assert!((leading - 3.5 * 5.0 / 3.0).abs() < 1e-9, "{leading}");
 }
 
+/// Where the first line's baseline starts and ends, in document coordinates.
+fn baseline_ends(t: &TextObject) -> (Point, Point) {
+    let layout = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), t);
+    let l = &layout.lines[0];
+    (t.xf * Point::new(l.x0, l.baseline), t.xf * Point::new(l.x1, l.baseline))
+}
+
+#[test]
+fn fit_and_aligned_text_span_their_two_points() {
+    // Millimetres: red lines at x = 10 and 90, fit and aligned text between them, and the same
+    // text left-justified for its natural size.
+    let e = [
+        (0, "LINE"),
+        (62, "1"),
+        (10, "10"),
+        (20, "0"),
+        (11, "10"),
+        (21, "60"),
+        (0, "LINE"),
+        (62, "1"),
+        (10, "90"),
+        (20, "0"),
+        (11, "90"),
+        (21, "60"),
+        (0, "TEXT"),
+        (10, "10"),
+        (20, "40"),
+        (40, "5"),
+        (1, "FIT BETWEEN"),
+        (72, "5"),
+        (11, "90"),
+        (21, "40"),
+        (0, "TEXT"),
+        (10, "10"),
+        (20, "10"),
+        (40, "5"),
+        (41, "0.8"),
+        (1, "ALIGNED"),
+        (72, "3"),
+        (11, "90"),
+        (21, "10"),
+        (0, "TEXT"),
+        (10, "10"),
+        (20, "25"),
+        (40, "5"),
+        (1, "FIT BETWEEN"),
+        (0, "TEXT"),
+        (10, "10"),
+        (20, "50"),
+        (40, "5"),
+        (41, "0.8"),
+        (1, "ALIGNED"),
+    ];
+    let o = ImportOptions { center: false, ..ImportOptions::default() };
+    let doc = open(&drawing(&[(9, "$INSUNITS"), (70, "4")], &[], &[], &e), &o).document;
+    let [left, right, fit, aligned, fit_natural, aligned_natural] = &leaves(&doc)[..] else { panic!() };
+    let (x10, x90) = (bounds(left).center().x, bounds(right).center().x);
+    for n in [fit, aligned] {
+        let (a, b) = baseline_ends(text_of(n));
+        assert!((a.x - x10).abs() < 1e-3 && (b.x - x90).abs() < 1e-3, "{a:?} to {b:?}, not {x10} to {x90}");
+        assert!((a.y - b.y).abs() < 1e-9, "level");
+    }
+    // Fit keeps its height and stretches across.
+    let (st, natural) = (text_of(fit).first_style(), text_of(fit_natural).first_style());
+    assert_eq!(st.size, natural.size);
+    assert!(st.h_scale > 100.0, "{}", st.h_scale);
+    // Aligned grows as a whole, its width factor kept.
+    let (a, b) = baseline_ends(text_of(aligned_natural));
+    let k = (x90 - x10) / (b.x - a.x);
+    let (st, natural) = (text_of(aligned).first_style(), text_of(aligned_natural).first_style());
+    assert!((st.size - natural.size * k).abs() < 1e-6 && k > 2.0, "{} vs {} × {k}", st.size, natural.size);
+    assert!((st.h_scale - 80.0).abs() < 1e-9 && (natural.h_scale - 80.0).abs() < 1e-9);
+}
+
+#[test]
+fn fit_and_aligned_text_without_a_second_point_keep_their_size() {
+    for h in ["3", "5"] {
+        let e = [
+            (0, "TEXT"),
+            (10, "10"),
+            (20, "10"),
+            (40, "7"),
+            (1, "Gap"),
+            (72, h),
+            (0, "TEXT"),
+            (10, "10"),
+            (20, "30"),
+            (40, "7"),
+            (1, "Gap"),
+            (72, h),
+            (11, "10"),
+            (21, "30"),
+        ];
+        let doc = open(&entities(&e), &points()).document;
+        let top = height(&doc);
+        for (n, y) in leaves(&doc).iter().zip([10.0, 30.0]) {
+            let t = text_of(n);
+            let st = t.first_style();
+            assert!((st.size - 10.0).abs() < 1e-9 && st.h_scale == 100.0, "{} at {}%", st.size, st.h_scale);
+            assert!((t.xf * Point::ZERO).distance(Point::new(10.0, top - y)) < 1e-9);
+        }
+    }
+}
+
+#[test]
+fn fit_and_aligned_text_scale_within_limits() {
+    // A span a billion units long and one a millionth of a unit long.
+    let e = [
+        (0, "TEXT"),
+        (10, "0"),
+        (20, "0"),
+        (40, "7"),
+        (1, "X"),
+        (72, "5"),
+        (11, "1e9"),
+        (21, "0"),
+        (0, "TEXT"),
+        (10, "0"),
+        (20, "10"),
+        (40, "7"),
+        (1, "X"),
+        (72, "3"),
+        (11, "1e-6"),
+        (21, "10"),
+    ];
+    let doc = open(&entities(&e), &points()).document;
+    let [fit, aligned] = &leaves(&doc)[..] else { panic!() };
+    let st = text_of(fit).first_style();
+    assert!((st.size - 10.0).abs() < 1e-9 && (st.h_scale - 10_000.0).abs() < 1e-6, "{} at {}%", st.size, st.h_scale);
+    let st = text_of(aligned).first_style();
+    assert!((st.size - 0.1).abs() < 1e-9 && st.h_scale == 100.0, "{} at {}%", st.size, st.h_scale);
+}
+
+#[test]
+fn fit_attributes_span_their_two_points() {
+    let inserts = [
+        (0, "INSERT"),
+        (66, "1"),
+        (2, "Door"),
+        (10, "0"),
+        (20, "0"),
+        (0, "ATTRIB"),
+        (10, "10"),
+        (20, "20"),
+        (40, "7"),
+        (1, "D-01"),
+        (2, "TAG"),
+        (70, "0"),
+        (72, "5"),
+        (74, "0"),
+        (11, "90"),
+        (21, "20"),
+        (0, "SEQEND"),
+    ];
+    let doc = open(&with_door(DOOR_LINE, &inserts), &points()).document;
+    let tag = leaves(&doc).into_iter().find(|n| matches!(n.kind, NodeKind::Text(_))).unwrap();
+    let (a, b) = baseline_ends(text_of(&tag));
+    assert!((a.x - 10.0).abs() < 1e-3 && (b.x - 90.0).abs() < 1e-3, "{a:?} to {b:?}");
+    assert_eq!(text_of(&tag).first_style().size, 10.0);
+}
+
 /// A block "Door" (base point 5, 5) holding `block_art`, and `inserts`.
 fn with_door(block_art: &[(i32, &'static str)], inserts: &[(i32, &'static str)]) -> Vec<u8> {
     let mut blocks = vec![(0, "BLOCK"), (8, "0"), (2, "Door"), (70, "0"), (10, "5"), (20, "5"), (3, "Door")];

crates/cad/src/scene.rs

@@ -315,7 +315,7 @@ impl<'a> Scene<'a> {
                 }
             }
             // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(c, false);

crates/color/src/cms/mod.rs

@@ -662,6 +662,60 @@ impl ProofLut {
     }
 }
 
+/// A 17⁴ CMYK → four values lookup table with quadrilinear interpolation: ink amounts to a
+/// colour (XYZ, RGB, or CMYK in another space).
+pub struct CmykLut {
+    data: Vec<[f32; 4]>,
+}
+
+impl CmykLut {
+    pub fn build(f: impl Fn([f32; 4]) -> [f32; 4]) -> Self {
+        let s = (LUT_N - 1) as f32;
+        let mut data = Vec::with_capacity(LUT_N.pow(4));
+        for c in 0..LUT_N {
+            for m in 0..LUT_N {
+                for y in 0..LUT_N {
+                    for k in 0..LUT_N {
+                        data.push(f([c, m, y, k].map(|i| i as f32 / s)));
+                    }
+                }
+            }
+        }
+        Self { data }
+    }
+
+    pub fn apply(&self, inks: [f32; 4]) -> [f32; 4] {
+        const STRIDE: [usize; 4] = [LUT_N * LUT_N * LUT_N, LUT_N * LUT_N, LUT_N, 1];
+        let p = inks.map(|v| v.clamp(0.0, 1.0) * (LUT_N - 1) as f32);
+        let i = p.map(|v| (v as usize).min(LUT_N - 2));
+        let base: usize = (0..4).map(|d| i[d] * STRIDE[d]).sum();
+        let mut out = [0.0f32; 4];
+        for corner in 0..16 {
+            let (mut w, mut at) = (1.0f32, base);
+            for d in 0..4 {
+                let t = p[d] - i[d] as f32;
+                if corner >> d & 1 == 1 {
+                    w *= t;
+                    at += STRIDE[d];
+                } else {
+                    w *= 1.0 - t;
+                }
+            }
+            if w > 0.0 {
+                for (o, v) in out.iter_mut().zip(self.data[at]) {
+                    *o += w * v;
+                }
+            }
+        }
+        out
+    }
+
+    /// [`Self::apply`] to 8-bit ink amounts, for 8-bit values.
+    pub fn apply8(&self, inks: [u8; 4]) -> [u8; 4] {
+        self.apply(inks.map(|v| v as f32 / 255.0)).map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8)
+    }
+}
+
 // ---------- the active (process-wide) settings ----------
 
 static ACTIVE: RwLock<Option<Arc<Cms>>> = RwLock::new(None);

crates/doc/Cargo.toml

@@ -13,9 +13,12 @@ vectorcraft-geom = { workspace = true }
 vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
+tiff = { workspace = true }
+zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+jpeg-encoder = { workspace = true }
 proptest = { workspace = true }

crates/doc/src/blend.rs

@@ -527,7 +527,8 @@ impl Lerp {
             (NodeKind::Mesh(ma), NodeKind::Mesh(mb)) if ma.rows == mb.rows && ma.cols == mb.cols && ma.points.len() == mb.points.len() => Shape::Mesh,
             (NodeKind::Text(_), NodeKind::Text(_))
             | (NodeKind::SymbolInstance { .. }, NodeKind::SymbolInstance { .. })
-            | (NodeKind::Image(_), NodeKind::Image(_)) => Shape::Placed,
+            | (NodeKind::Image(_), NodeKind::Image(_))
+            | (NodeKind::PlacedDocument(_), NodeKind::PlacedDocument(_)) => Shape::Placed,
             _ => match (node_path(a), node_path(b)) {
                 (Some((pa, ra, ma)), Some((pb, rb, mb))) => {
                     Shape::Path { pair: PathPair::new(&pa, &pb, starts), rules: (ra, rb), members: ma.zip(mb) }
@@ -586,6 +587,7 @@ impl Lerp {
                         *o = lerp_affine(*x, *y, t)
                     }
                     (NodeKind::Image(o), NodeKind::Image(x), NodeKind::Image(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
+                    (NodeKind::PlacedDocument(o), NodeKind::PlacedDocument(x), NodeKind::PlacedDocument(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
                     _ => {}
                 }
                 n.mask = None;
@@ -687,6 +689,7 @@ fn lerp_text(o: &mut TextObject, x: &TextObject, y: &TextObject, t: f64) {
     }
     if resized {
         o.cached_bounds = None;
+        o.cached_baselines.clear();
     }
 }
 

crates/doc/src/clipnest.rs

@@ -1,8 +1,10 @@
-//! Clipped art read from page descriptions (metafiles, PostScript) into clipping groups.
+//! Clipped and grouped art read from page descriptions (metafiles, PostScript) into clipping
+//! groups and groups.
 //!
-//! Importers record each object they draw with the chain of clips in force at the time, outermost
-//! first ([`Drawn`]); [`nest`] then puts runs of objects under the same clip into one clipping
-//! group, nesting groups for nested clips, keeping the drawing order.
+//! Importers record each object they draw with the chain of clips (and groups) in force at the
+//! time, outermost first ([`Drawn`]); [`nest`] then puts runs of objects under the same clip into
+//! one clipping group (under the same group into one group), nesting groups for nested clips,
+//! keeping the drawing order.
 
 use std::sync::Arc;
 
@@ -11,20 +13,30 @@ use vectorcraft_geom::{BezPath, FillRule, PathData};
 use crate::appearance::Appearance;
 use crate::{Document, Node, NodeKind};
 
-/// A clip: a region in document space and its rule. Each has an id unique within an import, so
-/// what one clip clips can be grouped.
+/// A clip: a region in document space and its rule, or a plain group (one that holds its art
+/// without clipping it, such as an Illustrator file's `u` … `U`). Each has an id unique within an
+/// import, so what one clip clips (or one group holds) can be grouped.
 #[derive(Debug)]
 pub struct Clip {
     pub id: u32,
-    pub path: BezPath,
-    pub rule: FillRule,
+    /// The region and its rule; `None` for a plain group.
+    pub region: Option<(BezPath, FillRule)>,
+}
+
+/// Deepest nesting of clips, and of groups, an importer records ([`nest`] goes one level deeper
+/// for each): deeper ones are left out.
+pub const MAX_NEST: usize = 128;
+
+/// The warning for clips left out for nesting deeper than [`MAX_NEST`].
+pub fn deep_clips() -> String {
+    format!("clips nested more than {MAX_NEST} deep were left out: what they clip is clipped by the clips around them")
 }
 
 /// Objects in drawing order, each with its clips (outermost first).
 pub type Drawn = Vec<(Vec<Arc<Clip>>, Node)>;
 
-/// The nodes of `items`, those under clips grouped into clipping groups (ids from `doc`), in
-/// order.
+/// The nodes of `items`, those under clips grouped into clipping groups and those in groups into
+/// groups (ids from `doc`), in order.
 pub fn nest(doc: &mut Document, items: Drawn) -> Vec<Arc<Node>> {
     nest_at(doc, items, 0)
 }
@@ -53,14 +65,18 @@ fn nest_at(doc: &mut Document, items: Drawn, depth: usize) -> Vec<Arc<Node>> {
     out
 }
 
-/// A clipping group of `items`, clipped by `c` (their clip at `depth`).
+/// A clipping group of `items`, clipped by `c` (their clip at `depth`), or their group when `c` is
+/// a plain group.
 fn clip_group(doc: &mut Document, c: &Clip, items: Drawn, depth: usize) -> Arc<Node> {
-    let mut path = Node::path(doc.alloc_id(), PathData::from_bezpath(&c.path), Appearance::default());
-    if let NodeKind::Path { clipping, rule, .. } = &mut path.kind {
-        *clipping = true;
-        *rule = c.rule;
+    let mut children = vec![];
+    if let Some((bp, r)) = &c.region {
+        let mut path = Node::path(doc.alloc_id(), PathData::from_bezpath(bp), Appearance::default());
+        if let NodeKind::Path { clipping, rule, .. } = &mut path.kind {
+            *clipping = true;
+            *rule = *r;
+        }
+        children.push(Arc::new(path));
     }
-    let mut children = vec![Arc::new(path)];
     children.extend(nest_at(doc, items, depth + 1));
-    Arc::new(Node::new(doc.alloc_id(), NodeKind::Group { children, clip: true }))
+    Arc::new(Node::new(doc.alloc_id(), NodeKind::Group { children, clip: c.region.is_some() }))
 }

crates/doc/src/cmyk.rs

@@ -0,0 +1,188 @@
+//! CMYK images: the ink amounts of image blobs that hold CMYK samples.
+//!
+//! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
+//! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
+//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
+//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+
+use std::io::Cursor;
+
+use zune_jpeg::zune_core::bytestream::ZCursor;
+use zune_jpeg::zune_core::colorspace::ColorSpace;
+use zune_jpeg::zune_core::options::DecoderOptions;
+
+use crate::ImageBlob;
+
+/// Most pixels a CMYK image is decoded with (256 MB of samples): larger ones decode as RGB.
+pub const MAX_CMYK_PIXELS: u64 = 1 << 26;
+
+/// The ink amounts of a CMYK image: C, M, Y and K bytes per pixel, 0 is no ink.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Inks {
+    pub width: u32,
+    pub height: u32,
+    pub data: Vec<u8>,
+}
+
+impl Inks {
+    /// `data` as a `width` × `height` image; `None` when it doesn't hold that many pixels, the
+    /// image is empty or it has more than [`MAX_CMYK_PIXELS`].
+    pub fn new(width: u32, height: u32, data: Vec<u8>) -> Option<Self> {
+        let n = pixels(width, height)?;
+        (data.len() as u64 == n * 4).then_some(Self { width, height, data })
+    }
+}
+
+/// `width` × `height` when it is a CMYK image's size: not empty, at most [`MAX_CMYK_PIXELS`].
+fn pixels(width: u32, height: u32) -> Option<u64> {
+    let n = width as u64 * height as u64;
+    (n > 0 && n <= MAX_CMYK_PIXELS).then_some(n)
+}
+
+/// The number of colour components of JPEG `bytes` (its frame header); `None` when they aren't a
+/// JPEG.
+pub fn jpeg_components(bytes: &[u8]) -> Option<usize> {
+    if !bytes.starts_with(&[0xFF, 0xD8]) {
+        return None;
+    }
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    Some(d.info()?.components as usize)
+}
+
+fn is_tiff(bytes: &[u8]) -> bool {
+    bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
+}
+
+/// The colour type of TIFF `bytes` and its decoder.
+fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
+    if !is_tiff(bytes) {
+        return None;
+    }
+    let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
+    Some((d.colortype().ok()?, d))
+}
+
+impl ImageBlob {
+    /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
+    pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
+        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        let mut out = Cursor::new(Vec::new());
+        TiffEncoder::new(&mut out)
+            .ok()?
+            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
+            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
+            .ok()?;
+        Some(Self::new("image/tiff", out.into_inner()))
+    }
+
+    /// Does the image hold CMYK samples (a four-component JPEG or a CMYK TIFF)? Reads only its
+    /// header.
+    pub fn is_cmyk(&self) -> bool {
+        jpeg_components(&self.bytes) == Some(4) || tiff(&self.bytes).is_some_and(|(t, _)| matches!(t, tiff::ColorType::CMYK(8 | 16)))
+    }
+
+    /// The ink amounts of a CMYK image; `None` for other images, and ones that can't be decoded
+    /// or are larger than [`MAX_CMYK_PIXELS`].
+    pub fn cmyk(&self) -> Option<Inks> {
+        let bytes = self.bytes.as_slice();
+        if bytes.starts_with(&[0xFF, 0xD8]) { jpeg_inks(bytes) } else { tiff_inks(bytes) }
+    }
+}
+
+/// The ink amounts of a four-component JPEG (its samples inverted back; YCCK converted to CMYK
+/// first, as JPEG readers do).
+fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    let space = d.input_colorspace()?;
+    if d.info()?.components != 4 || !matches!(space, ColorSpace::CMYK | ColorSpace::YCCK) {
+        return None;
+    }
+    let (w, h) = d.dimensions()?;
+    let (w, h) = (u32::try_from(w).ok()?, u32::try_from(h).ok()?);
+    pixels(w, h)?;
+    d.set_options(DecoderOptions::default().jpeg_set_out_colorspace(space));
+    let mut data = d.decode().ok()?;
+    for p in data.as_chunks_mut::<4>().0 {
+        if space == ColorSpace::YCCK {
+            let [y, cb, cr] = [p[0], p[1], p[2]].map(f32::from);
+            // libjpeg's YCCK → CMYK: the complement of the YCbCr colour's RGB.
+            p[0] = (434.456 - y - 1.402 * cr).clamp(0.0, 255.0) as u8;
+            p[1] = (119.541 - y + 0.344 * cb + 0.714 * cr).clamp(0.0, 255.0) as u8;
+            p[2] = (481.816 - y - 1.772 * cb).clamp(0.0, 255.0) as u8;
+        }
+        for v in p.iter_mut() {
+            *v = 255 - *v;
+        }
+    }
+    Inks::new(w, h, data)
+}
+
+/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
+    let (kind, mut d) = tiff(bytes)?;
+    let (w, h) = d.dimensions().ok()?;
+    // Planar samples (one plane per ink) would read as interleaved.
+    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+        return None;
+    }
+    let data = match d.read_image().ok()? {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    Inks::new(w, h, data)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn inks() -> Inks {
+        Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
+    }
+
+    #[test]
+    fn a_cmyk_tiff_keeps_its_ink_amounts_and_shows_as_rgb() {
+        let b = ImageBlob::cmyk_tiff(&inks()).unwrap();
+        assert_eq!(b.mime, "image/tiff");
+        assert!(b.is_cmyk());
+        assert_eq!(b.cmyk(), Some(inks()), "lossless");
+        // Every image reader sees an RGB image: cyan is (0, 255, 255).
+        let rgb = image::load_from_memory(&b.bytes).unwrap().to_rgb8();
+        assert_eq!(rgb.get_pixel(1, 0).0, [0, 255, 255]);
+    }
+
+    #[test]
+    fn a_cmyk_jpeg_reads_back_as_ink_amounts() {
+        // A flat CMYK JPEG: Adobe's inverted samples with its marker.
+        let flat = [10u8, 40, 100, 20];
+        let px: Vec<u8> = (0..16 * 16).flat_map(|_| flat).collect();
+        let mut jpg = Vec::new();
+        jpeg_encoder::Encoder::new(&mut jpg, 100).encode(&px, 16, 16, jpeg_encoder::ColorType::Cmyk).unwrap();
+        let b = ImageBlob::new("image/jpeg", jpg);
+        assert_eq!(jpeg_components(&b.bytes), Some(4));
+        assert!(b.is_cmyk());
+        let back = b.cmyk().unwrap();
+        assert_eq!((back.width, back.height), (16, 16));
+        for p in back.data.as_chunks::<4>().0 {
+            assert!(p.iter().zip(flat).all(|(a, b)| a.abs_diff(b) <= 2), "{p:?}");
+        }
+    }
+
+    #[test]
+    fn other_images_are_not_cmyk() {
+        let mut png = Vec::new();
+        image::RgbaImage::new(2, 2).write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        let mut jpg = Vec::new();
+        image::RgbImage::new(8, 8).write_to(&mut Cursor::new(&mut jpg), image::ImageFormat::Jpeg).unwrap();
+        for b in [ImageBlob::png(png), ImageBlob::new("image/jpeg", jpg), ImageBlob::new("image/tiff", b"II*\0junk".to_vec())] {
+            assert!(!b.is_cmyk() && b.cmyk().is_none(), "{}", b.mime);
+        }
+        assert_eq!(Inks::new(2, 2, vec![0; 15]), None, "too few samples");
+        assert_eq!(Inks::new(0, 2, vec![]), None, "empty");
+        assert_eq!(Inks::new(1 << 14, 1 << 13, vec![]), None, "too large");
+    }
+}

crates/doc/src/corners.rs

@@ -0,0 +1,271 @@
+//! Live Corners on any path: the corners of its uncut outline (a live rectangle's or polygon's, a
+//! live path's, or a plain path's own), each one's radius and kind, and the anchors of the path as
+//! drawn that belong to each. [`set_corners`] edits them.
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+
+use vectorcraft_geom::corners::{Corner, cut_corners, path_corners};
+use vectorcraft_geom::shapes::{self, CornerKind};
+use vectorcraft_geom::{Affine, PathData, Rect};
+
+use crate::node::{LiveShape, Node, NodeKind};
+use crate::selection::AnchorRef;
+
+/// The Live Corners of a path.
+#[derive(Clone, Debug)]
+pub struct LiveCorners<'a> {
+    /// The path with its corners uncut, in the corners' own space: a live rectangle's (its size
+    /// and radii in document units, see [`LiveShape::folded`]), else the document's.
+    pub base: Cow<'a, PathData>,
+    /// Maps `base` into the document.
+    pub xf: Affine,
+    /// The corners that can be cut, in anchor order ([`path_corners`] of `base`).
+    pub corners: Vec<Corner>,
+    radii: Vec<f64>,
+    kinds: Vec<CornerKind>,
+    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
+    sources: Vec<Vec<usize>>,
+}
+
+impl<'a> LiveCorners<'a> {
+    /// The Live Corners of `path` and its live shape; `None` for shapes without corners (ellipses,
+    /// lines).
+    pub fn new(path: &'a PathData, live: Option<&'a LiveShape>) -> Option<Self> {
+        let (base, xf, radii, kinds) = match live {
+            None => (Cow::Borrowed(path), Affine::IDENTITY, vec![], vec![]),
+            Some(l @ LiveShape::Rectangle { .. }) => {
+                let LiveShape::Rectangle { w, h, radii, kinds, xf } = l.folded() else { return None };
+                (Cow::Owned(shapes::rectangle(Rect::new(0.0, 0.0, w, h))), xf, radii.to_vec(), kinds.to_vec())
+            }
+            Some(l @ LiveShape::Polygon { radii, kinds, .. }) => (Cow::Owned(l.polygon_outline()), Affine::IDENTITY, radii.clone(), kinds.clone()),
+            Some(LiveShape::Path { base, radii, kinds }) => (Cow::Borrowed(base), Affine::IDENTITY, radii.clone(), kinds.clone()),
+            Some(LiveShape::Ellipse { .. } | LiveShape::Line { .. }) => return None,
+        };
+        let sources = if radii.iter().any(|r| *r > 0.0) {
+            cut_corners(&base, &radii, &kinds).1
+        } else {
+            let mut first = 0;
+            base.subpaths
+                .iter()
+                .map(|sp| {
+                    first += sp.anchors.len();
+                    (first - sp.anchors.len()..first).collect()
+                })
+                .collect()
+        };
+        Some(Self { corners: path_corners(&base), base, xf, radii, kinds, sources })
+    }
+
+    /// The Live Corners of a path object.
+    pub fn of(node: &'a Node) -> Option<Self> {
+        let NodeKind::Path { path, live, .. } = &node.kind else { return None };
+        Self::new(path, live.as_ref())
+    }
+
+    /// The corner at anchor `index` of `base`.
+    pub fn corner(&self, index: usize) -> Option<&Corner> {
+        self.corners.binary_search_by_key(&index, |c| c.index).ok().and_then(|i| self.corners.get(i))
+    }
+
+    /// The radius corner `index` is set to, in document units (drawn no larger than fits).
+    pub fn radius(&self, index: usize) -> f64 {
+        self.radii.get(index).copied().unwrap_or(0.0)
+    }
+
+    /// The kind corner `index` is cut with.
+    pub fn kind(&self, index: usize) -> CornerKind {
+        self.kinds.get(index).copied().unwrap_or_default()
+    }
+
+    /// Every corner.
+    pub fn all(&self) -> BTreeSet<usize> {
+        self.corners.iter().map(|c| c.index).collect()
+    }
+
+    /// The corners holding one of `anchors` (of the path as drawn).
+    pub fn corners_of(&self, anchors: &BTreeSet<AnchorRef>) -> BTreeSet<usize> {
+        anchors.iter().filter_map(|(si, ai)| self.sources.get(*si)?.get(*ai).copied()).filter(|k| self.corner(*k).is_some()).collect()
+    }
+
+    /// The corners Live Corners edit for a selection: those holding a selected anchor when the
+    /// path is partly selected (Direct Selection), else every corner.
+    pub fn picked(&self, partial: Option<&BTreeSet<AnchorRef>>) -> BTreeSet<usize> {
+        let picked = partial.map(|a| self.corners_of(a)).unwrap_or_default();
+        if picked.is_empty() { self.all() } else { picked }
+    }
+
+    /// The anchors of the path as drawn that belong to `corners` (to keep them selected as the
+    /// path changes).
+    pub fn anchors_of(&self, corners: &BTreeSet<usize>) -> BTreeSet<AnchorRef> {
+        let mut out = BTreeSet::new();
+        for (si, from) in self.sources.iter().enumerate() {
+            out.extend(from.iter().enumerate().filter(|(_, k)| corners.contains(k)).map(|(ai, _)| (si, ai)));
+        }
+        out
+    }
+
+    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
+    pub fn sources(&self) -> &[Vec<usize>] {
+        &self.sources
+    }
+
+    /// The radius (document units) and kind `corners` share (each `None` when they differ, or
+    /// for no corners).
+    pub fn style(&self, corners: &BTreeSet<usize>) -> (Option<f64>, Option<CornerKind>) {
+        fn shared<T: Copy>(mut it: impl Iterator<Item = T>, same: impl Fn(T, T) -> bool) -> Option<T> {
+            let first = it.next()?;
+            it.all(|x| same(x, first)).then_some(first)
+        }
+        let radius = shared(corners.iter().map(|k| self.radius(*k)), |a, b| (a - b).abs() < 1e-9);
+        (radius, shared(corners.iter().map(|k| self.kind(*k)), |a, b| a == b))
+    }
+}
+
+/// Set `radius` (document units; negative: 0) and/or `kind` on the `corners` (anchor indices of
+/// the uncut outline, see [`LiveCorners`]) of a path and its live shape, then cut the path again.
+/// A path that isn't a live shape keeps its uncut outline as a [`LiveShape::Path`], which is a
+/// plain path again once no corner is cut. Ellipses and lines have no corners: they stay as they
+/// are.
+pub fn set_corners(path: &mut PathData, live: &mut Option<LiveShape>, corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
+    fn edit(radii: &mut [f64], kinds: &mut [CornerKind], corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
+        for k in corners {
+            if let (Some(r), Some(slot)) = (radius, radii.get_mut(*k)) {
+                *slot = r.max(0.0);
+            }
+            if let (Some(kind), Some(slot)) = (kind, kinds.get_mut(*k)) {
+                *slot = kind;
+            }
+        }
+    }
+    /// One radius and kind per corner of an outline of `n` anchors while editing; none saved
+    /// when all are sharp or round.
+    fn edit_vec(
+        n: usize,
+        radii: &mut Vec<f64>,
+        kinds: &mut Vec<CornerKind>,
+        corners: &BTreeSet<usize>,
+        radius: Option<f64>,
+        kind: Option<CornerKind>,
+    ) {
+        radii.resize(n, 0.0);
+        kinds.resize(n, CornerKind::Round);
+        edit(radii, kinds, corners, radius, kind);
+        if radii.iter().all(|r| *r <= 0.0) {
+            radii.clear();
+        }
+        if kinds.iter().all(|k| *k == CornerKind::Round) {
+            kinds.clear();
+        }
+    }
+    let l = live.get_or_insert_with(|| LiveShape::Path { base: path.clone(), radii: vec![], kinds: vec![] });
+    // Radii are document lengths and corners circular, also on a rectangle from a file that kept
+    // an uneven scale in its transform (#442).
+    l.fold_scale();
+    match l {
+        LiveShape::Rectangle { radii, kinds, .. } => edit(radii, kinds, corners, radius, kind),
+        LiveShape::Polygon { sides, radii, kinds, .. } => edit_vec(*sides as usize, radii, kinds, corners, radius, kind),
+        LiveShape::Path { base, radii, kinds } => edit_vec(base.anchor_count(), radii, kinds, corners, radius, kind),
+        LiveShape::Ellipse { .. } | LiveShape::Line { .. } => return,
+    }
+    match live {
+        Some(LiveShape::Path { base, radii, kinds }) if radii.is_empty() && kinds.is_empty() => {
+            *path = std::mem::take(base);
+            *live = None;
+        }
+        Some(l) => *path = l.to_path(),
+        None => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_geom::{Point, SubPath};
+
+    fn set(v: &[usize]) -> BTreeSet<usize> {
+        v.iter().copied().collect()
+    }
+
+    fn anchors(v: &[usize]) -> BTreeSet<AnchorRef> {
+        v.iter().map(|ai| (0, *ai)).collect()
+    }
+
+    #[test]
+    fn rectangle_corners_map_to_their_anchors() {
+        let l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
+        let path = l.to_path();
+        let c = LiveCorners::new(&path, Some(&l)).unwrap();
+        // Anchors: top-left, the top-right corner's two, bottom-right, bottom-left.
+        assert_eq!(c.sources(), [vec![0, 1, 1, 2, 3]]);
+        assert_eq!(path.anchor_count(), 5);
+        assert_eq!(c.corners_of(&anchors(&[2, 4])), set(&[1, 3]));
+        assert!(c.corners_of(&anchors(&[9])).is_empty(), "out of range");
+        assert_eq!(c.anchors_of(&set(&[1, 3])), anchors(&[1, 2, 4]));
+        // Partly selected: the corners of the selected anchors; wholly (or no anchor): all four.
+        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[0]));
+        assert_eq!(c.picked(None), set(&[0, 1, 2, 3]));
+        assert_eq!(c.picked(Some(&anchors(&[]))), set(&[0, 1, 2, 3]));
+        assert_eq!(c.style(&set(&[1])), (Some(10.0), Some(CornerKind::Round)));
+        assert_eq!(c.style(&set(&[0, 1])), (None, Some(CornerKind::Round)));
+        assert_eq!(c.style(&set(&[0, 2, 3])), (Some(0.0), Some(CornerKind::Round)));
+        let e = LiveShape::Ellipse { w: 1.0, h: 1.0, pie: (0.0, 360.0), xf: Affine::IDENTITY };
+        assert!(LiveCorners::new(&e.to_path(), Some(&e)).is_none());
+    }
+
+    /// #511: a plain path (a star) rounds its corners and keeps them editable; with none cut it
+    /// is plain again.
+    #[test]
+    fn a_plain_path_keeps_its_cut_corners_live() {
+        let star = shapes::star(Point::new(100.0, 100.0), 50.0, 25.0, 5, 0.0);
+        let (mut path, mut live) = (star.clone(), None);
+        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(5.0), None);
+        let Some(LiveShape::Path { base, radii, kinds }) = &live else { panic!("live corners: {live:?}") };
+        assert_eq!((base, radii.len(), kinds.len()), (&star, 10, 0));
+        assert_eq!(path.anchor_count(), 12, "two corners cut");
+        let c = LiveCorners::new(&path, live.as_ref()).unwrap();
+        assert_eq!(c.style(&set(&[0, 2])), (Some(5.0), Some(CornerKind::Round)));
+        assert_eq!(c.corners_of(&anchors(&[0, 11])), set(&[0]), "the first corner's cut ends the path");
+        // Kinds alone keep it live; squaring every corner makes it the plain star again.
+        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(0.0), Some(CornerKind::Chamfer));
+        assert!(matches!(&live, Some(LiveShape::Path { radii, .. }) if radii.is_empty()));
+        set_corners(&mut path, &mut live, &set(&[0, 2]), None, Some(CornerKind::Round));
+        assert_eq!((path, live), (star, None));
+    }
+
+    /// A polygon's corners are cut in the document and survive a change of sides when shared.
+    #[test]
+    fn polygon_corners_follow_their_sides() {
+        let mut l = LiveShape::Polygon { radius: 50.0, sides: 6, xf: Affine::translate((100.0, 100.0)), radii: vec![], kinds: vec![] };
+        let (mut path, mut live) = (l.to_path(), Some(l.clone()));
+        set_corners(&mut path, &mut live, &set(&[0, 1, 2, 3, 4, 5]), Some(8.0), None);
+        assert_eq!(path.anchor_count(), 12);
+        l = live.clone().unwrap();
+        l.set_sides(8);
+        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == vec![8.0; 8]));
+        assert_eq!(l.to_path().anchor_count(), 16);
+        // Mixed radii: the new corners are sharp.
+        set_corners(&mut path, &mut live, &set(&[1]), Some(3.0), None);
+        let mut l = live.unwrap();
+        l.set_sides(7);
+        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == [8.0, 3.0, 8.0, 8.0, 8.0, 8.0, 0.0]));
+        // An uneven scale keeps the cuts circular: the radius scales by the mean scale.
+        let mut p = l.clone();
+        assert!(p.transform(Affine::scale_non_uniform(4.0, 1.0)));
+        assert!(matches!(&p, LiveShape::Polygon { radii, .. } if (radii[0] - 16.0).abs() < 1e-9));
+        assert!(!p.transform(Affine::translate((5.0, 0.0))), "a move needs no new cuts");
+    }
+
+    #[test]
+    fn open_paths_and_curves_keep_their_ends_and_smooth_anchors() {
+        let pen = PathData::single(SubPath::polyline(&[Point::new(0.0, 0.0), Point::new(100.0, 0.0), Point::new(100.0, 80.0)], false));
+        let c = LiveCorners::new(&pen, None).unwrap();
+        assert_eq!(c.all(), set(&[1]));
+        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[1]), "an end is no corner: every corner");
+        let (mut path, mut live) = (pen.clone(), None);
+        set_corners(&mut path, &mut live, &c.all(), Some(10.0), None);
+        assert_eq!(path.anchor_count(), 4);
+        assert_eq!(path.subpaths[0].anchors[0].p, Point::new(0.0, 0.0));
+        assert_eq!(path.subpaths[0].anchors[3].p, Point::new(100.0, 80.0));
+    }
+}

crates/doc/src/hit.rs

@@ -23,6 +23,8 @@ pub struct Hit {
     /// The innermost envelope in the ancestry whose contents are being edited (Edit Contents):
     /// its content, not the envelope, is the object clicked.
     pub contents_of: Option<NodeId>,
+    /// How many entries at the start of `ancestry` are layers (the layer and its sublayers).
+    pub layers: usize,
 }
 
 impl Hit {
@@ -34,8 +36,8 @@ impl Hit {
         if let Some(i) = at(scope).max(at(self.contents_of)) {
             return self.ancestry.get(i + 1).copied().unwrap_or(self.leaf);
         }
-        // Skip layers and sublayers.
-        self.ancestry.get(1).copied().unwrap_or(self.leaf)
+        // Skip layers and sublayers: they are not objects.
+        self.ancestry.get(self.layers.max(1)).copied().unwrap_or(self.leaf)
     }
 }
 
@@ -48,22 +50,45 @@ pub struct HitOptions {
     pub outline: bool,
     /// "Object Selection by Path Only" preference.
     pub path_only: bool,
+    /// "Type Object Selection by Path Only" preference: type is picked on its type path only
+    /// (point type's baseline, area type's frame, type on a path's path), not anywhere in its
+    /// bounds.
+    pub type_path_only: bool,
 }
 
 impl Default for HitOptions {
     fn default() -> Self {
-        Self { tol: 3.0, outline: false, path_only: false }
+        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false }
     }
 }
 
 /// Topmost editable object under `p`.
 pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
+    hit_test_skipping(doc, p, opt, &|_| false)
+}
+
+/// The objects under `p` that [`Hit::top_object`] picks in `scope` (isolation mode), topmost
+/// first: what clicks there select, one below the other (Cmd/Ctrl-click selects behind).
+pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
+    let mut tops: Vec<NodeId> = vec![];
+    // Each round leaves out the objects found so far (and everything inside them).
+    while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id)).map(|h| h.top_object(scope)) {
+        if tops.contains(&top) {
+            break;
+        }
+        tops.push(top);
+    }
+    tops
+}
+
+/// [`hit_test`] passing over the nodes `skip` names (and their contents).
+fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool) -> Option<Hit> {
     let mut chain = Vec::new();
     for layer in doc.layers.iter().rev() {
         if !layer.visible || layer.locked {
             continue;
         }
-        if let NodeKind::Layer { template: true, .. } = layer.kind {
+        if layer.is_template() {
             continue;
         }
         // Pattern editing mode: only the tile art is editable.
@@ -71,8 +96,10 @@ pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
             continue;
         }
         chain.push(layer.id);
-        if let Some(mut h) = hit_children(layer, p, opt, &mut chain) {
+        let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
+        if let Some(mut h) = hit_children(layer, p, opt, skip, &mut chain) {
             h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
+            h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
             return Some(h);
         }
         chain.pop();
@@ -95,7 +122,7 @@ fn clip_contains(clip: &Node, p: Point) -> bool {
     clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
 }
 
-fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId>) -> Option<Hit> {
+fn hit_children(parent: &Node, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, chain: &mut Vec<NodeId>) -> Option<Hit> {
     let children = parent.children()?;
     // A clip group (or a layer with a clipping mask) only hits inside its clipping path.
     if parent.clips()
@@ -105,7 +132,8 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
         return None;
     }
     for c in children.iter().rev() {
-        if !c.visible || c.locked {
+        // Hidden, locked and template sublayers block clicks like top-level layers do.
+        if !c.visible || c.locked || c.is_template() || skip(c.id) {
             continue;
         }
         // (An envelope's content sits where it was, not where the envelope draws it.)
@@ -117,14 +145,16 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
         }
         chain.push(c.id);
         let hit = match &c.kind {
-            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, chain),
+            // A sublayer whose Preview is off is clicked in outline, like an outline view.
+            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain),
+            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain),
             // Edit Contents: the envelope's content hits, undistorted.
-            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, chain),
+            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain),
             // A blend's key objects first (Direct and Group Selection pick them); its steps hit
             // as the blend.
-            NodeKind::Blend { .. } => hit_children(c, p, opt, chain)
-                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None })),
-            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None }),
+            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain)
+                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
+            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
         };
         if hit.is_some() {
             return hit;
@@ -162,11 +192,19 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
             if let Some(k) = hit_stroke(n, &bp, *rule, p, opt) {
                 return Some(k);
             }
-            (!opt.outline && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
+            (!opt.outline && !opt.path_only && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
         }
-        NodeKind::Text(_) | NodeKind::Image(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
-            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
+        // The type path lies within the bounds: they rule out the rest before it is measured.
+        NodeKind::Text(t) if opt.type_path_only => {
+            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p))?;
+            on_type_path(n, t, p, opt.tol).then_some(HitKind::Outline)
         }
+        NodeKind::Text(_)
+        | NodeKind::Image(_)
+        | NodeKind::PlacedDocument(_)
+        | NodeKind::SymbolInstance { .. }
+        | NodeKind::Blend { .. }
+        | NodeKind::Envelope { .. } => n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
         NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt)),
         NodeKind::Mesh(m) => {
             let bp = m.outline().to_bezpath();
@@ -179,6 +217,28 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
     }
 }
 
+/// Is `p` within `tol` of the type path of `t` (in `n`), what "Type Object Selection by Path
+/// Only" picks type by: its baselines ([`crate::TextObject::baselines`]), area type's frame and
+/// type on a path's path, drawn through `n`'s perspective projection if it has one.
+fn on_type_path(n: &Node, t: &crate::TextObject, p: Point, tol: f64) -> bool {
+    use crate::TextKind;
+    use vectorcraft_geom::kurbo::ParamCurveNearest;
+    let h = n.projection();
+    let project = |q: Point| h.as_ref().and_then(|h| h.apply(q)).unwrap_or(q);
+    // A homography keeps straight lines straight: a baseline's ends are enough.
+    let near = |(a, b): (Point, Point)| vectorcraft_geom::Line::new(project(t.xf * a), project(t.xf * b)).nearest(p, 1e-9).distance_sq <= tol * tol;
+    if t.baselines().any(near) {
+        return true;
+    }
+    let (TextKind::Area { frame: path } | TextKind::OnPath { path, .. }) = &t.kind else { return false };
+    let mut path = path.transformed(t.xf);
+    if h.is_some() {
+        let piece = path.bounds().map_or(1.0, |b| (b.width().max(b.height()) / 64.0).max(0.25));
+        path = crate::live::map_nonlinear(&path, piece, project);
+    }
+    stroke_contains(&path.to_bezpath(), 0.0, tol, p)
+}
+
 /// Hit anywhere in an evaluated subtree (groups recurse; leaves use [`hit_leaf`]).
 fn hit_any(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
     match &n.kind {
@@ -192,13 +252,28 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
     let mut out = Vec::new();
     let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
         Some(s) => s.children().map(|c| c.iter().collect()).unwrap_or_default(),
+        // The objects of the layers, looking through sublayers (hidden, locked and template ones
+        // are left out).
         None => doc
             .layers
             .iter()
-            .filter(|l| l.visible && !l.locked && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
-            .flat_map(|l| l.children().into_iter().flatten())
+            .filter(|l| l.visible && !l.locked && !l.is_template() && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
+            .flat_map(|l| layer_objects(l))
             .collect(),
     };
+    fn layer_objects(l: &Node) -> Vec<&std::sync::Arc<Node>> {
+        let mut out = vec![];
+        for c in l.children().into_iter().flatten() {
+            if c.is_layer() {
+                if c.visible && !c.locked && !c.is_template() {
+                    out.extend(layer_objects(c));
+                }
+            } else {
+                out.push(c);
+            }
+        }
+        out
+    }
     fn touches(n: &Node, r: Rect) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
@@ -296,6 +371,190 @@ mod tests {
         assert!(marquee(&d, Rect::new(100.0, 100.0, 105.0, 105.0), None, false).is_empty());
     }
 
+    /// Art in a sublayer is an object of its own: a click or a marquee takes it, not the
+    /// sublayer; hidden, locked and template sublayers block both.
+    #[test]
+    fn sublayers_are_not_objects() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let sub = d.alloc_id();
+        d.insert(Some(l), 0, Node::layer(sub, "Sub", crate::LayerColor::Preset(2))).unwrap();
+        let inner = d.alloc_id();
+        d.insert(Some(sub), 0, Node::layer(inner, "Inner", crate::LayerColor::Preset(3))).unwrap();
+        let a = d.alloc_id();
+        d.insert(Some(inner), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+        let g = d.alloc_id();
+        let b = d.alloc_id();
+        let pb = Node::path(b, shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default_art());
+        d.insert(Some(sub), 9, Node::group(g, vec![Arc::new(pb)])).unwrap();
+        let h = hit_test(&d, Point::new(10.0, 10.0), HitOptions::default()).unwrap();
+        assert_eq!((h.leaf, h.top_object(None), h.layers), (a, a, 3));
+        let h = hit_test(&d, Point::new(110.0, 10.0), HitOptions::default()).unwrap();
+        assert_eq!((h.top_object(None), h.top_object(Some(g))), (g, b));
+        let all = Rect::new(-5.0, -5.0, 200.0, 200.0);
+        assert_eq!(marquee(&d, all, None, false), vec![a, g]);
+        assert_eq!(d.layer_containing(a), Some(inner));
+        assert_eq!(d.layer_color(a), crate::LayerColor::Preset(3).rgb(), "the sublayer's own colour");
+        assert_eq!(d.selectable_art(), vec![a, g]);
+        for f in [
+            |n: &mut Node| n.visible = false,
+            |n: &mut Node| n.locked = true,
+            |n: &mut Node| {
+                if let NodeKind::Layer { template, .. } = &mut n.kind {
+                    *template = true;
+                }
+            },
+        ] {
+            let mut d2 = d.clone();
+            f(d2.node_mut(inner).unwrap());
+            assert!(hit_test(&d2, Point::new(10.0, 10.0), HitOptions::default()).is_none());
+            assert_eq!(marquee(&d2, all, None, false), vec![g]);
+            assert_eq!(d2.selectable_art(), vec![g]);
+        }
+        // A sublayer whose Preview is off is clicked in outline: its fill no longer hits.
+        if let NodeKind::Layer { preview, .. } = &mut d.node_mut(inner).unwrap().kind {
+            *preview = false;
+        }
+        assert!(hit_test(&d, Point::new(25.0, 25.0), HitOptions::default()).is_none());
+        assert!(hit_test(&d, Point::new(0.5, 25.0), HitOptions::default()).is_some());
+    }
+
+    /// Object Selection by Path Only: a filled path or compound path hits on its outline only.
+    #[test]
+    fn path_only_leaves_out_fills() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let (a, c) = (d.alloc_id(), d.alloc_id());
+        d.insert(Some(l), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+        let inner = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default());
+        let mut compound = Node::new(c, NodeKind::Compound { children: vec![Arc::new(inner)], rule: vectorcraft_geom::FillRule::NonZero });
+        compound.appearance = Appearance::default_art();
+        d.insert(Some(l), 9, compound).unwrap();
+        let path_only = HitOptions { path_only: true, ..Default::default() };
+        for (id, inside, edge) in [(a, Point::new(25.0, 25.0), Point::new(0.5, 25.0)), (c, Point::new(125.0, 25.0), Point::new(100.5, 25.0))] {
+            assert_eq!(hit_test(&d, inside, HitOptions::default()).map(|h| h.leaf), Some(id), "the fill hits");
+            assert!(hit_test(&d, inside, path_only).is_none(), "path only: the fill of {id:?} doesn't hit");
+            assert_eq!(hit_test(&d, edge, path_only).map(|h| h.leaf), Some(id), "path only: the outline does");
+        }
+    }
+
+    /// Type Object Selection by Path Only: point type is picked on its baseline, area type on its
+    /// frame and type on a path on its path, no longer anywhere in its bounds.
+    #[test]
+    fn type_path_only_picks_type_on_its_path() {
+        use crate::{CharStyle, TextKind, TextObject};
+        let mut d = Document::new(400.0, 400.0);
+        let l = d.layers[0].id;
+        let mut add = |t: TextObject| {
+            let id = d.alloc_id();
+            d.insert(Some(l), 9, Node::new(id, NodeKind::Text(Box::new(t)))).unwrap();
+            id
+        };
+        // Point type at (10, 100), 20 pt: its glyphs rise above the baseline, its layout is 60 wide.
+        let mut point = TextObject::point(Point::new(10.0, 100.0), "Hello", CharStyle { size: 20.0, ..CharStyle::default() });
+        point.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 4.0));
+        let point = add(point);
+        let mut area = TextObject::point(Point::new(200.0, 200.0), "Area", CharStyle::default());
+        area.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)) };
+        let area = add(area);
+        let mut on_path = TextObject::point(Point::new(10.0, 300.0), "Path", CharStyle::default());
+        on_path.kind = TextKind::OnPath { path: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 40.0)), start: 0.0, end: None };
+        let on_path = add(on_path);
+        let path_only = HitOptions { type_path_only: true, ..Default::default() };
+        let hit = |p: Point, opt: HitOptions| hit_test(&d, p, opt).map(|h| (h.leaf, h.kind));
+        // Off: anywhere in the bounds.
+        assert_eq!(hit(Point::new(40.0, 90.0), HitOptions::default()), Some((point, HitKind::Bounds)));
+        assert_eq!(hit(Point::new(250.0, 225.0), HitOptions::default()), Some((area, HitKind::Bounds)));
+        assert_eq!(hit(Point::new(60.0, 320.0), HitOptions::default()), Some((on_path, HitKind::Bounds)));
+        // On: the glyphs and the inside of the frame or path no longer pick the type.
+        assert_eq!(hit(Point::new(40.0, 90.0), path_only), None, "point type: among its glyphs");
+        assert_eq!(hit(Point::new(250.0, 225.0), path_only), None, "area type: inside its frame");
+        assert_eq!(hit(Point::new(60.0, 320.0), path_only), None, "type on a path: inside its path");
+        // The baseline (within the tolerance, across the layout's width), frame and path do.
+        assert_eq!(hit(Point::new(40.0, 101.5), path_only), Some((point, HitKind::Outline)), "point type: its baseline");
+        assert_eq!(hit(Point::new(75.0, 100.0), path_only), None, "point type: past the end of its layout");
+        assert_eq!(hit(Point::new(250.0, 200.5), path_only), Some((area, HitKind::Outline)), "area type: its frame");
+        assert_eq!(hit(Point::new(60.0, 339.5), path_only), Some((on_path, HitKind::Outline)), "type on a path: its path");
+    }
+
+    /// Type Object Selection by Path Only with the layout's baselines: every line's for point type,
+    /// area type's besides its frame, a vertical column's centre line, and type in perspective
+    /// where it is drawn.
+    #[test]
+    fn type_path_only_picks_every_baseline() {
+        use crate::{CharStyle, PerspectiveAttachment, TextKind, TextObject};
+        use vectorcraft_geom::{Affine, Homography};
+        let mut d = Document::new(400.0, 400.0);
+        let l = d.layers[0].id;
+        let mut add = |t: TextObject, perspective: Option<Affine>| {
+            let mut n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(t)));
+            n.perspective = perspective.map(|a| {
+                Box::new(PerspectiveAttachment { projection: Some(Homography::from_affine(a).to_array()), ..PerspectiveAttachment::new("left", 0.0) })
+            });
+            let id = n.id;
+            d.insert(Some(l), 9, n).unwrap();
+            id
+        };
+        let style = CharStyle { size: 20.0, ..CharStyle::default() };
+        // Two lines of point type at (10, 100), 24 pt apart.
+        let mut point = TextObject::point(
+            Point::new(10.0, 100.0),
+            "Hello
+world",
+            style.clone(),
+        );
+        point.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 28.0));
+        point.cached_baselines = vec![(Point::ZERO, Point::new(60.0, 0.0)), (Point::new(0.0, 24.0), Point::new(50.0, 24.0))];
+        let point = add(point, None);
+        // Area type: a line inside its frame.
+        let mut area = TextObject::point(Point::new(200.0, 50.0), "Area", style.clone());
+        area.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)) };
+        area.cached_baselines = vec![(Point::new(0.0, 16.0), Point::new(40.0, 16.0))];
+        let area = add(area, None);
+        // Vertical point type at (300, 200) with no baselines cached: down its first column.
+        let mut vertical = TextObject::point(Point::new(300.0, 200.0), "Tate", style.clone());
+        vertical.vertical = true;
+        vertical.cached_bounds = Some(Rect::new(-10.0, 0.0, 10.0, 80.0));
+        let vertical = add(vertical, None);
+        // Point type drawn 100 to the right of where it is laid out.
+        let mut moved = TextObject::point(Point::new(10.0, 350.0), "Moved", style);
+        moved.cached_bounds = Some(Rect::new(0.0, -16.0, 60.0, 4.0));
+        let moved = add(moved, Some(Affine::translate((100.0, 0.0))));
+        let path_only = HitOptions { type_path_only: true, ..Default::default() };
+        let hit = |p: Point| hit_test(&d, p, path_only).map(|h| h.leaf);
+        assert_eq!(hit(Point::new(40.0, 100.0)), Some(point), "the first line's baseline");
+        assert_eq!(hit(Point::new(40.0, 125.0)), Some(point), "the second line's");
+        assert_eq!(hit(Point::new(40.0, 112.0)), None, "between the lines");
+        assert_eq!(hit(Point::new(65.0, 124.0)), None, "past the end of the shorter second line");
+        assert_eq!(hit(Point::new(220.0, 66.0)), Some(area), "area type: a line's baseline");
+        assert_eq!(hit(Point::new(220.0, 80.0)), None, "area type: inside the frame, off the baselines");
+        assert_eq!(hit(Point::new(299.0, 260.0)), Some(vertical), "vertical type: down the column");
+        assert_eq!(hit(Point::new(306.0, 260.0)), None, "vertical type: beside it");
+        assert_eq!(hit(Point::new(140.0, 351.0)), Some(moved), "in perspective: where it is drawn");
+        assert_eq!(hit(Point::new(40.0, 351.0)), None, "in perspective: not where it is laid out");
+    }
+
+    /// `objects_at`: every object under the point, topmost first; a group counts once.
+    #[test]
+    fn objects_at_lists_the_stack() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let rect =
+            |d: &mut Document, x: f64| Node::path(d.alloc_id(), shapes::rectangle(Rect::new(x, 0.0, x + 50.0, 50.0)), Appearance::default_art());
+        let a = rect(&mut d, 0.0);
+        let (b, c) = (rect(&mut d, 10.0), rect(&mut d, 20.0));
+        let (a_id, b_id, c_id, g) = (a.id, b.id, c.id, d.alloc_id());
+        d.insert(Some(l), 0, a).unwrap();
+        d.insert(Some(l), 9, Node::group(g, vec![Arc::new(b), Arc::new(c)])).unwrap();
+        let far = rect(&mut d, 120.0);
+        d.insert(Some(l), 9, far).unwrap();
+        let at = |x: f64, scope| objects_at(&d, Point::new(x, 25.0), HitOptions::default(), scope);
+        assert_eq!(at(30.0, None), vec![g, a_id]);
+        assert_eq!(at(30.0, Some(g))[..2], [c_id, b_id], "isolated: the group's own objects");
+        assert_eq!(at(5.0, None), vec![a_id]);
+        assert!(at(90.0, None).is_empty());
+    }
+
     #[test]
     fn locked_and_hidden_skip() {
         let mut d = Document::new(200.0, 200.0);

crates/doc/src/lib.rs

@@ -9,6 +9,8 @@ pub mod appearance;
 pub mod assets;
 pub mod blend;
 pub mod clipnest;
+pub mod cmyk;
+pub mod corners;
 pub mod graph;
 pub mod hit;
 pub mod inks;
@@ -22,6 +24,7 @@ pub mod overprint;
 pub mod pattern;
 pub mod perspective;
 mod pixels;
+pub mod placed_document;
 pub mod profiles;
 pub mod puppet;
 pub mod range;
@@ -57,6 +60,7 @@ pub use appearance::{
     StrokeLayer, WidthProfile,
 };
 pub use assets::ExportAsset;
+pub use corners::LiveCorners;
 pub use graph::{GraphKind, GraphSpec};
 pub use hit::{Hit, HitKind};
 pub use links::{LinkInfo, PlacementOptions};
@@ -69,6 +73,7 @@ pub use node::{ImageObject, LAYER_COLORS, LayerColor, LiveShape, Node, NodeId, N
 pub use orient::OrientedBox;
 pub use pattern::{Overlap, PatternDef, PatternEdit, RepeatKind, RepeatSpec, TileType};
 pub use perspective::PerspectiveAttachment;
+pub use placed_document::PlacedDocument;
 pub use profiles::ColorProfiles;
 pub use puppet::{PuppetPin, PuppetPins};
 pub use rastersettings::{RasterColorModel, RasterEffectsSettings};
@@ -77,15 +82,15 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaOptions, CharPosition, CharStyle, FirstBaseline, Justify, ParaStyle, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject,
-    TextRun, TextStyleDef, TextWrap, WrapShape,
+    AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, FirstBaseline, Justify, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign,
+    PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, WrapShape,
 };
 pub use vectorcraft_color as color;
 pub use vectorcraft_geom as geom;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::{Swatch, SwatchGroup};
-use vectorcraft_geom::{Point, Rect};
+use vectorcraft_geom::{Point, Rect, Vec2};
 
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum DocError {
@@ -166,6 +171,18 @@ impl Unit {
             Unit::Feet => "Feet",
         }
     }
+    /// The rulers' label step at `zoom` (screen pixels per point), in this unit: the first of
+    /// 1, 2, 5 × 10ⁿ that puts labels at least 50 pixels apart. Ticks mark every tenth of it.
+    pub fn ruler_step(self, zoom: f64) -> f64 {
+        const STEPS: [f64; 19] =
+            [0.01, 0.02, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0, 50.0, 100.0, 200.0, 500.0, 1000.0, 2000.0, 5000.0, 10000.0];
+        STEPS.iter().copied().find(|s| s * self.points() * zoom >= 50.0).unwrap_or(10000.0)
+    }
+    /// `v` (points) on the nearest ruler tick at `zoom` ([`Self::ruler_step`]).
+    pub fn snap_to_ruler_tick(self, v: f64, zoom: f64) -> f64 {
+        let tick = self.ruler_step(zoom) / 10.0 * self.points();
+        (v / tick).round() * tick
+    }
     pub fn from_pt(self, v: f64) -> f64 {
         v / self.points()
     }
@@ -178,7 +195,10 @@ impl Unit {
     }
     /// [`Unit::format`] without the suffix (`12.5`), for narrow fields.
     pub fn number(self, pt: f64) -> String {
-        let s = format!("{:.3}", self.from_pt(pt));
+        // Three decimals for the small units (`595.276 pt`), four for the large ones (`8.2677 in`,
+        // `35.2778 mm`, the `0.0078 in` stroke preset); trailing zeros are trimmed (`1 pt` is `1`).
+        let decimals = if matches!(self, Unit::Points | Unit::Pixels | Unit::Picas) { 3 } else { 4 };
+        let s = format!("{:.*}", decimals, self.from_pt(pt));
         let s = s.trim_end_matches('0').trim_end_matches('.');
         if s == "-0" { "0".into() } else { s.into() }
     }
@@ -339,11 +359,53 @@ pub struct SavedView {
     pub rotation: f64,
 }
 
+/// A saved selection (Select → Save Selection…): the objects that were selected, listed by name at
+/// the bottom of the Select menu.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SavedSelection {
+    pub name: String,
+    pub objects: Vec<NodeId>,
+}
+
+impl SavedSelection {
+    /// Most saved selections a document keeps (the Select menu lists every one).
+    pub const MAX: usize = 25;
+    /// Longest name, in characters.
+    pub const MAX_NAME: usize = 255;
+
+    /// `name` trimmed and cut to [`Self::MAX_NAME`] characters (`None` when blank).
+    pub fn clean_name(name: &str) -> Option<String> {
+        let name: String = name.trim().chars().take(Self::MAX_NAME).collect();
+        (!name.is_empty()).then_some(name)
+    }
+
+    /// The first "Selection N" none of `saved` is named.
+    pub fn default_name(saved: &[SavedSelection]) -> String {
+        (1..=saved.len() + 1).map(|i| format!("Selection {i}")).find(|n| !saved.iter().any(|x| &x.name == n)).unwrap_or_default()
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Guide {
     /// true = vertical guide at `pos` (x), false = horizontal at `pos` (y).
     pub vertical: bool,
     pub pos: f64,
+    /// An artboard guide: the [`Artboard::id`] it belongs to. It runs across that artboard only
+    /// and moves, is copied and is deleted with it. None: a canvas guide, across the whole canvas.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub artboard: Option<u32>,
+}
+
+impl Guide {
+    /// A canvas guide.
+    pub fn new(vertical: bool, pos: f64) -> Self {
+        Self { vertical, pos, artboard: None }
+    }
+
+    /// Moved by `d` (a vertical guide across, a horizontal one down).
+    pub fn moved(&self, d: Vec2) -> Self {
+        Self { pos: self.pos + if self.vertical { d.x } else { d.y }, ..self.clone() }
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -490,6 +552,9 @@ pub struct Document {
     /// View → New View… (up to 25, like Illustrator).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub views: Vec<SavedView>,
+    /// Select → Save Selection… (at most [`SavedSelection::MAX`]); saved with the document.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub saved_selections: Vec<SavedSelection>,
     #[serde(default)]
     pub grid: GridPrefs,
     #[serde(default = "ppi72")]
@@ -616,6 +681,7 @@ impl Document {
             symbols: vec![],
             guides: vec![],
             views: vec![],
+            saved_selections: vec![],
             grid: GridPrefs::default(),
             raster_effects_ppi: 72.0,
             images: BTreeMap::new(),
@@ -810,15 +876,17 @@ impl Document {
         self.layers.push(Arc::new(Node::layer(id, &name, LayerColor::Preset((n % LAYER_COLORS.len()) as u8))));
         id
     }
+    /// The default name of a new layer or sublayer, "Layer N". Layers and sublayers share the
+    /// numbering: it starts after the number of layers there are and skips any layer's name.
     pub fn next_layer_name(&self) -> String {
-        let mut i = self.layers.len() + 1;
-        loop {
-            let name = format!("Layer {i}");
-            if !self.layers.iter().any(|l| l.name.as_deref() == Some(&name)) {
-                return name;
+        let (mut count, mut taken) = (0, std::collections::HashSet::new());
+        self.walk(|n| {
+            if n.is_layer() {
+                count += 1;
+                taken.extend(n.name.as_deref());
             }
-            i += 1;
-        }
+        });
+        (count + 1..).map(|i| format!("Layer {i}")).find(|name| !taken.contains(name.as_str())).unwrap_or_default()
     }
 
     /// Visit every node depth first in paint order (bottom to top).
@@ -837,9 +905,19 @@ impl Document {
     pub fn is_visible(&self, id: NodeId) -> bool {
         self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| n.visible)))
     }
-    /// Colour of the layer containing `id` (selection highlight colour).
+    /// The innermost layer or sublayer containing `id` (`id` itself when it is a layer).
+    pub fn layer_containing(&self, id: NodeId) -> Option<NodeId> {
+        let a = self.ancestry(id)?;
+        a.iter().rev().copied().find(|i| self.node(*i).is_some_and(Node::is_layer))
+    }
+    /// Every art object the Selection tool can reach (Select All): the visible, unlocked objects
+    /// of the visible, unlocked, non-template layers, looking through sublayers (bottom first).
+    pub fn selectable_art(&self) -> Vec<NodeId> {
+        self.layers.iter().filter(|l| l.visible && !l.locked && !l.is_template()).flat_map(|l| l.layer_art(true)).collect()
+    }
+    /// Colour of the innermost layer or sublayer containing `id` (selection highlight colour).
     pub fn layer_color(&self, id: NodeId) -> [u8; 3] {
-        let l = self.layer_of(id).and_then(|l| self.node(l));
+        let l = self.layer_containing(id).and_then(|l| self.node(l));
         match l.map(|n| &n.kind) {
             Some(NodeKind::Layer { color, .. }) => color.rgb(),
             _ => LAYER_COLORS[0].1,
@@ -859,6 +937,70 @@ impl Document {
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
         self.artboards.iter().rposition(|a| a.rect.contains(p))
     }
+    /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
+    /// sublayers) lying entirely inside it. Locked and hidden objects and layers stay put unless
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn art_on_artboard(&self, rect: Rect, locked_and_hidden: bool) -> Vec<NodeId> {
+        fn collect(n: &Node, rect: Rect, all: bool, out: &mut Vec<NodeId>) {
+            for c in n.children().into_iter().flatten().filter(|c| c.rides_with_artboard(all)) {
+                if c.is_layer() {
+                    collect(c, rect, all, out);
+                } else if let Some(b) = c.geometric_bounds()
+                    && rect.contains(Point::new(b.x0, b.y0))
+                    && rect.contains(Point::new(b.x1, b.y1))
+                {
+                    out.push(c.id);
+                }
+            }
+        }
+        let mut art = vec![];
+        for l in self.layers.iter().filter(|l| l.rides_with_artboard(locked_and_hidden)) {
+            collect(l, rect, locked_and_hidden, &mut art);
+        }
+        art
+    }
+    /// Where ruler guide `g` runs along its line (the y range of a vertical guide): across its
+    /// artboard for an artboard guide, None (the whole canvas) for a canvas guide or one whose
+    /// artboard is gone.
+    pub fn guide_span(&self, g: &Guide) -> Option<(f64, f64)> {
+        let r = self.artboards.iter().find(|a| Some(a.id) == g.artboard)?.rect;
+        Some(if g.vertical { (r.y0, r.y1) } else { (r.x0, r.x1) })
+    }
+    /// Does ruler guide `g` run past `p` (up to `tol` beyond its ends)?
+    pub fn guide_passes(&self, g: &Guide, p: Point, tol: f64) -> bool {
+        let along = if g.vertical { p.y } else { p.x };
+        self.guide_span(g).is_none_or(|(a, b)| along >= a - tol && along <= b + tol)
+    }
+    /// Keep the ruler guides `keep` accepts (by index), the selected ones left keeping their
+    /// place among the rest (the selected art stays selected). Returns how many went.
+    pub fn retain_guides(&mut self, sel: &mut Selection, keep: impl Fn(usize, &Guide) -> bool) -> usize {
+        let kept: Vec<bool> = self.guides.iter().enumerate().map(|(i, g)| keep(i, g)).collect();
+        // Where each kept guide ends up.
+        let (mut to, mut n) = (Vec::with_capacity(kept.len()), 0);
+        for k in &kept {
+            to.push(k.then_some(n));
+            n += usize::from(*k);
+        }
+        sel.guides = sel.guides.iter().filter_map(|i| to.get(*i).copied().flatten()).collect();
+        let before = self.guides.len();
+        let mut flags = kept.into_iter();
+        self.guides.retain(|_| flags.next().unwrap_or(true));
+        before - self.guides.len()
+    }
+    /// Move the guides of artboard `id` by `d` (along with their artboard).
+    pub fn move_artboard_guides(&mut self, id: u32, d: Vec2) {
+        for g in self.guides.iter_mut().filter(|g| g.artboard == Some(id)) {
+            *g = g.moved(d);
+        }
+    }
+    /// Copy the guides of artboard `from` onto artboard `to`, `d` away (with a copy of their
+    /// artboard).
+    pub fn copy_artboard_guides(&mut self, from: u32, to: u32, d: Vec2) {
+        let copies: Vec<Guide> =
+            self.guides.iter().filter(|g| g.artboard == Some(from)).map(|g| Guide { artboard: Some(to), ..g.moved(d) }).collect();
+        self.guides.extend(copies);
+    }
     pub fn next_artboard_id(&self) -> u32 {
         self.artboards.iter().map(|a| a.id).max().unwrap_or(0) + 1
     }
@@ -881,6 +1023,33 @@ impl Document {
 }
 
 impl Document {
+    /// Saved selections as a file gives them, made safe to list and recall: at most
+    /// [`SavedSelection::MAX`], each with a clean, unique name and naming objects this document
+    /// has, each once. (An id it doesn't have would select whatever object takes that id later.)
+    pub fn tidy_saved_selections(&mut self) {
+        if self.saved_selections.is_empty() {
+            return;
+        }
+        let mut ids = std::collections::HashSet::new();
+        self.walk(|n| {
+            ids.insert(n.id);
+        });
+        let mut kept: Vec<SavedSelection> = vec![];
+        for s in std::mem::take(&mut self.saved_selections) {
+            if kept.len() >= SavedSelection::MAX {
+                break;
+            }
+            let Some(name) = SavedSelection::clean_name(&s.name) else { continue };
+            if kept.iter().any(|k| k.name == name) {
+                continue;
+            }
+            let mut seen = std::collections::HashSet::new();
+            let objects = s.objects.into_iter().filter(|id| ids.contains(id) && seen.insert(*id)).collect();
+            kept.push(SavedSelection { name, objects });
+        }
+        self.saved_selections = kept;
+    }
+
     /// Leave opacity-mask editing: drop the temporary editing layer, a working copy of art the
     /// mask already holds (the engine syncs it after every edit).
     pub fn drop_edit_modes(&mut self) {
@@ -979,6 +1148,23 @@ mod tests {
         assert_eq!(d.artboards[0].rect, Rect::new(0.0, 0.0, 612.0, 792.0));
     }
 
+    #[test]
+    fn art_on_artboard_takes_unlocked_objects_wholly_inside() {
+        let (mut d, a, b) = doc_with_rects();
+        let wide = Rect::new(-1.0, -1.0, 40.0, 15.0);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 15.0, 15.0), false), vec![a]);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 25.0, 15.0), false), vec![a], "b only half inside");
+        d.node_mut(a).unwrap().locked = true;
+        assert_eq!(d.art_on_artboard(wide, false), vec![b]);
+        // Move Locked and Hidden Artwork with Artboard (#394): hidden art stays too, unless on.
+        d.node_mut(b).unwrap().visible = false;
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b]);
+        Arc::make_mut(&mut d.layers[0]).locked = true;
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b], "a locked layer's art too");
+    }
+
     #[test]
     fn find_and_paths() {
         let (d, a, b) = doc_with_rects();

crates/doc/src/links.rs

@@ -137,7 +137,7 @@ impl Document {
         }
     }
 
-    /// The keys of image blobs only linked images show: what a save writes as their preview.
+    /// The keys of image blobs only linked images (or placed documents, always linked) show: what a save writes as their preview.
     pub fn linked_only_images(&self) -> BTreeSet<String> {
         if self.images.values().all(|b| b.proxy.is_none()) {
             return BTreeSet::new();
@@ -152,6 +152,8 @@ impl Document {
                 u.1 = true;
             }
         });
+        // A placed document saves its file's preview the same way.
+        self.visit_placed(|_, p| uses.entry(p.key.as_str()).or_default().0 = true);
         uses.into_iter().filter(|(_, (linked, embedded))| *linked && !embedded).map(|(k, _)| k.to_string()).collect()
     }
 }

crates/doc/src/live.rs

@@ -589,6 +589,46 @@ impl GradientMesh {
         self.rows >= 1 && self.cols >= 1 && self.points.len() == (self.rows as usize + 1) * (self.cols as usize + 1)
     }
 
+    /// A 1×1 mesh from its four corners (bottom-left, top-left, top-right, bottom-right in u/v
+    /// order: row 0 is v = 0, columns follow u), each with its handles ([`H_RIGHT`] …).
+    fn patch(corners: [(Point, [Vec2; 4], Color); 4]) -> Self {
+        let point = |(p, handles, color): (Point, [Vec2; 4], Color)| MeshPoint { p, color, opacity: 1.0, handles };
+        let [a, b, c, d] = corners;
+        Self { rows: 1, cols: 1, points: vec![point(a), point(d), point(b), point(c)] }
+    }
+
+    /// A 1×1 mesh from a Coons patch's twelve boundary points (in the order PDF and PostScript
+    /// shadings list them: v runs cp0 → cp3 along cp1 and cp2, u runs cp0 → cp9 along cp11 and
+    /// cp10) and its corner colours (at cp0, cp3, cp6, cp9); `None` if a point isn't finite.
+    pub fn coons(cp: &[Point; 12], colors: [Color; 4]) -> Option<Self> {
+        if !cp.iter().all(|p| p.is_finite()) {
+            return None;
+        }
+        let h = |a: usize, b: usize| cp[b] - cp[a];
+        let handles = |right: Vec2, left: Vec2, down: Vec2, up: Vec2| {
+            let mut h = [Vec2::ZERO; 4];
+            (h[H_RIGHT], h[H_LEFT], h[H_DOWN], h[H_UP]) = (right, left, down, up);
+            h
+        };
+        let [c0, c1, c2, c3] = colors;
+        Some(Self::patch([
+            (cp[0], handles(h(0, 11), Vec2::ZERO, h(0, 1), Vec2::ZERO), c0),
+            (cp[3], handles(h(3, 4), Vec2::ZERO, Vec2::ZERO, h(3, 2)), c1),
+            (cp[6], handles(Vec2::ZERO, h(6, 5), Vec2::ZERO, h(6, 7)), c2),
+            (cp[9], handles(Vec2::ZERO, h(9, 10), h(9, 8), Vec2::ZERO), c3),
+        ]))
+    }
+
+    /// A 1×1 mesh of a Gouraud-shaded triangle (a patch with two corners together); `None` if a
+    /// point isn't finite.
+    pub fn triangle(corners: [(Point, Color); 3]) -> Option<Self> {
+        if !corners.iter().all(|(p, _)| p.is_finite()) {
+            return None;
+        }
+        let [a, b, c] = corners.map(|(p, color)| (p, [Vec2::ZERO; 4], color));
+        Some(Self::patch([a, b, c, c]))
+    }
+
     /// A mesh over surface `s` (u, v ∈ [0,1]) with handles from its partial derivatives.
     pub fn from_surface(rows: u32, cols: u32, s: &dyn Fn(f64, f64) -> Point, color: &dyn Fn(f64, f64) -> Color) -> Self {
         let (us, vs) = (even_steps(cols), even_steps(rows));
@@ -1407,6 +1447,8 @@ fn map_node(n: &Node, w: &Warper) -> Node {
             let im = im.clone();
             return warp_image(&out, &im, w);
         }
+        // Its art is plain, so it warps at this depth.
+        NodeKind::PlacedDocument(_) => return map_node(&expanded_group_hooks(n, w.hooks), w),
     }
     out
 }
@@ -1567,7 +1609,7 @@ pub fn envelope_bounds(content: &[Arc<Node>], kind: &EnvelopeKind, frame: Affine
 
 /// Is this one of the live kinds?
 pub fn is_live(n: &Node) -> bool {
-    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_))
+    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_))
 }
 
 /// Mesh tessellation as filled quad paths (no stroke), `n`×`n` per patch.
@@ -1601,6 +1643,7 @@ pub fn expand_live_hooks(n: &Node, hooks: Hooks) -> Vec<Node> {
         NodeKind::Envelope { content, kind, fidelity, options, frame, .. } => expand_envelope(content, kind, *fidelity, *options, *frame, hooks),
         NodeKind::Mesh(m) => mesh_quad_nodes(m, 8),
         NodeKind::Repeat(r) => r.expand(),
+        NodeKind::PlacedDocument(p) => p.art(n),
         _ => vec![n.clone()],
     }
 }

crates/doc/src/node.rs

@@ -4,7 +4,9 @@ use std::sync::Arc;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::BlendMode;
-use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect, shapes};
+use vectorcraft_geom::corners::cut_corners;
+use vectorcraft_geom::shapes::{self, CornerKind};
+use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
 
 use crate::appearance::Appearance;
 use crate::live::{BlendSpec, EnvelopeKind, GradientMesh, Outliner};
@@ -75,12 +77,19 @@ impl LayerColor {
 #[serde(tag = "shape", rename_all = "lowercase")]
 pub enum LiveShape {
     Rectangle {
-        /// Untransformed width/height.
+        /// Untransformed width/height. Transforms fold their scale into these (see
+        /// [`LiveShape::transform`]), so they are document lengths unless `xf` shears.
         w: f64,
         h: f64,
-        /// Corner radii: top-left, top-right, bottom-right, bottom-left.
+        /// Corner radii: top-left, top-right, bottom-right, bottom-left. In the same units as
+        /// `w`/`h`: the corners are circular arcs in the document whenever `xf` doesn't scale.
         radii: [f64; 4],
-        /// Maps the untransformed shape (origin at its top-left) into the document.
+        /// Corner kinds, in the same order (Live Corners' corner types).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: [CornerKind; 4],
+        /// Maps the untransformed shape (origin at its top-left) into the document. A rotation
+        /// or reflection plus a move, unless a shear (or a file saved before transforms folded
+        /// their scale into `w`/`h`) put more in it.
         xf: Affine,
     },
     Ellipse {
@@ -94,11 +103,30 @@ pub enum LiveShape {
         radius: f64,
         sides: u32,
         xf: Affine,
+        /// Corner radii in document units, by vertex from the first one clockwise (none: sharp).
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        radii: Vec<f64>,
+        /// Corner kinds, in the same order (none: round).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: Vec<CornerKind>,
     },
     Line {
         a: Point,
         b: Point,
     },
+    /// Any other path whose corners Live Corners cut (a star, a pen path): it keeps its uncut
+    /// outline so the corners stay editable. Without a cut corner it is a plain path again.
+    Path {
+        /// The path with its corners uncut, in the document.
+        base: PathData,
+        /// Corner radii in document units, by anchor index of `base` (counting every subpath's
+        /// anchors in order; missing: sharp).
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        radii: Vec<f64>,
+        /// Corner kinds, in the same order (missing: round).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: Vec<CornerKind>,
+    },
 }
 
 impl LiveShape {
@@ -109,45 +137,121 @@ impl LiveShape {
             LiveShape::Ellipse { .. } => "Ellipse",
             LiveShape::Polygon { .. } => "Polygon",
             LiveShape::Line { .. } => "Line",
+            LiveShape::Path { .. } => "Path",
         }
     }
     /// Regenerate the path.
     pub fn to_path(&self) -> PathData {
         match self {
-            LiveShape::Rectangle { w, h, radii, xf } => {
-                let r = Rect::new(0.0, 0.0, *w, *h);
-                let p = if radii.iter().all(|x| (x - radii[0]).abs() < 1e-9) {
-                    shapes::rounded_rectangle(r, radii[0])
-                } else {
-                    // Per-corner radii: generate uniformly then adjust (approximation until M2.5).
-                    shapes::rounded_rectangle(r, radii.iter().cloned().fold(0.0, f64::max))
-                };
-                p.transformed(*xf)
+            LiveShape::Rectangle { w, h, radii, kinds, xf } => {
+                shapes::rectangle_with_corners(Rect::new(0.0, 0.0, *w, *h), *radii, *kinds).transformed(*xf)
             }
             LiveShape::Ellipse { w, h, xf, .. } => shapes::ellipse(Rect::new(0.0, 0.0, *w, *h)).transformed(*xf),
-            LiveShape::Polygon { radius, sides, xf } => shapes::polygon(Point::ZERO, *radius, *sides, 0.0).transformed(*xf),
+            LiveShape::Polygon { radii, kinds, .. } => cut_corners(&self.polygon_outline(), radii, kinds).0,
             LiveShape::Line { a, b } => shapes::line(*a, *b),
+            LiveShape::Path { base, radii, kinds } => cut_corners(base, radii, kinds).0,
         }
     }
-    pub fn transform(&mut self, a: Affine) {
+    /// A polygon's outline with its corners uncut, in the document (empty for other shapes).
+    pub fn polygon_outline(&self) -> PathData {
         match self {
-            LiveShape::Rectangle { xf, .. } | LiveShape::Ellipse { xf, .. } | LiveShape::Polygon { xf, .. } => *xf = a * *xf,
+            LiveShape::Polygon { radius, sides, xf, .. } => shapes::polygon(Point::ZERO, *radius, *sides, 0.0).transformed(*xf),
+            _ => PathData::default(),
+        }
+    }
+    /// Give a polygon `n` sides (3–1000). Its corners keep the radius and kind they shared; else
+    /// the corners past the old last one are sharp.
+    pub fn set_sides(&mut self, n: u64) {
+        let LiveShape::Polygon { sides, radii, kinds, .. } = self else { return };
+        *sides = n.clamp(3, 1000) as u32;
+        fn spread<T: Copy + PartialEq + Default>(v: &mut Vec<T>, n: usize) {
+            match v.first().copied() {
+                Some(x) if v.iter().all(|y| *y == x) => *v = vec![x; n],
+                Some(_) => v.resize(n, T::default()),
+                None => {}
+            }
+        }
+        spread(radii, *sides as usize);
+        spread(kinds, *sides as usize);
+    }
+    /// Apply `a` to the shape. True when the shape is no longer `a` applied to the old path, so
+    /// the caller must regenerate the path with [`LiveShape::to_path`].
+    ///
+    /// A rectangle keeps round corners whatever its proportions: when `a` scales it along its own
+    /// sides (any rotation or reflection, no shear), the scale goes into `w`/`h` and `xf` keeps
+    /// only the rotation, reflection and position. The radii scale by the mean scale (the square
+    /// root of the determinant), which [`LiveShape::keep_corners`] undoes for Scale Corners off.
+    /// A shear can't keep circular corners: `xf` takes it, as do moves (so files saved with a
+    /// scale in `xf` keep their exact geometry until they're next transformed). A polygon's or a
+    /// path's corner radii are document lengths: they scale by the mean scale and the corners are
+    /// cut again, circular whatever `a` does.
+    pub fn transform(&mut self, a: Affine) -> bool {
+        match self {
+            LiveShape::Rectangle { xf, .. } => {
+                *xf = a * *xf;
+                !moves_only(a) && self.fold_scale()
+            }
+            LiveShape::Ellipse { xf, .. } => {
+                *xf = a * *xf;
+                false
+            }
+            LiveShape::Polygon { xf, radii, .. } => {
+                *xf = a * *xf;
+                scale_radii(radii, a)
+            }
+            LiveShape::Path { base, radii, .. } => {
+                base.transform(a);
+                scale_radii(radii, a)
+            }
             LiveShape::Line { a: p, b } => {
                 *p = a * *p;
                 *b = a * *b;
+                false
             }
         }
     }
+    /// Move the scale of a rectangle's `xf` into `w`/`h` (and its radii, by the mean scale), so
+    /// `xf` keeps only a rotation or reflection plus a move and the corners are circular in the
+    /// document. False (and nothing changes) when there is no scale to move, when `xf` shears or
+    /// isn't finite, and for other shapes. Files saved before transforms did this (#291) carry an
+    /// uneven scale in `xf`: their corners are elliptical until this runs.
+    pub fn fold_scale(&mut self) -> bool {
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = self else { return false };
+        let [m0, m1, m2, m3, m4, m5] = xf.as_coeffs();
+        let (sx, sy) = (m0.hypot(m1), m2.hypot(m3));
+        let orthogonal = sx > 1e-12 && sy > 1e-12 && (m0 * m2 + m1 * m3).abs() <= 1e-9 * sx * sy;
+        let finite = xf.as_coeffs().iter().all(|c| c.is_finite()) && w.is_finite() && h.is_finite();
+        let unscaled = (sx - 1.0).abs() < 1e-12 && (sy - 1.0).abs() < 1e-12;
+        if !orthogonal || !finite || unscaled {
+            return false;
+        }
+        let k = (sx * sy).sqrt();
+        radii.iter_mut().for_each(|r| *r *= k);
+        *w *= sx;
+        *h *= sy;
+        *xf = Affine::new([m0 / sx, m1 / sx, m2 / sy, m3 / sy, m4, m5]);
+        true
+    }
+    /// This shape with [`LiveShape::fold_scale`] applied: a rectangle's size and radii in document
+    /// units (what Live Corners show and edit).
+    pub fn folded(&self) -> Self {
+        let mut s = self.clone();
+        s.fold_scale();
+        s
+    }
     /// Divide live corner radii by `k`, the mean scale of a transform just applied, so the corners
     /// keep their size (Scale Corners off). False when nothing changed.
     pub fn keep_corners(&mut self, k: f64) -> bool {
-        match self {
-            LiveShape::Rectangle { radii, .. } if radii.iter().any(|r| *r > 0.0) && k > 1e-12 => {
-                radii.iter_mut().for_each(|r| *r /= k);
-                true
-            }
-            _ => false,
+        let radii: &mut [f64] = match self {
+            LiveShape::Rectangle { radii, .. } => radii,
+            LiveShape::Polygon { radii, .. } | LiveShape::Path { radii, .. } => radii,
+            LiveShape::Ellipse { .. } | LiveShape::Line { .. } => return false,
+        };
+        if !radii.iter().any(|r| *r > 0.0) || k <= 1e-12 {
+            return false;
         }
+        radii.iter_mut().for_each(|r| *r /= k);
+        true
     }
     /// Rotation angle of the live shape in degrees (shown in the Properties panel).
     pub fn angle_deg(&self) -> f64 {
@@ -157,10 +261,33 @@ impl LiveShape {
                 c[1].atan2(c[0]).to_degrees()
             }
             LiveShape::Line { a, b } => (b.y - a.y).atan2(b.x - a.x).to_degrees(),
+            LiveShape::Path { .. } => 0.0,
         }
     }
 }
 
+fn all_round(kinds: &[CornerKind]) -> bool {
+    kinds.iter().all(|k| *k == CornerKind::Round)
+}
+
+/// Whether `a` only moves (no rotation, scale, shear or reflection).
+fn moves_only(a: Affine) -> bool {
+    let [a0, a1, a2, a3, _, _] = a.as_coeffs();
+    (a0 - 1.0).abs() < 1e-12 && a1.abs() < 1e-12 && a2.abs() < 1e-12 && (a3 - 1.0).abs() < 1e-12
+}
+
+/// Scale corner radii in document units by the mean scale of `a`, applied to their path. True
+/// when the path must be cut again: some corner is cut and `a` does more than move it (an
+/// uneven scale would otherwise make the cuts elliptical).
+fn scale_radii(radii: &mut [f64], a: Affine) -> bool {
+    if moves_only(a) || !radii.iter().any(|r| *r > 0.0) {
+        return false;
+    }
+    let k = a.determinant().abs().sqrt();
+    radii.iter_mut().for_each(|r| *r *= k);
+    true
+}
+
 /// What a transform scales besides geometry, by its mean scale (the square root of its
 /// determinant). `Scaling::default()` (and `false`) scales nothing else; `true` scales stroke
 /// weights and dashes only. Transforms the user asks for take theirs from Scale Strokes & Effects
@@ -175,6 +302,9 @@ pub struct Scaling {
     pub keep_type_strokes: bool,
     /// Live corner radii keep their size.
     pub keep_corners: bool,
+    /// Pattern fills and strokes move with the art (Transform Patterns; General › Transform
+    /// Pattern Tiles is its default): their tiles transform too, instead of staying put.
+    pub patterns: bool,
 }
 
 impl Scaling {
@@ -223,6 +353,14 @@ pub enum NodeKind {
         /// Layer clipping mask: the first (bottom-most) child clips the others, as in a clip group.
         #[serde(default, skip_serializing_if = "crate::skip::is_default")]
         clip: bool,
+        /// Layer Options → Preview: off, the layer's art is drawn (and clicked) in outline on screen
+        /// (Ctrl-click its eye in the Layers panel).
+        #[serde(default = "yes", skip_serializing_if = "crate::skip::is_true")]
+        preview: bool,
+        /// Layer Options → Dim Images to: on screen, images on the layer show faded to this
+        /// percentage (0–100); `None`: not dimmed.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        dim_images: Option<u8>,
     },
     /// A group. With `clip`, the first (bottom-most) child is the clipping path.
     Group {
@@ -285,6 +423,9 @@ pub enum NodeKind {
     Mesh(GradientMesh),
     /// Live Repeat (radial / grid / mirror) of source art.
     Repeat(RepeatSpec),
+    /// A placed document: an artboard of another VectorCraft file, linked and locked (see
+    /// [`crate::placed_document`]).
+    PlacedDocument(Box<crate::placed_document::PlacedDocument>),
 }
 
 fn yes() -> bool {
@@ -412,7 +553,10 @@ impl Node {
         Self::new(id, NodeKind::Group { children, clip: false })
     }
     pub fn layer(id: NodeId, name: &str, color: LayerColor) -> Self {
-        let mut n = Self::new(id, NodeKind::Layer { color, template: false, printable: true, children: vec![], clip: false });
+        let mut n = Self::new(
+            id,
+            NodeKind::Layer { color, template: false, printable: true, children: vec![], clip: false, preview: true, dim_images: None },
+        );
         n.name = Some(name.to_string());
         n
     }
@@ -438,9 +582,39 @@ impl Node {
             _ => None,
         }
     }
+    /// Does this object or layer move with its artboard? Locked and hidden ones only with
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn rides_with_artboard(&self, locked_and_hidden: bool) -> bool {
+        locked_and_hidden || (!self.locked && self.visible)
+    }
     pub fn is_layer(&self) -> bool {
         matches!(self.kind, NodeKind::Layer { .. })
     }
+    /// A template layer (Layer Options → Template).
+    pub fn is_template(&self) -> bool {
+        matches!(self.kind, NodeKind::Layer { template: true, .. })
+    }
+    /// The art objects of this container: its children, looking through sublayers, which are not
+    /// objects (bottom first). With `editable`, only the visible, unlocked objects in visible,
+    /// unlocked, non-template sublayers.
+    pub fn layer_art(&self, editable: bool) -> Vec<NodeId> {
+        fn visit(n: &Node, editable: bool, out: &mut Vec<NodeId>) {
+            for c in n.children().into_iter().flatten() {
+                if editable && (!c.visible || c.locked || c.is_template()) {
+                    continue;
+                }
+                if c.is_layer() {
+                    visit(c, editable, out);
+                } else {
+                    out.push(c.id);
+                }
+            }
+        }
+        let mut out = vec![];
+        visit(self, editable, &mut out);
+        out
+    }
     pub fn is_container(&self) -> bool {
         self.children().is_some()
     }
@@ -471,6 +645,7 @@ impl Node {
             NodeKind::Envelope { .. } => "Envelope",
             NodeKind::Mesh(_) => "Mesh",
             NodeKind::Repeat(r) => r.kind.label(),
+            NodeKind::PlacedDocument(_) => "Placed Document",
         }
     }
     /// Name shown in the Layers panel: explicit name or `<Kind>`.
@@ -544,6 +719,7 @@ impl Node {
             NodeKind::Envelope { content, kind, frame, .. } => crate::live::envelope_bounds(content, kind, *frame),
             NodeKind::Mesh(m) => m.bounds(),
             NodeKind::Repeat(r) => r.bounds(),
+            NodeKind::PlacedDocument(p) => Some(p.bounds()),
         }
     }
     /// Visual bounds: what the object paints, its strokes included (paths and compound paths
@@ -609,15 +785,17 @@ impl Node {
             }
         }
         self.appearance.transform_gradients(a);
+        if sc.patterns {
+            crate::pattern::transform_pattern_paints(self, a);
+        }
         match &mut self.kind {
             NodeKind::Path { path, live, .. } => {
                 path.transform(a);
                 if let Some(l) = live {
-                    l.transform(a);
-                    if sc.keep_corners
-                        && let Some(k) = k
-                        && l.keep_corners(k)
-                    {
+                    // A rectangle scaled unevenly keeps circular corners: its path is regenerated.
+                    let reshaped = l.transform(a);
+                    let kept = sc.keep_corners && k.is_some_and(|k| l.keep_corners(k));
+                    if reshaped || kept {
                         *path = l.to_path();
                     }
                 }
@@ -637,6 +815,7 @@ impl Node {
                 }
             }
             NodeKind::Image(im) => im.xf = a * im.xf,
+            NodeKind::PlacedDocument(p) => p.xf = a * p.xf,
             NodeKind::SymbolInstance { xf, .. } => *xf = a * *xf,
             NodeKind::Blend { children, spec } => {
                 for c in children.iter_mut() {
@@ -799,6 +978,10 @@ impl Node {
                 let frame = shapes::rectangle(Rect::new(0.0, 0.0, im.width as f64, im.height as f64)).transformed(im.xf);
                 out.push((frame.to_bezpath(), FillRule::NonZero));
             }
+            NodeKind::PlacedDocument(p) => {
+                let frame = shapes::rectangle(p.natural()).transformed(p.xf);
+                out.push((frame.to_bezpath(), FillRule::NonZero));
+            }
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
                 crate::live::expand_deep(self, text).push_clip_shapes(text, out);
             }
@@ -1074,7 +1257,7 @@ impl Node {
 
     /// Shapes drawn with the shape tools (live rectangles, ellipses and polygons) show their centre.
     pub fn shows_center_by_default(&self) -> bool {
-        matches!(&self.kind, NodeKind::Path { live: Some(l), .. } if !matches!(l, LiveShape::Line { .. }))
+        matches!(&self.kind, NodeKind::Path { live: Some(l), .. } if !matches!(l, LiveShape::Line { .. } | LiveShape::Path { .. }))
     }
 
     /// Change this object's attributes with `f`; all-default attributes are dropped.
@@ -1130,11 +1313,171 @@ mod tests {
 
     #[test]
     fn rect_live_shape_roundtrip() {
-        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], xf: Affine::translate((5.0, 5.0)) };
+        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], kinds: Default::default(), xf: Affine::translate((5.0, 5.0)) };
         assert_eq!(l.to_path().bounds(), Some(Rect::new(5.0, 5.0, 15.0, 25.0)));
         assert_eq!(l.label(), "Rectangle");
     }
 
+    #[test]
+    fn corner_kinds_save_only_when_some_corner_isnt_round() {
+        let mut l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
+        // Older files read as round.
+        let json = serde_json::to_value(&l).unwrap();
+        assert!(json.get("kinds").is_none(), "{json}");
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        if let LiveShape::Rectangle { kinds, .. } = &mut l {
+            kinds[1] = CornerKind::Chamfer;
+        }
+        let json = serde_json::to_value(&l).unwrap();
+        assert_eq!(json["kinds"], serde_json::json!(["round", "chamfer", "round", "round"]));
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        // Polygons saved before Live Corners cut theirs read as sharp; a live path round-trips.
+        let p: LiveShape =
+            serde_json::from_value(serde_json::json!({"shape": "polygon", "radius": 10.0, "sides": 5, "xf": [1, 0, 0, 1, 0, 0]})).unwrap();
+        assert_eq!(p, LiveShape::Polygon { radius: 10.0, sides: 5, xf: Affine::IDENTITY, radii: vec![], kinds: vec![] });
+        let star = shapes::star(Point::new(0.0, 0.0), 20.0, 10.0, 5, 0.0);
+        let path = LiveShape::Path { base: star, radii: vec![2.0; 10], kinds: vec![] };
+        let json = serde_json::to_value(&path).unwrap();
+        assert_eq!((json["shape"].as_str(), json.get("kinds")), (Some("path"), None));
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), path);
+        assert_eq!(path.label(), "Path");
+    }
+
+    /// A node holding a live rectangle (`w` × `h`, all radii `r`, placed by `xf`) and its path.
+    fn live_rect(w: f64, h: f64, r: f64, xf: Affine) -> Node {
+        let live = LiveShape::Rectangle { w, h, radii: [r; 4], kinds: Default::default(), xf };
+        let mut n = Node::path(NodeId(1), live.to_path(), Appearance::default_art());
+        if let NodeKind::Path { live: slot, .. } = &mut n.kind {
+            *slot = Some(live);
+        }
+        n
+    }
+
+    fn live_of(n: &Node) -> (f64, f64, [f64; 4], Affine) {
+        let NodeKind::Path { live: Some(LiveShape::Rectangle { w, h, radii, xf, .. }), .. } = &n.kind else { panic!("not a live rectangle") };
+        (*w, *h, *radii, *xf)
+    }
+
+    fn near(a: f64, b: f64) -> bool {
+        (a - b).abs() < 1e-9
+    }
+
+    fn near_xf(a: Affine, b: Affine) -> bool {
+        a.as_coeffs().iter().zip(b.as_coeffs()).all(|(x, y)| near(*x, y))
+    }
+
+    /// Size and radius of a live rectangle, within rounding.
+    fn assert_live(n: &Node, w: f64, h: f64, r: f64) {
+        let (lw, lh, radii, _) = live_of(n);
+        assert!(near(lw, w) && near(lh, h) && radii.iter().all(|x| near(*x, r)), "{lw} × {lh} r {radii:?}, want {w} × {h} r {r}");
+    }
+
+    /// Each corner arc of a rounded rectangle's path, mapped by `back` (to undo a rotation),
+    /// spans `r` along x and y: the corner is a circular arc of radius `r`.
+    fn assert_round_corners(n: &Node, back: Affine, r: f64) {
+        let NodeKind::Path { path, .. } = &n.kind else { panic!("not a path") };
+        let a: Vec<Point> = path.subpaths[0].anchors.iter().map(|a| back * a.p).collect();
+        assert_eq!(a.len(), 8, "a rounded rectangle");
+        // Anchors 1→2, 3→4, 5→6 and 7→0 are the arcs.
+        for (i, j) in [(1, 2), (3, 4), (5, 6), (7, 0)] {
+            let (x, y) = ((a[j].x - a[i].x).abs(), (a[j].y - a[i].y).abs());
+            assert!(near(x, r) && near(y, r), "corner spans {x} × {y}, want {r} × {r}");
+        }
+    }
+
+    const KEEP_CORNERS: Scaling = Scaling { strokes: false, effects: None, keep_type_strokes: false, keep_corners: true, patterns: false };
+
+    #[test]
+    fn uneven_scales_keep_live_corners_circular() {
+        // A 100 pt rounded square at (10, 10) stretched to 300 × 100 (#291).
+        let mut n = live_rect(100.0, 100.0, 20.0, Affine::translate((10.0, 10.0)));
+        let stretch = Affine::translate((10.0, 10.0)) * Affine::scale_non_uniform(3.0, 1.0) * Affine::translate((-10.0, -10.0));
+        n.transform(stretch, KEEP_CORNERS);
+        assert_live(&n, 300.0, 100.0, 20.0);
+        assert!(near_xf(live_of(&n).3, Affine::translate((10.0, 10.0))), "the scale went into the size");
+        let b = n.geometric_bounds().unwrap();
+        assert!(near(b.x0, 10.0) && near(b.y0, 10.0) && near(b.x1, 310.0) && near(b.y1, 110.0), "{b:?}");
+        assert_round_corners(&n, Affine::IDENTITY, 20.0);
+        // Scale Corners on: the radius scales by the mean scale, still circular.
+        let mut n = live_rect(100.0, 100.0, 20.0, Affine::IDENTITY);
+        n.transform(Affine::scale_non_uniform(4.0, 1.0), Scaling::default());
+        assert_live(&n, 400.0, 100.0, 40.0);
+        assert_round_corners(&n, Affine::IDENTITY, 40.0);
+        // Squashed below the radius, the short sides are fully round; stretched back, it returns.
+        n.transform(Affine::scale_non_uniform(1.0, 0.5), KEEP_CORNERS);
+        assert_round_corners(&n, Affine::IDENTITY, 25.0);
+        n.transform(Affine::scale_non_uniform(1.0, 2.0), KEEP_CORNERS);
+        assert_round_corners(&n, Affine::IDENTITY, 40.0);
+    }
+
+    #[test]
+    fn rotated_and_reflected_live_rectangles_scale_along_their_own_sides() {
+        let place = Affine::translate((200.0, 100.0)) * Affine::rotate(30f64.to_radians());
+        let mut n = live_rect(100.0, 50.0, 10.0, place);
+        // Stretched along its own width, as a bounding-box drag of a rotated shape does.
+        n.transform(place * Affine::scale_non_uniform(2.0, 1.0) * place.inverse(), KEEP_CORNERS);
+        assert_live(&n, 200.0, 50.0, 10.0);
+        assert!(near_xf(live_of(&n).3, place));
+        assert_round_corners(&n, place.inverse(), 10.0);
+        // A reflection stays in `xf`; the corners stay as they were.
+        n.transform(Affine::scale_non_uniform(-1.0, 1.0), KEEP_CORNERS);
+        assert_live(&n, 200.0, 50.0, 10.0);
+        let xf = live_of(&n).3;
+        assert!(near(xf.determinant(), -1.0));
+        assert_round_corners(&n, xf.inverse(), 10.0);
+    }
+
+    #[test]
+    fn shears_and_moves_keep_the_old_transform() {
+        // Scaling a rotated rectangle along the page axes shears it: `xf` takes it all, as before.
+        let rot = Affine::rotate(30f64.to_radians());
+        let mut n = live_rect(100.0, 50.0, 10.0, rot);
+        let before = n.clone();
+        let a = Affine::scale_non_uniform(2.0, 1.0);
+        n.transform(a, Scaling::default());
+        assert_eq!(live_of(&n), (100.0, 50.0, [10.0; 4], a * rot));
+        let (NodeKind::Path { path, .. }, NodeKind::Path { path: old, .. }) = (&n.kind, &before.kind) else { panic!() };
+        assert_eq!(*path, old.transformed(a));
+        // A file saved with an uneven scale in `xf` keeps its exact geometry when moved...
+        let legacy = Affine::translate((5.0, 5.0)) * Affine::scale_non_uniform(2.0, 1.0);
+        let mut n = live_rect(100.0, 100.0, 20.0, legacy);
+        n.transform(Affine::translate((10.0, 0.0)), KEEP_CORNERS);
+        assert_eq!(live_of(&n), (100.0, 100.0, [20.0; 4], Affine::translate((10.0, 0.0)) * legacy));
+        // ...and once scaled, has document units and circular corners of its mean radius.
+        n.transform(Affine::scale(2.0), Scaling::default());
+        assert_live(&n, 400.0, 200.0, 20.0 * 2f64.sqrt() * 2.0);
+        assert!(near(live_of(&n).3.determinant(), 1.0));
+        assert_round_corners(&n, Affine::IDENTITY, 20.0 * 2f64.sqrt() * 2.0);
+    }
+
+    /// A rectangle saved with an uneven scale in `xf` (before #291) has elliptical corners; Live
+    /// Corners see and edit it in document units, with circular corners (#442).
+    #[test]
+    fn a_scale_left_in_the_transform_folds_into_the_size() {
+        let legacy = Affine::translate((5.0, 5.0)) * Affine::scale_non_uniform(4.0, 1.0);
+        let n = live_rect(50.0, 80.0, 20.0, legacy);
+        let NodeKind::Path { live: Some(live), .. } = &n.kind else { panic!("not live") };
+        let folded = live.folded();
+        assert_eq!(live_of(&n).3, legacy, "folded() leaves the shape alone");
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = &folded else { panic!("not a rectangle") };
+        // Drawn 200 × 80 with 80 × 20 corners; folded, the corners are circles of the mean radius.
+        assert!(near(*w, 200.0) && near(*h, 80.0) && radii.iter().all(|r| near(*r, 40.0)), "{w} × {h} r {radii:?}");
+        assert!(near_xf(*xf, Affine::translate((5.0, 5.0))));
+        let (a, b) = (folded.to_path().bounds().unwrap(), live.to_path().bounds().unwrap());
+        assert!(near(a.x0, b.x0) && near(a.y0, b.y0) && near(a.x1, b.x1) && near(a.y1, b.y1), "same place and size: {a:?} {b:?}");
+        let corners = crate::LiveCorners::of(&n).unwrap();
+        assert_eq!(corners.style(&corners.all()).0, Some(40.0), "the radius in document units");
+        // Nothing to fold: a moved, rotated or reflected rectangle and a sheared one stay as they are.
+        let place = Affine::translate((5.0, 5.0)) * Affine::rotate(0.5) * Affine::scale_non_uniform(-1.0, 1.0);
+        let shear = Affine::new([1.0, 0.0, 0.5, 1.0, 0.0, 0.0]);
+        for xf in [place, shear] {
+            let mut l = live_rect(100.0, 160.0, 20.0, xf);
+            let NodeKind::Path { live: Some(live), .. } = &mut l.kind else { panic!("not live") };
+            assert!(!live.fold_scale());
+            assert_eq!(live_of(&l), (100.0, 160.0, [20.0; 4], xf));
+        }
+    }
+
     #[test]
     fn default_transparency() {
         let p = || Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());

crates/doc/src/placed_document.rs

@@ -0,0 +1,684 @@
+//! Placed documents: another VectorCraft file placed linked ([`PlacedDocument`]).
+//!
+//! The object keeps the link to the file and the file's bytes, stored like image data in
+//! [`Document::images`] (with a small preview a save writes instead, as for linked images), so the
+//! document shows correctly without the file. The art it shows is read from those bytes and never
+//! joins the object tree, so editing can't reach it: it is locked by design. Drawing and exporting
+//! expand it like a live object ([`crate::live::expanded`]).
+//!
+//! The file is read by the native format's loader, which lives above this crate and registers
+//! itself ([`set_loader`]); the art read is kept in a small cache by content. Before exporting,
+//! every exporter calls [`Document::with_placed_art`], which adds the resources the art uses
+//! (images, symbols, patterns) under names of their own ([`RESOURCE_PREFIX`]) to a temporary copy
+//! of the document, so they never meet the user's or show in panels. Placed documents inside a
+//! placed document are read the same way, up to [`MAX_DEPTH`] deep (documents that place each
+//! other stop there, showing their previews).
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+use std::sync::{Arc, Mutex, MutexGuard, OnceLock, PoisonError};
+
+use serde::{Deserialize, Serialize};
+use vectorcraft_geom::{Affine, Rect};
+
+use vectorcraft_color::Paint;
+
+use crate::{AppearanceItem, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeKind, PatternDef, PlacementOptions, Symbol};
+
+/// A placed document: an artboard of another VectorCraft file, shown as one locked object.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PlacedDocument {
+    /// The file (its `page` is the artboard shown, 1-based).
+    pub link: LinkInfo,
+    /// Key into [`Document::images`]: the file's bytes (see [`key_for`]).
+    pub key: String,
+    /// The art's bounds rather than the artboard (File › Place's `crop: "bounding"`).
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub bounding: bool,
+    /// The artboard's size (or the art's) at 100% (pt).
+    pub width: f64,
+    pub height: f64,
+    /// Maps the box (0..width, 0..height) into the document.
+    pub xf: Affine,
+    /// Links panel → Placement Options: how the file read again takes this object's place.
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub placement: PlacementOptions,
+}
+
+/// The images key of a file's bytes (`hash`, [`crate::links::hash_bytes`]) placed showing
+/// artboard `page` (`bounding`: its art's bounds): objects showing the same thing share a blob and
+/// its preview.
+pub fn key_for(hash: &str, page: u32, bounding: bool) -> String {
+    format!("{hash}-{page}{}", if bounding { "b" } else { "" })
+}
+
+impl PlacedDocument {
+    /// The artboard shown (1-based).
+    pub fn page(&self) -> u32 {
+        self.link.page.unwrap_or(1)
+    }
+
+    /// The box at 100%.
+    pub fn natural(&self) -> Rect {
+        Rect::new(0.0, 0.0, self.width, self.height)
+    }
+
+    /// The four corners of the box in the document.
+    pub fn corners(&self) -> [vectorcraft_geom::Point; 4] {
+        let r = self.natural();
+        [(r.x0, r.y0), (r.x1, r.y0), (r.x1, r.y1), (r.x0, r.y1)].map(|(x, y)| self.xf * vectorcraft_geom::Point::new(x, y))
+    }
+
+    /// The box in the document (axis-aligned).
+    pub fn bounds(&self) -> Rect {
+        self.xf.transform_rect_bbox(self.natural())
+    }
+
+    /// The transform from the file's coordinates (its artboard or art bounds `frame`) to the
+    /// document; `None` when either size is empty.
+    pub fn art_xf(&self, frame: Rect) -> Option<Affine> {
+        let ok = self.width > 0.0 && self.height > 0.0 && frame.width() > 0.0 && frame.height() > 0.0;
+        ok.then(|| {
+            self.xf * Affine::scale_non_uniform(self.width / frame.width(), self.height / frame.height()) * Affine::translate((-frame.x0, -frame.y0))
+        })
+    }
+
+    /// The art the object shows, as plain objects with `n`'s id: one group, its resources named
+    /// as [`Document::with_placed_art`] adds them (nothing until that has read it).
+    pub fn art(&self, n: &Node) -> Vec<Node> {
+        let prefix = prefix(&self.key);
+        read_cached(self).and_then(|e| self.art_node(n, &e, &prefix)).into_iter().collect()
+    }
+
+    /// Read `e`'s art placed as this object `n` shows it (`n`'s id), its resources renamed with
+    /// `prefix`.
+    fn art_node(&self, n: &Node, e: &ReadDocument, prefix: &str) -> Option<Node> {
+        let m = self.art_xf(e.frame)?;
+        let mut g = (*e.art).clone();
+        rename(&mut g, prefix);
+        g.transform(m, true);
+        each_mut(&mut g, &mut |c| crate::pattern::transform_pattern_paints(c, m));
+        g.id = n.id;
+        Some(g)
+    }
+
+    /// An image object showing preview `bytes` (stored under this object's key) in this object's
+    /// box: what it shows and outputs as when the file can't be read.
+    pub fn preview_image(&self, bytes: &[u8]) -> Option<ImageObject> {
+        let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+        let px = Affine::scale_non_uniform(self.width / w as f64, self.height / h as f64);
+        Some(ImageObject { key: self.key.clone(), width: w, height: h, xf: self.xf * px, link: None, placement: Default::default() })
+    }
+}
+
+/// The names the resources of the art stored under `key` take in a prepared document.
+fn prefix(key: &str) -> String {
+    format!("{RESOURCE_PREFIX}{key}/")
+}
+
+/// `n` and every descendant, opacity-mask art included.
+fn walk_all<'a>(n: &'a Node, f: &mut impl FnMut(&'a Node)) {
+    f(n);
+    if let Some(m) = &n.mask {
+        walk_all(&m.art, f);
+    }
+    for c in n.children().into_iter().flatten() {
+        walk_all(c, f);
+    }
+}
+
+/// The roots of `d`'s art: layers, symbol definitions and pattern swatches.
+fn roots(d: &Document) -> impl Iterator<Item = &Arc<Node>> {
+    d.layers.iter().chain(d.symbols.iter().map(|s| &s.art)).chain(d.patterns.iter().flat_map(|p| &p.art))
+}
+
+fn roots_mut(d: &mut Document) -> impl Iterator<Item = &mut Arc<Node>> {
+    d.layers.iter_mut().chain(d.symbols.iter_mut().map(|s| &mut s.art)).chain(d.patterns.iter_mut().flat_map(|p| &mut p.art))
+}
+
+impl Document {
+    /// Visit every placed document: in the layers, then in symbol definitions and pattern
+    /// swatches, opacity-mask art included.
+    pub fn visit_placed<'a>(&'a self, mut f: impl FnMut(&'a Node, &'a PlacedDocument)) {
+        for root in roots(self) {
+            walk_all(root, &mut |n| {
+                if let NodeKind::PlacedDocument(p) = &n.kind {
+                    f(n, p);
+                }
+            });
+        }
+    }
+
+    /// Does the document hold a placed document anywhere?
+    pub fn has_placed(&self) -> bool {
+        let mut any = false;
+        self.visit_placed(|_, _| any = true);
+        any
+    }
+
+    /// Every placed document (those in the art they show too) replaced by a plain group of that
+    /// art, for apps that don't know them: call it on [`Self::with_placed_art`]'s copy. Only the
+    /// subtrees holding one are copied.
+    pub fn placed_as_groups(&mut self) {
+        fn holds(n: &Node) -> bool {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(c.kind, NodeKind::PlacedDocument(_)));
+            hit
+        }
+        fn update(n: &mut Arc<Node>) {
+            if !holds(n) {
+                return;
+            }
+            if matches!(n.kind, NodeKind::PlacedDocument(_)) {
+                let mut g = crate::live::expanded_group(n, None);
+                g.appearance = n.appearance.clone();
+                *n = Arc::new(g);
+            }
+            // The art shown may hold placed documents too.
+            let n = Arc::make_mut(n);
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c);
+            }
+        }
+        for root in roots_mut(self) {
+            update(root);
+        }
+    }
+
+    /// Placed documents whose key is in `keys` replaced by images of their previews (for output
+    /// when their files can't be read).
+    pub fn placed_as_previews(&mut self, keys: &BTreeSet<String>) {
+        fn update(n: &mut Arc<Node>, keys: &BTreeSet<String>, images: &std::collections::BTreeMap<String, ImageBlob>) {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(&c.kind, NodeKind::PlacedDocument(p) if keys.contains(&p.key)));
+            if !hit {
+                return;
+            }
+            let n = Arc::make_mut(n);
+            if let NodeKind::PlacedDocument(p) = &n.kind
+                && keys.contains(&p.key)
+            {
+                if let Some(im) = images.get(&p.key).and_then(|b| p.preview_image(&b.bytes)) {
+                    n.kind = NodeKind::Image(im);
+                }
+                return;
+            }
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art, keys, images);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c, keys, images);
+            }
+        }
+        let images = self.images.clone();
+        for root in roots_mut(self) {
+            update(root, keys, &images);
+        }
+    }
+}
+
+// ---------- previews and the files' bytes ----------
+
+/// A placed document's preview: this many pixels per point of its box…
+pub const PREVIEW_PX_PER_PT: f64 = 1.0;
+/// …and at most this many on its longer side.
+pub const PREVIEW_MAX: u32 = 1024;
+/// How deep placed documents inside placed documents are read; deeper ones show their previews.
+pub const MAX_DEPTH: usize = 8;
+
+/// Reads `p`'s file again (`None`: not found, or changed since it was read). The engine registers
+/// one with [`set_file_reader`].
+pub type FileReader = fn(&PlacedDocument) -> Option<Vec<u8>>;
+
+static FILE_READER: OnceLock<FileReader> = OnceLock::new();
+
+/// Register how files are read again (the first registration stays).
+pub fn set_file_reader(f: FileReader) {
+    // Already set: the same engine, registered by another session.
+    let _ = FILE_READER.set(f);
+}
+
+/// The most bytes of files read again kept.
+const FULL_BYTES: usize = 512 << 20;
+
+/// Files read again, by key, the most recently read last.
+type FullFiles = Vec<(String, Arc<Vec<u8>>)>;
+
+static FULL: Mutex<FullFiles> = Mutex::new(Vec::new());
+
+fn full() -> MutexGuard<'static, FullFiles> {
+    // Entries are only pushed and removed: a panic while held leaves it whole.
+    FULL.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// The file's bytes when they are at hand: stored (`blob` isn't just the preview) or read again
+/// already. Never reads it.
+pub fn full_bytes_cached(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if !blob.is_proxy() {
+        return Some(blob.bytes.clone());
+    }
+    full().iter().rev().find(|(k, _)| *k == p.key).map(|(_, b)| b.clone())
+}
+
+/// The file's bytes: stored, read again already, or read again now ([`set_file_reader`]). `None`
+/// when only the preview can be had.
+pub fn full_bytes(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if let Some(b) = full_bytes_cached(p, blob) {
+        return Some(b);
+    }
+    let b = Arc::new(FILE_READER.get()?(p)?);
+    let mut c = full();
+    c.push((p.key.clone(), b.clone()));
+    let mut total: usize = c.iter().map(|(_, b)| b.len()).sum();
+    while total > FULL_BYTES && c.len() > 1 {
+        total = total.saturating_sub(c.remove(0).1.len());
+    }
+    Some(b)
+}
+
+/// The size in pixels of image bytes `bytes` (a preview), read from its header.
+pub fn image_size(bytes: &[u8]) -> Option<(u32, u32)> {
+    image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()
+}
+
+// ---------- reading files ----------
+
+/// The prefix of the names the resources of placed documents' art take in a prepared document:
+/// `placed:<key>/<name>`.
+pub const RESOURCE_PREFIX: &str = "placed:";
+
+/// Reads a placed document's file (its bytes) into what it shows: a document holding the
+/// resources (no layers), the art as one group in the file's coordinates, and the frame shown
+/// (the artboard, or the art's bounds). The native format lives above this crate, so the engine
+/// registers one with [`set_loader`].
+pub type Loader = fn(&PlacedDocument, &[u8]) -> Option<(Document, Node, Rect)>;
+
+static LOADER: OnceLock<Loader> = OnceLock::new();
+
+/// Register how files are read (the first registration stays).
+pub fn set_loader(l: Loader) {
+    // Already set: the same loader, registered by another session.
+    let _ = LOADER.set(l);
+}
+
+/// The most files kept read whatever their size.
+const CACHE_SIZE: usize = 64;
+/// Past [`CACHE_SIZE`], the most bytes of files kept read (their own sizes, standing for what
+/// reading them holds).
+const CACHE_BYTES: usize = 256 << 20;
+
+/// A placed document's file read: the art it shows, ready to draw with its own resources.
+pub struct ReadDocument {
+    key: String,
+    /// Read from the preview, not the file.
+    preview: bool,
+    /// The bytes read (what tells a cached read is still the one shown).
+    bytes: Arc<Vec<u8>>,
+    /// The artboard (or art bounds) shown: what the object's box shows.
+    pub frame: Rect,
+    /// The art as one group, in the file's coordinates. Its images, symbols and patterns are
+    /// `doc`'s, under their own names.
+    pub art: Arc<Node>,
+    /// The file's resources and setup (no layers: the art is `art`).
+    pub doc: Arc<Document>,
+}
+
+struct Entry {
+    e: Arc<ReadDocument>,
+    used: u64,
+}
+
+#[derive(Default)]
+struct Cache {
+    entries: std::collections::HashMap<(String, bool), Entry>,
+    clock: u64,
+}
+
+static CACHE: std::sync::LazyLock<Mutex<Cache>> = std::sync::LazyLock::new(Default::default);
+
+fn cache() -> MutexGuard<'static, Cache> {
+    // A panic while the cache was held leaves it whole (entries are only inserted and removed).
+    CACHE.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+impl Cache {
+    /// The read of `key` (its preview's when `preview`; made from `bytes` when given), marked used.
+    fn get(&mut self, key: &str, preview: bool, bytes: Option<&Arc<Vec<u8>>>) -> Option<Arc<ReadDocument>> {
+        self.clock += 1;
+        let clock = self.clock;
+        let e = self.entries.get_mut(&(key.to_string(), preview))?;
+        if bytes.is_some_and(|b| !Arc::ptr_eq(&e.e.bytes, b)) {
+            return None;
+        }
+        e.used = clock;
+        Some(e.e.clone())
+    }
+
+    fn insert(&mut self, e: Arc<ReadDocument>) {
+        self.clock += 1;
+        self.entries.insert((e.key.clone(), e.preview), Entry { e, used: self.clock });
+        // The least recently used go while over both limits.
+        let mut total: usize = self.entries.values().map(|x| x.e.bytes.len()).sum();
+        while self.entries.len() > CACHE_SIZE && total > CACHE_BYTES {
+            let Some(k) = self.entries.iter().min_by_key(|(_, x)| x.used).map(|(k, _)| k.clone()) else { break };
+            if let Some(x) = self.entries.remove(&k) {
+                total = total.saturating_sub(x.e.bytes.len());
+            }
+        }
+    }
+}
+
+/// `p`'s file (`bytes`) read, from the cache when it was read already: what the renderer draws a
+/// placed document from. `None` when it can't be read (or no loader is registered).
+pub fn read(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, false, Some(bytes)) {
+        return Some(e);
+    }
+    let loader = LOADER.get()?;
+    let (doc, art, frame) = loader(p, bytes)?;
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s preview (`bytes`) read as art: one image filling the box.
+fn read_preview(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, true, Some(bytes)) {
+        return Some(e);
+    }
+    let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+    let frame = p.natural();
+    let mut doc = Document::new(frame.width().max(1.0), frame.height().max(1.0));
+    doc.layers.clear();
+    doc.swatches.clear();
+    let mime = if bytes.starts_with(&[0xff, 0xd8]) { "image/jpeg" } else { "image/png" };
+    doc.images.insert("preview".into(), ImageBlob { mime: mime.into(), bytes: bytes.clone(), proxy: None });
+    let xf = Affine::scale_non_uniform(frame.width() / w as f64, frame.height() / h as f64);
+    let im = ImageObject { key: "preview".into(), width: w, height: h, xf, link: None, placement: Default::default() };
+    let art = Node::new(art_id(), NodeKind::Group { children: vec![Arc::new(Node::new(art_id(), NodeKind::Image(im)))], clip: false });
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: true, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s file as read already (else its preview's), without reading it.
+pub fn read_cached(p: &PlacedDocument) -> Option<Arc<ReadDocument>> {
+    let mut c = cache();
+    c.get(&p.key, false, None).or_else(|| c.get(&p.key, true, None))
+}
+
+/// Keep `read` (what [`Loader`] gives), just read from `bytes` for `p` (when it was placed), so
+/// drawing it doesn't read it again.
+pub fn prime(p: &PlacedDocument, bytes: Arc<Vec<u8>>, (doc, art, frame): (Document, Node, Rect)) {
+    cache().insert(Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes, frame, art: Arc::new(art), doc: Arc::new(doc) }));
+}
+
+/// The id the read art's own nodes take (their object's, once expanded).
+fn art_id() -> crate::NodeId {
+    crate::NodeId(0)
+}
+
+/// Visit `n` and every descendant (opacity-mask art included) mutably.
+fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
+    f(n);
+    if let Some(m) = &mut n.mask {
+        each_mut(Arc::make_mut(&mut m.art), f);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        each_mut(Arc::make_mut(c), f);
+    }
+}
+
+/// `n`'s references to images, symbols, patterns and placed files prefixed with `prefix`. Colours
+/// keep their swatch links (a spot colour stays a plate, one with the parent's spot of that name).
+fn rename(n: &mut Node, prefix: &str) {
+    let paint = |p: &mut Paint| {
+        if let Paint::Pattern { pattern, .. } = p {
+            *pattern = format!("{prefix}{pattern}");
+        }
+    };
+    each_mut(n, &mut |n| {
+        for it in &mut n.appearance.items {
+            match it {
+                AppearanceItem::Fill(f) => paint(&mut f.paint),
+                AppearanceItem::Stroke(s) => paint(&mut s.paint),
+            }
+        }
+        match &mut n.kind {
+            NodeKind::Text(t) => {
+                for r in &mut t.runs {
+                    paint(&mut r.style.fill);
+                    paint(&mut r.style.stroke);
+                }
+            }
+            NodeKind::Image(im) => im.key = format!("{prefix}{}", im.key),
+            NodeKind::PlacedDocument(p) => p.key = format!("{prefix}{}", p.key),
+            NodeKind::SymbolInstance { symbol, .. } => *symbol = format!("{prefix}{symbol}"),
+            _ => {}
+        }
+    });
+}
+
+impl Document {
+    /// This document ready to export its placed documents: their files read (the file read again
+    /// when only the preview is stored, else the preview), and the resources their art uses added
+    /// under names of their own ([`RESOURCE_PREFIX`]); the same for the placed documents in that
+    /// art, up to [`MAX_DEPTH`] deep. Borrowed when there is none. (The renderer draws them from
+    /// [`read`] instead.)
+    pub fn with_placed_art(&self) -> Cow<'_, Document> {
+        let mut queue: Vec<(PlacedDocument, usize)> = vec![];
+        let mut seen = BTreeSet::new();
+        self.visit_placed(|_, p| {
+            if seen.insert(p.key.clone()) {
+                queue.push((p.clone(), 0));
+            }
+        });
+        if queue.is_empty() {
+            return Cow::Borrowed(self);
+        }
+        let mut d = self.clone();
+        let mut found: Vec<Arc<ReadDocument>> = vec![];
+        while let Some((p, depth)) = queue.pop() {
+            let Some(blob) = d.images.get(&p.key).cloned() else { continue };
+            let full = if depth < MAX_DEPTH { full_bytes(&p, &blob) } else { None };
+            if full.and_then(|b| read(&p, &b)).is_none() {
+                let preview = if blob.is_proxy() { Some(blob.bytes.clone()) } else { blob.proxy.clone() };
+                if let Some(bytes) = preview {
+                    read_preview(&p, &bytes);
+                }
+            }
+            // What the art (`PlacedDocument::art`) will show.
+            let Some(e) = read_cached(&p) else { continue };
+            let prefix = prefix(&p.key);
+            add_resources(&mut d, &e.doc, &prefix);
+            // The placed documents in that art, under their names here.
+            let inner = std::iter::once(&e.art).chain(e.doc.symbols.iter().map(|s| &s.art)).chain(e.doc.patterns.iter().flat_map(|p| &p.art));
+            for root in inner {
+                walk_all(root, &mut |n| {
+                    if let NodeKind::PlacedDocument(q) = &n.kind {
+                        let key = format!("{prefix}{}", q.key);
+                        if seen.insert(key.clone()) {
+                            queue.push((PlacedDocument { key, ..(**q).clone() }, depth + 1));
+                        }
+                    }
+                });
+            }
+            found.push(e);
+        }
+        // Read last, so all stay read while the art is made (see `PlacedDocument::art`).
+        {
+            let mut c = cache();
+            for e in &found {
+                c.get(&e.key, e.preview, None);
+            }
+        }
+        Cow::Owned(d)
+    }
+
+    /// Drop the resources [`Self::with_placed_art`] added under its names (what a save leaves out).
+    pub fn drop_placed_resources(&mut self) {
+        self.symbols.retain(|s| !s.name.starts_with(RESOURCE_PREFIX));
+        self.patterns.retain(|p| !p.name.starts_with(RESOURCE_PREFIX));
+        self.images.retain(|k, _| !k.starts_with(RESOURCE_PREFIX));
+    }
+}
+
+/// The resources of `src` (a read file's) added to `d` under `prefix`: symbols, patterns, images;
+/// swatches by name, when `d` has none of that name.
+fn add_resources(d: &mut Document, src: &Document, prefix: &str) {
+    for s in &src.symbols {
+        let name = format!("{prefix}{}", s.name);
+        if !d.symbols.iter().any(|x| x.name == name) {
+            let mut s = s.clone();
+            rename(Arc::make_mut(&mut s.art), prefix);
+            d.symbols.push(Symbol { name, ..s });
+        }
+    }
+    for p in &src.patterns {
+        let name = format!("{prefix}{}", p.name);
+        if d.pattern(&name).is_none() {
+            let mut p = p.clone();
+            p.art.iter_mut().for_each(|a| rename(Arc::make_mut(a), prefix));
+            d.patterns.push(PatternDef { name, ..p });
+        }
+    }
+    for (k, b) in &src.images {
+        d.images.entry(format!("{prefix}{k}")).or_insert_with(|| b.clone());
+    }
+    for w in &src.swatches {
+        if d.swatch(&w.name).is_none() {
+            d.swatches.push(w.clone());
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::NodeId;
+
+    fn placed(key: &str) -> PlacedDocument {
+        PlacedDocument {
+            link: LinkInfo::new("/art/logo.vectorcraft"),
+            key: key.into(),
+            bounding: false,
+            width: 80.0,
+            height: 40.0,
+            xf: Affine::translate((10.0, 10.0)),
+            placement: Default::default(),
+        }
+    }
+
+    /// Whatever the bytes: a 40×20 artboard showing a symbol instance and, when the bytes say
+    /// `nest`, a placed document of key `inner`.
+    fn stub_loader(_: &PlacedDocument, bytes: &[u8]) -> Option<(Document, Node, Rect)> {
+        let mut d = Document::new(40.0, 20.0);
+        d.layers.clear();
+        let art = Node::new(
+            NodeId(50),
+            NodeKind::Image(ImageObject { key: "pic".into(), width: 1, height: 1, xf: Affine::IDENTITY, link: None, placement: Default::default() }),
+        );
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(art) });
+        d.images.insert("pic".into(), ImageBlob::new("image/png", vec![1, 2, 3]));
+        let mut children = vec![Arc::new(Node::new(NodeId(51), NodeKind::SymbolInstance { symbol: "Star".into(), xf: Affine::IDENTITY }))];
+        if bytes.starts_with(b"nest") {
+            d.images.insert("inner".into(), ImageBlob::new("application/json", b"leaf".to_vec()));
+            let inner = PlacedDocument { key: "inner".into(), width: 10.0, height: 10.0, xf: Affine::IDENTITY, ..placed("inner") };
+            children.push(Arc::new(Node::new(NodeId(52), NodeKind::PlacedDocument(Box::new(inner)))));
+        }
+        Some((d, Node::new(NodeId(0), NodeKind::Group { children, clip: false }), Rect::new(0.0, 0.0, 40.0, 20.0)))
+    }
+
+    #[test]
+    fn round_trips_through_json() {
+        let n = Node::new(NodeId(3), NodeKind::PlacedDocument(Box::new(placed("doc1-1"))));
+        let v = serde_json::to_value(&n).unwrap();
+        assert_eq!(v["kind"]["type"], "placeddocument");
+        assert_eq!(v["kind"]["link"]["path"], "/art/logo.vectorcraft");
+        let back: Node = serde_json::from_value(v).unwrap();
+        assert_eq!(back, n);
+        assert_eq!(key_for("img00", 2, true), "img00-2b");
+    }
+
+    #[test]
+    fn the_art_and_its_resources_join_only_a_prepared_copy_under_their_own_names() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(Node::new(NodeId(60), NodeKind::Group { children: vec![], clip: false })) });
+        d.images.insert("doc1-1".into(), ImageBlob::new("application/json", b"nest".to_vec()));
+        let p = placed("doc1-1");
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(p.clone())))).unwrap();
+        assert!(d.has_placed());
+        let prepared = d.with_placed_art();
+        let names: Vec<&str> = prepared.symbols.iter().map(|s| s.name.as_str()).collect();
+        // The placed document inside is read too, its resources under its own names.
+        assert_eq!(names, ["Star", "placed:doc1-1/Star", "placed:placed:doc1-1/inner/Star"]);
+        assert!(prepared.images.contains_key("placed:doc1-1/pic"));
+        assert_eq!(d.symbols.len(), 1, "the document itself is unchanged");
+        // The art: a group of the drawing, its resources renamed.
+        let n = d.node(NodeId(7)).unwrap();
+        let art = p.art(n);
+        let [g] = &art[..] else { panic!("{art:?}") };
+        let mut refs = vec![];
+        g.walk(&mut |c| match &c.kind {
+            NodeKind::SymbolInstance { symbol, .. } => refs.push(symbol.clone()),
+            NodeKind::PlacedDocument(q) => {
+                // Its 10×10 box at the file's origin, scaled ×2 into the box at (10, 10).
+                assert_eq!(q.bounds(), Rect::new(10.0, 10.0, 30.0, 30.0));
+                refs.push(q.key.clone())
+            }
+            _ => {}
+        });
+        assert_eq!(refs, ["placed:doc1-1/Star", "placed:doc1-1/inner"]);
+        // For older apps: plain groups all the way down.
+        let mut older = prepared.clone().into_owned();
+        older.placed_as_groups();
+        assert!(!older.has_placed());
+        let mut saved = prepared.into_owned();
+        saved.drop_placed_resources();
+        assert_eq!((saved.symbols.len(), saved.images.len()), (1, 1));
+    }
+
+    #[test]
+    fn more_files_than_the_cache_holds_all_draw() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        let layer = d.layers[0].id;
+        let n = CACHE_SIZE + 10;
+        for i in 0..n {
+            let key = format!("many{i}-1");
+            d.images.insert(key.clone(), ImageBlob::new("application/json", format!("doc {i}").into_bytes()));
+            d.insert(Some(layer), i, Node::new(NodeId(100 + i as u64), NodeKind::PlacedDocument(Box::new(placed(&key))))).unwrap();
+        }
+        let _prepared = d.with_placed_art();
+        let mut empty = 0;
+        d.visit_placed(|n, p| empty += usize::from(p.art(n).is_empty()));
+        assert_eq!(empty, 0, "every file of the document is kept read");
+    }
+
+    #[test]
+    fn a_file_that_cant_be_read_shows_its_preview() {
+        set_loader(stub_loader);
+        let mut png = vec![];
+        image::RgbaImage::from_pixel(8, 4, image::Rgba([0, 200, 0, 255]))
+            .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+            .unwrap();
+        let mut blob = ImageBlob::new("image/png", png);
+        blob.proxy = Some(blob.bytes.clone());
+        let mut d = Document::new(200.0, 200.0);
+        d.images.insert("gone-1".into(), blob);
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(placed("gone-1"))))).unwrap();
+        // No file reader: only the preview can be had.
+        let prepared = d.with_placed_art();
+        assert!(prepared.images.contains_key("placed:gone-1/preview"));
+        let n = d.node(NodeId(7)).unwrap();
+        let NodeKind::PlacedDocument(p) = &n.kind else { panic!("not a placed document") };
+        let art = p.art(n);
+        assert_eq!(art.first().and_then(Node::geometric_bounds), Some(Rect::new(10.0, 10.0, 90.0, 50.0)));
+    }
+}

crates/doc/src/selection.rs

@@ -1,4 +1,4 @@
-//! Selection state (objects and, for direct selection, individual anchors).
+//! Selection state (objects and, for direct selection, individual anchors; ruler guides).
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -29,12 +29,20 @@ pub struct Selection {
     /// clears them.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub slices: Vec<NodeId>,
+    /// Ruler guides selected with a selection tool, as indexes into [`Document::guides`]. They are
+    /// selected on their own: any change to the object selection clears them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub guides: Vec<usize>,
 }
 
 impl Selection {
     pub fn is_empty(&self) -> bool {
         self.objects.is_empty()
     }
+    /// Is anything selected that Delete and the arrow keys act on: objects or ruler guides?
+    pub fn has_objects_or_guides(&self) -> bool {
+        !self.objects.is_empty() || !self.guides.is_empty()
+    }
     pub fn len(&self) -> usize {
         self.objects.len()
     }
@@ -47,6 +55,7 @@ impl Selection {
         self.key = None;
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
     }
     pub fn set(&mut self, ids: impl IntoIterator<Item = NodeId>) {
         self.clear();
@@ -57,6 +66,7 @@ impl Selection {
     pub fn add(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         if !self.objects.contains(&id) {
             self.objects.push(id);
         }
@@ -64,6 +74,7 @@ impl Selection {
     pub fn remove(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         self.objects.retain(|x| *x != id);
         self.anchors.remove(&id);
         if self.key == Some(id) {
@@ -79,6 +90,15 @@ impl Selection {
             }
         }
     }
+    /// Select ruler guides `indexes` (see [`Selection::guides`]) and nothing else.
+    pub fn set_guides(&mut self, indexes: impl IntoIterator<Item = usize>) {
+        self.clear();
+        for i in indexes {
+            if !self.guides.contains(&i) {
+                self.guides.push(i);
+            }
+        }
+    }
     pub fn toggle(&mut self, id: NodeId) {
         if self.contains(id) { self.remove(id) } else { self.add(id) }
     }
@@ -97,12 +117,13 @@ impl Selection {
             self.target = None;
         }
         self.slices.retain(|id| doc.is_slice(*id));
+        self.guides.retain(|i| *i < doc.guides.len());
     }
-    /// Target `id` (see [`Selection::target`]): a layer gets its visible, unlocked art selected,
-    /// anything else is selected itself.
+    /// Target `id` (see [`Selection::target`]): a layer gets its visible, unlocked art selected
+    /// (the art of its sublayers too), anything else is selected itself.
     pub fn set_target(&mut self, doc: &Document, id: NodeId) {
         match doc.node(id) {
-            Some(n) if n.is_layer() => self.set(n.children().into_iter().flatten().filter(|c| c.visible && !c.locked).map(|c| c.id)),
+            Some(n) if n.is_layer() => self.set(n.layer_art(true)),
             _ => self.set([id]),
         }
         self.target = Some(id);
@@ -138,6 +159,23 @@ mod tests {
         assert!(s.is_empty());
     }
 
+    #[test]
+    fn guides_are_selected_on_their_own() {
+        let mut s = Selection::default();
+        s.add(NodeId(1));
+        s.set_guides([2, 0, 2]);
+        assert_eq!((s.objects.clone(), s.guides.clone()), (vec![], vec![2, 0]));
+        assert!(s.has_objects_or_guides() && s.is_empty());
+        s.add(NodeId(1));
+        assert!(s.guides.is_empty());
+        // Pruning drops guides the document no longer has.
+        let mut d = Document::new(100.0, 100.0);
+        d.guides.push(crate::Guide::new(true, 10.0));
+        s.set_guides([0, 1]);
+        s.prune(&d);
+        assert_eq!(s.guides, vec![0]);
+    }
+
     #[test]
     fn selection_changes_clear_the_target() {
         let mut s = Selection::default();

crates/doc/src/tests_units.rs

@@ -60,6 +60,9 @@ fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");
     assert_eq!(Unit::Millimeters.readout(72.0), "25.40 mm");
     assert_eq!(Unit::Inches.readout(-36.0), "-0.50 in");
-    assert_eq!(Unit::Millimeters.number(1.0), "0.353");
-    assert_eq!(Unit::Points.number(-0.0001), "0");
+    assert_eq!(Unit::Millimeters.number(1.0), "0.3528");
+    // Four decimals for the large units, three for the small ones.
+    assert_eq!(Unit::Inches.number(0.5616), "0.0078");
+    assert_eq!((Unit::Inches.number(595.2756), Unit::Points.number(595.2756)), ("8.2677".into(), "595.276".into()));
+    assert_eq!(Unit::Points.number(-0.00001), "0");
 }

crates/doc/src/text.rs

@@ -2,12 +2,15 @@
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::{Color, Paint};
-use vectorcraft_geom::{Affine, PathData, Point, Rect};
+use vectorcraft_geom::{Affine, PathData, Point, Rect, Vec2};
 
 use crate::appearance::{Appearance, AppearanceItem, Dash, FillLayer, LineCap, LineJoin, StrokeLayer};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Justify {
+    /// Align to the start of each paragraph's direction ([`ParaStyle::direction`]): left for
+    /// left-to-right paragraphs, right for right-to-left ones. New type's alignment.
+    Auto,
     #[default]
     Left,
     Center,
@@ -83,6 +86,23 @@ pub struct CharStyle {
     /// size (Document Setup → Type → Small Caps); None = off.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub small_caps: Option<f64>,
+    /// Character Alignment (Character panel menu): where characters smaller than the largest on
+    /// their line line up with it.
+    #[serde(default, rename = "charAlign", skip_serializing_if = "crate::skip::is_default")]
+    pub char_align: CharAlign,
+}
+
+/// Where a character smaller than the largest on its line lines up with it: on the Roman
+/// baseline, or at the top (right, in vertical type), centre or bottom (left) of the ideographic
+/// em boxes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum CharAlign {
+    #[default]
+    RomanBaseline,
+    EmBoxTop,
+    EmBoxCenter,
+    EmBoxBottom,
 }
 
 /// Superscript or subscript proportions in percent of the font size (Document Setup → Type).
@@ -175,6 +195,7 @@ impl Default for CharStyle {
             stroke_miter_limit: 10.0,
             stroke_dash: None,
             position: CharPosition::Normal,
+            char_align: CharAlign::RomanBaseline,
             small_caps: None,
         }
     }
@@ -265,28 +286,209 @@ fn default_align_on() -> char {
 pub const DEFAULT_TAB_INTERVAL: f64 = 36.0;
 
 /// Paragraph attributes (the Paragraph panel).
+///
+/// Saved through [`ParaStyleFile`], which keeps files with text openable by builds from before
+/// [`Justify::Auto`].
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(from = "ParaStyleFile", into = "ParaStyleFile")]
 pub struct ParaStyle {
-    #[serde(default)]
     pub justify: Justify,
-    #[serde(default)]
     pub left_indent: f64,
-    #[serde(default)]
     pub right_indent: f64,
-    #[serde(default)]
     pub first_line_indent: f64,
-    #[serde(default)]
     pub space_before: f64,
-    #[serde(default)]
     pub space_after: f64,
-    #[serde(default)]
     pub hyphenate: bool,
     /// Tab stops (Tabs panel), sorted by position.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub tabs: Vec<TabStop>,
     /// Paragraph style (Paragraph Styles panel) these attributes come from; None = Normal.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub style_name: Option<String>,
+    /// Japanese composition: the spacing of punctuation (Paragraph panel › Mojikumi). Type made
+    /// with the Type tools and `text.create` takes [`Mojikumi::LineEndHalf`]; documents from before
+    /// it and imported text (already set) keep [`Mojikumi::None`].
+    pub mojikumi: Mojikumi,
+    /// Paragraph direction (Paragraph panel): the base direction of each paragraph for
+    /// bidirectional text (UAX #9). None: from each paragraph's first strong character (Hebrew or
+    /// Arabic: right to left).
+    pub direction: Option<ParaDirection>,
+    /// How leading is measured (Paragraph panel menu): from baseline to baseline, or from the top
+    /// of one line's ideographic em box to the next.
+    pub leading_model: LeadingModel,
+    /// Hanging punctuation (Paragraph panel menu › Burasagari): a comma or full stop ending a line
+    /// may stand outside the frame. New type takes [`Burasagari::Standard`]; documents from before
+    /// it and imported text keep [`Burasagari::None`].
+    pub burasagari: Burasagari,
+}
+
+/// [`ParaStyle`] as saved. [`Justify::Auto`] is written as the alignment it has in the paragraph
+/// direction (`Right` for right to left, else `Left`) with `justify_auto` set: builds without Auto
+/// read the alignment and ignore the flag, and builds with it read Auto back.
+#[derive(Serialize, Deserialize)]
+struct ParaStyleFile {
+    #[serde(default)]
+    justify: Justify,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    justify_auto: bool,
+    #[serde(default)]
+    left_indent: f64,
+    #[serde(default)]
+    right_indent: f64,
+    #[serde(default)]
+    first_line_indent: f64,
+    #[serde(default)]
+    space_before: f64,
+    #[serde(default)]
+    space_after: f64,
+    #[serde(default)]
+    hyphenate: bool,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    tabs: Vec<TabStop>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    style_name: Option<String>,
+    #[serde(default, skip_serializing_if = "Mojikumi::is_none")]
+    mojikumi: Mojikumi,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    direction: Option<ParaDirection>,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    leading_model: LeadingModel,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    burasagari: Burasagari,
+}
+
+impl From<ParaStyle> for ParaStyleFile {
+    fn from(p: ParaStyle) -> Self {
+        let justify_auto = p.justify == Justify::Auto;
+        let justify = match p.justify {
+            Justify::Auto if p.direction == Some(ParaDirection::RightToLeft) => Justify::Right,
+            Justify::Auto => Justify::Left,
+            j => j,
+        };
+        let ParaStyle {
+            left_indent,
+            right_indent,
+            first_line_indent,
+            space_before,
+            space_after,
+            hyphenate,
+            tabs,
+            style_name,
+            mojikumi,
+            direction,
+            leading_model,
+            burasagari,
+            ..
+        } = p;
+        Self {
+            justify,
+            justify_auto,
+            left_indent,
+            right_indent,
+            first_line_indent,
+            space_before,
+            space_after,
+            hyphenate,
+            tabs,
+            style_name,
+            mojikumi,
+            direction,
+            leading_model,
+            burasagari,
+        }
+    }
+}
+
+impl From<ParaStyleFile> for ParaStyle {
+    fn from(f: ParaStyleFile) -> Self {
+        let justify = if f.justify_auto { Justify::Auto } else { f.justify };
+        let ParaStyleFile {
+            left_indent,
+            right_indent,
+            first_line_indent,
+            space_before,
+            space_after,
+            hyphenate,
+            tabs,
+            style_name,
+            mojikumi,
+            direction,
+            leading_model,
+            burasagari,
+            ..
+        } = f;
+        Self {
+            justify,
+            left_indent,
+            right_indent,
+            first_line_indent,
+            space_before,
+            space_after,
+            hyphenate,
+            tabs,
+            style_name,
+            mojikumi,
+            direction,
+            leading_model,
+            burasagari,
+        }
+    }
+}
+
+/// A paragraph's base direction ([`ParaStyle::direction`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ParaDirection {
+    LeftToRight,
+    RightToLeft,
+}
+
+/// How a paragraph's leading is measured.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum LeadingModel {
+    /// From one line's baseline to the next's: a line's leading is the space above it, and area
+    /// type's first baseline follows Area Type Options › First Baseline.
+    #[default]
+    RomanBaseline,
+    /// From the top of one line's ideographic em box (the right side, in vertical type) to the
+    /// next's: a line's leading is the space below it, and area type's first line touches the top
+    /// of the frame. Japanese layout's usual model.
+    EmBoxTop,
+}
+
+/// How Japanese punctuation is spaced (JLREQ 3.1). Full-width punctuation is half a glyph and half
+/// a space: an opening bracket's space before it, a closing bracket's, a comma's or a full stop's
+/// after it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Mojikumi {
+    /// Every character takes its full advance.
+    #[default]
+    None,
+    /// Consecutive punctuation shares one half-em space (JLREQ 3.1.4), and a closing bracket,
+    /// comma or full stop ending a line is set half width.
+    LineEndHalf,
+}
+
+impl Mojikumi {
+    pub fn is_none(&self) -> bool {
+        *self == Mojikumi::None
+    }
+}
+
+/// Hanging punctuation (burasagari): an East Asian comma or full stop ending a line (、。，．､｡)
+/// stands outside the line's measure, in the space its punctuation spacing gives it (half width
+/// with Line-end Punctuation Half Width). Closing brackets and Latin punctuation don't hang. Shown
+/// as None / Regular / Force.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Burasagari {
+    /// A comma or full stop that doesn't fit goes to the next line with the character before it.
+    #[default]
+    None,
+    /// A comma or full stop that doesn't fit hangs outside the line; one that fits stays inside.
+    Standard,
+    /// A comma or full stop ending a line always hangs, and the rest of the line fills the measure.
+    Forced,
 }
 
 /// Area Type Options "First Baseline" offset.
@@ -363,6 +565,36 @@ impl PathEffect {
     }
 }
 
+/// Type on a Path Options › Align to Path: which height of the type runs along the path.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum PathAlign {
+    /// The font's top edge: the type hangs below the path.
+    Ascender,
+    /// The font's bottom edge: the type stands above the path.
+    Descender,
+    /// Halfway between the ascender and the descender.
+    Center,
+    /// The baseline (the default).
+    #[default]
+    Baseline,
+}
+
+impl PathAlign {
+    pub const ALL: [PathAlign; 4] = [PathAlign::Ascender, PathAlign::Descender, PathAlign::Center, PathAlign::Baseline];
+    pub fn id(self) -> &'static str {
+        match self {
+            PathAlign::Ascender => "ascender",
+            PathAlign::Descender => "descender",
+            PathAlign::Center => "center",
+            PathAlign::Baseline => "baseline",
+        }
+    }
+    pub fn parse(s: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|a| a.id().eq_ignore_ascii_case(s.trim()))
+    }
+}
+
 /// Area Type Options: rows and columns, gutters, inset and first baseline of area type.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -407,8 +639,48 @@ pub enum TextKind {
     Point,
     /// Area type flowed inside `frame` (document coordinates, untransformed by `xf`).
     Area { frame: PathData },
-    /// Type on a path, starting at `start` (0..1 of the path length).
-    OnPath { path: PathData, start: f64 },
+    /// Type on a path, flowing from its start bracket `start` to its end bracket `end` (0..1 of the
+    /// path length; no `end`: the end of the path, or once round a closed path). See
+    /// [`TextKind::path_span`].
+    OnPath {
+        path: PathData,
+        start: f64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        end: Option<f64>,
+    },
+}
+
+impl TextKind {
+    /// Type on a path's span: from its start to its end bracket, as fractions of its path's length.
+    /// Round a closed path the end may be past 1 (the span runs on past the path's start), a full
+    /// turn without an end or with the end at the start. None for other type.
+    pub fn path_span(&self) -> Option<(f64, f64)> {
+        let TextKind::OnPath { path, start, end } = self else { return None };
+        let s = fraction(*start);
+        Some(if path.is_closed() {
+            let run = end.map_or(0.0, |e| (fraction(e) - s).rem_euclid(1.0));
+            (s, s + if run < 1e-9 { 1.0 } else { run })
+        } else {
+            (s, end.map_or(1.0, |e| fraction(e).max(s)))
+        })
+    }
+}
+
+/// `x` as a fraction of a path's length (0..1; 0 when not finite).
+fn fraction(x: f64) -> f64 {
+    if x.is_finite() { x.clamp(0.0, 1.0) } else { 0.0 }
+}
+
+/// `path` run the other way, each point as far from its new start as it was from its old end
+/// (the subpaths in reverse order, a closed one keeping its first anchor first).
+fn reverse_from_end(path: &mut PathData) {
+    path.subpaths.reverse();
+    for sp in &mut path.subpaths {
+        sp.reverse();
+        if sp.closed && !sp.anchors.is_empty() {
+            sp.anchors.rotate_right(1);
+        }
+    }
 }
 
 /// A text object. `runs` split into paragraphs at `\n`.
@@ -429,12 +701,24 @@ pub struct TextObject {
     /// Type on a Path effect (type on a path only).
     #[serde(default, rename = "pathEffect", skip_serializing_if = "crate::skip::is_default")]
     pub path_effect: PathEffect,
+    /// Type on a Path Options › Align to Path (type on a path only).
+    #[serde(default, rename = "pathAlign", skip_serializing_if = "crate::skip::is_default")]
+    pub path_align: PathAlign,
+    /// Type on a Path Options › Spacing in points (type on a path only): glyphs are spaced as if
+    /// set this far above the path, which closes them up round the outside of a curve and opens
+    /// them up round the inside.
+    #[serde(default, rename = "pathSpacing", skip_serializing_if = "crate::skip::is_default")]
+    pub path_spacing: f64,
     /// Wrap objects above this area type, resolved by the engine after each edit (text space).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub wrap: Vec<WrapShape>,
     /// Cached layout bounds in text space, filled in by the layout engine (not serialized).
     #[serde(skip)]
     pub cached_bounds: Option<Rect>,
+    /// Cached baselines in text space, start to end, one per line that holds characters (a
+    /// vertical column's centre line), filled in with `cached_bounds` (not serialized).
+    #[serde(skip)]
+    pub cached_baselines: Vec<(Point, Point)>,
 }
 
 impl TextObject {
@@ -447,8 +731,11 @@ impl TextObject {
             para: ParaStyle::default(),
             area: AreaOptions::default(),
             path_effect: PathEffect::default(),
+            path_align: PathAlign::default(),
+            path_spacing: 0.0,
             wrap: Vec::new(),
             cached_bounds: None,
+            cached_baselines: Vec::new(),
         }
     }
     pub fn plain_text(&self) -> String {
@@ -476,6 +763,72 @@ impl TextObject {
     pub fn transform(&mut self, a: Affine) {
         self.xf = a * self.xf;
     }
+    /// Type on a path's path in document space; None for other type.
+    pub fn type_path(&self) -> Option<PathData> {
+        match &self.kind {
+            TextKind::OnPath { path, .. } => Some(path.transformed(self.xf)),
+            _ => None,
+        }
+    }
+    /// Flip type on a path to the other side of its path (Type on a Path Options › Flip, or its
+    /// centre bracket dragged across the path): the path runs the other way and the brackets swap
+    /// ends, so the type keeps its stretch of the path. False, changing nothing, for other type.
+    pub fn flip_on_path(&mut self) -> bool {
+        let Some((s, e)) = self.kind.path_span() else { return false };
+        let TextKind::OnPath { path, start, end } = &mut self.kind else { return false };
+        reverse_from_end(path);
+        if path.is_closed() {
+            *start = (1.0 - e).rem_euclid(1.0);
+            *end = (e - s < 1.0 - 1e-9).then(|| (1.0 - s).rem_euclid(1.0));
+        } else {
+            *start = 1.0 - e;
+            *end = (s > 1e-9).then_some(1.0 - s);
+        }
+        true
+    }
+    /// Area type's frame (the type area) in document space; None for other type.
+    pub fn area_frame(&self) -> Option<PathData> {
+        match &self.kind {
+            TextKind::Area { frame } => Some(frame.transformed(self.xf)),
+            _ => None,
+        }
+    }
+    /// Reshape area type's frame by `a`, a document-space transform, keeping the type at its size
+    /// (a bounding-box resize: the text reflows, it isn't scaled). False, changing nothing, for
+    /// other type, a degenerate `xf` or a frame that would not be finite.
+    pub fn transform_area(&mut self, a: Affine) -> bool {
+        let xf = self.xf;
+        self.reshape_area(|frame, to_text| {
+            frame.transform(to_text * a * xf);
+            true
+        })
+    }
+    /// Move anchors `refs` (subpath, anchor) of area type's frame by `d` in document space, with
+    /// their handles (a Direct Selection drag of a frame corner or edge). False, changing
+    /// nothing, when an anchor doesn't exist, or as [`Self::transform_area`].
+    pub fn move_area_anchors(&mut self, refs: &[(usize, usize)], d: Vec2) -> bool {
+        self.reshape_area(|frame, to_text| {
+            // A distance: only the linear part of the document → text map applies.
+            let local = to_text * d.to_point() - to_text * Point::ZERO;
+            refs.iter().all(|&(si, ai)| frame.anchor_mut(si, ai).map(|a| a.translate(local)).is_some())
+        })
+    }
+    /// Edit a copy of the area frame with `f` (given the document → text space map) and keep it
+    /// when `f` succeeds and the result is finite.
+    fn reshape_area(&mut self, f: impl FnOnce(&mut PathData, Affine) -> bool) -> bool {
+        let det = self.xf.determinant();
+        if !det.is_finite() || det.abs() < 1e-12 {
+            return false;
+        }
+        let to_text = self.xf.inverse();
+        let TextKind::Area { frame } = &mut self.kind else { return false };
+        let mut next = frame.clone();
+        if !f(&mut next, to_text) || !next.anchors().all(|(_, _, a)| a.p.is_finite() && a.h_in.is_finite() && a.h_out.is_finite()) {
+            return false;
+        }
+        *frame = next;
+        true
+    }
     /// Scale the character strokes' weights and dashes by `s` (they are drawn in text space, so
     /// `1 / scale` keeps their weight through a transform that scales the type).
     pub fn scale_char_strokes(&mut self, s: f64) {
@@ -491,6 +844,15 @@ impl TextObject {
     pub fn local_bounds(&self) -> Rect {
         self.cached_bounds.unwrap_or_else(|| self.estimate_bounds())
     }
+    /// The baselines in text space (the layout cache): for point type with none cached, the first
+    /// one across [`Self::local_bounds`] (down the first column's centre line for vertical type).
+    pub fn baselines(&self) -> impl Iterator<Item = (Point, Point)> + '_ {
+        let first = (self.cached_baselines.is_empty() && matches!(self.kind, TextKind::Point)).then(|| {
+            let b = self.local_bounds();
+            if self.vertical { (Point::new(0.0, b.y0), Point::new(0.0, b.y1)) } else { (Point::new(b.x0, 0.0), Point::new(b.x1, 0.0)) }
+        });
+        self.cached_baselines.iter().copied().chain(first)
+    }
 }
 
 #[cfg(test)]
@@ -505,4 +867,90 @@ mod tests {
         assert!(b.x0 >= 10.0 - 1e-9 && b.y1 > 20.0);
         assert_eq!(CharStyle::default().effective_leading(), 14.399999999999999);
     }
+
+    /// 120 × 40 area type at (40, 40), its text drawn at twice its size.
+    fn area_type() -> TextObject {
+        let mut t = TextObject::point(Point::ZERO, "Some text", CharStyle::default());
+        t.kind = TextKind::Area { frame: vectorcraft_geom::shapes::rectangle(Rect::new(0.0, 0.0, 60.0, 20.0)) };
+        t.xf = Affine::translate((40.0, 40.0)) * Affine::scale(2.0);
+        t
+    }
+
+    #[test]
+    fn area_resizes_its_frame_and_keeps_its_type() {
+        let mut t = area_type();
+        assert_eq!(t.bounds(), Some(Rect::new(40.0, 40.0, 160.0, 80.0)));
+        // Bottom-right handle to (200, 140), about the top-left corner.
+        let o = Affine::translate((40.0, 40.0));
+        assert!(t.transform_area(o * Affine::scale_non_uniform(160.0 / 120.0, 100.0 / 40.0) * o.inverse()));
+        assert_eq!(t.xf, Affine::translate((40.0, 40.0)) * Affine::scale(2.0), "the type keeps its size");
+        let b = t.bounds().unwrap();
+        assert!((b.x1 - 200.0).abs() < 1e-9 && (b.y1 - 140.0).abs() < 1e-9 && b.x0 == 40.0, "{b:?}");
+        assert_eq!(t.area_frame().unwrap().bounds(), Some(b));
+        // Point type has no area; a degenerate transform or a non-finite frame changes nothing.
+        let mut p = TextObject::point(Point::ZERO, "x", CharStyle::default());
+        assert!(!p.transform_area(Affine::scale(2.0)) && p.area_frame().is_none());
+        let before = t.clone();
+        assert!(!t.transform_area(Affine::scale(f64::INFINITY)));
+        t.xf = Affine::scale(0.0);
+        assert!(!t.transform_area(Affine::scale(2.0)));
+        t.xf = before.xf;
+        assert_eq!(t, before);
+    }
+
+    #[test]
+    fn area_anchors_move_in_document_space() {
+        let mut t = area_type();
+        // The bottom-right corner (anchor 2) 20 pt right: 10 pt in text space at 2×.
+        assert!(t.move_area_anchors(&[(0, 2)], Vec2::new(20.0, 0.0)));
+        let TextKind::Area { frame } = &t.kind else { panic!() };
+        assert_eq!(frame.subpaths[0].anchors[2].p, Point::new(70.0, 20.0));
+        assert_eq!(frame.subpaths[0].anchors[1].p, Point::new(60.0, 0.0), "the others stay");
+        // A missing anchor changes nothing.
+        let before = t.clone();
+        assert!(!t.move_area_anchors(&[(0, 1), (0, 9)], Vec2::new(5.0, 5.0)));
+        assert!(!t.move_area_anchors(&[(3, 0)], Vec2::new(5.0, 5.0)));
+        assert_eq!(t, before);
+    }
+
+    /// Builds from before [`Justify::Auto`] read new type's alignment as Left or Right (and ignore
+    /// `justify_auto`); this build reads Auto back.
+    #[test]
+    fn auto_alignment_saves_readable_by_older_builds() {
+        #[derive(Deserialize, Debug, PartialEq)]
+        enum OldJustify {
+            Left,
+            Center,
+            Right,
+            JustifyLeft,
+            JustifyCenter,
+            JustifyRight,
+            JustifyAll,
+        }
+        #[derive(Deserialize)]
+        struct OldPara {
+            justify: OldJustify,
+        }
+        #[derive(Deserialize)]
+        struct OldText {
+            para: OldPara,
+        }
+        for (direction, physical) in
+            [(Some(ParaDirection::RightToLeft), OldJustify::Right), (Some(ParaDirection::LeftToRight), OldJustify::Left), (None, OldJustify::Left)]
+        {
+            let mut t = TextObject::point(Point::ZERO, "שלום", CharStyle::default());
+            t.para = ParaStyle { justify: Justify::Auto, direction, ..Default::default() };
+            let json = serde_json::to_string(&t).unwrap();
+            let old: OldText = serde_json::from_str(&json).unwrap();
+            assert_eq!(old.para.justify, physical, "{json}");
+            assert_eq!(serde_json::from_str::<TextObject>(&json).unwrap(), t);
+        }
+        // Other alignments save as before, without the flag.
+        let p = ParaStyle { justify: Justify::Right, ..Default::default() };
+        let json = serde_json::to_string(&p).unwrap();
+        assert!(!json.contains("justify_auto"), "{json}");
+        assert_eq!(serde_json::from_str::<ParaStyle>(&json).unwrap(), p);
+        // Files from before the flag keep their alignment.
+        assert_eq!(serde_json::from_str::<ParaStyle>(r#"{"justify":"Center"}"#).unwrap().justify, Justify::Center);
+    }
 }

crates/effects/src/bake.rs

@@ -324,14 +324,19 @@ pub fn bake_appearance(n: &Node) -> Option<Node> {
     Some(m)
 }
 
-/// A copy of `doc` with every live geometry effect baked into plain paths, or `None` when the
-/// document has none (export it as is).
+/// A copy of `doc` ready to export: every live geometry effect baked into plain paths, and the
+/// resources of its placed documents' art added ([`Document::with_placed_art`]); `None` when
+/// there is nothing to do (export it as is).
 pub fn bake_document(doc: &Document) -> Option<Document> {
-    if !doc.layers.iter().any(|l| needs_bake(l)) {
-        return None;
+    let placed = doc.with_placed_art();
+    if !placed.layers.iter().any(|l| needs_bake(l)) {
+        return match placed {
+            std::borrow::Cow::Owned(d) => Some(d),
+            std::borrow::Cow::Borrowed(_) => None,
+        };
     }
-    let mut d = doc.clone();
-    let layers = doc.layers.clone();
+    let mut d = placed.into_owned();
+    let layers = d.layers.clone();
     d.layers = layers.iter().map(|l| bake_node(&mut d, l).map(Arc::new).unwrap_or_else(|| l.clone())).collect();
     Some(d)
 }

crates/effects/src/reshape.rs

@@ -26,6 +26,7 @@ pub fn needs_outline(n: &Node) -> bool {
             | NodeKind::Envelope { .. }
             | NodeKind::Mesh(_)
             | NodeKind::Repeat(_)
+            | NodeKind::PlacedDocument(_)
     )
 }
 

crates/engine/src/cmd/buildcmds.rs

@@ -16,10 +16,11 @@ use serde_json::{Value, json};
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::appearance::{AppearanceItem, FillLayer, StrokeLayer};
 use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind, Selection};
-use vectorcraft_geom::{FillRule, Point, Rect, Shape as _};
+use vectorcraft_geom::{FillRule, PathData, Point, Rect, SubPath};
 use vectorcraft_pathops as po;
 use vectorcraft_tools::builder::{
-    self as b, EDGE_NAME, FACE_NAME, LIVE_PAINT_NAME, SOURCES_NAME, edge_near, face_at, is_live_paint, sample_polyline, shapes_for, sorted_roots,
+    self as b, BuilderMap, EDGE_NAME, FACE_NAME, LIVE_PAINT_NAME, SOURCES_NAME, Touched, edge_near, face_at, is_live_paint, sample_polyline,
+    sorted_roots,
 };
 use vectorcraft_trace as tr;
 
@@ -38,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shape Builder",
             [],
             None,
-            "{ids?: [id…] (default: selection), points: [[x,y]…] (drag path; one point = click), erase?: bool (Alt-drag deletes the regions), fill?: \"#rrggbb\" | {color|swatch|gradient|none} (default: the fill of the object under the first point)} → {ids, merged, regions}",
+            "{ids?: [id…] (default: selection), points: [[x,y]…] (drag path; one point = click), erase?: bool (erase mode, Alt: deletes the regions touched, and the pieces of unfilled open paths and the edges (outline pieces between the points where paths meet; see shapeBuilder.regions) within tolerance; a deleted edge opens its path there, and edges bounding a deleted region go with it), tolerance?: pt (2, erase only), fill?: \"#rrggbb\" | {color|swatch|gradient|none} (default: the fill of the object under the first point; the current fill for an area only lines enclose)} → {ids, merged, regions, lines, edges} (counts deleted or merged)",
             has_selection_or_ids,
             sb_merge
         ),
@@ -47,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shape Builder Regions",
             [],
             None,
-            "{ids?} → {regions: [{bounds: [x0,y0,x1,y1], area, sources: [id…]}]} faces of the planar arrangement",
+            "{ids?} → {regions: [{bounds: [x0,y0,x1,y1], area, sources: [id…]}], lines: [{bounds, source: id}], edges: [{bounds, source: id}]} faces of the planar arrangement (unfilled open paths cut them; sources is empty for an area only they enclose), the pieces of those open paths and the edges (the other paths' outlines cut where paths meet; source: the front-most path along it), which erasing deletes",
             has_selection_or_ids,
             sb_regions
         ),
@@ -224,47 +225,91 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "points must be a non-empty list of finite [x,y]"));
     }
     let erase = bool_or(p, "erase", false);
+    // Line pieces and edges are only deleted (erase mode), never merged.
+    let piece_tol = erase.then(|| f64_or(p, "tolerance", 2.0).clamp(0.0, 1000.0));
     let fill = fill_param(s, p, C)?;
+    let current_fill = s.paint.fill.clone();
     let roots = root_ids(s, p)?;
     let label = if erase { "Shape Builder Delete" } else { "Shape Builder" };
-    let (ids, merged, count) = s.edit(label, |d, sel| {
-        let (shapes, leaves) = shapes_for(d, &roots);
+    let (ids, merged, touched) = s.edit(label, |d, sel| {
+        let (map, leaves) = BuilderMap::new(d, &roots, erase);
         let leaves: Vec<Node> = leaves.into_iter().cloned().collect();
-        if shapes.is_empty() {
+        if map.shapes.is_empty() {
             return Err(EngineError::Other("Shape Builder: select paths or compound paths".into()));
         }
-        let regs = po::regions(&shapes);
-        let shapes_r: Vec<(kurbo::BezPath, Rect)> = regs.iter().map(|r| (r.path.to_bezpath(), r.path.bounds().unwrap_or(Rect::ZERO))).collect();
         let step = (d.bounds_of(&roots, false).map(|r| r.width().max(r.height())).unwrap_or(100.0) / 2000.0).max(0.25);
-        let mut touched: Vec<usize> = vec![];
+        let mut touched = Touched::default();
         for q in sample_polyline(&pts, step) {
-            if let Some(i) = shapes_r.iter().position(|(bp, bb)| bb.contains(q) && bp.winding(q) != 0)
-                && !touched.contains(&i)
-            {
-                touched.push(i);
-            }
+            touched.add(map.hit(q, piece_tol));
         }
+        touched.edges = map.erased_edges(&touched);
         if touched.is_empty() {
             return Err(EngineError::Other("Shape Builder: no region under the pointer".into()));
         }
-        let picked: Vec<&po::Region> = touched.iter().map(|&i| &regs[i]).collect();
-        let union = po::merge_regions(&picked);
-        let affected: Vec<bool> = (0..shapes.len()).map(|i| picked.iter().any(|r| r.sources.contains(&i))).collect();
-        let style_src = regs[touched[0]].top();
+        let cuts: Vec<&SubPath> = touched.edges.iter().filter_map(|&k| map.edges.get(k)?.0.path.subpaths.first()).collect();
+        // Edges come back from the planar map within a few hundredths of the outlines they follow.
+        let cut_tol = step * 0.2;
+        let picked: Vec<&po::Region> = touched.regions.iter().filter_map(|&i| map.regions.get(i).map(|r| &r.0)).collect();
+        let faces = po::FaceMerger::new(&map.shapes);
+        let union = if picked.is_empty() { PathData::default() } else { faces.merge(&picked) };
+        // The merged shape takes the look of the front-most object over the first region, or (for an
+        // area only lines enclose) of the front-most object and the current fill.
+        let covered = picked.iter().find_map(|r| r.top());
+        let style_src = covered.or(map.shapes.len().checked_sub(1));
+        let merged_fill = fill.or_else(|| covered.is_none().then_some(current_fill));
         let mut new_nodes: Vec<Node> = vec![];
         let mut merged_id = None;
-        for (i, (sh, leaf)) in shapes.iter().zip(&leaves).enumerate() {
-            if !affected[i] {
-                new_nodes.push(d.reid(leaf));
+        for (i, (sh, leaf)) in map.shapes.iter().zip(&leaves).enumerate() {
+            let pieces: Vec<usize> = map.lines.iter().enumerate().filter(|(_, (l, _))| l.key == i as u64).map(|(k, _)| k).collect();
+            if !pieces.is_empty() {
+                // An open path loses the pieces deleted and those between merged (or deleted) regions.
+                let keep: Vec<usize> =
+                    pieces.iter().copied().filter(|k| !touched.lines.contains(k) && !map.line_between(*k, &touched.regions)).collect();
+                if keep.len() == pieces.len() {
+                    new_nodes.push(d.reid(leaf));
+                } else {
+                    for k in keep {
+                        if let Some((l, _)) = map.lines.get(k) {
+                            new_nodes.push(shape_node(d, l.path.clone(), Some(leaf)));
+                        }
+                    }
+                }
             } else {
-                let rest = po::boolean(&sh.path, sh.rule, &union, FillRule::NonZero, po::BoolOp::Difference);
-                if !rest.is_empty() {
+                // A shape loses the regions deleted or merged, then the edges deleted (each one on
+                // its outline, shared edges from every shape along them).
+                let in_union = picked.iter().any(|r| r.sources.contains(&i));
+                let mut rest = if in_union {
+                    // What is left of it: its faces not merged or deleted, united. They share their
+                    // edges with the merged faces exactly, where subtracting the merged shape left
+                    // slivers of the outline along them (#569).
+                    let kept: Vec<&po::Region> = map
+                        .regions
+                        .iter()
+                        .enumerate()
+                        .filter(|(k, (r, ..))| r.sources.contains(&i) && !touched.regions.contains(k))
+                        .map(|(_, (r, ..))| r)
+                        .collect();
+                    if kept.is_empty() { PathData::default() } else { faces.merge(&kept) }
+                } else {
+                    b::node_outline(leaf).map_or_else(|| sh.path.clone(), |o| o.0)
+                };
+                let fill_closes = !leaf.appearance.fill_paint().is_none();
+                let mut cut = false;
+                for piece in &cuts {
+                    if let Some(r) = po::cut_out(&rest, piece, fill_closes, cut_tol) {
+                        rest = r;
+                        cut = true;
+                    }
+                }
+                if !in_union && !cut {
+                    new_nodes.push(d.reid(leaf));
+                } else if !rest.is_empty() {
                     new_nodes.push(shape_node(d, rest, Some(leaf)));
                 }
             }
-            if !erase && Some(i) == style_src {
+            if !erase && !union.is_empty() && Some(i) == style_src {
                 let mut m = shape_node(d, union.clone(), Some(leaf));
-                if let Some(f) = &fill {
+                if let Some(f) = &merged_fill {
                     m.appearance.set_fill(f.clone());
                 }
                 merged_id = Some(m.id);
@@ -273,9 +318,15 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
         }
         let new_ids = replace_roots(d, &roots, new_nodes)?;
         sel.set(new_ids.iter().copied());
-        Ok((new_ids, merged_id, touched.len()))
+        Ok((new_ids, merged_id, touched))
     })?;
-    Ok(json!({ "ids": ids_json(&ids), "merged": merged.map(|m| m.0), "regions": count }))
+    Ok(json!({
+        "ids": ids_json(&ids),
+        "merged": merged.map(|m| m.0),
+        "regions": touched.regions.len(),
+        "lines": touched.lines.len(),
+        "edges": touched.edges.len(),
+    }))
 }
 
 /// Remove the roots and insert `nodes` where the front-most root was. Returns the new ids.
@@ -300,20 +351,23 @@ fn replace_roots(d: &mut Document, roots: &[NodeId], nodes: Vec<Node>) -> Result
 fn sb_regions(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = root_ids(s, p)?;
     let d = &s.doc()?.doc;
-    let (shapes, leaves) = shapes_for(d, &roots);
-    let regs = po::regions(&shapes);
-    let out: Vec<Value> = regs
+    let (map, leaves) = BuilderMap::new(d, &roots, true);
+    let id_of = |i: usize| leaves.get(i).map(|n| n.id.0);
+    let regions: Vec<Value> = map
+        .regions
         .iter()
-        .filter_map(|r| {
-            let bb = r.path.bounds()?;
-            Some(json!({
+        .map(|(r, _, bb)| {
+            json!({
                 "bounds": [bb.x0, bb.y0, bb.x1, bb.y1],
                 "area": po::area(&r.path, FillRule::NonZero),
-                "sources": r.sources.iter().map(|&i| leaves[i].id.0).collect::<Vec<_>>(),
-            }))
+                "sources": r.sources.iter().filter_map(|&i| id_of(i)).collect::<Vec<_>>(),
+            })
         })
         .collect();
-    Ok(json!({ "regions": out }))
+    let pieces = |list: &[(po::Shape, Rect)]| -> Vec<Value> {
+        list.iter().map(|(l, bb)| json!({ "bounds": [bb.x0, bb.y0, bb.x1, bb.y1], "source": id_of(l.key as usize) })).collect()
+    };
+    Ok(json!({ "regions": regions, "lines": pieces(&map.lines), "edges": pieces(&map.edges) }))
 }
 
 // ---------- Live Paint ----------
@@ -597,6 +651,11 @@ fn trace_params(p: &Value) -> Result<tr::TraceParams> {
     serde_json::from_value(v).map_err(|e| bad("imageTrace.make", e.to_string()))
 }
 
+/// The most anchor points an Image Trace may make: a photo traced at high fidelity can make
+/// millions, more than the canvas draws smoothly or a laptop has memory for, so the trace is
+/// refused with advice instead (#525).
+pub const MAX_TRACE_ANCHORS: usize = 2_000_000;
+
 fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     const C: &str = "imageTrace.make";
     let params = trace_params(p)?;
@@ -628,7 +687,7 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     };
     let blob = s.doc()?.doc.images.get(&img.key).ok_or_else(|| EngineError::Other(format!("image data `{}` is missing", img.key)))?;
     let raster = tr::Raster::decode(&blob.bytes).map_err(|e| EngineError::Other(e.to_string()))?;
-    let res = tr::trace(&raster, &params);
+    let res = tr::trace_within(&raster, &params, MAX_TRACE_ANCHORS).map_err(|e| EngineError::Other(e.to_string()))?;
     // Pixel space of the decoded raster → the image object's pixel space → document.
     let sx = img.width.max(1) as f64 / raster.width.max(1) as f64;
     let sy = img.height.max(1) as f64 / raster.height.max(1) as f64;

crates/engine/src/cmd/clipboard.rs

@@ -21,7 +21,7 @@ use vectorcraft_color::Swatch;
 use vectorcraft_doc::{Document, GraphicStyle, ImageBlob, Node, NodeId, PatternDef, Symbol, TextStyleDef};
 use vectorcraft_geom::Rect;
 
-pub use flavours::{BITMAP, EMF, Flavour, PASTE_ORDER, PDF, PNG, SVG, TEXT};
+pub use flavours::{BITMAP, EMF, FILE_HEAD, Flavour, PASTE_ORDER, PDF, PNG, SVG, TEXT, file_flavour};
 pub(crate) use resources::SwatchChoices;
 
 use super::*;
@@ -87,11 +87,14 @@ pub struct Clipboard {
     /// The open document the objects came from ([`DocState::uid`]): pasting back into it uses its
     /// own resources as they are now.
     pub source_doc: Option<u64>,
+    /// An artboard copied with the Artboard tool (`artboard.copy`); `nodes` are then its art. Pasting
+    /// adds a copy of it with the art.
+    pub artboard: Option<vectorcraft_doc::Artboard>,
 }
 
 impl Clipboard {
     pub fn is_empty(&self) -> bool {
-        self.nodes.is_empty()
+        self.nodes.is_empty() && self.artboard.is_none()
     }
 
     /// Objects `roots` of `st`'s document with their resources, source artboard and layers.

crates/engine/src/cmd/clipboard/flavours.rs

@@ -30,6 +30,23 @@ pub const EMF: &str = "image/emf";
 /// What Paste reads from other apps, best first: vector art before text, text before bitmaps
 /// (word processors offer a picture of copied text too).
 pub const PASTE_ORDER: [&str; 5] = [SVG, PDF, EMF, TEXT, BITMAP];
+/// How much of a copied file [`file_flavour`] needs to tell what it is.
+pub const FILE_HEAD: usize = 4096;
+
+/// What a file copied in a file manager pastes as, if one of `mimes` (`image/*`: any bitmap):
+/// SVG, PDF, a Windows metafile or a bitmap (its own `image/…` type), told from its first
+/// [`FILE_HEAD`] bytes and its name. The file's bytes are that flavour's data.
+pub fn file_flavour(name: &str, head: &[u8], mimes: &[&str]) -> Option<&'static str> {
+    let f = fileio::detect(name, head)?;
+    let (asked, mime) = match f.id {
+        "svg" => (SVG, SVG),
+        "pdf" => (PDF, PDF),
+        "emf" | "wmf" => (EMF, EMF),
+        _ if f.raster => (BITMAP, f.mime),
+        _ => return None,
+    };
+    mimes.contains(&asked).then_some(mime)
+}
 
 /// One representation of the clipboard's contents.
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -283,7 +300,7 @@ fn import_text(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "the text is empty"));
     }
     let mut t = TextObject::point(Point::ZERO, text, super::super::create::new_type_style(s, &Value::Null));
-    t.cached_bounds = Some(vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t).bounds);
+    crate::cmd::typecmd::refresh_bounds(&mut t);
     let n = Node::new(NodeId(1), NodeKind::Text(Box::new(t)));
     let count = s.load_clipboard(Clipboard { nodes: vec![n], ..Default::default() }, p)?;
     Ok(json!({ "count": count }))

crates/engine/src/cmd/clipboard/resources.rs

@@ -127,6 +127,7 @@ fn node_refs(n: &Node, f: Visit) {
                 }
             }
             NodeKind::Image(im) => f(Ref::Name(Res::Image, &im.key)),
+            NodeKind::PlacedDocument(pl) => f(Ref::Name(Res::Image, &pl.key)),
             NodeKind::SymbolInstance { symbol, .. } => f(Ref::Name(Res::Symbol, symbol)),
             _ => {}
         }
@@ -444,6 +445,7 @@ impl Relink {
                 }
             }
             NodeKind::Image(im) => self.name(Res::Image, &mut im.key),
+            NodeKind::PlacedDocument(pl) => self.name(Res::Image, &mut pl.key),
             NodeKind::SymbolInstance { symbol, .. } => self.name(Res::Symbol, symbol),
             _ => {}
         }

crates/engine/src/cmd/colormgmt.rs

@@ -8,9 +8,11 @@
 //! become active when assigned.
 
 use std::collections::BTreeMap;
+use std::sync::Arc;
 
 use serde_json::{Value, json};
 use vectorcraft_color::cms::{self, ColorSettings, Intent, Model, ProofTarget};
+use vectorcraft_color::recolor::Neutral;
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::ColorMode;
 use vectorcraft_render::proof;
@@ -55,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert Document Color Mode",
             [],
             None,
-            "same as file.documentColorMode: {mode: \"cmyk\"|\"rgb\", convert?: true, intent?} → {changed} (an alias kept for older scripts; the command palette leaves it out)",
+            "same as file.documentColorMode: {mode: \"cmyk\"|\"rgb\", convert?: true, intent?, grays?} → {changed} (an alias kept for older scripts; the command palette leaves it out)",
             has_doc,
             convert_mode
         ),
@@ -232,6 +234,28 @@ fn assign_profile(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"rgb": rgb, "cmyk": cmyk}))
 }
 
+/// How Document Color Mode converts neutral RGB greys (R = G = B) to CMYK (the `grays` param).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Grays {
+    /// Through the CMYK profile like any colour: four-colour greys and a rich black.
+    #[default]
+    Profile,
+    /// On the black plate only: K is the grey's ink percentage (as Convert to Grayscale and then
+    /// to CMYK would give).
+    Black,
+}
+
+impl Grays {
+    /// The `grays` param of `cmd`: `"profile"` (default) or `"black"`.
+    pub(crate) fn param(cmd: &str, p: &Value) -> Result<Self> {
+        match str_param(p, "grays").map(str::to_ascii_lowercase).as_deref() {
+            None | Some("profile") => Ok(Grays::Profile),
+            Some("black") => Ok(Grays::Black),
+            Some(g) => Err(bad(cmd, format!("grays must be \"profile\" or \"black\", not `{g}`"))),
+        }
+    }
+}
+
 /// File → Document Color Mode (`file.documentColorMode` and its alias
 /// `object.convertDocumentColorMode`): set the mode and, unless `convert: false`, convert every
 /// colour through the colour settings.
@@ -243,6 +267,7 @@ pub(crate) fn convert_mode(s: &mut Session, p: &Value) -> Result<Value> {
         _ => return Err(bad(C, "mode must be \"cmyk\" or \"rgb\"")),
     };
     let intent = intent_param(p, C)?;
+    let grays = Grays::param(C, p)?;
     // Choosing the mode the document already has (the checked menu item) is not an edit.
     if s.doc()?.doc.color_mode == mode {
         return Ok(json!({ "changed": 0 }));
@@ -250,18 +275,20 @@ pub(crate) fn convert_mode(s: &mut Session, p: &Value) -> Result<Value> {
     let convert = bool_or(p, "convert", true);
     let mut changed = 0usize;
     s.edit("Document Color Mode", |d, _| {
-        changed = set_color_mode(d, mode, convert, intent);
+        changed = set_color_mode(d, mode, convert, intent, grays);
         Ok(())
     })?;
     Ok(json!({ "changed": changed }))
 }
 
-/// Put `d` in colour `mode` and, with `convert`, convert every colour of its art, symbols and
-/// swatches through the colour settings (`intent`, default: theirs) → how many colours changed.
-/// Greys stay greys (they print on the black plate in either mode); Lab colours (spot colour
+/// Put `d` in colour `mode` and, with `convert`, convert every colour of its art, symbols,
+/// pattern tiles and swatches through the colour settings (`intent`, default: theirs) → how many
+/// colours of the art, symbols and patterns changed. Gray colours stay Gray (they print on the
+/// black plate in either mode); RGB greys are colours like any other and separate through the
+/// CMYK profile, unless `grays` puts them on the black plate. Lab colours (spot colour
 /// definitions) are device independent and fit either mode. Document Color Mode and
 /// `document.open {colorMode}` both convert this way.
-pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode, convert: bool, intent: Option<Intent>) -> usize {
+pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode, convert: bool, intent: Option<Intent>, grays: Grays) -> usize {
     d.color_mode = mode;
     if !convert {
         return 0;
@@ -269,15 +296,25 @@ pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode,
     let c = cms::active();
     let intent = intent.unwrap_or(c.settings().intent);
     let model = if mode == ColorMode::Cmyk { Model::Cmyk } else { Model::Rgb };
-    let conv = |col: &Color| if matches!(col, Color::Gray { .. } | Color::Lab { .. }) { *col } else { c.convert(col, model, intent) };
+    let k_only = model == Model::Cmyk && grays == Grays::Black;
+    let conv = |col: &Color| match col {
+        Color::Gray { .. } | Color::Lab { .. } => *col,
+        // Grey ink percentage, then K only (a Gray colour's CMYK).
+        Color::Rgb { .. } if k_only && Neutral::of(col).is_some() => c.convert(&c.convert(col, Model::Gray, intent), Model::Cmyk, intent),
+        _ => c.convert(col, model, intent),
+    };
     let mut changed = 0usize;
-    proof::map_document_colors(d, &mut |col, _| {
+    let mut count = |col: &Color, _: proof::Link| {
         let n = conv(col);
         if n != *col {
             changed += 1;
         }
         n
-    });
+    };
+    proof::map_document_colors(d, &mut count);
+    for a in d.patterns.iter_mut().flat_map(|p| &mut p.art) {
+        proof::map_node_colors(Arc::make_mut(a), &mut count);
+    }
     for sw in d.swatches_iter_mut() {
         match &mut sw.paint {
             Paint::Solid { color, .. } => *color = conv(color),

crates/engine/src/cmd/create.rs

@@ -50,7 +50,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Create Text",
             [],
             None,
-            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height}} → {id}",
+            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id}",
             has_doc,
             text_create
         ),
@@ -166,7 +166,13 @@ fn rect_of(p: &Value, cmd: &str) -> Result<Rect> {
 fn rectangle(s: &mut Session, p: &Value) -> Result<Value> {
     let r = rect_of(p, "shape.rectangle")?;
     let radius = f64_or(p, "radius", 0.0).max(0.0);
-    let live = LiveShape::Rectangle { w: r.width(), h: r.height(), radii: [radius; 4], xf: Affine::translate(r.origin().to_vec2()) };
+    let live = LiveShape::Rectangle {
+        w: r.width(),
+        h: r.height(),
+        radii: [radius; 4],
+        kinds: Default::default(),
+        xf: Affine::translate(r.origin().to_vec2()),
+    };
     let label = if radius > 0.0 { "Rounded Rectangle" } else { "Rectangle" };
     add_art(s, label, path_kind(live.to_path(), Some(live)), None)
 }
@@ -182,7 +188,8 @@ fn polygon(s: &mut Session, p: &Value) -> Result<Value> {
     let r = f64_req(p, "radius", "shape.polygon")?.abs();
     let sides = p.get("sides").and_then(Value::as_u64).unwrap_or(6).clamp(3, 1000) as u32;
     let rot = f64_or(p, "rotation", 0.0);
-    let live = LiveShape::Polygon { radius: r, sides, xf: Affine::translate(c.to_vec2()) * Affine::rotate(rot.to_radians()) };
+    let xf = Affine::translate(c.to_vec2()) * Affine::rotate(rot.to_radians());
+    let live = LiveShape::Polygon { radius: r, sides, xf, radii: vec![], kinds: vec![] };
     add_art(s, "Polygon", path_kind(live.to_path(), Some(live)), None)
 }
 
@@ -402,16 +409,68 @@ fn text_create(s: &mut Session, p: &Value) -> Result<Value> {
     let text = str_param(p, "text").unwrap_or("");
     let mut t = TextObject::point(Point::new(x, y), text, new_type_style(s, p));
     t.vertical = p.get("vertical").and_then(Value::as_bool).unwrap_or(false);
+    t.para = new_type_para();
+    new_type_alignment(s, p, "text.create", &mut t)?;
     if let Some(a) = p.get("area") {
         let w = f64_or(a, "width", 200.0);
         let h = f64_or(a, "height", 100.0);
         t.kind = vectorcraft_doc::TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, w, h)) };
     }
-    let lay = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t);
-    t.cached_bounds = Some(lay.bounds);
+    if bool_or(p, "placeholder", false) {
+        super::typemenu::fill_with_placeholder(&mut t);
+    } else {
+        super::typecmd::refresh_bounds(&mut t);
+    }
     add_node(s, "Type", NodeKind::Text(Box::new(t)), Appearance::default(), None)
 }
 
+/// The paragraph attributes new type gets (the Type tools, `text.create`): aligned to the start of
+/// each paragraph's direction (left, right for Hebrew and Arabic), Japanese punctuation composed
+/// with Line-end Punctuation Half Width and Standard burasagari (as in Illustrator). Imported text
+/// keeps its own.
+pub(crate) fn new_type_para() -> vectorcraft_doc::ParaStyle {
+    vectorcraft_doc::ParaStyle {
+        justify: vectorcraft_doc::Justify::Auto,
+        mojikumi: vectorcraft_doc::Mojikumi::LineEndHalf,
+        burasagari: vectorcraft_doc::Burasagari::Standard,
+        ..Default::default()
+    }
+}
+
+/// The leading model and character alignment new type starts with (`t`'s paragraph and runs):
+/// `leadingModel` and `charAlign` from `p`, else em box top to top and em box centre while the
+/// interface is in Japanese (#432), else the Roman baseline for both. Noted in the journal, so a
+/// replay sets the same whatever the interface.
+pub(crate) fn new_type_alignment(s: &mut Session, p: &Value, cmd: &str, t: &mut TextObject) -> Result<()> {
+    use vectorcraft_doc::{CharAlign, LeadingModel};
+    let japanese = s.japanese_interface();
+    let leading = match p.get("leadingModel").filter(|v| !v.is_null()) {
+        Some(v) => match v.as_str() {
+            Some("romanBaseline") => LeadingModel::RomanBaseline,
+            Some("emBoxTop") => LeadingModel::EmBoxTop,
+            _ => return Err(bad(cmd, "`leadingModel` must be \"romanBaseline\" or \"emBoxTop\"")),
+        },
+        None => {
+            let l = if japanese { LeadingModel::EmBoxTop } else { LeadingModel::RomanBaseline };
+            s.note_journal("leadingModel", json!(l));
+            l
+        }
+    };
+    let align = match super::textedit::char_align_param(p, cmd)? {
+        Some(a) => a,
+        None => {
+            let a = if japanese { CharAlign::EmBoxCenter } else { CharAlign::RomanBaseline };
+            s.note_journal("charAlign", json!(a));
+            a
+        }
+    };
+    t.para.leading_model = leading;
+    for r in &mut t.runs {
+        r.style.char_align = align;
+    }
+    Ok(())
+}
+
 /// The character style new type gets: `size`, `font`, `style` and `color` from `p`, else the
 /// defaults, filled with the current fill unless that is None or white (black then).
 pub(crate) fn new_type_style(s: &Session, p: &Value) -> CharStyle {

crates/engine/src/cmd/distortcmds.rs

@@ -418,6 +418,7 @@ fn not_liquified(n: &Node) -> Option<&'static str> {
         NodeKind::Mesh(_) => "meshes",
         NodeKind::Envelope { .. } => "envelopes",
         NodeKind::Repeat(_) => "repeats",
+        NodeKind::PlacedDocument(_) => "placed documents",
         NodeKind::Blend { .. } => "blends",
         _ => return None,
     })

crates/engine/src/cmd/docinfo.rs

@@ -49,13 +49,14 @@ pub const CATEGORIES: [(&str, &str); 11] = [
 ];
 
 /// The object counts of `document.info` and their labels.
-const OBJECT_LABELS: [(&str, &str); 16] = [
+const OBJECT_LABELS: [(&str, &str); 17] = [
     ("paths", "Paths"),
     ("compoundPaths", "Compound Paths"),
     ("groups", "Groups"),
     ("clipGroups", "Clipping Masks"),
     ("textObjects", "Text Objects"),
     ("images", "Images"),
+    ("placedDocuments", "Placed Documents"),
     ("symbolInstances", "Symbol Instances"),
     ("gradients", "Gradient Objects"),
     ("patterns", "Pattern Objects"),
@@ -252,6 +253,7 @@ fn info(s: &mut Session, p: &Value) -> Result<Value> {
                 NodeKind::Envelope { .. } => Some("envelopes"),
                 NodeKind::Mesh(_) => Some("meshes"),
                 NodeKind::Repeat(_) => Some("repeats"),
+                NodeKind::PlacedDocument(_) => Some("placedDocuments"),
             };
             if let Some(k) = k {
                 *counts.entry(k).or_default() += 1;

crates/engine/src/cmd/docmenu.rs

@@ -6,7 +6,8 @@ use std::collections::BTreeSet;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{CharStyle, Guide, Node, NodeId, NodeKind, TextKind};
+use vectorcraft_doc::{CharStyle, Guide, Node, NodeId, NodeKind, SavedSelection, TextKind};
+use vectorcraft_geom::Vec2;
 
 use super::edit::selected_roots;
 use super::*;
@@ -93,15 +94,30 @@ pub fn specs() -> Vec<CommandSpec> {
             "Save Selection…",
             ["Select"],
             None,
-            "{name?} remember the current selection for this session (default name \"Selection N\") → {name}",
+            "{name?} save the current selection under a name, in the document (default \"Selection N\"; an existing name is replaced; at most 25, names up to 255 characters) → {name}",
             has_selection,
             save_selection
         ),
-        cmd!("select.recall", "Recall Selection", ["Select"], None, "{name} → {count}", has_doc, recall_selection),
-        cmd!("select.editSaved", "Edit Selection…", ["Select"], None, "{name, newName?: rename, delete?: bool}", has_doc, edit_saved),
+        cmd!(
+            "select.recall",
+            "Recall Selection",
+            ["Select"],
+            None,
+            "{name} select the objects of a saved selection (those since deleted are left out) → {count}",
+            has_saved_selection,
+            recall_selection
+        ),
+        cmd!(
+            "select.editSaved",
+            "Edit Selection…",
+            ["Select"],
+            None,
+            "{name, newName?: rename, delete?: bool} | {edits: [{name, newName?, delete?}…]} rename or delete saved selections, all in one undo step; names are those before the edit and must stay unique",
+            has_saved_selection,
+            edit_saved
+        ),
         cmd!(query "select.savedList", "Saved Selections", [], None, "{} → [name…] for the active document", has_doc, |s, _| {
-            let t = s.doc()?.title();
-            Ok(json!(s.menu.saved_selections.iter().filter(|x| x.0 == t).map(|x| x.1.clone()).collect::<Vec<_>>()))
+            Ok(json!(s.doc()?.doc.saved_selections.iter().map(|x| x.name.clone()).collect::<Vec<_>>()))
         }),
         cmd!(
             "view.guides.make",
@@ -139,16 +155,58 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             clear_guides
         ),
-        cmd!("guide.add", "Add Guide", [], None, "{vertical: bool, pos: pt (x for vertical, y for horizontal)} → {index}", has_doc, guide_add),
-        cmd!("guide.remove", "Remove Guide", [], None, "{index}", guides_unlocked, guide_remove),
-        cmd!("guide.move", "Move Guide", [], None, "{index, pos: pt}", guides_unlocked, guide_move),
+        cmd!(
+            "guide.add",
+            "Add Guide",
+            [],
+            None,
+            "{vertical: bool, pos: pt (x for vertical, y for horizontal), artboard?: index (an artboard guide: it runs across that artboard only and moves, is copied and is deleted with it; default a canvas guide, across the whole canvas)} → {index}",
+            has_doc,
+            guide_add
+        ),
+        cmd!(
+            query "guide.list",
+            "Guides",
+            [],
+            None,
+            "{} → [{index, vertical, pos, selected, artboard?: index (an artboard guide's)}…] the ruler guides",
+            has_doc,
+            guide_list
+        ),
+        cmd!(
+            "guide.select",
+            "Select Guides",
+            [],
+            None,
+            "{indexes: [index…], toggle?: bool} select ruler guides on their own (deselecting the art); toggle adds or removes them instead → {selected: [index…]}",
+            guides_unlocked,
+            guide_select
+        ),
+        cmd!(
+            "guide.remove",
+            "Remove Guide",
+            [],
+            None,
+            "{index?} delete ruler guide `index`, else the selected ones (as Delete / edit.clear does) → {count}",
+            guides_unlocked,
+            guide_remove
+        ),
+        cmd!(
+            "guide.move",
+            "Move Guide",
+            [],
+            None,
+            "{index, pos: pt} put ruler guide `index` at `pos` | {dx?, dy?: pt, copy?: bool} move the selected guides (vertical ones by dx, horizontal ones by dy); copy leaves them and selects the moved copies",
+            guides_unlocked,
+            guide_move
+        ),
         cmd!("file.closeAll", "Close All", ["File"], Some("Cmd+Alt+W"), "{} → {closed}", has_doc, close_all),
         cmd!(
             "file.documentColorMode",
             "Document Color Mode",
             ["File", "Document Color Mode"],
             None,
-            "{mode: \"cmyk\"|\"rgb\", convert?: true (convert every colour of the art, symbols and swatches through the colour settings; swatch links kept; greys stay greys), intent?} → {changed}",
+            "{mode: \"cmyk\"|\"rgb\", convert?: true (convert every colour of the art, symbols, pattern tiles and swatches through the colour settings; swatch links kept; Gray colours stay Gray, on the black plate), intent?, grays?: \"profile\" (default: RGB greys separate through the CMYK profile like any colour, into four-colour greys and a rich black) | \"black\" (to CMYK, RGB greys with R = G = B go on the black plate only, K = their grey value)} → {changed}",
             has_doc,
             super::colormgmt::convert_mode
         ),
@@ -259,43 +317,79 @@ fn direction_handles(s: &mut Session, _: &Value) -> Result<Value> {
 }
 
 fn save_selection(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "select.save";
     let st = s.doc()?;
-    let title = st.title();
     let ids = st.selection.objects.clone();
-    let name = match str_param(p, "name").filter(|n| !n.trim().is_empty()) {
-        Some(n) => n.trim().to_string(),
-        None => {
-            let mut i = 1;
-            while s.menu.saved_selections.iter().any(|x| x.0 == title && x.1 == format!("Selection {i}")) {
-                i += 1;
-            }
-            format!("Selection {i}")
+    let saved = &st.doc.saved_selections;
+    let name = str_param(p, "name").and_then(SavedSelection::clean_name).unwrap_or_else(|| SavedSelection::default_name(saved));
+    let existing = saved.iter().position(|x| x.name == name);
+    if existing.is_none() && saved.len() >= SavedSelection::MAX {
+        return Err(bad(C, format!("a document keeps at most {} saved selections", SavedSelection::MAX)));
+    }
+    s.edit("Save Selection", |d, _| {
+        let entry = SavedSelection { name: name.clone(), objects: ids };
+        match existing.and_then(|i| d.saved_selections.get_mut(i)) {
+            Some(x) => *x = entry,
+            None => d.saved_selections.push(entry),
         }
-    };
-    s.menu.saved_selections.retain(|x| !(x.0 == title && x.1 == name));
-    s.menu.saved_selections.push((title, name.clone(), ids));
+        Ok(())
+    })?;
     Ok(json!({ "name": name }))
 }
 
-fn saved_index(s: &Session, p: &Value, cmd: &str) -> Result<usize> {
-    let name = str_param(p, "name").ok_or_else(|| bad(cmd, "missing name"))?;
-    let t = s.doc()?.title();
-    s.menu.saved_selections.iter().position(|x| x.0 == t && x.1 == name).ok_or_else(|| bad(cmd, format!("no saved selection `{name}`")))
-}
-
 fn recall_selection(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = saved_index(s, p, "select.recall")?;
-    let ids = s.menu.saved_selections[i].2.clone();
+    const C: &str = "select.recall";
+    let name = str_param(p, "name").ok_or_else(|| bad(C, "missing name"))?;
+    let ids = s.doc()?.doc.saved_selections.iter().find(|x| x.name == name).map(|x| x.objects.clone());
+    let ids = ids.ok_or_else(|| bad(C, format!("no saved selection `{name}`")))?;
     s.select(|d, sel| sel.set(ids.into_iter().filter(|id| d.node(*id).is_some())))?;
     Ok(json!({ "count": s.doc()?.selection.len() }))
 }
 
+/// Recall and Edit Selection… need a document with at least one saved selection.
+fn has_saved_selection(s: &Session) -> std::result::Result<(), String> {
+    let st = s.active().ok_or("no document open")?;
+    if st.doc.saved_selections.is_empty() { Err("no saved selections".into()) } else { Ok(()) }
+}
+
 fn edit_saved(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = saved_index(s, p, "select.editSaved")?;
-    if bool_or(p, "delete", false) {
-        s.menu.saved_selections.remove(i);
-    } else if let Some(n) = str_param(p, "newName").filter(|n| !n.trim().is_empty()) {
-        s.menu.saved_selections[i].1 = n.trim().to_string();
+    const C: &str = "select.editSaved";
+    let edits = match p.get("edits").and_then(Value::as_array) {
+        Some(list) => list.as_slice(),
+        None => std::slice::from_ref(p),
+    };
+    let before = s.doc()?.doc.saved_selections.clone();
+    // Edits name the selections as they are now, so they don't depend on each other's order.
+    let mut after: Vec<Option<SavedSelection>> = before.iter().cloned().map(Some).collect();
+    // Files may hold any number of saved selections: keep this linear.
+    let mut index = std::collections::HashMap::with_capacity(before.len());
+    for (i, x) in before.iter().enumerate() {
+        index.entry(x.name.as_str()).or_insert(i);
+    }
+    for e in edits {
+        let name = str_param(e, "name").ok_or_else(|| bad(C, "missing name"))?;
+        let i = *index.get(name).ok_or_else(|| bad(C, format!("no saved selection `{name}`")))?;
+        let Some(slot) = after.get_mut(i) else { continue };
+        if bool_or(e, "delete", false) {
+            *slot = None;
+        } else if let Some(n) = str_param(e, "newName").and_then(SavedSelection::clean_name)
+            && let Some(x) = slot
+        {
+            x.name = n;
+        }
+    }
+    let after: Vec<SavedSelection> = after.into_iter().flatten().collect();
+    let mut names = std::collections::HashSet::with_capacity(after.len());
+    for x in &after {
+        if !names.insert(x.name.as_str()) {
+            return Err(bad(C, format!("two saved selections would be named `{}`", x.name)));
+        }
+    }
+    if after != before {
+        s.edit("Edit Selection", |d, _| {
+            d.saved_selections = after;
+            Ok(())
+        })?;
     }
     ok()
 }
@@ -377,6 +471,10 @@ fn release_guides(s: &mut Session, _: &Value) -> Result<Value> {
 fn lock_guides(s: &mut Session, p: &Value) -> Result<Value> {
     let v = p.get("locked").and_then(Value::as_bool).unwrap_or(!s.menu.guides_locked);
     s.menu.guides_locked = v;
+    // Locked guides can't stay selected.
+    if v && !s.doc()?.selection.guides.is_empty() {
+        s.select(|_, sel| sel.guides.clear())?;
+    }
     Ok(json!({ "locked": v }))
 }
 
@@ -400,35 +498,112 @@ fn clear_guides(s: &mut Session, _: &Value) -> Result<Value> {
 fn guide_add(s: &mut Session, p: &Value) -> Result<Value> {
     let pos = f64_req(p, "pos", "guide.add")?;
     let vertical = bool_or(p, "vertical", false);
+    let artboard = match p.get("artboard").filter(|v| !v.is_null()) {
+        Some(v) => {
+            let boards = &s.doc()?.doc.artboards;
+            let ab = v.as_u64().and_then(|i| boards.get(usize::try_from(i).ok()?)).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+            Some(ab.id)
+        }
+        None => None,
+    };
     let i = s.edit("New Guide", |d, _| {
-        d.guides.push(Guide { vertical, pos });
+        d.guides.push(Guide { artboard, ..Guide::new(vertical, pos) });
         Ok(d.guides.len() - 1)
     })?;
     Ok(json!({ "index": i }))
 }
 
-fn guide_index(s: &Session, p: &Value, cmd: &str) -> Result<usize> {
-    let i = p.get("index").and_then(Value::as_u64).ok_or_else(|| bad(cmd, "missing index"))? as usize;
+fn guide_list(s: &mut Session, _: &Value) -> Result<Value> {
+    let st = s.doc()?;
+    let row = |(i, g): (usize, &Guide)| {
+        let mut r = json!({ "index": i, "vertical": g.vertical, "pos": g.pos, "selected": st.selection.guides.contains(&i) });
+        if let Some(ab) = st.doc.artboards.iter().position(|a| Some(a.id) == g.artboard) {
+            r["artboard"] = json!(ab);
+        }
+        r
+    };
+    Ok(Value::Array(st.doc.guides.iter().enumerate().map(row).collect()))
+}
+
+/// Ruler guide `index` of the active document (`index` validated).
+fn guide_index(s: &Session, v: Option<&Value>, cmd: &str) -> Result<usize> {
+    let i = v.and_then(Value::as_u64).and_then(|i| usize::try_from(i).ok()).ok_or_else(|| bad(cmd, "an index must be a whole number"))?;
     if i >= s.doc()?.doc.guides.len() {
-        return Err(bad(cmd, "no such guide"));
+        return Err(bad(cmd, format!("no guide {i}")));
     }
     Ok(i)
 }
 
-fn guide_remove(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = guide_index(s, p, "guide.remove")?;
-    s.edit("Delete Guide", |d, _| {
-        d.guides.remove(i);
-        Ok(())
-    })?;
-    ok()
+fn guide_select(s: &mut Session, p: &Value) -> Result<Value> {
+    let list = p.get("indexes").and_then(Value::as_array).ok_or_else(|| bad("guide.select", "missing indexes"))?;
+    let picked = list.iter().map(|v| guide_index(s, Some(v), "guide.select")).collect::<Result<Vec<_>>>()?;
+    if bool_or(p, "toggle", false) {
+        let mut now = s.doc()?.selection.guides.clone();
+        for i in picked {
+            if let Some(k) = now.iter().position(|g| *g == i) {
+                now.remove(k);
+            } else {
+                now.push(i);
+            }
+        }
+        s.select(|_, sel| sel.set_guides(now))?;
+    } else {
+        s.select(|_, sel| sel.set_guides(picked))?;
+    }
+    Ok(json!({ "selected": s.doc()?.selection.guides }))
 }
 
-fn guide_move(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = guide_index(s, p, "guide.move")?;
-    let pos = f64_req(p, "pos", "guide.move")?;
-    s.edit("Move Guide", |d, _| {
-        d.guides[i].pos = pos;
+/// Delete ruler guide `index`, else the selected guides, in one undo step → {count}.
+pub(crate) fn guide_remove(s: &mut Session, p: &Value) -> Result<Value> {
+    let gone: Vec<usize> = match p.get("index") {
+        Some(v) => vec![guide_index(s, Some(v), "guide.remove")?],
+        None => s.doc()?.selection.guides.clone(),
+    };
+    if gone.is_empty() {
+        return Err(bad("guide.remove", "no guide selected"));
+    }
+    let label = if gone.len() == 1 { "Delete Guide" } else { "Delete Guides" };
+    s.edit(label, |d, sel| {
+        d.retain_guides(sel, |i, _| !gone.contains(&i));
+        Ok(())
+    })?;
+    Ok(json!({ "count": gone.len() }))
+}
+
+/// Put ruler guide `index` at `pos`, else move (or copy) the selected guides, in one undo step.
+pub(crate) fn guide_move(s: &mut Session, p: &Value) -> Result<Value> {
+    if let Some(v) = p.get("index") {
+        let i = guide_index(s, Some(v), "guide.move")?;
+        let pos = f64_req(p, "pos", "guide.move")?;
+        s.edit("Move Guide", |d, _| {
+            if let Some(g) = d.guides.get_mut(i) {
+                g.pos = pos;
+            }
+            Ok(())
+        })?;
+        return ok();
+    }
+    let moving = s.doc()?.selection.guides.clone();
+    if moving.is_empty() {
+        return Err(bad("guide.move", "no guide selected (or give an index)"));
+    }
+    let (dx, dy, copy) = (f64_or(p, "dx", 0.0), f64_or(p, "dy", 0.0), bool_or(p, "copy", false));
+    s.edit(if copy { "Copy Guide" } else { "Move Guide" }, |d, sel| {
+        let mut copies = vec![];
+        for &i in &moving {
+            let Some(g) = d.guides.get_mut(i) else { continue };
+            let moved = g.moved(Vec2::new(dx, dy));
+            if copy {
+                copies.push(moved);
+            } else {
+                *g = moved;
+            }
+        }
+        if copy {
+            let first = d.guides.len();
+            d.guides.extend(copies);
+            sel.set_guides(first..d.guides.len());
+        }
         Ok(())
     })?;
     ok()

crates/engine/src/cmd/draw2.rs

@@ -45,6 +45,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             remove_anchor
         ),
+        cmd!(
+            "path.removeAnchors",
+            "Remove Anchor Points",
+            ["Object", "Path"],
+            None,
+            "{} remove the direct-selected anchors without opening their paths, refitting the curve round each → {removedObjects}",
+            has_anchors,
+            remove_anchors
+        ),
         cmd!(
             "path.convertAnchor",
             "Convert Anchor Point",
@@ -592,66 +601,62 @@ fn remove_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
     let ai = usize_req(p, "anchor", C)?;
     let removed = s.edit("Delete Anchor Point", |d, sel| {
-        let path = path_mut(d, id)?;
-        let sp = path.subpaths.get_mut(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
-        let n = sp.anchors.len();
-        if ai >= n {
+        let sp = path_mut(d, id)?.subpaths.get(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
+        if ai >= sp.anchors.len() {
             return Err(EngineError::Other("no such anchor".into()));
         }
-        let interior = sp.closed || (ai > 0 && ai + 1 < n);
-        if interior && n >= 3 {
-            let (pi, ni) = ((ai + n - 1) % n, (ai + 1) % n);
-            let (prev, a, next) = (sp.anchors[pi], sp.anchors[ai], sp.anchors[ni]);
-            // Keep the outer tangents; stretch them to span both removed segments.
-            let l1 = prev.p.distance(a.p);
-            let l2 = a.p.distance(next.p);
-            let chord = prev.p.distance(next.p).max(1e-9);
-            let first_line = !prev.has_out() && !a.has_in();
-            let second_line = !a.has_out() && !next.has_in();
-            let (mut hout, mut hin) = (prev.h_out, next.h_in);
-            if !(first_line && second_line) {
-                // Curved: stretch the outer handles to span both segments; a straight side aims a
-                // third of the chord at the removed anchor.
-                hout = if prev.has_out() {
-                    prev.p + (prev.h_out - prev.p) * ((l1 + l2) / l1.max(1e-9)).min(3.0)
-                } else {
-                    prev.p + (a.p - prev.p) * (chord / 3.0 / l1.max(1e-9))
-                };
-                hin = if next.has_in() {
-                    next.p + (next.h_in - next.p) * ((l1 + l2) / l2.max(1e-9)).min(3.0)
-                } else {
-                    next.p + (a.p - next.p) * (chord / 3.0 / l2.max(1e-9))
-                };
-            }
-            sp.anchors[pi].h_out = hout;
-            sp.anchors[ni].h_in = hin;
-        }
-        sp.anchors.remove(ai);
-        if !sp.closed && !sp.anchors.is_empty() {
-            let (f, l) = (0, sp.anchors.len() - 1);
-            let a0 = sp.anchors[f].p;
-            sp.anchors[f].h_in = a0;
-            let al = sp.anchors[l].p;
-            sp.anchors[l].h_out = al;
-        }
-        if sp.anchors.len() < 3 {
-            sp.closed = sp.closed && sp.anchors.len() == 2 && sp.anchors.iter().any(|a| a.has_in() || a.has_out());
-        }
-        let empty = sp.anchors.len() < 2;
-        if empty {
-            path.subpaths.remove(si);
-        }
-        if path.is_empty() {
-            d.remove(id)?;
-            sel.clear();
-            return Ok(true);
-        }
-        sel.anchors.remove(&id);
-        Ok(false)
+        remove_anchors_of(d, sel, id, [(si, ai)])
     })?;
     Ok(json!({ "removedObject": removed }))
 }
 
+fn remove_anchors(s: &mut Session, _: &Value) -> Result<Value> {
+    let st = s.doc()?;
+    let jobs: Vec<(NodeId, Vec<(usize, usize)>)> = st
+        .selection
+        .anchors
+        .iter()
+        .filter(|(id, set)| !set.is_empty() && st.doc.node(**id).is_some_and(|n| matches!(n.kind, NodeKind::Path { .. })))
+        .map(|(id, set)| (*id, set.iter().copied().collect()))
+        .collect();
+    if jobs.is_empty() {
+        return Err(bad("path.removeAnchors", "direct-select anchor points of a path"));
+    }
+    let removed = s.edit("Remove Anchor Points", |d, sel| {
+        let mut removed = 0;
+        for (id, anchors) in jobs {
+            removed += usize::from(remove_anchors_of(d, sel, id, anchors)?);
+        }
+        Ok(removed)
+    })?;
+    Ok(json!({ "removedObjects": removed }))
+}
+
+/// Remove `anchors` (subpath, anchor) of path `id` without opening it, refitting the curve round
+/// each one; a subpath left with one anchor goes, and the path with its last subpath. True when
+/// the path went.
+fn remove_anchors_of(d: &mut Document, sel: &mut Selection, id: NodeId, anchors: impl IntoIterator<Item = (usize, usize)>) -> Result<bool> {
+    let mut anchors: Vec<(usize, usize)> = anchors.into_iter().collect();
+    // The last first, so the indexes still to come stay valid.
+    anchors.sort_unstable_by(|a, b| b.cmp(a));
+    anchors.dedup();
+    let path = path_mut(d, id)?;
+    for (si, ai) in anchors {
+        if let Some(sp) = path.subpaths.get_mut(si) {
+            po::remove_anchor(sp, ai);
+        }
+    }
+    path.subpaths.retain(|sp| sp.anchors.len() >= 2);
+    let gone = path.is_empty();
+    if gone {
+        d.remove(id)?;
+        sel.remove(id);
+    } else {
+        sel.anchors.remove(&id);
+    }
+    Ok(gone)
+}
+
 fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.convertAnchor";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
@@ -665,34 +670,13 @@ fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     s.edit("Convert Anchor Point", |d, _| {
         let path = path_mut(d, id)?;
         let sp = path.subpaths.get_mut(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
-        let n = sp.anchors.len();
-        if ai >= n {
-            return Err(EngineError::Other("no such anchor".into()));
-        }
-        let prev = if ai > 0 || sp.closed { Some(sp.anchors[(ai + n - 1) % n].p) } else { None };
-        let next = if ai + 1 < n || sp.closed { Some(sp.anchors[(ai + 1) % n].p) } else { None };
-        let a = &mut sp.anchors[ai];
-        if !smooth {
-            a.retract();
-            return Ok(());
-        }
+        let a = sp.anchors.get_mut(ai).ok_or_else(|| EngineError::Other("no such anchor".into()))?;
         match target {
-            Some(t) if t.distance(a.p) > 1e-9 => {
-                a.h_out = t;
-                a.h_in = a.p - (t - a.p);
-                a.kind = AnchorKind::Smooth;
-            }
+            _ if !smooth => a.retract(),
+            Some(t) if t.distance(a.p) > 1e-9 => *a = Anchor::smooth(a.p, t),
             Some(_) => a.retract(),
             None => {
-                let (pp, nn) = (prev.unwrap_or(a.p), next.unwrap_or(a.p));
-                let dir = nn - pp;
-                let l = dir.hypot();
-                if l > 1e-9 {
-                    let u = dir / l;
-                    a.h_in = a.p - u * (a.p.distance(pp) / 3.0);
-                    a.h_out = a.p + u * (a.p.distance(nn) / 3.0);
-                    a.kind = AnchorKind::Smooth;
-                }
+                sp.smooth_anchor(ai);
             }
         }
         Ok(())
@@ -717,13 +701,16 @@ fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
             return Err(EngineError::Other("no such segment".into()));
         }
         let n = sp.anchors.len();
-        // Moving both inner control points by v moves B(t) by 3t(1-t)·v.
+        // Moving both inner control points by v moves B(t) by 3t(1-t)·v. A smooth anchor stays
+        // smooth: its other handle turns with the moved one.
         let v = dv / (3.0 * t * (1.0 - t));
         let (i0, i1) = (seg % n, (seg + 1) % n);
-        let a = sp.anchors[i0];
-        sp.anchors[i0] = Anchor::with_handles(a.p, a.h_in, a.h_out + v);
-        let b = sp.anchors[i1];
-        sp.anchors[i1] = Anchor::with_handles(b.p, b.h_in + v, b.h_out);
+        if let Some(a) = sp.anchors.get_mut(i0) {
+            a.set_handle(true, a.h_out + v, false);
+        }
+        if let Some(b) = sp.anchors.get_mut(i1) {
+            b.set_handle(false, b.h_in + v, false);
+        }
         Ok(())
     })?;
     ok()
@@ -762,30 +749,13 @@ fn split(s: &mut Session, p: &Value) -> Result<Value> {
             }
             _ => return Err(EngineError::Other("no such segment".into())),
         };
+        let mut pieces = sp.cut_at(&std::collections::BTreeSet::from([k]));
         if sp.closed {
-            sp.anchors.rotate_left(k);
-            let mut last = sp.anchors[0];
-            last.h_out = last.p;
-            sp.anchors[0].h_in = sp.anchors[0].p;
-            last.kind = AnchorKind::Corner;
-            sp.anchors[0].kind = AnchorKind::Corner;
-            sp.anchors.push(last);
-            sp.closed = false;
-            path.subpaths[si] = sp;
+            path.subpaths[si] = pieces.pop().ok_or_else(|| EngineError::Other("no such anchor".into()))?;
             sel.set([id]);
             return Ok(vec![id]);
         }
-        let n = sp.anchors.len();
-        if k == 0 || k + 1 >= n {
-            return Err(EngineError::Other("cannot split an open path at its end point".into()));
-        }
-        let mut left = SubPath::new(sp.anchors[..=k].to_vec(), false);
-        let mut right = SubPath::new(sp.anchors[k..].to_vec(), false);
-        let lp = left.anchors[k].p;
-        left.anchors[k].h_out = lp;
-        left.anchors[k].kind = AnchorKind::Corner;
-        right.anchors[0].h_in = lp;
-        right.anchors[0].kind = AnchorKind::Corner;
+        let [left, right] = <[SubPath; 2]>::try_from(pieces).map_err(|_| EngineError::Other("cannot split an open path at its end point".into()))?;
         if path.subpaths.len() == 1 {
             path.subpaths[0] = left;
             let node = sibling_with(d, id, PathData::single(right))?;

crates/engine/src/cmd/edit.rs

@@ -5,7 +5,7 @@ use std::sync::Arc;
 
 use serde_json::{Value, json};
 use vectorcraft_doc::{Document, Node, NodeId, Unit};
-use vectorcraft_geom::Affine;
+use vectorcraft_geom::{Affine, Vec2};
 
 use super::clipboard::SwatchChoices;
 use super::*;
@@ -24,8 +24,9 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         cmd!("file.close", "Close", ["File"], Some("Cmd+W"), "{index?}", has_doc, file_close),
         cmd!("document.activate", "Activate Document", [], None, "{index}", always, doc_activate),
-        cmd!(query "document.inspect", "Inspect Document", [], None, "{} → layer tree, artboards, selection, history", has_doc, |s, _| Ok(inspect::document(s))),
-        cmd!(query "document.node", "Inspect Object", [], None, "{id} → full object JSON", has_doc, doc_node),
+        cmd!(query "document.inspect", "Inspect Document", [], None, "{depth?, childLimit?} → layer tree, artboards, selection, history (a sliced tree reports childCount)", has_doc, |s, p| Ok(inspect::document_opts(s, slice_opts(p, "document.inspect")?))),
+        cmd!(query "document.node", "Inspect Object", [], None, "{id, summary?: compact summary, depth?: child levels in the summary (default all), childLimit?: children shown per node (default all; a level that shows fewer reports childCount)} → one object", has_doc, doc_node),
+        cmd!(query "document.find", "Find Objects", [], None, "{name?: substring of the Layers panel name, kind?: panel label such as Group, Path, Type or Image (exact), text?: substring of type content, limit?: max matches (default 100, 0 counts only)} → {matches: [{id, name, kind, path}], total}", has_doc, doc_find),
         cmd!(query "document.json", "Document JSON", [], None, "{} → complete document model", has_doc, |s, _| Ok(serde_json::to_value(&*s.doc()?.doc).unwrap_or(Value::Null))),
         cmd!(
             "document.setUnits",
@@ -38,14 +39,14 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         cmd!("edit.undo", "Undo", ["Edit"], Some("Cmd+Z"), "{}", can_undo, undo),
         cmd!("edit.redo", "Redo", ["Edit"], Some("Cmd+Shift+Z"), "{}", can_redo, redo),
-        cmd!("edit.cut", "Cut", ["Edit"], Some("Cmd+X"), "{}", has_selection, cut),
-        cmd!("edit.copy", "Copy", ["Edit"], Some("Cmd+C"), "{}", has_selection, copy),
+        cmd!("edit.cut", "Cut", ["Edit"], Some("Cmd+X"), "{} (the Artboard tool chosen: artboard.cut)", has_selection_or_artboard_tool, cut),
+        cmd!("edit.copy", "Copy", ["Edit"], Some("Cmd+C"), "{} (the Artboard tool chosen: artboard.copy)", has_selection_or_artboard_tool, copy),
         cmd!(
             "edit.paste",
             "Paste",
             ["Edit"],
             Some("Cmd+V"),
-            "{center?: [x, y], dx?, dy?, swatchConflict?} paste centred on `center` (the app passes the view centre), else offset by dx/dy (default: the Paste Offset preference). Pasting brings the image blobs, symbols, patterns, global and spot swatches (with the tint swatches of the tints used), gradient swatches, graphic styles, character and paragraph styles and brushes the objects use; one of the same name that differs comes in renamed. swatchConflict, for a swatch whose name the document gives another colour (clipboard.conflicts): \"merge\" (default: the objects take the document's swatch) | \"add\" (the pasted swatch comes in renamed) | {name: \"merge\"|\"add\"}. With Paste Remembers Layers on (layer.pasteRemembersLayers), objects go back into the layers they came from (by name; made when missing) → {ids, added: resources added, merged: conflicts merged, renamed: [{kind, from, to}]}",
+            "{center?: [x, y], dx?, dy?, swatchConflict?} paste centred on `center` (the app passes the view centre), else offset by dx/dy (default: the Paste Offset preference). Pasting brings the image blobs, symbols, patterns, global and spot swatches (with the tint swatches of the tints used), gradient swatches, graphic styles, character and paragraph styles and brushes the objects use; one of the same name that differs comes in renamed. swatchConflict, for a swatch whose name the document gives another colour (clipboard.conflicts): \"merge\" (default: the objects take the document's swatch) | \"add\" (the pasted swatch comes in renamed) | {name: \"merge\"|\"add\"}. With Paste Remembers Layers on (layer.pasteRemembersLayers), objects go back into the layers they came from (by name; made when missing). An artboard copied with artboard.copy comes with its art, right of the last artboard (the other paste commands but Paste on All Artboards: where it was), its art back in the layers it came from → {ids, artboard: the new artboard's index or null, added: resources added, merged: conflicts merged, renamed: [{kind, from, to}]}",
             has_clipboard,
             |s, p| paste(s, p, PasteMode::Offset)
         ),
@@ -85,7 +86,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_clipboard,
             |s, p| paste(s, p, PasteMode::AllArtboards)
         ),
-        cmd!("edit.clear", "Clear", ["Edit"], Some("Delete"), "{ids?}", has_selection, clear),
+        cmd!(
+            "edit.clear",
+            "Clear",
+            ["Edit"],
+            Some("Delete"),
+            "{ids?} delete the objects `ids`, else the selection (direct-selected anchors, else objects, else ruler guides)",
+            has_selection_or_guides,
+            clear
+        ),
         cmd!("edit.duplicate", "Duplicate", [], None, "{dx?, dy?} duplicate the selection in place (offset optional)", has_selection, duplicate),
     ]
 }
@@ -105,8 +114,45 @@ fn doc_activate(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn doc_node(s: &mut Session, p: &Value) -> Result<Value> {
     let id = id_param(p, "id").ok_or_else(|| bad("document.node", "missing id"))?;
+    let opts = slice_opts(p, "document.node")?;
+    let summary = bool_or(p, "summary", false);
+    if !summary && (opts.depth.is_some() || opts.child_limit.is_some()) {
+        // The full object JSON is never truncated: a slice without `summary` would
+        // otherwise silently return the whole subtree.
+        return Err(bad("document.node", "`depth` and `childLimit` slice the summary: pass `summary: true`"));
+    }
     let n = s.doc()?.doc.node(id).ok_or(EngineError::NoNode(id))?;
-    Ok(serde_json::to_value(n).unwrap_or(Value::Null))
+    if summary { Ok(inspect::node_summary_opts(n, opts)) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
+}
+
+/// `depth` / `childLimit` for a summary read: absent (or null) means no limit.
+fn slice_opts(p: &Value, cmd: &str) -> Result<inspect::SummaryOpts> {
+    Ok(inspect::SummaryOpts { depth: opt_u64(p, cmd, "depth")?, child_limit: opt_u64(p, cmd, "childLimit")? })
+}
+
+/// An optional count: absent (or null) is `None`; a present value that is not a
+/// non-negative integer is rejected rather than silently reinterpreted.
+fn opt_u64(p: &Value, cmd: &str, key: &str) -> Result<Option<u64>> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v.as_u64().map(Some).ok_or_else(|| bad(cmd, format!("`{key}` must be a non-negative integer"))),
+    }
+}
+
+fn doc_find(s: &mut Session, p: &Value) -> Result<Value> {
+    // A filter of the wrong type is an error, not dropped: dropping it would widen the search.
+    let needle = |key: &str| match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(v)) => Ok(Some(v.to_lowercase()).filter(|v| !v.is_empty())),
+        Some(_) => Err(bad("document.find", format!("`{key}` must be a string"))),
+    };
+    let filter = inspect::FindFilter { name: needle("name")?, kind: needle("kind")?, text: needle("text")? };
+    if filter.is_empty() {
+        return Err(bad("document.find", "give at least one of `name`, `kind`, `text`"));
+    }
+    let limit = opt_u64(p, "document.find", "limit")?.unwrap_or(100);
+    let (matches, total) = inspect::find_nodes(&s.doc()?.doc, &filter, limit);
+    Ok(json!({"matches": matches, "total": total}))
 }
 
 /// Document Setup's units (also `document.setup {units}`).
@@ -116,10 +162,21 @@ fn set_units(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
+/// A typing session in progress (the Type tool previews the whole session as one interaction).
+pub(crate) fn typing_in_progress(s: &Session) -> bool {
+    s.active().and_then(|d| d.interaction.as_ref()).is_some_and(|it| it.label == "Typing" && it.preview.is_some())
+}
+
 fn undo(s: &mut Session, _: &Value) -> Result<Value> {
     // What is still in progress (typing, a drag) is the step to undo: keep it first, so Undo takes
     // back only that and Redo brings it back, instead of dropping it and undoing the step before.
+    // A typing session also ends in the Type tool, whose caret and marked text (IME) must follow
+    // the document.
+    let typing = typing_in_progress(s);
     s.commit_interaction()?;
+    if typing {
+        s.set_tool_option("endTyping", &Value::Bool(true));
+    }
     let st = s.doc_mut()?;
     let e = st.history.undo.pop().ok_or_else(|| EngineError::Other("nothing to undo".into()))?;
     let label = e.label.clone();
@@ -180,12 +237,19 @@ pub(crate) fn roots_of(doc: &Document, ids: Vec<NodeId>) -> Vec<NodeId> {
 }
 
 fn copy(s: &mut Session, _: &Value) -> Result<Value> {
+    // The Artboard tool copies its artboard (and the art on it).
+    if s.tool_id() == "artboard" {
+        return super::panelcmds::artboard_copy(s, &json!({}), false);
+    }
     let roots = selected_roots(s)?;
     s.clipboard = Clipboard::copy(s.doc()?, &roots);
     Ok(json!({ "copied": s.clipboard.nodes.len() }))
 }
 
 fn cut(s: &mut Session, p: &Value) -> Result<Value> {
+    if s.tool_id() == "artboard" {
+        return super::panelcmds::artboard_copy(s, &json!({}), true);
+    }
     copy(s, p)?;
     clear(s, &json!({}))
 }
@@ -195,6 +259,10 @@ fn clear(s: &mut Session, p: &Value) -> Result<Value> {
     if ids_param(p, "ids").is_none() && !s.doc()?.selection.anchors.is_empty() {
         return super::path::delete_anchors(s, p);
     }
+    // Selected ruler guides (selected on their own).
+    if ids_param(p, "ids").is_none() && s.doc()?.selection.is_empty() {
+        return super::docmenu::guide_remove(s, &json!({}));
+    }
     let ids = match ids_param(p, "ids") {
         Some(v) => v,
         None => selected_roots(s)?,
@@ -247,8 +315,16 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
     let st = s.doc()?;
     let same_doc = clip.source_doc == Some(st.uid);
     let parent = st.insertion_parent();
-    // Paste Remembers Layers (not while isolating a group: pastes stay in it).
-    let remember = st.doc.paste_remembers_layers && parent.is_some_and(|p| st.doc.node(p).is_some_and(Node::is_layer));
+    // A copied artboard comes back with its art: right of the last artboard, or where it was
+    // (Paste in Place, in Front, in Back). Paste on All Artboards pastes only the art.
+    let board = clip
+        .artboard
+        .as_ref()
+        .filter(|_| mode != PasteMode::AllArtboards)
+        .map(|a| (a, if mode == PasteMode::Offset { super::panelcmds::beside_artboards(&st.doc, a.rect) } else { Vec2::ZERO }));
+    // Paste Remembers Layers (not while isolating a group: pastes stay in it); an artboard's art
+    // always goes back into its layers.
+    let remember = (st.doc.paste_remembers_layers || board.is_some()) && parent.is_some_and(|p| st.doc.node(p).is_some_and(Node::is_layer));
     // Front/back: relative to the selection (top-most / bottom-most selected object); with
     // nothing selected, the top / bottom of the current layer.
     let anchor = match mode {
@@ -259,19 +335,21 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
         }
         _ => None,
     };
-    let placements: Vec<Affine> = match mode {
-        PasteMode::Offset => vec![match point_param(p, "center") {
+    let placements: Vec<Affine> = match (mode, board) {
+        (_, Some((_, dv))) => vec![Affine::translate(dv)],
+        (PasteMode::Offset, None) => vec![match point_param(p, "center") {
             Some(c) => clip.bounds().map_or(Affine::IDENTITY, |b| Affine::translate(c - b.center())),
             None => Affine::translate((f64_or(p, "dx", off), f64_or(p, "dy", off))),
         }],
-        PasteMode::AllArtboards => {
+        (PasteMode::AllArtboards, None) => {
             let src = clip.source_artboard.or_else(|| st.doc.artboards.first().map(|a| a.rect)).map(|r| r.origin()).unwrap_or_default();
             st.doc.artboards.iter().map(|a| Affine::translate(a.rect.origin() - src)).collect()
         }
         _ => vec![Affine::IDENTITY],
     };
-    let (ids, imported) = s.edit(mode.label(), |d, sel| {
+    let (ids, imported, artboard) = s.edit(mode.label(), |d, sel| {
         let imported = clip.import_into(d, choices, same_doc);
+        let artboard = board.map(|(a, dv)| super::panelcmds::push_artboard_copy(d, a, a.rect + dv));
         let mut layers: BTreeMap<&str, NodeId> = BTreeMap::new();
         // Objects pasted into each parent so far (keeps their order in front and back pastes).
         let mut placed: BTreeMap<Option<NodeId>, usize> = BTreeMap::new();
@@ -303,10 +381,15 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
             }
         }
         sel.set(new_ids.iter().copied());
-        Ok((new_ids, imported))
+        Ok((new_ids, imported, artboard))
     })?;
+    // The Artboard tool takes the pasted artboard.
+    if let Some(i) = artboard.filter(|_| s.tool_id() == "artboard") {
+        s.set_tool_option("active", &json!(i));
+    }
     Ok(json!({
         "ids": ids.iter().map(|i| i.0).collect::<Vec<_>>(),
+        "artboard": artboard,
         "added": imported.added,
         "merged": imported.merged,
         "renamed": imported.renamed,

crates/engine/src/cmd/effectcmd.rs

@@ -23,7 +23,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Apply Effect",
             [],
             None,
-            "{effect: id (see effect.list, e.g. \"stylize.dropShadow\", \"distort.roughen\", \"warp.arc\", or \"plugin.<id>\" for an installed effect plug-in), params?: {…} (missing keys take the dialog defaults), item?: appearance item index|null (apply to that fill/stroke only; omitted: the Appearance panel's active item, else the whole object), ids?: [..] (layers too), target?: \"object\"|\"contents\" (contents: the objects inside groups and layers)} append a live effect to each selected object's appearance (a group's or layer's apply to its members as one piece: one combined shadow) → {ids, index, item}",
+            "{effect: id (see effect.list, e.g. \"stylize.dropShadow\", \"distort.roughen\", \"warp.arc\", or \"plugin.<id>\" for an installed effect plug-in), params?: {…} (missing keys take the dialog defaults), item?: appearance item index|null (apply to that fill/stroke only; omitted: the Appearance panel's active item, else the whole object), ids?: [..] (layers too), target?: \"object\"|\"contents\" (contents: the objects inside groups and layers)} append a live effect to each selected object's appearance (a group's or layer's apply to its members as one piece: one combined shadow; a Pathfinder effect, which combines a group's contents, groups several loose selected objects first, in the same undo step) → {ids, index, item, grouped?}",
             has_doc,
             apply
         ),
@@ -130,6 +130,15 @@ pub(crate) fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let effect = effects::new_effect(id, &params).ok_or_else(|| bad(C, format!("unknown effect `{id}`")))?;
     let label = effects::effect_info(id).map(|e| e.label.trim_end_matches('…').to_string()).unwrap_or_default();
+    if let Some(loose) = loose_for_pathfinder(s, p, id)? {
+        let gid = s.edit(&label, |d, sel| {
+            let gid = super::object::group_nodes(d, &loose)?;
+            d.node_mut(gid).ok_or(EngineError::NoNode(gid))?.appearance.effects.push(effect.clone());
+            sel.set([gid]);
+            Ok(gid)
+        })?;
+        return Ok(json!({ "ids": [gid.0], "index": 0, "item": null, "grouped": true }));
+    }
     let item = item_target(s, p, C)?;
     let mut index = 0;
     let ids = edit_effects(s, p, item, C, &label, "Apply Effect: select objects", |fx| {
@@ -143,6 +152,19 @@ pub(crate) fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "ids": ids_json(&ids), "index": index, "item": landed }))
 }
 
+/// The selected objects a Pathfinder effect should group before it applies: it combines the
+/// contents of a group or layer, so on several loose objects (none a group) it would do nothing.
+/// `None` when the effect isn't one, objects are named (`ids`) or another target is asked for.
+fn loose_for_pathfinder(s: &Session, p: &Value, id: &str) -> Result<Option<Vec<NodeId>>> {
+    if !effects::is_pathfinder(id) || ["ids", "id", "item", "target"].iter().any(|k| p.get(k).is_some()) {
+        return Ok(None);
+    }
+    let roots = super::appearance::subject_roots(s)?;
+    let d = &s.doc()?.doc;
+    let grouped = roots.iter().any(|r| d.node(*r).is_some_and(|n| matches!(n.kind, NodeKind::Group { clip: false, .. } | NodeKind::Layer { .. })));
+    Ok((roots.len() >= 2 && !grouped).then_some(roots))
+}
+
 fn list(s: &mut Session, p: &Value) -> Result<Value> {
     let catalog: Vec<Value> = effects::effect_catalog()
         .into_iter()
@@ -507,6 +529,34 @@ mod tests {
         assert!((b.x1 - 320.0).abs() < 1e-6, "{b:?}");
     }
 
+    #[test]
+    fn pathfinder_effect_on_loose_objects_groups_them_first() {
+        let (mut s, a) = session_with_rect();
+        let b = NodeId(s.execute("shape.rectangle", &json!({"x": 150, "y": 100, "width": 100, "height": 100})).unwrap()["id"].as_u64().unwrap());
+        s.execute("select.set", &json!({"ids": [a.0, b.0]})).unwrap();
+        let r = s.execute("effect.apply", &json!({"effect": "pathfinder.add"})).unwrap();
+        assert_eq!(r["grouped"], true);
+        let g = NodeId(r["ids"][0].as_u64().unwrap());
+        let gn = node(&s, g);
+        assert_eq!(gn.children().unwrap().iter().map(|c| c.id).collect::<Vec<_>>(), [a, b], "stacking order kept");
+        assert!(vectorcraft_render::effects::has_pathfinder(&gn));
+        assert_eq!(s.doc().unwrap().selection.objects, [g]);
+        // Live: one united shape, so expanding leaves a single path.
+        s.execute("effect.expandAppearance", &json!({})).unwrap();
+        assert_eq!(node(&s, g).children().unwrap().len(), 1);
+        // Grouping and applying are one undo step.
+        s.execute("edit.undo", &json!({})).unwrap();
+        s.execute("edit.undo", &json!({})).unwrap();
+        let d = &s.doc().unwrap().doc;
+        assert!(d.node(g).is_none());
+        assert!(d.node(a).is_some_and(|n| n.appearance.effects.is_empty()) && d.parent_of(a) == d.parent_of(b));
+        // A selection holding a group applies to each object as before; so does a single object.
+        s.execute("select.set", &json!({"ids": [a.0]})).unwrap();
+        let r = s.execute("effect.apply", &json!({"effect": "pathfinder.add"})).unwrap();
+        assert!(r.get("grouped").is_none());
+        assert_eq!(node(&s, a).appearance.effects.len(), 1);
+    }
+
     #[test]
     fn pathfinder_effect_on_a_group_renders_live_and_expands() {
         let (mut s, a) = session_with_rect();

crates/engine/src/cmd/expand.rs

@@ -1,6 +1,7 @@
 //! Object → Expand: live shapes, type and effects (Object), strokes (Stroke) and gradient fills
-//! (Fill) into plain art in one undo step. A linear or radial gradient fill becomes a gradient mesh,
-//! or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
+//! (Fill) into plain art in one undo step. Placed documents (Object) become editable copies of the
+//! art they show, their resources joining the document. A linear or radial gradient fill becomes a
+//! gradient mesh, or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
 //! gradient becomes a mesh shaped like the object. Create Gradient Mesh shares the sampling.
 
 use std::sync::Arc;
@@ -36,7 +37,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand…",
             ["Object"],
             None,
-            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, envelopes → their distorted content), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh), both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
+            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh), both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
             has_selection,
             expand
         ),
@@ -55,6 +56,21 @@ pub fn specs() -> Vec<CommandSpec> {
     ]
 }
 
+/// Every placed document in `roots` of `d` (at any depth) replaced by an editable copy of the art it
+/// shows, keeping its id and place; the resources the art uses join `d` (a name `d` uses for
+/// something else gets a free variant).
+fn expand_placed_under(d: &mut Document, roots: &[NodeId]) -> Result<()> {
+    let mut ids = vec![];
+    for n in roots.iter().filter_map(|r| d.node(*r)) {
+        n.walk(&mut |c| {
+            if matches!(c.kind, NodeKind::PlacedDocument(_)) {
+                ids.push(c.id);
+            }
+        });
+    }
+    ids.into_iter().try_for_each(|id| super::place::document::expand(d, id, C))
+}
+
 /// Expand Gradient To.
 #[derive(Clone, Copy, Debug, PartialEq)]
 enum GradientTo {
@@ -88,6 +104,8 @@ struct Expandable {
     envelope: bool,
     /// Live blends (Object expands them into groups of their steps).
     blends: bool,
+    /// Placed documents (Object expands them into the art they show).
+    placed: bool,
 }
 
 impl Expandable {
@@ -101,6 +119,7 @@ impl Expandable {
                 e.effects |= !c.appearance.effects.is_empty();
                 e.envelope |= matches!(c.kind, NodeKind::Envelope { .. });
                 e.blends |= matches!(c.kind, NodeKind::Blend { .. });
+                e.placed |= matches!(c.kind, NodeKind::PlacedDocument(_));
                 e.stroke |= shape && !c.appearance.stroke_paint().is_none();
                 e.fill |= match &c.kind {
                     NodeKind::Text(t) => t.runs.iter().any(|r| matches!(r.style.fill, Paint::Gradient(_))),
@@ -112,7 +131,7 @@ impl Expandable {
     }
 
     fn object(&self) -> bool {
-        self.text || self.live || self.effects || self.envelope || self.blends
+        self.text || self.live || self.effects || self.envelope || self.blends || self.placed
     }
 }
 
@@ -135,6 +154,11 @@ fn expand(s: &mut Session, p: &Value) -> Result<Value> {
     let from = s.doc()?.history.undo.len();
     let rev0 = s.doc()?.revision;
     let e = Expandable::of(&s.doc()?.doc, &selected_roots(s)?);
+    // Placed documents first: their art (type, strokes, gradients) expands below.
+    if object && e.placed {
+        let roots = selected_roots(s)?;
+        s.edit("Expand", |d, _| expand_placed_under(d, &roots))?;
+    }
     // Blends first: what their steps hold (type, effects, strokes, gradients) expands below.
     if object && e.blends {
         let roots = selected_roots(s)?;

crates/engine/src/cmd/fileio/encode.rs

@@ -355,7 +355,8 @@ pub fn encode(doc: &Document, format: &str, p: &Value) -> Result<Vec<u8>> {
 }
 
 /// Like [`encode`], also returning the encoder's warnings (PDF and SVG: options not applied yet,
-/// features approximated or left out; the other formats have none).
+/// features approximated or left out; every format that draws type: fonts written in the fallback
+/// font).
 pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(Vec<u8>, Vec<String>)> {
     let f = super::writable(C, Some(format), None)?;
     encode_all(doc, f.id, p)?.single(f)
@@ -363,7 +364,36 @@ pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(
 
 /// [`encode`], with every file the export writes.
 pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
+    // Placed documents output their files' art (a native file keeps what it keeps: see
+    // `native::encode`).
+    if !matches!(format, "vectorcraft" | "template") {
+        let (full, warnings) = crate::cmd::place::document::full_documents(doc);
+        if !warnings.is_empty() {
+            let mut enc = encode_all_of(&full, format, p)?;
+            enc.warnings.extend(warnings);
+            return Ok(enc);
+        }
+        return encode_all_of(&full, format, p);
+    }
+    encode_all_of(doc, format, p)
+}
+
+/// [`encode_all`] of `doc` as it is.
+fn encode_all_of(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
     let f = super::writable(C, Some(format), None)?;
+    let mut enc = encode_files(doc, f, p)?;
+    // Formats that draw type: missing fonts come out in the fallback font (PDF and SVG say so
+    // themselves: SVG only when it outlines or embeds fonts).
+    if (f.raster || matches!(f.id, "eps" | "emf" | "wmf"))
+        && let Some(w) = crate::cmd::fonts::substitution_warning(doc)
+    {
+        enc.warnings.push(w);
+    }
+    Ok(enc)
+}
+
+/// [`encode_all`] without the font substitution warning.
+fn encode_files(doc: &Document, f: &Format, p: &Value) -> Result<Encoded> {
     let doc = &*doc.without_edit_modes();
     let n = doc.artboards.len();
     // SVG reads its own `useArtboards` (an SVG option).
@@ -374,7 +404,7 @@ pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
         if let Some(o) = q.as_object_mut() {
             o.remove("useArtboards");
         }
-        return encode_all(&single_artboard(doc, bounds, "Art"), f.id, &q);
+        return encode_files(&single_artboard(doc, bounds, "Art"), f, &q);
     }
     let bytes = match f.id {
         "vectorcraft" => super::native::encode(C, f, doc, p)?,
@@ -387,6 +417,12 @@ pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
         "txt" => super::text::encode(doc, p)?,
         "svg" | "svgz" => return super::svg::encode(doc, p, f.id == "svgz").map_err(|e| bad(C, e)),
         "dxf" => return super::dxf::encode(doc, p, use_artboards),
+        // As Save As writes it (a PDF of every artboard carrying the native document).
+        "ai" => {
+            let mut q = p.clone();
+            super::save::ai_params(&mut q);
+            return super::save::encode_ai(C, f, doc, &q);
+        }
         // EPS reads its own `useArtboards` (the art's bounds unless asked).
         "eps" => return super::eps::encode(doc, p),
         "emf" => return super::metafile::encode(doc, p, use_artboards, vectorcraft_metafile::Kind::Emf),

crates/engine/src/cmd/fileio/export.rs

@@ -11,7 +11,7 @@ use crate::DocState;
 
 use super::super::*;
 use super::encode::single_artboard;
-use super::{ARTBOARD_PARAMS, Format, default_name, encode, encode_all, merge, writable, write_encoded, write_or_return};
+use super::{ARTBOARD_PARAMS, Format, default_name, encode, encode_all, encode_with_warnings, merge, writable, write_encoded, write_or_return};
 
 pub(super) fn serialize(s: &mut Session, p: &Value) -> Result<Value> {
     let f = writable("document.serialize", Some(str_param(p, "format").unwrap_or("vectorcraft")), None)?;
@@ -87,6 +87,26 @@ fn selected_part(n: &Node, keep: &HashSet<NodeId>) -> Option<Node> {
     Some(out)
 }
 
+/// `doc` with only the art over `rect` (an artboard): objects whose visual bounds miss it are left
+/// out, at any depth of layers and sublayers, and objects that reach it stay whole (the file's
+/// bounds clip them), as DXF's crop leaves them. A clipping layer keeps every object, its clipping
+/// path among them. An artboard's file then holds its own art, not a whole document of artboards.
+pub(super) fn art_over(doc: &Document, rect: vectorcraft_geom::Rect) -> Document {
+    fn kept(n: &Arc<Node>, rect: vectorcraft_geom::Rect) -> Option<Arc<Node>> {
+        if matches!(n.kind, NodeKind::Layer { clip: false, .. }) {
+            let mut layer = Node::clone(n);
+            let children = layer.children_mut()?;
+            *children = children.iter().filter_map(|c| kept(c, rect)).collect();
+            return Some(Arc::new(layer));
+        }
+        let over = |b: vectorcraft_geom::Rect| b.x0 <= rect.x1 && rect.x0 <= b.x1 && b.y0 <= rect.y1 && rect.y0 <= b.y1;
+        n.visual_bounds().is_none_or(over).then(|| n.clone())
+    }
+    let mut d = doc.clone();
+    d.layers = doc.layers.iter().filter_map(|l| kept(l, rect)).collect();
+    d
+}
+
 /// `p` without its artboard choice, also inside its SVG options (for documents made of one
 /// synthetic artboard, and for callers that pick the artboard themselves).
 pub(super) fn without_artboards(p: &Value) -> Value {
@@ -151,8 +171,10 @@ pub(super) fn export_selection(s: &mut Session, p: &Value) -> Result<Value> {
     let expanded = expand_presets(s, C, p)?;
     let p = &*expanded;
     let (d, bounds) = selection(s, C)?;
-    let bytes = encode(&d, f.id, &without_artboards(p))?;
-    write_or_return(path, &bytes, json!({ "bounds": [bounds.x0, bounds.y0, bounds.width(), bounds.height()] }))
+    // The encoder's warnings (options accepted but not applied, features approximated or left
+    // out), as document.export reports them.
+    let (bytes, warnings) = encode_with_warnings(&d, f.id, &without_artboards(p))?;
+    write_or_return(path, &bytes, json!({ "format": f.id, "warnings": warnings, "bounds": [bounds.x0, bounds.y0, bounds.width(), bounds.height()] }))
 }
 
 /// File → Save for Office Documents: one artboard as a PNG at `ppi`, on white unless

crates/engine/src/cmd/fileio/load.rs

@@ -178,7 +178,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
         _ => return Err(err(format!("{} files can't be opened yet", format.label))),
     };
     if let Some(mode) = opts.color_mode.filter(|m| *m != doc.color_mode) {
-        super::super::colormgmt::set_color_mode(&mut doc, mode, true, None);
+        super::super::colormgmt::set_color_mode(&mut doc, mode, true, None, opts.grays);
     }
     // Imports are named after the file; a native document keeps its own title (the tab shows the
     // file name once it has a path).
@@ -282,13 +282,15 @@ pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
     open_template(s, src.name, &src.bytes, src.path)
 }
 
-/// Decode an image's header (and, for formats stored as PNG, its pixels).
+/// Decode an image's header (and, for formats stored as PNG, its pixels). CMYK TIFFs are kept as
+/// they are, with their ink amounts ([`ImageBlob::cmyk`]).
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     let reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
     let kind = reader.format().ok_or_else(|| err("not an image VectorCraft reads (see document.formats)"))?;
     let f = image_format(kind).ok_or_else(|| err(format!("{kind:?} images can't be opened (see document.formats)")))?;
     let ppi = super::ppi::resolution(bytes);
-    let (bytes, mime, (width, height)) = if matches!(f.id, "png" | "jpg" | "gif" | "webp") {
+    let cmyk = || ImageBlob::new(f.mime, bytes.to_vec()).cmyk().is_some();
+    let (bytes, mime, (width, height)) = if matches!(f.id, "png" | "jpg" | "gif" | "webp") || (f.id == "tiff" && cmyk()) {
         (bytes.to_vec(), f.mime, reader.into_dimensions().map_err(err)?)
     } else {
         let img = reader.decode().map_err(err)?.to_rgba8();

crates/engine/src/cmd/fileio/mod.rs

@@ -78,7 +78,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Open Document",
             [],
             None,
-            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
+            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, lines wrapped in a frame as area type where they lay out the same, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
             always,
             load::open
         ),
@@ -105,7 +105,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export Selection…",
             ["File"],
             None,
-            "{path?, format?: png|jpg|webp|svg|svgz|pdf (default: from the extension, else png), scale?: 1, …the format's options} the selected objects cropped to their bounds (template layers left out) → {path, bytes, bounds} (no path → {dataBase64, bounds})",
+            "{path?, format?: png|jpg|webp|svg|svgz|pdf (default: from the extension, else png), scale?: 1, …the format's options} the selected objects cropped to their bounds (template layers left out) → {path, format, bytes, warnings, bounds} (no path → {dataBase64, format, bytes, warnings, bounds}); warnings say what the format approximated or left out, as for document.export",
             has_selection,
             export::export_selection
         ),
@@ -465,8 +465,8 @@ pub const FORMATS: &[Format] = &[
         extensions: &["ai"],
         mime: "application/pdf",
         read: true,
-        // Saved (Save As), not exported.
-        write: false,
+        // Save As writes it; exports write the same file.
+        write: true,
         raster: false,
         options: native::AI_OPTIONS,
     },
@@ -581,6 +581,18 @@ pub const OPEN_EXTS: &[&str] = &[
     "eps",
 ];
 
+/// The extension that picks each writable format when exporting (the format's first; PNG-8 shares
+/// `.png` with PNG, so `.png` comes once), in [`FORMATS`] order.
+pub fn export_extensions() -> Vec<&'static str> {
+    let mut v: Vec<&'static str> = Vec::new();
+    for e in FORMATS.iter().filter(|f| f.write).filter_map(|f| f.extensions.first()) {
+        if !v.contains(e) {
+            v.push(e);
+        }
+    }
+    v
+}
+
 /// Text files: File → Place sets them as area type (Text Import Options).
 pub const TEXT_EXTS: &[&str] = &["txt"];
 

crates/engine/src/cmd/fileio/native.rs

@@ -127,6 +127,13 @@ pub(super) fn save_options(cmd: &str, f: &Format, doc: &Document, p: &Value) ->
 /// The `.vectorcraft` file of `doc` with the options in `p`.
 pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Vec<u8>> {
     let (mut so, extras) = save_options(cmd, f, doc, p)?;
+    // Include Linked Files keeps placed documents' files; older versions get their art.
+    let full = if so.include_linked || so.version < vectorcraft_format::VERSION {
+        crate::cmd::place::document::full_documents(doc).0
+    } else {
+        std::borrow::Cow::Borrowed(doc)
+    };
+    let doc = &*full;
     if extras.preview {
         so.preview = preview_png(doc)?;
     }

crates/engine/src/cmd/fileio/pdf.rs

@@ -276,6 +276,7 @@ pub(super) fn encode_carrying(cmd: &str, doc: &Document, p: &Value, native: impl
     }
     let r = super::super::rasterfx::export_pdf_with_report(flat.as_ref().unwrap_or(doc), &opts).map_err(|e| pdf_error(cmd, e))?;
     warnings.extend(r.warnings);
+    warnings.extend(crate::cmd::fonts::substitution_warning(doc));
     Ok((r.bytes, warnings))
 }
 

crates/engine/src/cmd/fileio/pdfimport.rs

@@ -6,6 +6,7 @@ use serde_json::{Value, json};
 use vectorcraft_doc::{ColorMode, Document};
 use vectorcraft_pdf::{Choice, CropTo, ImportOptions, PdfError, TextAs};
 
+use super::super::colormgmt::Grays;
 use super::super::*;
 use super::{err, source};
 
@@ -22,6 +23,8 @@ pub struct LoadOptions {
     /// The colour mode the document opens in, its colours converted as Document Color Mode does
     /// (default: the file's; a PDF painted mostly in CMYK opens in CMYK).
     pub color_mode: Option<ColorMode>,
+    /// How that conversion separates RGB greys (`grays`).
+    pub grays: Grays,
     /// What a PDF's text becomes.
     pub text_as: TextAs,
     /// A PDF's optional content groups become layers (else one layer per page, without the art
@@ -38,6 +41,7 @@ impl Default for LoadOptions {
             crop: CropTo::default(),
             password: None,
             color_mode: None,
+            grays: Grays::default(),
             text_as: TextAs::default(),
             layers: true,
             dxf: Default::default(),
@@ -47,7 +51,7 @@ impl Default for LoadOptions {
 
 impl LoadOptions {
     /// From command params: `pages` (`"2-3, 5"`, a page number or `"all"`), `page` (one page, when
-    /// `pages` isn't given), `cropTo` (or `crop`), `password`, `colorMode` (`rgb` | `cmyk`),
+    /// `pages` isn't given), `cropTo` (or `crop`), `password`, `colorMode` (`rgb` | `cmyk`) with `grays`,
     /// `textAs` (`text` | `outlines`), `layers` (true | false) and `dxf` (the DXF import options).
     pub fn from_params(cmd: &str, p: &Value) -> Result<Self> {
         let pages = match p.get("pages").filter(|v| !v.is_null()).or_else(|| p.get("page").filter(|v| !v.is_null())) {
@@ -65,13 +69,14 @@ impl LoadOptions {
             Some("cmyk") => Some(ColorMode::Cmyk),
             Some(m) => return Err(bad(cmd, format!("colorMode must be rgb or cmyk, not `{m}`"))),
         };
+        let grays = Grays::param(cmd, p)?;
         let text_as = choice(cmd, "textAs", str_param(p, "textAs"))?;
         let layers = match p.get("layers").filter(|v| !v.is_null()) {
             None => true,
             Some(v) => v.as_bool().ok_or_else(|| bad(cmd, "layers must be true or false"))?,
         };
         let dxf = super::dxfimport::options(cmd, p.get("dxf"))?;
-        Ok(Self { pages, crop, password, color_mode, text_as, layers, dxf })
+        Ok(Self { pages, crop, password, color_mode, grays, text_as, layers, dxf })
     }
 
     /// Does the document read only part of the file, or read it differently (a page range, another

crates/engine/src/cmd/fileio/save.rs

@@ -305,6 +305,35 @@ fn blank_pages(doc: &Document) -> Document {
 /// Why a `.ai` file saved without PDF content looks empty elsewhere.
 const NOT_PDF_COMPATIBLE: &str = "saved without PDF content: VectorCraft opens it as before, other apps show empty pages";
 
+/// The encoder's params for a `.ai` file, from a save's or an export's: a PDF of every artboard
+/// with the PDF options, always carrying the native document; Use Compression compresses the
+/// PDF's content.
+pub(super) fn ai_params(params: &mut Value) {
+    let Some(o) = params.as_object_mut() else { return };
+    o.extend([("preserveEditing".into(), json!(true)), ("range".into(), json!("all"))]);
+    if let Some(c) = o.get("compress").and_then(Value::as_bool) {
+        let compression = o.entry("compression").or_insert_with(|| json!({}));
+        if let Some(m) = compression.as_object_mut() {
+            m.insert("compressText".into(), json!(c));
+        }
+    }
+}
+
+/// Encode `doc` as a PDF-compatible `.ai` file (`params` as [`ai_params`] makes them) for command
+/// `cmd`: its pages (blank with `pdfCompatible: false`, which it then notes), carrying the native
+/// document. File › Save As writes it, and so do the exports (`document.export`, the CLI).
+pub(super) fn encode_ai(cmd: &str, f: &Format, doc: &Document, params: &Value) -> Result<Encoded> {
+    let compatible = bool_or(params, "pdfCompatible", true);
+    let pages = doc.without_edit_modes();
+    let pages = if compatible { pages } else { std::borrow::Cow::Owned(blank_pages(&pages)) };
+    let native = || super::native::ai_native(cmd, f, doc, params);
+    let (bytes, mut warnings) = super::pdf::encode_carrying(cmd, &pages, params, native)?;
+    if !compatible {
+        warnings.insert(0, NOT_PDF_COMPATIBLE.to_string());
+    }
+    Ok(Encoded { warnings, ..Encoded::one(bytes) })
+}
+
 /// Snapshot the active document for `plan` (stamping File Info's dates when the file becomes the
 /// document's own). Bad options fail here, before anything is encoded.
 pub fn save_job(s: &mut Session, plan: SavePlan) -> Result<SaveJob> {
@@ -339,16 +368,8 @@ pub(crate) fn job_for(s: &Session, st: &DocState, plan: SavePlan) -> Result<Save
     }
     let boards = separate_boards(cmd, plan.format, &doc, &params)?;
     let mut params = super::pdf::expand_preset(s, cmd, &params)?.into_owned();
-    if let (Some(o), "ai") = (params.as_object_mut(), plan.format.id) {
-        // A PDF of every artboard with the PDF options, always carrying the native document.
-        o.extend([("preserveEditing".into(), json!(true)), ("range".into(), json!("all"))]);
-        // Use Compression compresses the PDF's content.
-        if let Some(c) = o.get("compress").and_then(Value::as_bool) {
-            let compression = o.entry("compression").or_insert_with(|| json!({}));
-            if let Some(m) = compression.as_object_mut() {
-                m.insert("compressText".into(), json!(c));
-            }
-        }
+    if plan.format.id == "ai" {
+        ai_params(&mut params);
     }
     Ok(SaveJob { plan, doc, params, snapshot: st.doc.clone(), boards })
 }
@@ -372,25 +393,14 @@ impl SaveJob {
             let one = self.encode_one(&artboard_doc(&self.doc, b))?;
             enc.files.extend(one.files.into_iter().map(|(_, bytes)| (Some(b), bytes)));
         }
-        let pdf_less = self.plan.format.id == "ai" && !bool_or(&self.params, "pdfCompatible", true);
-        let notes = fidelity_warning(self.plan.format).into_iter().chain(pdf_less.then(|| NOT_PDF_COMPATIBLE.to_string()));
-        enc.warnings.splice(0..0, notes);
+        enc.warnings.splice(0..0, fidelity_warning(self.plan.format));
         Ok(enc)
     }
 
     /// Encode one file of `doc` in the job's format.
     fn encode_one(&self, doc: &Document) -> Result<Encoded> {
         let (cmd, f) = (self.plan.mode.command(), self.plan.format);
-        let enc = if f.id == "ai" {
-            // The pages (blank without PDF content), carrying the native document.
-            let pages = doc.without_edit_modes();
-            let pages = if bool_or(&self.params, "pdfCompatible", true) { pages } else { std::borrow::Cow::Owned(blank_pages(&pages)) };
-            let native = || super::native::ai_native(cmd, f, doc, &self.params);
-            let (bytes, warnings) = super::pdf::encode_carrying(cmd, &pages, &self.params, native)?;
-            Encoded { warnings, ..Encoded::one(bytes) }
-        } else {
-            encode_all(doc, f.id, &self.params)?
-        };
+        let enc = if f.id == "ai" { encode_ai(cmd, f, doc, &self.params)? } else { encode_all(doc, f.id, &self.params)? };
         if enc.files.len() != 1 {
             return Err(bad(cmd, "Save writes one artboard: name one, or export several with document.export"));
         }
@@ -450,12 +460,17 @@ impl SaveJob {
     /// its own also ends its Data Recovery copy.
     pub fn complete(self, s: &mut Session, uid: u64) {
         let saved = self.plan.retargets() && self.plan.path.is_some();
+        // The other open documents that place this one show the new version.
+        let written = self.plan.path.clone().filter(|_| matches!(self.plan.format.id, "vectorcraft" | "template"));
         if let Some(st) = s.document_mut(uid) {
             self.finish(st);
         }
         if saved {
             crate::cmd::recovery::forget(s, uid);
         }
+        if let Some(path) = written {
+            crate::cmd::links::refresh_placed(s, uid, &path);
+        }
     }
 }
 

crates/engine/src/cmd/fileio/screens.rs

@@ -161,7 +161,7 @@ impl Row {
             return Err(bad(C, "each format is an object {format, scale?, suffix?}"));
         }
         let format = writable(C, Some(str_param(row, "format").unwrap_or("png")), None)?;
-        if matches!(format.id, "vectorcraft" | "template" | "txt" | "dxf" | "eps" | "emf" | "wmf") {
+        if matches!(format.id, "vectorcraft" | "template" | "ai" | "txt" | "dxf" | "eps" | "emf" | "wmf") {
             return Err(bad(C, "Export for Screens writes png, png8, jpg, webp, gif, svg, svgz or pdf"));
         }
         // Vector formats have no pixel size: it doesn't apply and adds no @2x suffix (not even one

crates/engine/src/cmd/fileio/svg.rs

@@ -19,7 +19,7 @@ pub const OPTIONS: &[FormatOption] = &[
         name: "useArtboards",
         ty: "boolean",
         default: "true",
-        description: "false: one SVG of the bounds of all art instead of artboards (several artboards write one file each)",
+        description: "false: one SVG of the bounds of all art instead of artboards (several artboards write one file each; a named artboard's file holds only the art over it)",
     },
     FormatOption {
         name: "styling",
@@ -125,8 +125,10 @@ pub fn options_map(p: &Value) -> Result<Map<String, Value>, String> {
     Ok(m)
 }
 
-/// The writer options and the artboards (`None`: the art bounds) an SVG export of `doc` covers.
-fn plan(doc: &Document, p: &Value) -> Result<(ExportOptions, Vec<Option<usize>>), String> {
+/// The writer options and the artboards (`None`: the art bounds) an SVG export of `doc` covers,
+/// and whether `p` named those artboards (else the first stands for the whole document, as Save
+/// writes it).
+fn plan(doc: &Document, p: &Value) -> Result<(ExportOptions, Vec<Option<usize>>, bool), String> {
     let mut m = options_map(p)?;
     // Fonts: unless chosen, Document Setup → Type → Export decides (appearance = outlines).
     if !m.contains_key("outlineText") && doc.setup.export_text == vectorcraft_doc::ExportText::Appearance {
@@ -138,21 +140,24 @@ fn plan(doc: &Document, p: &Value) -> Result<(ExportOptions, Vec<Option<usize>>)
     opts.check().map_err(|e| format!("SVG options: {e}"))?;
     let n = doc.artboards.len();
     if n == 0 || boards.use_artboards == Some(false) {
-        return Ok((opts, vec![None]));
+        return Ok((opts, vec![None], false));
     }
-    let picked = boards.pick.resolve(n)?.unwrap_or_else(|| vec![0]);
-    Ok((opts, picked.into_iter().map(Some).collect()))
+    let named = boards.pick.resolve(n)?;
+    let chosen = named.is_some();
+    Ok((opts, named.unwrap_or_else(|| vec![0]).into_iter().map(Some).collect(), chosen))
 }
 
 /// Encode `doc` as SVG (or gzipped, SVGZ): one file per chosen artboard, with the images they
 /// link to and the writer's warnings.
 pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Encoded, String> {
-    let (opts, boards) = plan(doc, p)?;
+    let (opts, boards, chosen) = plan(doc, p)?;
     // Preserve editing embeds the native document (once, shared by every file).
     let native = opts.preserve_editing.then(|| vectorcraft_format::save(doc, false));
     let mut enc = Encoded::default();
     for artboard in boards {
-        let mut out = vectorcraft_svg::export_full(doc, &ExportOptions { artboard, ..opts.clone() }, native.as_deref());
+        // A chosen artboard's file holds the art over it (#550).
+        let over = artboard.filter(|_| chosen).and_then(|b| doc.artboards.get(b)).map(|a| super::export::art_over(doc, a.rect));
+        let mut out = vectorcraft_svg::export_full(over.as_ref().unwrap_or(doc), &ExportOptions { artboard, ..opts.clone() }, native.as_deref());
         let bytes = out.take_bytes();
         for l in out.linked {
             if !enc.linked.iter().any(|e| e.name == l.name) {
@@ -166,5 +171,11 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
         }
         enc.files.push((artboard, if compressed { vectorcraft_svg::compress_bytes(&bytes) } else { bytes }));
     }
+    // Live type names its fonts; outlines and embedded fonts are the fallback font's.
+    if (opts.outline_text || opts.embed_fonts)
+        && let Some(w) = crate::cmd::fonts::substitution_warning(doc)
+    {
+        enc.warnings.push(w);
+    }
     Ok(enc)
 }

crates/engine/src/cmd/fileio/tests.rs

@@ -103,6 +103,17 @@ fn webp_opens_at_its_pixel_size() {
     assert_eq!((r.width, r.height, r.blob.mime.as_str()), (3, 2, "image/webp"));
 }
 
+#[test]
+fn cmyk_tiffs_keep_their_inks_and_other_tiffs_become_png() {
+    let inks = vectorcraft_doc::cmyk::Inks::new(2, 1, vec![0, 102, 255, 0, 10, 20, 30, 40]).unwrap();
+    let tiff = vectorcraft_doc::ImageBlob::cmyk_tiff(&inks).unwrap();
+    let r = raster_image(&tiff.bytes).unwrap();
+    assert_eq!((r.width, r.height, r.blob.mime.as_str()), (2, 1, "image/tiff"));
+    assert_eq!(r.blob.cmyk(), Some(inks));
+    let rgb = raster_image(&image_bytes(2, 1, image::ImageFormat::Tiff)).unwrap();
+    assert_eq!(rgb.blob.mime, "image/png");
+}
+
 #[test]
 fn content_beats_a_wrong_extension() {
     let png = image_bytes(2, 2, image::ImageFormat::Png);
@@ -150,6 +161,40 @@ fn open_exts_cover_every_readable_format() {
     assert_eq!(filters.last(), Some(&("Plug-ins", crate::cmd::plugin::EXTS)), "File › Open installs plug-ins");
 }
 
+/// The extensions usage texts list for export: one per writable format, each picking that format
+/// (`.png` picks PNG; PNG-8 is asked for by `format`).
+#[test]
+fn export_extensions_name_every_writable_format() {
+    let exts = export_extensions();
+    assert_eq!(
+        exts,
+        [
+            "vectorcraft",
+            "svg",
+            "svgz",
+            "pdf",
+            "ai",
+            "png",
+            "jpg",
+            "gif",
+            "webp",
+            "tif",
+            "bmp",
+            "vctemplate",
+            "txt",
+            "dxf",
+            "eps",
+            "emf",
+            "wmf",
+            "tga",
+            "psd"
+        ]
+    );
+    for e in exts {
+        assert!(format_for_name(&format!("x.{e}")).is_some_and(|f| f.write), "{e}");
+    }
+}
+
 #[test]
 fn formats_query_lists_readers_writers_and_options() {
     let mut s = Session::new();
@@ -162,6 +207,7 @@ fn formats_query_lists_readers_writers_and_options() {
             "svg",
             "svgz",
             "pdf",
+            "ai",
             "png",
             "jpg",
             "gif",

crates/engine/src/cmd/fileio/tests_epsimport.rs

@@ -92,6 +92,22 @@ fn postscript_ai_files_and_garbage() {
     assert_eq!((&r["format"], &r["restored"]), (&json!("ai"), &json!(false)), "{r}");
     assert_eq!(s.doc().unwrap().path, None);
     assert_eq!(objects(&s), 1);
+    // Illustrator's groups come in as groups, nested as they were.
+    let ai = b"%!PS-Adobe-3.0
+%%Creator: Adobe Illustrator(R) 8.0
+%%BoundingBox: 0 0 100 100
+%%EndComments
+               /u {} def /U {} def /L {lineto} def /f {closepath fill} def
+               u 0 0 moveto 9 0 L 9 9 L f u 20 0 moveto 29 0 L 29 9 L f 40 0 moveto 49 0 L 49 9 L f U U
+showpage
+%%EOF
+";
+    open(&mut s, "groups.ai", ai).unwrap();
+    let d = s.doc().unwrap().doc.clone();
+    let outer = &d.layers[0].children().unwrap()[0];
+    let inner = outer.children().map(|c| (c.len(), c[1].children().map(Vec::len))).unwrap();
+    assert!(matches!(outer.kind, vectorcraft_doc::NodeKind::Group { clip: false, .. }), "{:?}", outer.kind);
+    assert_eq!(inner, (2, Some(2)));
     // A .ait one opens as a new untitled document.
     let r = open(&mut s, "legacy.ait", ps).unwrap();
     assert!(r["title"].as_str().unwrap().starts_with("Untitled"), "{r}");

crates/engine/src/cmd/fileio/tests_pdfedit.rs

@@ -118,6 +118,27 @@ fn ai_files_are_pdfs_that_save_and_reopen_editable() {
     assert_eq!(s.doc().unwrap().path, None);
 }
 
+/// #526: the exports (`document.export`, the CLI's `--export` and `convert`) write `.ai` as Save
+/// As does, leaving the document's own path alone.
+#[test]
+fn exports_write_ai_as_save_as_does() {
+    let mut s = rich();
+    let before = comparable(&s.doc().unwrap().doc);
+    let path = tmp("exported.ai");
+    let r = s.execute("document.export", &json!({"path": path})).unwrap();
+    assert_eq!(r["format"], "ai", "{r}");
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(bytes.starts_with(b"%PDF") && vectorcraft_pdf::editing(&bytes).is_some_and(|e| e.intact), "PDF-compatible, carrying the document");
+    assert_eq!(s.doc().unwrap().path, None, "an export doesn't give the document a path");
+    let r = s.execute("document.open", &json!({"path": path})).unwrap();
+    assert_eq!((&r["format"], &r["restored"]), (&json!("ai"), &json!(true)), "{r}");
+    assert_eq!(comparable(&s.doc().unwrap().doc), before);
+    // Its options as Save As takes them; no path gives the bytes.
+    let r = s.execute("document.export", &json!({"format": "ai", "pdfCompatible": false})).unwrap();
+    assert!(r["warnings"].as_array().unwrap().iter().any(|w| w.as_str().is_some_and(|w| w.contains("without PDF content"))), "{r}");
+    assert!(b64(&r).starts_with(b"%PDF"));
+}
+
 #[test]
 fn ait_templates_open_their_document_untitled() {
     let mut s = rich();

crates/engine/src/cmd/fileio/tests_pdffidelity.rs

@@ -67,3 +67,40 @@ fn load_options_read_text_and_layers() {
     let d = LoadOptions::default();
     assert_eq!((d.text_as, d.layers, d.is_partial()), (TextAs::Text, true, false));
 }
+
+#[test]
+fn exports_that_draw_type_in_a_missing_font_say_it_is_the_fallback_font() {
+    let page = PdfPage {
+        resources: "/Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Zyxwvu-Serif >> >>".into(),
+        ..PdfPage::new(200.0, 100.0, "BT /F1 12 Tf 10 50 Td (Hello) Tj ET")
+    };
+    let mut s = Session::new();
+    let r = open(&mut s, &pdf(&[page], None), json!({})).unwrap();
+    let fonts = s.execute("text.fonts", &json!({})).unwrap();
+    let family = fonts[0]["family"].as_str().unwrap().to_string();
+    assert_eq!(fonts[0]["status"], "missing", "{fonts}");
+    assert!(r["warnings"].to_string().contains(&family), "opening lists it: {r}");
+    let warned = |s: &mut Session, p: Value| {
+        let w = s.execute("document.serialize", &p).unwrap()["warnings"].to_string();
+        w.contains(&family) && w.contains(vectorcraft_text::FALLBACK_FAMILY)
+    };
+    for p in [
+        json!({"format": "pdf"}),
+        json!({"format": "pdf", "advanced": {"outlineText": false}}),
+        json!({"format": "png"}),
+        json!({"format": "eps"}),
+        json!({"format": "emf"}),
+        json!({"format": "svg", "outlineText": true}),
+        json!({"format": "svg", "embedFonts": true}),
+    ] {
+        assert!(warned(&mut s, p.clone()), "{p}");
+    }
+    // Live SVG type and the native file name the font itself.
+    for p in [json!({"format": "svg", "outlineText": false}), json!({"format": "vectorcraft"}), json!({"format": "txt"})] {
+        assert!(!warned(&mut s, p.clone()), "{p}");
+    }
+    let pdf_export = s.execute("document.exportPdf", &json!({})).unwrap();
+    assert!(pdf_export["warnings"].to_string().contains(&family), "{pdf_export}");
+    s.execute("text.replaceFont", &json!({"from": {"family": family}, "to": {"family": "Source Serif 4"}})).unwrap();
+    assert!(!warned(&mut s, json!({"format": "pdf"})), "replaced: nothing is substituted");
+}

crates/engine/src/cmd/fileio/tests_svgenc.rs

@@ -49,3 +49,28 @@ fn profile_and_embedded_fonts_reach_the_writer() {
     assert!(s.execute("document.serialize", &json!({"format": "svg", "svg": {"profile": "svg2"}})).is_err(), "unknown profiles are refused");
     assert!(s.execute("document.serialize", &json!({"format": "svg", "encoding": "ebcdic"})).is_err(), "unknown encodings are refused");
 }
+
+/// #550: an SVG of chosen artboards holds the art over each, not every artboard's art; with no
+/// artboard named (as Save writes it) the whole document's art is there.
+#[test]
+fn a_chosen_artboard_s_svg_holds_only_its_own_art() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 100, "height": 100, "artboards": 3})).unwrap();
+    let x = |s: &Session, b: usize| s.doc().unwrap().doc.artboards[b].rect.x0;
+    let (first, third) = (x(&s, 0), x(&s, 2));
+    s.execute("shape.rectangle", &json!({"x": first + 10.0, "y": 10, "width": 30, "height": 30})).unwrap();
+    s.execute("shape.ellipse", &json!({"x": third + 10.0, "y": 10, "width": 30, "height": 30})).unwrap();
+    // A rectangle has straight sides only; the ellipse is curves.
+    let shapes = |svg: &str| (svg.matches("<path").count() + svg.matches("<rect").count(), svg.contains(" C") || svg.contains("<ellipse"));
+    let text = |v: &serde_json::Value| v["text"].as_str().unwrap().to_string();
+    let third_only = text(&s.execute("document.serialize", &json!({"format": "svg", "useArtboards": true, "range": "3"})).unwrap());
+    assert_eq!(shapes(&third_only), (1, true), "{third_only}");
+    let all = s.execute("document.serialize", &json!({"format": "svg", "useArtboards": true, "range": "all"})).unwrap();
+    let files: Vec<String> = all["files"].as_array().unwrap().iter().map(text).collect();
+    assert_eq!(files.iter().map(|f| shapes(f)).collect::<Vec<_>>(), [(1, false), (0, false), (1, true)]);
+    // Export for Screens names one artboard at a time the same way.
+    let screen = text(&s.execute("document.serialize", &json!({"format": "svg", "artboard": 0})).unwrap());
+    assert_eq!(shapes(&screen), (1, false));
+    let whole = text(&s.execute("document.serialize", &json!({"format": "svg"})).unwrap());
+    assert_eq!(shapes(&whole).0, 2, "nothing named: the whole document's art");
+}

crates/engine/src/cmd/flatten.rs

@@ -1185,6 +1185,8 @@ impl Scratch {
                 let art = self.doc.symbols.iter().find(|s| &s.name == symbol).map(|s| vectorcraft_render::instance_art(&s.art, n));
                 art.and_then(|a| effects::outline_art(n, Some(&a))).map(|g| carry(n, g))
             }
+            // A placed document stays one: its art's resources aren't the document's.
+            NodeKind::PlacedDocument(_) => None,
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Repeat(_) => {
                 let hook: &dyn Fn(&Node) -> Option<Node> = &effects::outline_text;
                 Some(carry(n, vectorcraft_doc::live::expanded_group(n, Some(hook))))

crates/engine/src/cmd/fonts.rs

@@ -2,10 +2,10 @@
 //! another everywhere or in the selection, and selecting the text that uses a font. Also the fonts
 //! available (the bundled and installed ones) and rescanning the installed fonts.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, NodeId, NodeKind};
+use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
 
 use super::typecmd::refresh_bounds;
 use super::*;
@@ -17,7 +17,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Fonts in Document",
             [],
             None,
-            "{selectionOnly?} → [{family, style, runs, objects, missing}] sorted by name",
+            "{selectionOnly?} → [{family, style, runs, objects, missing, status: exact|substitute|missing, resolved: {family, style}, missingGlyphs}] sorted by name. A font is found by any of its names (ヒラギノ角ゴシック = Hiragino Sans) among the loaded and installed fonts; substitute: the family is there but not the style (resolved names the stand-in); missing: the family is unknown (the fallback family stands in); missingGlyphs: characters of its text the resolved font lacks (drawn by a fallback font)",
             has_doc,
             fonts
         ),
@@ -26,7 +26,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Replace Font",
             [],
             None,
-            "{from: {family, style?}, to: {family, style?}, selectionOnly?} (style omitted: every style of the family / keep the closest style) → {runs}",
+            "{from: {family, style?}, to: {family (any of its names; stored as the font's own family name), style?}, selectionOnly?} (style omitted: every style of the family / keep the closest style) → {runs}",
             has_doc,
             replace
         ),
@@ -44,7 +44,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Font List",
             [],
             None,
-            "{family?} → {families: [names]} sorted: the bundled fonts, fonts added and the fonts installed on the system (none on the web); with family: {family, styles: [names]} (upright styles by weight, then italics; an error when the family isn't available)",
+            "{family?} → {families: [names]} sorted: the bundled fonts, fonts added and the fonts installed on the system (none on the web), as the font menus list them (without the system's hidden families, whose names start with a dot; they still resolve by name); with family: {family, styles: [names]} (upright styles by weight, then italics; an error when the family isn't available)",
             always,
             font_list
         ),
@@ -53,7 +53,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Refresh Font List",
             [],
             None,
-            "{} scan the system font folders again, for fonts installed or removed since the app started; text in a font that became available redraws in it (no fonts are installed on the web) → {families, faces} (families available, installed faces found)",
+            "{} scan the system font folders again, for fonts installed or removed since the app started; text in a font that became available redraws in it (no fonts are installed on the web) → {families, faces} (families listed, installed faces found)",
             always,
             rescan
         ),
@@ -85,6 +85,41 @@ fn scope(s: &Session, selection_only: bool) -> Result<Vec<NodeId>> {
     Ok(v)
 }
 
+/// The fonts (family, style) of the type in the layers and symbols of `d`.
+pub(super) fn used_fonts(d: &Document) -> BTreeSet<(String, String)> {
+    let mut fonts = BTreeSet::new();
+    let mut add = |n: &Node| {
+        if let NodeKind::Text(t) = &n.kind {
+            fonts.extend(t.runs.iter().map(|r| (r.style.font_family.clone(), r.style.font_style.clone())));
+        }
+    };
+    d.walk(&mut add);
+    for s in &d.symbols {
+        s.art.walk(&mut add);
+    }
+    fonts
+}
+
+/// What an export that draws type (as outlines, embedded fonts or pixels) says when `d` uses font
+/// families that aren't available: their type is drawn in the fallback font, not the font it names.
+pub(super) fn substitution_warning(d: &Document) -> Option<String> {
+    let db = vectorcraft_text::FontDb::global();
+    let mut missing: Vec<String> = used_fonts(d)
+        .into_iter()
+        .filter(|(family, style)| db.resolve(family, style).is_none_or(|(_, m)| m == vectorcraft_text::FontMatch::Missing))
+        .map(|(family, _)| family)
+        .collect();
+    // Sorted by family: its styles are neighbours.
+    missing.dedup();
+    (!missing.is_empty()).then(|| {
+        format!(
+            "fonts that aren't available were written in the fallback font, {}: {} (install them, or replace them with Find Font)",
+            vectorcraft_text::FALLBACK_FAMILY,
+            missing.join(", ")
+        )
+    })
+}
+
 fn text(d: &Document, id: NodeId) -> Option<&vectorcraft_doc::TextObject> {
     match d.node(id).map(|n| &n.kind) {
         Some(NodeKind::Text(t)) => Some(t),
@@ -96,12 +131,12 @@ fn fonts(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = scope(s, bool_or(p, "selectionOnly", false))?;
     let d = &s.doc()?.doc;
     let db = vectorcraft_text::FontDb::global();
-    let families = db.families();
-    let mut found: BTreeMap<(String, String), (usize, Vec<NodeId>)> = BTreeMap::new();
+    let mut found: BTreeMap<(String, String), (usize, Vec<NodeId>, String)> = BTreeMap::new();
     for id in ids {
         for r in text(d, id).map(|t| t.runs.as_slice()).unwrap_or_default() {
             let e = found.entry((r.style.font_family.clone(), r.style.font_style.clone())).or_default();
             e.0 += 1;
+            e.2.push_str(&r.text);
             if !e.1.contains(&id) {
                 e.1.push(id);
             }
@@ -109,10 +144,20 @@ fn fonts(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let list: Vec<Value> = found
         .into_iter()
-        .map(|((family, style), (runs, objects))| {
-            let have_family = families.iter().any(|f| f.eq_ignore_ascii_case(&family));
-            let missing = !have_family || !db.styles(&family).iter().any(|st| st.eq_ignore_ascii_case(&style));
-            json!({ "family": family, "style": style, "runs": runs, "objects": objects.len(), "missing": missing })
+        .map(|((family, style), (runs, objects, chars))| {
+            let resolved = db.resolve(&family, &style);
+            let status = resolved.as_ref().map(|(_, m)| *m).unwrap_or(vectorcraft_text::FontMatch::Missing);
+            let mut lacking: Vec<char> = chars.chars().filter(|c| !c.is_whitespace() && !c.is_control()).collect();
+            lacking.sort_unstable();
+            lacking.dedup();
+            lacking.retain(|c| !resolved.as_ref().is_some_and(|(f, _)| f.covers(*c)));
+            json!({
+                "family": family, "style": style, "runs": runs, "objects": objects.len(),
+                "missing": status == vectorcraft_text::FontMatch::Missing,
+                "status": status.as_str(),
+                "resolved": resolved.as_ref().map(|(f, _)| json!({ "family": f.family, "style": f.style })),
+                "missingGlyphs": lacking.len(),
+            })
         })
         .collect();
     Ok(json!(list))
@@ -130,9 +175,11 @@ fn replace(s: &mut Session, p: &Value) -> Result<Value> {
     let (ff, fs) = font_param(p, "from", C)?;
     let (tf, ts) = font_param(p, "to", C)?;
     let db = vectorcraft_text::FontDb::global();
-    if !db.families().iter().any(|f| f.eq_ignore_ascii_case(&tf)) {
-        return Err(bad(C, format!("font family `{tf}` is not available")));
-    }
+    // Any name of the family (ヒラギノ角ゴシック) is stored as its own name (Hiragino Sans).
+    let tf = match db.resolve(&tf, ts.as_deref().unwrap_or("Regular")) {
+        Some((f, m)) if m != vectorcraft_text::FontMatch::Missing => f.family.clone(),
+        _ => return Err(bad(C, format!("font family `{tf}` is not available"))),
+    };
     let ids = scope(s, bool_or(p, "selectionOnly", false))?;
     let matches = |st: &vectorcraft_doc::CharStyle| {
         st.font_family.eq_ignore_ascii_case(&ff) && fs.as_ref().is_none_or(|x| st.font_style.eq_ignore_ascii_case(x))
@@ -196,7 +243,7 @@ fn font_list(_: &mut Session, p: &Value) -> Result<Value> {
             let name = db.family_list().iter().find(|f| f.eq_ignore_ascii_case(family)).cloned().unwrap_or_else(|| family.to_string());
             Ok(json!({ "family": name, "styles": db.styles(family) }))
         }
-        None => Ok(json!({ "families": *db.family_list() })),
+        None => Ok(json!({ "families": *db.menu_family_list() })),
     }
 }
 
@@ -229,7 +276,7 @@ fn rescan(s: &mut Session, _: &Value) -> Result<Value> {
         }
         d.revision += 1;
     }
-    Ok(json!({ "families": db.family_list().len(), "faces": faces }))
+    Ok(json!({ "families": db.menu_family_list().len(), "faces": faces }))
 }
 
 #[cfg(test)]
@@ -261,6 +308,41 @@ mod tests {
 mod open_tests {
     use super::*;
 
+    #[test]
+    fn list_says_how_each_font_resolved() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+        // "Black Wide" is a style no Source Sans 3 has, bundled or installed, so it is always a
+        // substitute (the installed family can hold a real Black).
+        for (text, font, style) in
+            [("Exact", "Source Sans 3", "Semibold"), ("Closest", "Source Sans 3", "Black Wide"), ("Gone", "No Such Font Family", "Regular")]
+        {
+            s.execute("text.create", &json!({"x": 10, "y": 20, "text": text, "font": font, "style": style})).unwrap();
+        }
+        let list = s.execute("text.fonts", &json!({})).unwrap();
+        let rows: Vec<(String, String, String, String)> = list
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|f| {
+                (
+                    f["style"].as_str().unwrap().into(),
+                    f["status"].as_str().unwrap().into(),
+                    f["resolved"]["family"].as_str().unwrap().into(),
+                    f["resolved"]["style"].as_str().unwrap().into(),
+                )
+            })
+            .collect();
+        let row = |style: &str| rows.iter().find(|r| r.0 == style).cloned().unwrap();
+        assert_eq!(row("Semibold").1, "exact");
+        assert_eq!(row("Black Wide").1, "substitute", "{rows:?}");
+        assert_eq!(row("Black Wide").2, "Source Sans 3");
+        assert_eq!((row("Regular").1.as_str(), row("Regular").2.as_str()), ("missing", vectorcraft_text::FALLBACK_FAMILY));
+        s.execute("text.create", &json!({"x": 10, "y": 90, "text": "Ab 雅楽", "font": "Inter"})).unwrap();
+        let inter = s.execute("text.fonts", &json!({})).unwrap().as_array().unwrap().iter().find(|f| f["family"] == "Inter").cloned().unwrap();
+        assert_eq!(inter["missingGlyphs"], 2, "雅 and 楽 come from a fallback font: {inter}");
+    }
+
     #[test]
     fn opened_documents_have_exact_text_bounds() {
         let mut s = Session::new();

crates/engine/src/cmd/layer.rs

@@ -1,31 +1,125 @@
 //! Layers panel, artboards.
+//!
+//! The Layers panel works on rows: layers, sublayers, groups and objects. Clicking a row makes it
+//! the highlighted row (`layer.setCurrent`; Shift and Ctrl change several, `layer.highlight`) and
+//! its layer the current one, where new art goes. Panel commands without `ids` act on the
+//! highlighted rows, else on the current layer. More panel-menu operations live in
+//! [`super::layerpanel`].
+
+use std::collections::HashSet;
+use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Artboard, LayerColor, NodeId, NodeKind};
+use vectorcraft_doc::{Artboard, Document, LAYER_COLORS, LayerColor, Node, NodeId, NodeKind};
 use vectorcraft_geom::Rect;
 
 use super::*;
 use crate::EngineError;
 
+/// Most rows one panel command takes (ids are untrusted input).
+pub(crate) const MAX_ROWS: usize = 100_000;
+
 pub fn specs() -> Vec<CommandSpec> {
     vec![
-        cmd!("layer.new", "New Layer…", ["Window", "Layers"], Some("Cmd+L"), "{name?} → {id} (above the current layer)", has_doc, new_layer),
-        cmd!("layer.newSublayer", "New Sublayer…", ["Window", "Layers"], None, "{parent?: id, name?} → {id}", has_doc, new_sublayer),
-        cmd!("layer.delete", "Delete Layer", ["Window", "Layers"], None, "{id?} (default: current layer)", has_doc, delete_layer),
-        cmd!("layer.duplicate", "Duplicate Layer", ["Window", "Layers"], None, "{id?}", has_doc, duplicate_layer),
-        cmd!("layer.setCurrent", "Set Current Layer", [], None, "{id}", has_doc, set_current),
+        cmd!(
+            "layer.new",
+            "New Layer…",
+            ["Window", "Layers"],
+            Some("Cmd+L"),
+            "{name?, top?: bool, color?, template?, locked?, visible?, printable?, preview?, dimImages?} a layer directly above the current layer, at its level (a sublayer beside a current sublayer); `top`: above all layers (Ctrl-click the button). Options as layer.setProps → {id}",
+            has_doc,
+            new_layer
+        ),
+        cmd!(
+            "layer.newSublayer",
+            "New Sublayer…",
+            ["Window", "Layers"],
+            None,
+            "{parent?: layer id (default: the highlighted row's layer, else the current layer), name?, options as layer.new} a sublayer on top of the parent's contents → {id}",
+            has_doc,
+            new_sublayer
+        ),
+        cmd!(
+            "layer.delete",
+            "Delete Selection",
+            ["Window", "Layers"],
+            None,
+            "{ids?|id?} delete rows: layers, sublayers, groups or objects with what they hold (default: the highlighted rows, else the current layer). The last layer stays → {deleted}",
+            has_doc,
+            delete_rows
+        ),
+        cmd!(
+            "layer.duplicate",
+            "Duplicate Selection",
+            ["Window", "Layers"],
+            None,
+            "{ids?|id?} copy rows (default: the highlighted rows, else the current layer), each just above its original; a layer's copy is named `<name> copy`. The copies are highlighted → {ids}",
+            has_doc,
+            duplicate_rows
+        ),
+        cmd!(
+            "layer.setCurrent",
+            "Set Current Layer",
+            [],
+            None,
+            "{id} click a row: it alone is highlighted, and the layer it is (or the layer it is in) becomes the current layer, where new art goes. Not an undo step → {id, layer}",
+            has_doc,
+            set_current
+        ),
+        cmd!(
+            "layer.highlight",
+            "Highlight Rows",
+            [],
+            None,
+            "{ids, mode?: \"set\"|\"add\"|\"toggle\"} highlight Layers panel rows (Shift-click: a range, Ctrl-click: toggle one); the last one's layer becomes current. Not an undo step → {rows}",
+            has_doc,
+            highlight
+        ),
         cmd!(
             "layer.setProps",
             "Layer Options…",
             ["Window", "Layers"],
             None,
-            "{id, name?, visible?, locked?, template?, printable?, color?: index 0..26}",
+            "{ids?|id? (default: the highlighted rows, else the current layer), name?, visible?, locked?, template?, printable?, preview?, dimImages?: 0..100|false, color?: index 0..26|\"#rrggbb\"|preset name} Layer Options; rows that are not layers take name, visible and locked. Template on also locks the layer and dims its images to 50% (unless given); off unlocks it and stops dimming. One undo step",
             has_doc,
             set_props
         ),
-        cmd!("layer.collectInNew", "Collect in New Layer", ["Window", "Layers"], None, "{}", has_selection, collect),
-        cmd!("layer.selectAll", "Select All Art on Layer", [], None, "{id}", has_doc, select_all_on),
-        cmd!("node.move", "Reorder", [], None, "{id, parent?: id (null = top level), index} drag-reorder in the Layers panel", has_doc, move_node),
+        cmd!(
+            "layer.collectInNew",
+            "Collect in New Layer",
+            ["Window", "Layers"],
+            None,
+            "{ids?} move rows (default: the highlighted rows, else the selected objects) into a new layer where the topmost of them was (a sublayer when they are in a layer) → {id}",
+            has_doc,
+            collect
+        ),
+        cmd!(
+            "layer.selectAll",
+            "Select Art",
+            [],
+            None,
+            "{id, add?: bool} the Layers panel's selection column: select the visible, unlocked art of a layer (its sublayers' too), or the object itself; `add` (Shift-click) adds it to the selection, or removes it when it is all selected already → {selected: [..]}",
+            has_doc,
+            select_art
+        ),
+        cmd!(
+            "layer.move",
+            "Move Rows",
+            [],
+            None,
+            "{ids, target, place?: \"above\"|\"below\"|\"inside\" (default inside), copy?: bool} drag rows in the Layers panel: above or below the target row (beside it, in its layer or group), or inside a layer or group (on top of its contents). Layers go only in layers or at the top level, objects in layers and groups; an object placed beside a top-level layer goes inside it. A row never goes into itself; a locked layer or group takes nothing. `copy` (Alt-drag) moves copies. One undo step → {ids}",
+            has_doc,
+            move_rows
+        ),
+        cmd!(
+            "node.move",
+            "Reorder",
+            [],
+            None,
+            "{id, parent?: id (null = top level), index} put a row at `index` (0 = bottom) of `parent` (layers only at the top level or in layers)",
+            has_doc,
+            move_node
+        ),
         cmd!(
             "artboard.new",
             "New Artboard",
@@ -52,7 +146,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make/Release Clipping Mask",
             ["Window", "Layers"],
             None,
-            "{id?: layer or group (default: the one selected group, else the current layer)} make: its top object (a path, compound path or text, which loses its paint) clips the rest and moves to the bottom (new art added on top is clipped); release: it stops clipping, the clipping path stays unpainted → {clip}",
+            "{id?: layer or group (default: the one highlighted layer or group row, else the one selected group, else the current layer)} make: its top object (a path, compound path or text, which loses its paint) clips the rest and moves to the bottom (new art added on top is clipped); release: it stops clipping, the clipping path stays unpainted → {clip}",
             has_doc,
             clip_toggle
         ),
@@ -61,7 +155,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Target",
             [],
             None,
-            "{id} target a layer, group or object as clicking its target circle in the Layers panel does: a layer gets its visible, unlocked art selected and becomes the current layer, and appearance.*, effect.*, transparency.* and the opacity-mask commands without `ids` then act on the layer itself; anything else is selected. Any other selection change ends the targeting (`document.inspect` → target) → {id, selected: [..]}",
+            "{id} target a layer, group or object as clicking its target circle in the Layers panel does: a layer gets its visible, unlocked art (its sublayers' too) selected and becomes the current layer, and appearance.*, effect.*, transparency.* and the opacity-mask commands without `ids` then act on the layer itself; anything else is selected. Any other selection change ends the targeting (`document.inspect` → target) → {id, selected: [..]}",
             has_doc,
             target
         ),
@@ -77,6 +171,165 @@ pub fn specs() -> Vec<CommandSpec> {
     ]
 }
 
+/// The rows a panel command acts on: `ids` or `id`, else the highlighted rows, else the current
+/// layer (capped at [`MAX_ROWS`]).
+pub(crate) fn rows_param(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
+    let mut ids = match (ids_param(p, "ids"), id_param(p, "id")) {
+        (Some(ids), _) => ids,
+        (None, Some(id)) => vec![id],
+        (None, None) => {
+            let st = s.doc()?;
+            let rows = st.highlighted_rows();
+            if rows.is_empty() { st.current_layer().into_iter().collect() } else { rows }
+        }
+    };
+    ids.truncate(MAX_ROWS);
+    Ok(ids)
+}
+
+/// `ids` that exist, without repeats or rows inside another listed row, in paint order (bottom
+/// first).
+pub(crate) fn row_roots(d: &Document, ids: &[NodeId]) -> Vec<NodeId> {
+    let set: HashSet<NodeId> = ids.iter().copied().filter(|i| d.node(*i).is_some()).collect();
+    let keep: Vec<NodeId> = set
+        .iter()
+        .copied()
+        .filter(|id| d.ancestry(*id).is_some_and(|a| a.split_last().is_none_or(|(_, above)| !above.iter().any(|x| set.contains(x)))))
+        .collect();
+    d.paint_order(keep)
+}
+
+/// Whether `parent` (None: the top level) can hold `n`: layers go at the top level or in layers,
+/// anything else in layers and groups.
+pub(crate) fn accepts(d: &Document, parent: Option<NodeId>, n: &Node) -> bool {
+    match parent {
+        None => n.is_layer(),
+        Some(p) => match d.node(p).map(|x| &x.kind) {
+            Some(NodeKind::Layer { .. }) => true,
+            Some(NodeKind::Group { .. }) => !n.is_layer(),
+            _ => false,
+        },
+    }
+}
+
+/// Whether `id` or a container around it is locked.
+fn locked_within(d: &Document, id: NodeId) -> bool {
+    d.ancestry(id).unwrap_or_default().iter().any(|a| d.node(*a).is_some_and(|n| n.locked))
+}
+
+/// Every layer and sublayer, depth first.
+fn all_layers(d: &Document) -> Vec<&Node> {
+    let mut out = vec![];
+    d.walk(|n| {
+        if n.is_layer() {
+            out.push(n);
+        }
+    });
+    out
+}
+
+/// A new layer named `name` (default: the next `Layer N`) in the next layer colour.
+pub(crate) fn make_layer(d: &mut Document, name: Option<&str>) -> Node {
+    let n = all_layers(d).len();
+    let name = name.map(str::to_string).unwrap_or_else(|| d.next_layer_name());
+    let id = d.alloc_id();
+    Node::layer(id, &name, LayerColor::Preset((n % LAYER_COLORS.len()) as u8))
+}
+
+/// A layer colour: a preset index (0–26), `#rrggbb` or a preset's name (any case).
+fn layer_color_param(v: &Value) -> std::result::Result<LayerColor, String> {
+    match v {
+        Value::Number(n) => match n.as_u64() {
+            Some(i) if (i as usize) < LAYER_COLORS.len() => Ok(LayerColor::Preset(i as u8)),
+            _ => Err(format!("a colour index is 0 to {}, not {n}", LAYER_COLORS.len() - 1)),
+        },
+        Value::String(s) => {
+            if let Some(i) = LAYER_COLORS.iter().position(|(name, _)| name.eq_ignore_ascii_case(s.trim())) {
+                return Ok(LayerColor::Preset(i as u8));
+            }
+            let c = vectorcraft_color::Color::from_hex(s).ok_or_else(|| format!("`{s}` is not a colour (#rrggbb or a preset name)"))?;
+            let [r, g, b, _] = c.to_rgba8(1.0);
+            Ok(LayerColor::Custom([r, g, b]))
+        }
+        _ => Err(format!("a colour is an index, #rrggbb or a preset name, not {v}")),
+    }
+}
+
+/// Layer Options in `p` applied to layer or row `n` (validated first by [`check_options`]).
+fn apply_options(n: &mut Node, p: &Value) {
+    if let Some(v) = str_param(p, "name") {
+        if v.trim().is_empty() {
+            // A layer keeps a name; an object goes back to its generated `<Kind>` one.
+            if !n.is_layer() {
+                n.name = None;
+            }
+        } else {
+            n.name = Some(v.chars().take(512).collect());
+        }
+    }
+    if let Some(v) = p.get("visible").and_then(Value::as_bool) {
+        n.visible = v;
+    }
+    let locked = p.get("locked").and_then(Value::as_bool);
+    if let Some(v) = locked {
+        n.locked = v;
+    }
+    let mut lock = None;
+    if let NodeKind::Layer { template, printable, color, preview, dim_images, .. } = &mut n.kind {
+        let dim_given = p.get("dimImages").is_some();
+        if let Some(v) = p.get("template").and_then(Value::as_bool)
+            && v != *template
+        {
+            *template = v;
+            // A template is locked and its images dimmed; it stops being either with it.
+            lock = Some(v);
+            if !dim_given {
+                *dim_images = v.then_some(50);
+            }
+        }
+        if let Some(v) = p.get("printable").and_then(Value::as_bool) {
+            *printable = v;
+        }
+        if let Some(v) = p.get("preview").and_then(Value::as_bool) {
+            *preview = v;
+        }
+        match p.get("dimImages") {
+            Some(Value::Bool(false) | Value::Null) => *dim_images = None,
+            Some(Value::Bool(true)) => *dim_images = Some(50),
+            Some(v) => {
+                if let Some(x) = v.as_f64().filter(|x| x.is_finite()) {
+                    *dim_images = Some(x.clamp(0.0, 100.0).round() as u8);
+                }
+            }
+            None => {}
+        }
+        if let Some(c) = p.get("color").and_then(|v| layer_color_param(v).ok()) {
+            *color = c;
+        }
+    }
+    if let (Some(v), None) = (lock, locked) {
+        n.locked = v;
+    }
+}
+
+/// Bad values in Layer Options params, as an error for `cmd`.
+fn check_options(cmd: &str, p: &Value) -> Result<()> {
+    if let Some(v) = p.get("color") {
+        layer_color_param(v).map_err(|e| bad(cmd, e))?;
+    }
+    for k in ["visible", "locked", "template", "printable", "preview"] {
+        if p.get(k).is_some_and(|v| !v.is_boolean()) {
+            return Err(bad(cmd, format!("`{k}` is true or false")));
+        }
+    }
+    if let Some(v) = p.get("dimImages")
+        && !(v.is_boolean() || v.is_null() || v.as_f64().is_some_and(f64::is_finite))
+    {
+        return Err(bad(cmd, "`dimImages` is a percentage or false"));
+    }
+    Ok(())
+}
+
 /// Layers panel → Paste Remembers Layers.
 fn paste_remembers_layers(s: &mut Session, p: &Value) -> Result<Value> {
     let cur = s.doc()?.doc.paste_remembers_layers;
@@ -100,8 +353,11 @@ fn target(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "the object is hidden or locked"));
     }
     let layer = n.is_layer();
+    let rows = st.layer_rows.clone();
     s.select(|d, sel| sel.set_target(d, id))?;
     let st = s.doc_mut()?;
+    // Targeting doesn't change which rows are highlighted.
+    st.layer_rows = rows;
     if layer {
         st.active_layer = Some(id);
     }
@@ -112,11 +368,16 @@ fn target(s: &mut Session, p: &Value) -> Result<Value> {
 /// or the clipping mask is released.
 fn clip_toggle(s: &mut Session, p: &Value) -> Result<Value> {
     let st = s.doc()?;
+    let container = |id: &NodeId| st.doc.node(*id).is_some_and(|n| matches!(n.kind, NodeKind::Group { .. } | NodeKind::Layer { .. }));
+    let row = match st.highlighted_rows().as_slice() {
+        [id] if container(id) => Some(*id),
+        _ => None,
+    };
     let group = match st.selection.objects.as_slice() {
         [id] if matches!(st.doc.node(*id).map(|n| &n.kind), Some(NodeKind::Group { .. })) => Some(*id),
         _ => None,
     };
-    let id = id_param(p, "id").or(group).or(st.current_layer()).ok_or_else(|| bad("layer.clippingMask.toggle", "no layer"))?;
+    let id = id_param(p, "id").or(row).or(group).or(st.current_layer()).ok_or_else(|| bad("layer.clippingMask.toggle", "no layer"))?;
     let clip = s.edit("Make/Release Clipping Mask", |d, _| {
         let n = d.node(id).ok_or(EngineError::NoNode(id))?;
         if !matches!(n.kind, NodeKind::Layer { .. } | NodeKind::Group { .. }) {
@@ -138,99 +399,142 @@ fn clip_toggle(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "clip": clip }))
 }
 
-fn new_layer(s: &mut Session, p: &Value) -> Result<Value> {
-    let name = str_param(p, "name").map(str::to_string);
-    let st = s.doc()?;
-    let cur = st.active_layer.and_then(|l| st.doc.position(l)).filter(|(par, _, _)| par.is_none()).map(|(_, i, _)| i);
-    let id = s.edit("New Layer", |d, _| {
-        let id = d.add_layer(name.as_deref());
-        if let Some(i) = cur {
-            d.move_node(id, None, i + 1)?;
-        }
-        Ok(id)
+/// A new layer with the options in `p`, at `parent`/`index`; it becomes current and highlighted.
+fn add_layer(s: &mut Session, p: &Value, cmd: &str, label: &str, place: impl FnOnce(&Document) -> Result<(Option<NodeId>, usize)>) -> Result<Value> {
+    check_options(cmd, p)?;
+    let name = str_param(p, "name").filter(|n| !n.trim().is_empty()).map(str::to_string);
+    let id = s.edit(label, |d, _| {
+        let (parent, index) = place(d)?;
+        let mut n = make_layer(d, name.as_deref());
+        apply_options(&mut n, p);
+        Ok(d.insert(parent, index, n)?)
     })?;
-    s.doc_mut()?.active_layer = Some(id);
+    let st = s.doc_mut()?;
+    st.active_layer = Some(id);
+    st.layer_rows = vec![id];
     Ok(json!({ "id": id.0 }))
 }
 
+fn new_layer(s: &mut Session, p: &Value) -> Result<Value> {
+    let st = s.doc()?;
+    // Above the current layer, at its level; on top of everything with `top`.
+    let cur = st.current_layer().filter(|_| !bool_or(p, "top", false));
+    add_layer(s, p, "layer.new", "New Layer", |d| match cur.and_then(|c| d.position(c)) {
+        Some((parent, i, _)) => Ok((parent, i + 1)),
+        None => Ok((None, usize::MAX)),
+    })
+}
+
 fn new_sublayer(s: &mut Session, p: &Value) -> Result<Value> {
-    let parent = id_param(p, "parent").or(s.doc()?.current_layer()).ok_or_else(|| bad("layer.newSublayer", "no parent layer"))?;
-    let name = str_param(p, "name").map(str::to_string);
-    let id = s.edit("New Sublayer", |d, _| {
-        let n = d.node(parent).and_then(|n| n.children()).map(|c| c.iter().filter(|c| c.is_layer()).count()).unwrap_or(0);
-        let id = d.alloc_id();
-        let color = LayerColor::Preset(((d.layers.len() + n + 1) % 27) as u8);
-        let nm = name.unwrap_or_else(|| format!("Layer {}", d.node_count()));
-        d.insert(Some(parent), usize::MAX, vectorcraft_doc::Node::layer(id, &nm, color))?;
-        Ok(id)
-    })?;
-    Ok(json!({ "id": id.0 }))
+    const C: &str = "layer.newSublayer";
+    let st = s.doc()?;
+    let row = st.highlighted_rows().last().and_then(|r| st.doc.layer_containing(*r));
+    let parent = id_param(p, "parent").or(row).or(st.current_layer()).ok_or_else(|| bad(C, "no parent layer"))?;
+    if !st.doc.node(parent).is_some_and(Node::is_layer) {
+        return Err(bad(C, "the parent must be a layer or sublayer"));
+    }
+    add_layer(s, p, C, "New Sublayer", |_| Ok((Some(parent), usize::MAX)))
 }
 
-fn delete_layer(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").or(s.doc()?.current_layer()).ok_or_else(|| bad("layer.delete", "no layer"))?;
+fn delete_rows(s: &mut Session, p: &Value) -> Result<Value> {
+    let ids = rows_param(s, p)?;
     let st = s.doc()?;
-    if st.doc.layers.len() == 1 && st.doc.layers[0].id == id {
+    let ids = row_roots(&st.doc, &ids);
+    if ids.is_empty() {
+        return Err(bad("layer.delete", "no such rows"));
+    }
+    if st.doc.layers.iter().all(|l| ids.contains(&l.id)) {
         return Err(EngineError::Other("a document needs at least one layer".into()));
     }
-    s.edit("Delete Layer", |d, sel| {
-        d.remove(id)?;
+    s.edit("Delete Selection", |d, sel| {
+        for id in &ids {
+            d.remove(*id)?;
+        }
         sel.prune(d);
         Ok(())
     })?;
     let st = s.doc_mut()?;
-    if st.active_layer == Some(id) || st.active_layer.is_some_and(|l| st.doc.node(l).is_none()) {
+    st.layer_rows.clear();
+    if st.current_layer().is_none() {
         st.active_layer = st.doc.default_layer();
     }
-    ok()
+    Ok(json!({ "deleted": ids.len() }))
 }
 
-fn duplicate_layer(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").or(s.doc()?.current_layer()).ok_or_else(|| bad("layer.duplicate", "no layer"))?;
-    let nid = s.edit("Duplicate Layer", |d, _| {
-        let (par, idx, _) = d.position(id).ok_or(EngineError::NoNode(id))?;
-        let n = d.node(id).cloned().ok_or(EngineError::NoNode(id))?;
-        let mut c = d.reid(&n);
-        c.name = Some(format!("{} copy", n.display_name()));
-        Ok(d.insert(par, idx + 1, c)?)
+fn duplicate_rows(s: &mut Session, p: &Value) -> Result<Value> {
+    let ids = rows_param(s, p)?;
+    let ids = row_roots(&s.doc()?.doc, &ids);
+    if ids.is_empty() {
+        return Err(bad("layer.duplicate", "no such rows"));
+    }
+    let copies = s.edit("Duplicate Selection", |d, _| {
+        let mut out = vec![];
+        for id in &ids {
+            let (par, idx, _) = d.position(*id).ok_or(EngineError::NoNode(*id))?;
+            let n = d.node(*id).cloned().ok_or(EngineError::NoNode(*id))?;
+            let mut c = d.reid(&n);
+            if n.is_layer() {
+                c.name = Some(format!("{} copy", n.display_name()));
+            }
+            out.push(d.insert(par, idx + 1, c)?);
+        }
+        Ok(out)
     })?;
-    Ok(json!({ "id": nid.0 }))
+    s.doc_mut()?.layer_rows = copies.clone();
+    Ok(json!({ "ids": copies.iter().map(|i| i.0).collect::<Vec<_>>() }))
 }
 
 fn set_current(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").ok_or_else(|| bad("layer.setCurrent", "missing id"))?;
+    const C: &str = "layer.setCurrent";
+    let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
     let st = s.doc_mut()?;
-    if !st.doc.node(id).is_some_and(|n| n.is_layer()) {
-        return Err(bad("layer.setCurrent", "not a layer"));
-    }
-    st.active_layer = Some(id);
+    let layer = st.doc.layer_containing(id).ok_or(EngineError::NoNode(id))?;
+    st.active_layer = Some(layer);
+    st.layer_rows = vec![id];
     st.revision += 1;
-    ok()
+    Ok(json!({ "id": id.0, "layer": layer.0 }))
+}
+
+fn highlight(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.highlight";
+    let mut ids = ids_param(p, "ids").ok_or_else(|| bad(C, "missing ids"))?;
+    ids.truncate(MAX_ROWS);
+    let mode = str_param(p, "mode").unwrap_or("set");
+    let st = s.doc_mut()?;
+    ids.retain(|id| st.doc.node(*id).is_some());
+    let mut rows = st.highlighted_rows();
+    match mode {
+        "set" => rows.clear(),
+        "add" | "toggle" => {}
+        other => return Err(bad(C, format!("mode is set, add or toggle, not `{other}`"))),
+    }
+    let mut last = None;
+    for id in ids {
+        if mode == "toggle" && rows.contains(&id) {
+            rows.retain(|r| *r != id);
+        } else if !rows.contains(&id) {
+            rows.push(id);
+            last = Some(id);
+        }
+    }
+    if let Some(layer) = last.or(rows.last().copied()).and_then(|id| st.doc.layer_containing(id)) {
+        st.active_layer = Some(layer);
+    }
+    st.layer_rows = rows;
+    st.revision += 1;
+    Ok(json!({ "rows": st.layer_rows.iter().map(|i| i.0).collect::<Vec<_>>() }))
 }
 
 fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").ok_or_else(|| bad("layer.setProps", "missing id"))?;
+    const C: &str = "layer.setProps";
+    check_options(C, p)?;
+    let ids = rows_param(s, p)?;
+    if ids.is_empty() {
+        return Err(bad(C, "no rows"));
+    }
     s.edit("Layer Options", |d, sel| {
-        let n = d.node_mut(id).ok_or(EngineError::NoNode(id))?;
-        if let Some(v) = str_param(p, "name") {
-            n.name = Some(v.to_string());
-        }
-        if let Some(v) = p.get("visible").and_then(Value::as_bool) {
-            n.visible = v;
-        }
-        if let Some(v) = p.get("locked").and_then(Value::as_bool) {
-            n.locked = v;
-        }
-        if let NodeKind::Layer { template, printable, color, .. } = &mut n.kind {
-            if let Some(v) = p.get("template").and_then(Value::as_bool) {
-                *template = v;
-            }
-            if let Some(v) = p.get("printable").and_then(Value::as_bool) {
-                *printable = v;
-            }
-            if let Some(v) = p.get("color").and_then(Value::as_u64) {
-                *color = LayerColor::Preset((v % 27) as u8);
-            }
+        for id in &ids {
+            apply_options(d.node_mut(*id).ok_or(EngineError::NoNode(*id))?, p);
         }
         // Hidden or locked content can't stay selected.
         let hidden: Vec<NodeId> = sel.objects.iter().copied().filter(|o| !d.is_editable(*o)).collect();
@@ -242,37 +546,166 @@ fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
-fn collect(s: &mut Session, _: &Value) -> Result<Value> {
-    let ids = super::edit::selected_roots(s)?;
-    let lid = s.edit("Collect in New Layer", |d, _| {
-        let lid = d.add_layer(None);
+fn collect(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.collectInNew";
+    let ids = match ids_param(p, "ids") {
+        Some(ids) => ids,
+        None => {
+            let rows = s.doc()?.highlighted_rows();
+            if rows.is_empty() { super::edit::selected_roots(s)? } else { rows }
+        }
+    };
+    let ids = row_roots(&s.doc()?.doc, &ids);
+    let Some(top) = ids.last().copied() else { return Err(bad(C, "select rows or objects to collect")) };
+    let lid = s.edit("Collect in New Layer", |d, sel| {
+        // Where the topmost of them is: beside it in its layer, or on top of the layer holding
+        // its group.
+        let (parent, index) = match d.position(top) {
+            Some((par, i, _)) if par.is_none_or(|p| d.node(p).is_some_and(Node::is_layer)) => (par, i + 1),
+            _ => (d.layer_containing(top), usize::MAX),
+        };
+        let layer = make_layer(d, None);
+        let lid = d.insert(parent, index, layer)?;
         for id in &ids {
             d.move_node(*id, Some(lid), usize::MAX)?;
         }
+        sel.prune(d);
         Ok(lid)
     })?;
+    let st = s.doc_mut()?;
+    st.active_layer = Some(lid);
+    st.layer_rows = vec![lid];
     Ok(json!({ "id": lid.0 }))
 }
 
-fn select_all_on(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").ok_or_else(|| bad("layer.selectAll", "missing id"))?;
-    let ids: Vec<NodeId> = s
-        .doc()?
-        .doc
-        .node(id)
-        .and_then(|n| n.children())
-        .map(|c| c.iter().filter(|n| n.visible && !n.locked).map(|n| n.id).collect())
-        .unwrap_or_default();
-    s.select(|_, sel| sel.set(ids.iter().copied()))?;
-    ok()
+/// The selection column: select a row's art.
+fn select_art(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.selectAll";
+    let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
+    let add = bool_or(p, "add", false);
+    let st = s.doc()?;
+    let n = st.doc.node(id).ok_or(EngineError::NoNode(id))?;
+    let ids: Vec<NodeId> = if !st.doc.is_editable(id) {
+        vec![]
+    } else if n.is_layer() {
+        n.layer_art(true)
+    } else {
+        vec![id]
+    };
+    let all_selected = !ids.is_empty() && ids.iter().all(|i| st.selection.contains(*i));
+    let rows = st.layer_rows.clone();
+    s.select(|_, sel| {
+        if !add {
+            sel.set(ids.iter().copied());
+        } else if all_selected {
+            for i in &ids {
+                sel.remove(*i);
+            }
+        } else {
+            for i in &ids {
+                sel.add(*i);
+            }
+        }
+    })?;
+    let st = s.doc_mut()?;
+    // The selection column leaves the highlighted rows as they are.
+    st.layer_rows = rows;
+    Ok(json!({ "selected": st.selection.objects.iter().map(|i| i.0).collect::<Vec<_>>() }))
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Place {
+    Above,
+    Below,
+    Inside,
+}
+
+/// Drag rows in the Layers panel.
+fn move_rows(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.move";
+    let mut ids = ids_param(p, "ids").or_else(|| id_param(p, "id").map(|i| vec![i])).ok_or_else(|| bad(C, "missing ids"))?;
+    ids.truncate(MAX_ROWS);
+    let target = id_param(p, "target").ok_or_else(|| bad(C, "missing target"))?;
+    let place = match str_param(p, "place").unwrap_or("inside") {
+        "above" => Place::Above,
+        "below" => Place::Below,
+        "inside" | "into" => Place::Inside,
+        other => return Err(bad(C, format!("place is above, below or inside, not `{other}`"))),
+    };
+    let copy = bool_or(p, "copy", false);
+    let st = s.doc()?;
+    let d = &st.doc;
+    d.node(target).ok_or(EngineError::NoNode(target))?;
+    let ids = row_roots(d, &ids);
+    if ids.is_empty() {
+        return Err(bad(C, "no such rows"));
+    }
+    // Never into itself or a row inside it.
+    let around = d.ancestry(target).unwrap_or_default();
+    if ids.iter().any(|i| around.contains(i)) {
+        return Err(bad(C, "a row can't go into itself"));
+    }
+    let nodes: Vec<&Node> = ids.iter().filter_map(|i| d.node(*i)).collect();
+    let (parent, anchor) = match place {
+        Place::Inside => (Some(target), None),
+        _ => match d.parent_of(target) {
+            // Objects can't be at the top level: beside a top-level layer means in it.
+            None if nodes.iter().any(|n| !n.is_layer()) => (Some(target), None),
+            parent => (parent, Some(target)),
+        },
+    };
+    if let Some(n) = nodes.iter().find(|n| !accepts(d, parent, n)) {
+        let into = parent.and_then(|p| d.node(p)).map_or("the top level", |p| if p.is_layer() { "a layer" } else { p.kind_label() });
+        return Err(bad(C, format!("{} can't go into {into}", n.display_name())));
+    }
+    if parent.is_some_and(|p| locked_within(d, p)) {
+        return Err(EngineError::Other("the layer or group is locked".into()));
+    }
+    let label = if copy { "Duplicate Rows" } else { "Move Rows" };
+    let moved = s.edit(label, |d, sel| {
+        let mut nodes = vec![];
+        for id in &ids {
+            nodes.push(if copy {
+                let n = d.node(*id).cloned().ok_or(EngineError::NoNode(*id))?;
+                d.reid(&n)
+            } else {
+                Arc::unwrap_or_clone(d.remove(*id)?)
+            });
+        }
+        let count = d.children(parent).map_or(0, Vec::len);
+        let mut index = match anchor {
+            None => count,
+            Some(a) => {
+                let (_, i, _) = d.position(a).ok_or(EngineError::NoNode(a))?;
+                if place == Place::Above { i + 1 } else { i }
+            }
+        };
+        // The clipping path stays at the bottom of a clip group or a clipping layer.
+        if count > 0 && parent.and_then(|p| d.node(p)).is_some_and(Node::clips) {
+            index = index.max(1);
+        }
+        let mut out = vec![];
+        for n in nodes {
+            out.push(d.insert(parent, index, n)?);
+            index += 1;
+        }
+        sel.prune(d);
+        Ok(out)
+    })?;
+    let st = s.doc_mut()?;
+    st.layer_rows = moved.clone();
+    Ok(json!({ "ids": moved.iter().map(|i| i.0).collect::<Vec<_>>() }))
 }
 
 fn move_node(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = id_param(p, "id").ok_or_else(|| bad("node.move", "missing id"))?;
+    const C: &str = "node.move";
+    let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
     let parent = id_param(p, "parent");
-    let index = p.get("index").and_then(Value::as_u64).unwrap_or(u64::MAX) as usize;
-    if parent.is_none() && !s.doc()?.doc.node(id).is_some_and(|n| n.is_layer()) {
-        return Err(bad("node.move", "only layers can be at the top level"));
+    let index = p.get("index").and_then(Value::as_u64).unwrap_or(u64::MAX).min(usize::MAX as u64) as usize;
+    let d = &s.doc()?.doc;
+    let n = d.node(id).ok_or(EngineError::NoNode(id))?;
+    if !accepts(d, parent, n) {
+        return Err(bad(C, "layers go only at the top level or in layers, objects in layers and groups"));
     }
     s.edit("Reorder", |d, _| Ok(d.move_node(id, parent, index)?))?;
     ok()
@@ -302,14 +735,16 @@ fn artboard_new(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn artboard_delete(s: &mut Session, p: &Value) -> Result<Value> {
     let i = p.get("index").and_then(Value::as_u64).ok_or_else(|| bad("artboard.delete", "missing index"))? as usize;
-    s.edit("Delete Artboard", |d, _| {
+    s.edit("Delete Artboard", |d, sel| {
         if d.artboards.len() <= 1 {
             return Err(EngineError::Other("a document needs at least one artboard".into()));
         }
         if i >= d.artboards.len() {
             return Err(EngineError::Other("no such artboard".into()));
         }
-        d.artboards.remove(i);
+        // Its guides go with it.
+        let id = d.artboards.remove(i).id;
+        d.retain_guides(sel, |_, g| g.artboard != Some(id));
         Ok(())
     })?;
     ok()
@@ -319,10 +754,16 @@ fn artboard_set(s: &mut Session, p: &Value) -> Result<Value> {
     let i = p.get("index").and_then(Value::as_u64).unwrap_or(0) as usize;
     s.edit("Artboard Options", |d, _| {
         let a = d.artboards.get_mut(i).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+        let was = a.rect;
         a.rect = rect_from(p, a.rect);
         if let Some(n) = str_param(p, "name") {
             a.name = n.to_string();
         }
+        // Moved (not resized), it takes its guides along.
+        let (id, now) = (a.id, a.rect);
+        if (now.width() - was.width()).abs() <= 1e-6 && (now.height() - was.height()).abs() <= 1e-6 {
+            d.move_artboard_guides(id, now.origin() - was.origin());
+        }
         Ok(())
     })?;
     ok()

crates/engine/src/cmd/layerpanel.rs

@@ -0,0 +1,429 @@
+//! The Layers panel menu's operations on rows: Merge Selected, Flatten Artwork, Release to Layers,
+//! Reverse Order, Template, Hide/Outline/Lock Others and their Show/Preview/Unlock All
+//! counterparts, Locate Object. Rows default to the highlighted ones, else the current layer (see
+//! [`super::layer`]).
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
+
+use super::layer::{make_layer, row_roots, rows_param};
+use super::*;
+use crate::EngineError;
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            "layer.merge",
+            "Merge Selected",
+            ["Window", "Layers"],
+            None,
+            "{ids?} (default: the highlighted rows) merge two or more rows into the layer listed (highlighted) last: the other layers' contents and the other rows move into it, keeping their stacking order, and the emptied layers go. One undo step → {id}",
+            has_doc,
+            merge
+        ),
+        cmd!(
+            "layer.flatten",
+            "Flatten Artwork",
+            ["Window", "Layers"],
+            None,
+            "{id?} (default: the highlighted row's top-level layer, else the current one's) move the art of every other visible top-level layer into this one, keeping the stacking order; hidden layers and their art are deleted, template layers stay. One undo step → {id, discarded}",
+            has_doc,
+            flatten
+        ),
+        cmd!(
+            "layer.releaseToLayers",
+            "Release to Layers (Sequence)",
+            ["Window", "Layers"],
+            None,
+            "{id?: layer or group (default: the highlighted row, else the current layer), build?: bool} each object in it goes into a new sublayer of its own, in stacking order (a group's objects go into sublayers of its layer, where the group was). `build`: Release to Layers (Build), each new sublayer holds copies of the objects up to its own, so the layers add up. One undo step → {ids}",
+            has_doc,
+            release
+        ),
+        cmd!(
+            "layer.releaseToLayersBuild",
+            "Release to Layers (Build)",
+            ["Window", "Layers"],
+            None,
+            "{id?} layer.releaseToLayers with build: true → {ids}",
+            has_doc,
+            |s, p| {
+                let mut p = p.clone();
+                if let Some(m) = p.as_object_mut() {
+                    m.insert("build".into(), json!(true));
+                } else {
+                    p = json!({"build": true});
+                }
+                release(s, &p)
+            }
+        ),
+        cmd!(
+            "layer.reverse",
+            "Reverse Order",
+            ["Window", "Layers"],
+            None,
+            "{ids?} (default: the highlighted rows) reverse the stacking order of two or more rows that share a layer or group; each keeps the places the others held. One undo step",
+            has_doc,
+            reverse
+        ),
+        cmd!(
+            "layer.template",
+            "Template",
+            ["Window", "Layers"],
+            None,
+            "{ids?, on?: bool (default: toggle the first)} make layers templates (locked, dimmed, left out of print and export) or ordinary layers again (layer.setProps template) → {on}",
+            has_doc,
+            template
+        ),
+        cmd!(
+            "layer.hideOthers",
+            "Hide Others",
+            ["Window", "Layers"],
+            None,
+            "{ids?} hide every top-level layer but those holding the highlighted rows (else the current layer). One undo step → {count}",
+            has_doc,
+            |s, p| others(s, p, Flag::Visible, false)
+        ),
+        cmd!("layer.showAll", "Show All Layers", ["Window", "Layers"], None, "{} show every layer and sublayer → {count}", has_doc, |s, _| all(
+            s,
+            Flag::Visible,
+            true
+        )),
+        cmd!(
+            "layer.outlineOthers",
+            "Outline Others",
+            ["Window", "Layers"],
+            None,
+            "{ids?} turn Preview off (outline view) for every top-level layer but those holding the highlighted rows (else the current layer) → {count}",
+            has_doc,
+            |s, p| others(s, p, Flag::Preview, false)
+        ),
+        cmd!(
+            "layer.previewAll",
+            "Preview All Layers",
+            ["Window", "Layers"],
+            None,
+            "{} turn Preview on for every layer and sublayer → {count}",
+            has_doc,
+            |s, _| all(s, Flag::Preview, true)
+        ),
+        cmd!(
+            "layer.lockOthers",
+            "Lock Others",
+            ["Window", "Layers"],
+            None,
+            "{ids?} lock every top-level layer but those holding the highlighted rows (else the current layer) → {count}",
+            has_doc,
+            |s, p| others(s, p, Flag::Locked, true)
+        ),
+        cmd!(
+            "layer.unlockAll",
+            "Unlock All Layers",
+            ["Window", "Layers"],
+            None,
+            "{} unlock every layer and sublayer → {count}",
+            has_doc,
+            |s, _| all(s, Flag::Locked, false)
+        ),
+        cmd!(
+            "layer.locate",
+            "Locate Object",
+            ["Window", "Layers"],
+            None,
+            "{id?} (default: the last selected object) highlight the object's row; the Layers panel opens the layers around it and scrolls to it → {id, ancestry: [layer…, id]}",
+            has_doc,
+            locate
+        ),
+    ]
+}
+
+/// A layer flag the panel menu sets on many layers.
+#[derive(Clone, Copy)]
+enum Flag {
+    Visible,
+    Locked,
+    Preview,
+}
+
+impl Flag {
+    fn get(self, n: &Node) -> bool {
+        match (self, &n.kind) {
+            (Flag::Visible, _) => n.visible,
+            (Flag::Locked, _) => n.locked,
+            (Flag::Preview, NodeKind::Layer { preview, .. }) => *preview,
+            (Flag::Preview, _) => true,
+        }
+    }
+    fn set(self, n: &mut Node, v: bool) {
+        match (self, &mut n.kind) {
+            (Flag::Visible, _) => n.visible = v,
+            (Flag::Locked, _) => n.locked = v,
+            (Flag::Preview, NodeKind::Layer { preview, .. }) => *preview = v,
+            (Flag::Preview, _) => {}
+        }
+    }
+    fn label(self, on: bool) -> &'static str {
+        match (self, on) {
+            (Flag::Visible, true) => "Show All Layers",
+            (Flag::Visible, false) => "Hide Others",
+            (Flag::Locked, true) => "Lock Others",
+            (Flag::Locked, false) => "Unlock All Layers",
+            (Flag::Preview, true) => "Preview All Layers",
+            (Flag::Preview, false) => "Outline Others",
+        }
+    }
+}
+
+/// Set `flag` to `v` on `ids` (layers that differ) in one undo step labelled `label` → how many
+/// changed.
+fn set_flag(s: &mut Session, ids: Vec<NodeId>, flag: Flag, v: bool, label: &str) -> Result<Value> {
+    let d = &s.doc()?.doc;
+    let ids: Vec<NodeId> = ids.into_iter().filter(|id| d.node(*id).is_some_and(|n| flag.get(n) != v)).collect();
+    if !ids.is_empty() {
+        s.edit(label, |d, sel| {
+            for id in &ids {
+                if let Some(n) = d.node_mut(*id) {
+                    flag.set(n, v);
+                }
+            }
+            // Hidden or locked art can't stay selected.
+            let out: Vec<NodeId> = sel.objects.iter().copied().filter(|o| !d.is_editable(*o)).collect();
+            for o in out {
+                sel.remove(o);
+            }
+            Ok(())
+        })?;
+    }
+    Ok(json!({ "count": ids.len() }))
+}
+
+/// The top-level layers holding the rows a command acts on.
+fn kept_layers(s: &Session, p: &Value) -> Result<HashSet<NodeId>> {
+    let ids = rows_param(s, p)?;
+    let d = &s.doc()?.doc;
+    Ok(ids.iter().filter_map(|id| d.layer_of(*id)).collect())
+}
+
+fn others(s: &mut Session, p: &Value, flag: Flag, v: bool) -> Result<Value> {
+    let keep = kept_layers(s, p)?;
+    let ids: Vec<NodeId> = s.doc()?.doc.layers.iter().map(|l| l.id).filter(|l| !keep.contains(l)).collect();
+    set_flag(s, ids, flag, v, flag.label(v))
+}
+
+fn all(s: &mut Session, flag: Flag, v: bool) -> Result<Value> {
+    let mut ids = vec![];
+    s.doc()?.doc.walk(|n| {
+        if n.is_layer() {
+            ids.push(n.id);
+        }
+    });
+    set_flag(s, ids, flag, v, flag.label(v))
+}
+
+fn template(s: &mut Session, p: &Value) -> Result<Value> {
+    let ids = rows_param(s, p)?;
+    let d = &s.doc()?.doc;
+    let ids: Vec<NodeId> = ids.into_iter().filter(|id| d.node(*id).is_some_and(Node::is_layer)).collect();
+    let Some(first) = ids.first().and_then(|id| d.node(*id)) else { return Err(bad("layer.template", "select a layer")) };
+    let on = bool_or(p, "on", !first.is_template());
+    s.execute("layer.setProps", &json!({"ids": ids.iter().map(|i| i.0).collect::<Vec<_>>(), "template": on}))?;
+    Ok(json!({ "on": on }))
+}
+
+/// Move the contents of `others` (layers give their children, anything else itself; none inside
+/// another) into layer `into`, keeping the document's stacking order, then delete the emptied
+/// layers.
+fn merge_into(d: &mut Document, into: NodeId, others: &[NodeId]) -> Result<()> {
+    let own: Vec<NodeId> =
+        d.node(into).and_then(|n| n.children()).map(|c| c.iter().map(|c| c.id).filter(|c| !others.contains(c)).collect()).unwrap_or_default();
+    let mut moved = vec![];
+    for id in others {
+        let n = d.node(*id).ok_or(EngineError::NoNode(*id))?;
+        if n.is_layer() {
+            moved.extend(n.children().into_iter().flatten().map(|c| c.id));
+        } else {
+            moved.push(*id);
+        }
+    }
+    // Where everything is now: the merged layer stacks its contents in this order.
+    let keys: HashMap<NodeId, Vec<usize>> = own.iter().chain(&moved).filter_map(|id| Some((*id, d.index_path(*id)?))).collect();
+    let mut taken = vec![];
+    for id in &moved {
+        taken.push(d.remove(*id)?);
+    }
+    for id in others {
+        if d.node(*id).is_some() {
+            d.remove(*id)?;
+        }
+    }
+    let ch = d.children_mut(Some(into))?;
+    let mut all = std::mem::take(ch);
+    all.extend(taken);
+    all.sort_by(|a, b| keys.get(&a.id).cmp(&keys.get(&b.id)));
+    *ch = all;
+    Ok(())
+}
+
+fn merge(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.merge";
+    let ids = rows_param(s, p)?;
+    let st = s.doc()?;
+    let d = &st.doc;
+    let mut seen = HashSet::new();
+    let ids: Vec<NodeId> = ids.into_iter().filter(|id| d.node(*id).is_some() && seen.insert(*id)).collect();
+    if ids.len() < 2 {
+        return Err(bad(C, "highlight two or more rows to merge"));
+    }
+    let into =
+        ids.iter().rev().copied().find(|id| d.node(*id).is_some_and(Node::is_layer)).ok_or_else(|| bad(C, "highlight a layer to merge into"))?;
+    let around = d.ancestry(into).unwrap_or_default();
+    // (Rows inside the target layer merge too: only rows inside other listed rows go with those.)
+    let rest: Vec<NodeId> = ids.iter().copied().filter(|id| *id != into).collect();
+    let others = row_roots(d, &rest);
+    if others.iter().any(|o| around.contains(o)) {
+        return Err(bad(C, "a layer can't be merged into its own sublayer"));
+    }
+    s.edit("Merge Selected", |d, sel| {
+        merge_into(d, into, &others)?;
+        sel.prune(d);
+        Ok(())
+    })?;
+    let st = s.doc_mut()?;
+    st.active_layer = Some(into);
+    st.layer_rows = vec![into];
+    Ok(json!({ "id": into.0 }))
+}
+
+fn flatten(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.flatten";
+    let st = s.doc()?;
+    let d = &st.doc;
+    let from = id_param(p, "id").or_else(|| st.highlighted_rows().last().copied()).or(st.current_layer());
+    let into = from.and_then(|id| d.layer_of(id)).ok_or_else(|| bad(C, "no layer"))?;
+    if !d.node(into).is_some_and(|n| n.visible) {
+        return Err(EngineError::Other("the layer to flatten into is hidden".into()));
+    }
+    let others: Vec<NodeId> = d.layers.iter().filter(|l| l.id != into && l.visible && !l.is_template()).map(|l| l.id).collect();
+    let hidden: Vec<NodeId> = d.layers.iter().filter(|l| l.id != into && !l.visible && !l.is_template()).map(|l| l.id).collect();
+    s.edit("Flatten Artwork", |d, sel| {
+        for h in &hidden {
+            d.remove(*h)?;
+        }
+        merge_into(d, into, &others)?;
+        sel.prune(d);
+        Ok(())
+    })?;
+    let st = s.doc_mut()?;
+    st.active_layer = Some(into);
+    st.layer_rows = vec![into];
+    Ok(json!({ "id": into.0, "discarded": hidden.len() }))
+}
+
+fn release(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.releaseToLayers";
+    let build = bool_or(p, "build", false);
+    let st = s.doc()?;
+    let id = match id_param(p, "id") {
+        Some(id) => id,
+        None => match st.highlighted_rows().as_slice() {
+            [id] => *id,
+            _ => st.current_layer().ok_or_else(|| bad(C, "no layer"))?,
+        },
+    };
+    let n = st.doc.node(id).ok_or(EngineError::NoNode(id))?;
+    let group = match n.kind {
+        NodeKind::Layer { .. } => false,
+        NodeKind::Group { .. } => true,
+        _ => return Err(bad(C, "release a layer or a group")),
+    };
+    // Its objects, bottom first (sublayers stay as they are).
+    let objects: Vec<NodeId> = n.children().into_iter().flatten().filter(|c| !c.is_layer()).map(|c| c.id).collect();
+    if objects.is_empty() {
+        return Err(EngineError::Other("there are no objects to release".into()));
+    }
+    let new = s.edit(if build { "Release to Layers (Build)" } else { "Release to Layers (Sequence)" }, |d, sel| {
+        // A group's objects go into sublayers of the layer holding it, where it was.
+        let (parent, mut index) = if group {
+            let layer = d.layer_containing(id).ok_or(EngineError::NoNode(id))?;
+            let (par, i, _) = d.position(id).ok_or(EngineError::NoNode(id))?;
+            if par == Some(layer) { (layer, i) } else { (layer, usize::MAX) }
+        } else {
+            (id, 0)
+        };
+        let mut originals = vec![];
+        for o in &objects {
+            originals.push(Arc::unwrap_or_clone(d.remove(*o)?));
+        }
+        if group {
+            d.remove(id)?;
+        }
+        let mut new = vec![];
+        let last = originals.len().saturating_sub(1);
+        for k in 0..originals.len() {
+            let mut layer = make_layer(d, None);
+            let lid = layer.id;
+            let held: Vec<Node> = if build {
+                // Copies of the objects below and itself; the top layer keeps the originals.
+                (0..=k).filter_map(|j| originals.get(j)).map(|o| if k == last { o.clone() } else { d.reid(o) }).collect()
+            } else {
+                originals.get(k).cloned().into_iter().collect()
+            };
+            if let Some(ch) = layer.children_mut() {
+                ch.extend(held.into_iter().map(Arc::new));
+            }
+            let at = if group { index } else { index.min(d.children(Some(parent)).map_or(0, Vec::len)) };
+            d.insert(Some(parent), at, layer)?;
+            index = at.saturating_add(1);
+            new.push(lid);
+        }
+        sel.prune(d);
+        Ok(new)
+    })?;
+    s.doc_mut()?.layer_rows = new.clone();
+    Ok(json!({ "ids": new.iter().map(|i| i.0).collect::<Vec<_>>() }))
+}
+
+fn reverse(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "layer.reverse";
+    let ids = rows_param(s, p)?;
+    let d = &s.doc()?.doc;
+    let ids = row_roots(d, &ids);
+    // Rows grouped by the layer or group holding them (None: top-level layers).
+    let mut by_parent: Vec<(Option<NodeId>, Vec<usize>)> = vec![];
+    for id in &ids {
+        let Some((par, i, _)) = d.position(*id) else { continue };
+        match by_parent.iter_mut().find(|(p, _)| *p == par) {
+            Some((_, v)) => v.push(i),
+            None => by_parent.push((par, vec![i])),
+        }
+    }
+    by_parent.retain(|(_, v)| v.len() >= 2);
+    if by_parent.is_empty() {
+        return Err(bad(C, "highlight two or more rows in one layer or group"));
+    }
+    s.edit("Reverse Order", |d, _| {
+        for (par, mut slots) in by_parent {
+            slots.sort_unstable();
+            let ch = d.children_mut(par)?;
+            let nodes: Vec<Arc<Node>> = slots.iter().filter_map(|i| ch.get(*i).cloned()).collect();
+            for (slot, n) in slots.iter().zip(nodes.into_iter().rev()) {
+                if let Some(c) = ch.get_mut(*slot) {
+                    *c = n;
+                }
+            }
+        }
+        Ok(())
+    })?;
+    ok()
+}
+
+fn locate(s: &mut Session, p: &Value) -> Result<Value> {
+    let st = s.doc_mut()?;
+    let id = id_param(p, "id").or_else(|| st.selection.objects.last().copied()).ok_or_else(|| bad("layer.locate", "nothing selected"))?;
+    let ancestry = st.doc.ancestry(id).ok_or(EngineError::NoNode(id))?;
+    st.layer_rows = vec![id];
+    st.revision += 1;
+    Ok(json!({ "id": id.0, "ancestry": ancestry.iter().map(|i| i.0).collect::<Vec<_>>() }))
+}

crates/engine/src/cmd/links.rs

@@ -16,13 +16,17 @@
 //! selects one (`links.goTo`), Embed keeps a linked file's pixels in the document
 //! (`links.embed`) and Unembed writes an embedded image to a file it then links to
 //! (`links.unembed`).
+//!
+//! Placed documents ([`PlacedDocument`], VectorCraft documents placed with Link) link to their
+//! files the same way: checking, updating, relinking and finding them on open work alike, and they
+//! are listed. Embed (Break Link) turns one into an editable copy of its art.
 
 use std::collections::BTreeMap;
 use std::path::{Component, Path};
 
 use serde_json::{Value, json};
 use vectorcraft_doc::links::{Align, Preserve, hash_bytes};
-use vectorcraft_doc::{Appearance, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeId, NodeKind, PlacementOptions};
+use vectorcraft_doc::{Appearance, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeId, NodeKind, PlacedDocument, PlacementOptions};
 use vectorcraft_geom::{Affine, Rect, shapes};
 
 use super::fileio::{self, RasterImage, absolute_path, file_created, file_stamp, read_file, write_file};
@@ -35,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Check Links",
             [],
             None,
-            "{ids?: [image ids] (default: every linked image)} where each linked file is and whether it changed since it was read → {links: [{name, path, status: ok|modified|missing, ids, found?: path (found away from its path: relative to the document, or by name in its folder), preview: true (showing the low-resolution preview, not the file)}], missing, modified}",
+            "{ids?: [image or placed document ids] (default: every linked image and placed document)} where each linked file is and whether it changed since it was read → {links: [{name, path, status: ok|modified|missing, ids, found?: path (found away from its path: relative to the document, or by name in its folder), preview: true (showing the low-resolution preview, not the file)}], missing, modified}",
             has_doc,
             check
         ),
@@ -44,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Update Links",
             [],
             None,
-            "{ids?: [image ids] (default: the linked images whose file was modified or is showing its preview)} read their linked files again; each image keeps its bounds. One undo step → {updated: [ids], missing: [ids]}",
+            "{ids?: [image or placed document ids] (default: the linked images whose file was modified or is showing its preview, and placed documents whose file was modified)} read their linked files again; each keeps its bounds. One undo step → {updated: [ids], missing: [ids]}",
             has_doc,
             update
         ),
@@ -53,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Relink",
             [],
             None,
-            "{ids?: [image ids] (default: the selected images; with folder and nothing selected, every missing link), path | folder} link images to the file at path, or each to the file of its link's name in folder; embedded images become linked; each keeps its bounds. One undo step → {relinked: [ids], notFound: [file names]}",
+            "{ids?: [image or placed document ids] (default: the selected ones; with folder and nothing selected, every missing link), path | folder} link images (or placed documents, each showing the same artboard of the new file) to the file at path, or each to the file of its link's name in folder; embedded images become linked; each keeps its bounds. One undo step → {relinked: [ids], notFound: [file names]}",
             has_doc,
             relink
         ),
@@ -62,7 +66,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Links",
             [],
             None,
-            "{show?: all (default)|missing|modified|embedded, sort?: name|kind (file format)|status (missing, modified, ok, embedded); default: stacking order, top first} every image object in the layers, as the Links panel lists them → {links: [{id, name, linked, status: ok|modified|missing|embedded, format, pixelWidth, pixelHeight, path?, found?: path (found away from its path), page?, preview?: true (showing the saved preview)}], missing, modified, embedded}",
+            "{show?: all (default)|missing|modified|embedded, sort?: name|kind (file format)|status (missing, modified, ok, embedded); default: stacking order, top first} every image object and placed document in the layers, as the Links panel lists them → {links: [{id, name, linked, status: ok|modified|missing|embedded, format, pixelWidth, pixelHeight, path?, found?: path (found away from its path), page?, preview?: true (showing the saved preview), document?: true (a placed document: pageWidth and pageHeight in pt instead of pixels)}], missing, modified, embedded}",
             has_doc,
             list
         ),
@@ -71,7 +75,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Go To Link",
             [],
             None,
-            "{id?} select image `id` (default: the first selected image); the Links panel scrolls it into view → {id, bounds: [x0, y0, x1, y1]}",
+            "{id?} select image or placed document `id` (default: the first selected one); the Links panel scrolls it into view → {id, bounds: [x0, y0, x1, y1]}",
             has_doc,
             go_to
         ),
@@ -80,7 +84,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Embed Image",
             [],
             None,
-            "{ids?: [image ids] (default: the selected linked images)} keep the linked files' pixels in the document and drop the links (an image whose file can't be found and that shows the saved preview stays linked: relink it first). One undo step → {embedded: [ids], missing: [ids]}",
+            "{ids?: [image or placed document ids] (default: the selected linked ones)} break the links (the Links panel's Break Link): images keep the linked files' pixels in the document; a placed document becomes an editable copy of its art, as placing its file without link gives (its symbols, patterns, swatches and images joining the document). An image whose file can't be found and that shows the saved preview, or a placed document whose file can't be read or changed, stays linked: relink or update it first. One undo step → {embedded: [ids], missing: [ids]}",
             has_doc,
             embed
         ),
@@ -98,7 +102,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Link Info",
             [],
             None,
-            "{id?} an image's Link Info (default: the one selected) → image.info's fields (id, name, linked, link, colorMode, pixelWidth, pixelHeight, width, height) and status: ok|modified|missing|embedded, format, ppi: [x, y] (the file's), effectivePpi: [x, y] (at its placed size), scale: [x%, y%] (of its 100% size), rotation (degrees, counter-clockwise), placement: {preserve, align, clip}; linked images also fileName, location (its folder), page?, fileSize? (bytes), modified?, created? (ms since the Unix epoch)",
+            "{id?} an image's or placed document's Link Info (default: the one selected) → image.info's fields (id, name, linked, link, colorMode, pixelWidth, pixelHeight, width, height) and status: ok|modified|missing|embedded, format, ppi: [x, y] (the file's), effectivePpi: [x, y] (at its placed size), scale: [x%, y%] (of its 100% size), rotation (degrees, counter-clockwise), placement: {preserve, align, clip}; linked images also fileName, location (its folder), page?, fileSize? (bytes), modified?, created? (ms since the Unix epoch); a placed document has document: true, pageWidth and pageHeight (pt) instead of pixels, ppi and colorMode, and its scale is of its artboard's 100% size",
             has_doc,
             info
         ),
@@ -107,7 +111,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Placement Options",
             [],
             None,
-            "{ids?: [image ids] (default: the selected images), preserve?: transforms|bounds (default)|fileDimensions|fit|fill, align?: topLeft|top|topRight|left|center (default)|right|bottomLeft|bottom|bottomRight (where the new art sits; not for bounds), clip?: false (clip it to the old bounds where it is larger)} how a file read again (links.relink, links.update) takes each image's place: transforms keeps its scale (relative to each file's 100% size), rotation and position; bounds stretches it into the old bounds; fileDimensions puts it at 100%, unrotated; fit and fill scale it proportionally to fit inside or cover the old bounds. Without options → {placement} of the first image; else one undo step → {ids, placement}",
+            "{ids?: [image or placed document ids] (default: the selected ones), preserve?: transforms|bounds (default)|fileDimensions|fit|fill, align?: topLeft|top|topRight|left|center (default)|right|bottomLeft|bottom|bottomRight (where the new art sits; not for bounds), clip?: false (clip it to the old bounds where it is larger)} how a file read again (links.relink, links.update) takes each image's place: transforms keeps its scale (relative to each file's 100% size), rotation and position; bounds stretches it into the old bounds; fileDimensions puts it at 100%, unrotated; fit and fill scale it proportionally to fit inside or cover the old bounds. Without options → {placement} of the first image; else one undo step → {ids, placement}",
             has_doc,
             placement_options
         ),
@@ -134,22 +138,34 @@ impl Status {
     }
 }
 
-/// The image objects that show one linked file as one content (same path, same image).
+/// The image objects that show one linked file as one content (same path, same image), or the
+/// placed documents that show one artboard of it.
 struct Group {
     link: LinkInfo,
     key: String,
     /// The objects in the layers (images in symbols and patterns share the content, not an id).
     ids: Vec<NodeId>,
+    /// Placed documents: whether the art's bounds (not the artboard) are shown.
+    document: Option<bool>,
 }
 
-/// The linked images of `d` by file and content: those in the layers (only `ids` when given), then,
-/// without `ids`, the ones only symbols and patterns show.
+/// The linked object `n` as (link, content key, placed document's bounding).
+fn linked(n: &Node) -> Option<(&LinkInfo, &str, Option<bool>)> {
+    match &n.kind {
+        NodeKind::Image(im) => Some((im.link.as_ref()?, &im.key, None)),
+        NodeKind::PlacedDocument(p) => Some((&p.link, &p.key, Some(p.bounding))),
+        _ => None,
+    }
+}
+
+/// The linked images and placed documents of `d` by file and content: those in the layers (only `ids` when
+/// given), then, without `ids`, the ones only symbols and patterns show.
 fn groups(d: &Document, ids: Option<&[NodeId]>) -> Vec<Group> {
     let mut out: Vec<Group> = vec![];
-    let mut index: BTreeMap<(String, String), usize> = BTreeMap::new();
-    let mut add = |link: &LinkInfo, key: &str, id: Option<NodeId>| {
-        let i = *index.entry((link.path.clone(), key.to_string())).or_insert_with(|| {
-            out.push(Group { link: link.clone(), key: key.to_string(), ids: vec![] });
+    let mut index: BTreeMap<(String, String, bool), usize> = BTreeMap::new();
+    let mut add = |link: &LinkInfo, key: &str, document: Option<bool>, id: Option<NodeId>| {
+        let i = *index.entry((link.path.clone(), key.to_string(), document.is_some())).or_insert_with(|| {
+            out.push(Group { link: link.clone(), key: key.to_string(), ids: vec![], document });
             out.len() - 1
         });
         if let (Some(id), Some(g)) = (id, out.get_mut(i)) {
@@ -157,19 +173,19 @@ fn groups(d: &Document, ids: Option<&[NodeId]>) -> Vec<Group> {
         }
     };
     d.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind
-            && let Some(l) = &im.link
+        if let Some((l, key, document)) = linked(n)
             && ids.is_none_or(|ids| ids.contains(&n.id))
         {
-            add(l, &im.key, Some(n.id));
+            add(l, key, document, Some(n.id));
         }
     });
     if ids.is_none() {
         d.visit_images(|_, im| {
             if let Some(l) = &im.link {
-                add(l, &im.key, None);
+                add(l, &im.key, None, None);
             }
         });
+        d.visit_placed(|_, p| add(&p.link, &p.key, Some(p.bounding), None));
     }
     out
 }
@@ -238,7 +254,7 @@ fn probe(g: &Group, dir: Option<&Path>) -> (Status, Option<Found>) {
     let same = match &l.hash {
         Some(h) => *h == hash_bytes(&bytes),
         // Linked before links kept a hash: the image the file decodes to.
-        None => fileio::raster_image(&bytes).is_ok_and(|img| img.key == g.key),
+        None => g.document.is_none() && fileio::raster_image(&bytes).is_ok_and(|img| img.key == g.key),
     };
     f.bytes = Some(bytes);
     (if same { Status::Ok } else { Status::Modified }, Some(f))
@@ -254,6 +270,15 @@ fn previewing(d: &Document, key: &str) -> bool {
     d.images.get(key).is_none_or(ImageBlob::is_proxy)
 }
 
+/// Does group `g` of `d` show something other than its file: an image its preview, a placed
+/// document nothing (its file's bytes are gone)?
+fn stale(d: &Document, g: &Group) -> bool {
+    match g.document {
+        None => previewing(d, &g.key),
+        Some(_) => !d.images.contains_key(&g.key),
+    }
+}
+
 /// A linked file of a document (File → Package): its path, name and bytes.
 pub(crate) struct LinkedFile {
     pub path: String,
@@ -301,6 +326,51 @@ fn read_image(f: &mut Found, base: &LinkInfo) -> Result<FileRead> {
     Ok((f.link(&bytes, base), fileio::raster_image(&bytes)?))
 }
 
+/// A linked file read for the objects that show it.
+enum Read {
+    Image(FileRead),
+    /// A VectorCraft document read for placed documents: the link to it and what they show.
+    Document(LinkInfo, super::place::document::Source),
+}
+
+/// The file at `f` read for group `g`: its image, or the artboard `g` shows.
+fn read_for(f: &mut Found, g: &Group, cmd: &str) -> Result<Read> {
+    let Some(bounding) = g.document else { return read_image(f, &g.link).map(Read::Image) };
+    let bytes = f.read()?;
+    let page = g.link.page.unwrap_or(1);
+    let src = super::place::document::source(&f.path, &bytes, Some(&f.path), page, bounding, cmd)?;
+    Ok(Read::Document(f.link(&bytes, &g.link), src))
+}
+
+/// Objects `ids` show what was read (see [`install`], [`install_document`]).
+fn install_read(d: &mut Document, ids: &[NodeId], read: Read, keep_bounds: bool) -> Result<()> {
+    match read {
+        Read::Image(r) => install(d, ids, r, keep_bounds),
+        Read::Document(link, src) => install_document(d, ids, &link, &src, keep_bounds),
+    }
+}
+
+/// Placed documents `ids` show `src`, read from the file `link` points at, each placed as its
+/// Placement Options say (`keep_bounds`: in its bounds, whatever they say).
+fn install_document(d: &mut Document, ids: &[NodeId], link: &LinkInfo, src: &super::place::document::Source, keep_bounds: bool) -> Result<()> {
+    let mut clips = vec![];
+    let (w, h) = (src.frame.width(), src.frame.height());
+    for id in ids {
+        let Some(NodeKind::PlacedDocument(p)) = d.node(*id).map(|n| &n.kind) else { continue };
+        let o = if keep_bounds { PlacementOptions { preserve: Preserve::Bounds, ..p.placement } } else { p.placement };
+        let (xf, clip) = placed_xf(p.xf, (p.width, p.height), (1.0, 1.0), (w, h), (1.0, 1.0), o);
+        if let Some(n) = d.node_mut(*id)
+            && let NodeKind::PlacedDocument(p) = &mut n.kind
+        {
+            let p: &mut PlacedDocument = p;
+            (p.key, p.width, p.height, p.xf, p.link) = (src.key.clone(), w, h, xf, link.clone());
+        }
+        clips.extend(clip.map(|c| (*id, c)));
+    }
+    super::place::document::store(d, src);
+    clips.into_iter().try_for_each(|(id, clip)| clip_image(d, id, clip))
+}
+
 /// Points per pixel of the file image `key` of `d` shows, at the resolution it declares (72 ppi
 /// when it declares none, or when only its preview is loaded).
 fn file_pt(d: &Document, key: &str) -> (f64, f64) {
@@ -318,9 +388,10 @@ type Clip = (Affine, (f64, f64));
 
 /// The transform an image placed with `xf` showing `old` pixels (`old_pt`: points per pixel at
 /// 100%) gives a new file of `new` pixels (`new_pt`), as Placement Options `o` say; and the clip
-/// when `o.clip` and the new art overflows the old bounds.
-fn placed_xf(xf: Affine, old: (u32, u32), old_pt: (f64, f64), new: (u32, u32), new_pt: (f64, f64), o: PlacementOptions) -> (Affine, Option<Clip>) {
-    let (ow, oh, nw, nh) = (old.0 as f64, old.1 as f64, new.0.max(1) as f64, new.1.max(1) as f64);
+/// when `o.clip` and the new art overflows the old bounds. (A placed document's "pixels" are points,
+/// one point each.)
+fn placed_xf(xf: Affine, old: (f64, f64), old_pt: (f64, f64), new: (f64, f64), new_pt: (f64, f64), o: PlacementOptions) -> (Affine, Option<Clip>) {
+    let (ow, oh, nw, nh) = (old.0, old.1, new.0.max(1e-9), new.1.max(1e-9));
     let [a, b, c, d, ..] = xf.as_coeffs();
     // The bounds' frame: the transform without its scale (rotation, reflection and position).
     let (su, sv) = (a.hypot(b), c.hypot(d));
@@ -388,7 +459,8 @@ fn install(d: &mut Document, ids: &[NodeId], (link, img): FileRead, keep_bounds:
     for id in ids {
         let Some(NodeKind::Image(im)) = d.node(*id).map(|n| &n.kind) else { continue };
         let o = if keep_bounds { PlacementOptions { preserve: Preserve::Bounds, ..im.placement } } else { im.placement };
-        let (xf, clip) = placed_xf(im.xf, (im.width, im.height), file_pt(d, &im.key), (img.width, img.height), new_pt, o);
+        let size = |w: u32, h: u32| (w as f64, h as f64);
+        let (xf, clip) = placed_xf(im.xf, size(im.width, im.height), file_pt(d, &im.key), size(img.width, img.height), new_pt, o);
         if let Some(n) = d.node_mut(*id)
             && let NodeKind::Image(im) = &mut n.kind
         {
@@ -436,11 +508,34 @@ pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool) -> Resolv
         let row = rows(std::iter::once(&g));
         match probe(&g, folder(doc_path)) {
             (Status::Missing, _) => out.missing.extend(row),
-            (Status::Modified, Some(mut f)) if update => match read_image(&mut f, &g.link).and_then(|read| install(d, &g.ids, read, false)) {
-                Ok(()) => out.updated.extend(row),
-                Err(_) => out.missing.extend(row),
-            },
+            (Status::Modified, Some(mut f)) if update => {
+                match read_for(&mut f, &g, "document.open").and_then(|read| install_read(d, &g.ids, read, false)) {
+                    Ok(()) => out.updated.extend(row),
+                    Err(_) => out.missing.extend(row),
+                }
+            }
             (Status::Modified, _) => out.modified.extend(row),
+            // A placed document keeps its file's bytes: only lost ones are read again.
+            (Status::Ok, Some(mut f)) if g.document.is_some() => {
+                let read = if stale(d, &g) { Some(read_for(&mut f, &g, "document.open")) } else { None };
+                match read {
+                    Some(Ok(read)) => {
+                        if install_read(d, &g.ids, read, true).is_err() {
+                            out.missing.extend(row);
+                        }
+                    }
+                    Some(Err(_)) => out.missing.extend(row),
+                    None => {
+                        let link = match f.bytes.take() {
+                            Some(b) => f.link(&b, &g.link),
+                            None => LinkInfo { path: f.path.clone(), ..g.link.clone() },
+                        };
+                        if link != g.link {
+                            set_links(d, &g.ids, &link);
+                        }
+                    }
+                }
+            }
             (Status::Ok, Some(mut f)) => {
                 let preview = previewing(d, &g.key);
                 // Read when the images show the preview, or when the file's details changed.
@@ -471,17 +566,58 @@ pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool) -> Resolv
     out
 }
 
-/// Image objects `ids` link to `link`.
+/// The link of linked object `n` (a linked image or a placed document) to change.
+fn link_mut(n: &mut Node) -> Option<&mut LinkInfo> {
+    match &mut n.kind {
+        NodeKind::Image(im) => im.link.as_mut(),
+        NodeKind::PlacedDocument(p) => Some(&mut p.link),
+        _ => None,
+    }
+}
+
+/// Linked image objects (or placed documents) `ids` link to `link`.
 fn set_links(d: &mut Document, ids: &[NodeId], link: &LinkInfo) {
     for id in ids {
-        if let Some(n) = d.node_mut(*id)
-            && let NodeKind::Image(im) = &mut n.kind
-        {
-            im.link = Some(link.clone());
+        if let Some(l) = d.node_mut(*id).and_then(link_mut) {
+            *l = link.clone();
         }
     }
 }
 
+/// Placed documents of the document saved at `path` (document `saved` of `s`) in the other open
+/// documents: read again from the new file, each as one Update Links step of its document.
+pub(crate) fn refresh_placed(s: &mut Session, saved: u64, path: &str) {
+    let path = absolute_path(path);
+    let targets: Vec<(usize, Vec<u64>)> = s
+        .documents()
+        .iter()
+        .enumerate()
+        .filter(|(_, st)| st.uid != saved)
+        .filter_map(|(i, st)| {
+            let mut ids = vec![];
+            st.doc.walk(|n| {
+                if let NodeKind::PlacedDocument(p) = &n.kind
+                    && p.link.path == path
+                {
+                    ids.push(n.id.0);
+                }
+            });
+            (!ids.is_empty()).then_some((i, ids))
+        })
+        .collect();
+    if targets.is_empty() {
+        return;
+    }
+    // Each document is updated as the active one, without switching tools.
+    let back = s.active;
+    for (i, ids) in targets {
+        s.active = Some(i);
+        // A file that can't be read leaves what its objects show: links.check reports it.
+        let _ = update(s, &json!({ "ids": ids }));
+    }
+    s.active = back;
+}
+
 // ---------- relative paths ----------
 
 /// `target` relative to folder `base` with `/` separators; `None` when they share no root (another
@@ -509,9 +645,7 @@ pub fn with_relative_paths(d: &Document, dest: &str) -> Option<Document> {
     let dir = Path::new(&dest).parent()?;
     let mut changes = vec![];
     d.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind
-            && let Some(l) = &im.link
-        {
+        if let Some((l, _, _)) = linked(n) {
             let r = relative_path(Path::new(&l.path), dir);
             if r != l.relative {
                 changes.push((n.id, r));
@@ -523,10 +657,7 @@ pub fn with_relative_paths(d: &Document, dest: &str) -> Option<Document> {
     }
     let mut d = d.clone();
     for (id, r) in changes {
-        if let Some(n) = d.node_mut(id)
-            && let NodeKind::Image(im) = &mut n.kind
-            && let Some(l) = &mut im.link
-        {
+        if let Some(l) = d.node_mut(id).and_then(link_mut) {
             l.relative = r;
         }
     }
@@ -548,7 +679,7 @@ fn check(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(f) = found.filter(|f| f.path != g.link.path) {
             row["found"] = json!(f.path);
         }
-        if previewing(&st.doc, &g.key) {
+        if stale(&st.doc, g) {
             row["preview"] = json!(true);
         }
         links.push(row);
@@ -564,9 +695,9 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
         match probe(&g, folder(st.path.as_deref())) {
             (Status::Missing, _) | (_, None) => missing.extend(ids_json(&g.ids)),
             // Unchanged and showing the file: nothing to read unless asked for by id.
-            (Status::Ok, Some(_)) if ids.is_none() && !previewing(&st.doc, &g.key) => {}
-            // Unreadable as an image counts as missing.
-            (_, Some(mut f)) => match read_image(&mut f, &g.link) {
+            (Status::Ok, Some(_)) if ids.is_none() && !stale(&st.doc, &g) => {}
+            // Unreadable as an image (or a document) counts as missing.
+            (_, Some(mut f)) => match read_for(&mut f, &g, "links.update") {
                 Ok(read) => reads.push((g.ids, read)),
                 Err(_) => missing.extend(ids_json(&g.ids)),
             },
@@ -574,7 +705,7 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let updated: Vec<u64> = reads.iter().flat_map(|(ids, _)| ids_json(ids)).collect();
     if !reads.is_empty() {
-        s.edit("Update Links", |d, _| reads.into_iter().try_for_each(|(ids, read)| install(d, &ids, read, false)))?;
+        s.edit("Update Links", |d, _| reads.into_iter().try_for_each(|(ids, read)| install_read(d, &ids, read, false)))?;
     }
     Ok(json!({ "updated": updated, "missing": missing }))
 }
@@ -583,7 +714,14 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.relink";
     let st = s.doc()?;
     let folder_param = str_param(p, "folder");
-    let image = |id: &NodeId| st.doc.node(*id).and_then(|n| if let NodeKind::Image(im) = &n.kind { Some(im) } else { None });
+    // An image or a placed document, with its link.
+    let image = |id: &NodeId| {
+        st.doc.node(*id).and_then(|n| match &n.kind {
+            NodeKind::Image(im) => Some(im.link.as_ref()),
+            NodeKind::PlacedDocument(p) => Some(Some(&p.link)),
+            _ => None,
+        })
+    };
     let ids: Vec<NodeId> = match ids_param(p, "ids") {
         Some(ids) => ids,
         None => {
@@ -599,7 +737,7 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
         }
     };
     if let Some(id) = ids.iter().find(|id| image(id).is_none()) {
-        return Err(bad(C, format!("object {} is not an image", id.0)));
+        return Err(bad(C, format!("object {} is not an image or a linked file", id.0)));
     }
     if ids.is_empty() {
         return Err(bad(C, "select the images to relink, or pass ids"));
@@ -611,7 +749,7 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
         (Some(path), _) => files.push((ids, absolute_path(path))),
         (None, Some(dir)) => {
             for id in ids {
-                let Some(link) = image(&id).and_then(|im| im.link.as_ref()) else { continue };
+                let Some(link) = image(&id).flatten() else { continue };
                 let path = absolute_path(&Path::new(dir).join(link.name()).to_string_lossy());
                 match files.iter_mut().find(|(_, p)| *p == path) {
                     Some((ids, _)) => ids.push(id),
@@ -625,12 +763,34 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
     let mut reads = vec![];
     for (ids, path) in files {
         let bytes = read_file(&path)?;
-        let img = fileio::raster_image(&bytes).map_err(|e| bad(C, format!("{path}: {e}")))?;
-        reads.push((ids, (link_info(&path, &bytes), img)));
+        let link = link_info(&path, &bytes);
+        // Images show the file; placed documents each show their artboard of it.
+        let mut images = vec![];
+        let mut documents: Vec<((u32, bool), Vec<NodeId>)> = vec![];
+        for id in ids {
+            match st.doc.node(id).map(|n| &n.kind) {
+                Some(NodeKind::PlacedDocument(pl)) => {
+                    let k = (pl.page(), pl.bounding);
+                    match documents.iter_mut().find(|(e, _)| *e == k) {
+                        Some((_, ids)) => ids.push(id),
+                        None => documents.push((k, vec![id])),
+                    }
+                }
+                _ => images.push(id),
+            }
+        }
+        if !images.is_empty() {
+            let img = fileio::raster_image(&bytes).map_err(|e| bad(C, format!("{path}: {e}")))?;
+            reads.push((images, Read::Image((link.clone(), img))));
+        }
+        for ((page, bounding), ids) in documents {
+            let src = super::place::document::source(&path, &bytes, Some(&path), page, bounding, C)?;
+            reads.push((ids, Read::Document(LinkInfo { page: Some(page), ..link.clone() }, src)));
+        }
     }
     let relinked: Vec<u64> = reads.iter().flat_map(|(ids, _)| ids_json(ids)).collect();
     if !reads.is_empty() {
-        s.edit("Relink", |d, _| reads.into_iter().try_for_each(|(ids, read)| install(d, &ids, read, false)))?;
+        s.edit("Relink", |d, _| reads.into_iter().try_for_each(|(ids, read)| install_read(d, &ids, read, false)))?;
     }
     not_found.sort();
     not_found.dedup();
@@ -652,18 +812,6 @@ fn selected_images(st: &crate::DocState, keep: impl Fn(&ImageObject) -> bool) ->
     st.selection.objects.iter().copied().filter(|id| image_of(&st.doc, *id).is_some_and(&keep)).collect()
 }
 
-/// `ids` (else the selected images `keep` accepts), checked to be images; an error when none.
-fn images_param(st: &crate::DocState, p: &Value, cmd: &str, keep: impl Fn(&ImageObject) -> bool) -> Result<Vec<NodeId>> {
-    let ids = ids_param(p, "ids").unwrap_or_else(|| selected_images(st, keep));
-    if let Some(id) = ids.iter().find(|id| image_of(&st.doc, **id).is_none()) {
-        return Err(bad(cmd, format!("object {} is not an image", id.0)));
-    }
-    if ids.is_empty() {
-        return Err(bad(cmd, "select the images, or pass ids"));
-    }
-    Ok(ids)
-}
-
 /// `id`, else the first selected image.
 fn image_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
     let id = id_param(p, "id").or_else(|| selected_images(st, |_| true).first().copied()).ok_or_else(|| bad(cmd, "select an image, or pass id"))?;
@@ -674,6 +822,35 @@ fn image_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
     }
 }
 
+/// The Placement Options of image or placed document `n`.
+fn placement_mut(n: &mut Node) -> Option<&mut PlacementOptions> {
+    match &mut n.kind {
+        NodeKind::Image(im) => Some(&mut im.placement),
+        NodeKind::PlacedDocument(p) => Some(&mut p.placement),
+        _ => None,
+    }
+}
+
+/// The Placement Options of image or placed document `id` of `d`.
+fn placement_of(d: &Document, id: NodeId) -> Option<PlacementOptions> {
+    match &d.node(id)?.kind {
+        NodeKind::Image(im) => Some(im.placement),
+        NodeKind::PlacedDocument(p) => Some(p.placement),
+        _ => None,
+    }
+}
+
+/// `id`, else the first selected image or placed document.
+fn linked_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
+    let first = || st.selection.objects.iter().copied().find(|id| placement_of(&st.doc, *id).is_some());
+    let id = id_param(p, "id").or_else(first).ok_or_else(|| bad(cmd, "select an image, or pass id"))?;
+    match placement_of(&st.doc, id) {
+        Some(_) => Ok(id),
+        None if st.doc.node(id).is_none() => Err(crate::EngineError::NoNode(id)),
+        None => Err(bad(cmd, format!("object {} is not an image or a linked file", id.0))),
+    }
+}
+
 /// Per linked image in the layers of `st`: its file's status, where it was found when away from
 /// its path, and whether the image shows its preview (each file probed once).
 fn statuses(st: &crate::DocState) -> BTreeMap<NodeId, (Status, Option<String>, bool)> {
@@ -681,7 +858,7 @@ fn statuses(st: &crate::DocState) -> BTreeMap<NodeId, (Status, Option<String>, b
     for g in groups(&st.doc, None).iter().filter(|g| !g.ids.is_empty()) {
         let (status, found) = probe(g, folder(st.path.as_deref()));
         let found = found.map(|f| f.path).filter(|p| *p != g.link.path);
-        let preview = previewing(&st.doc, &g.key);
+        let preview = stale(&st.doc, g);
         out.extend(g.ids.iter().map(|id| (*id, (status, found.clone(), preview))));
     }
     out
@@ -696,6 +873,12 @@ fn format_label(d: &Document, im: &ImageObject) -> &'static str {
         .map_or("Image", |f| f.label)
 }
 
+/// A placed document's `links.list` fields: `format`, `document: true` and its artboard's size
+/// (`pageWidth`, `pageHeight`, pt) instead of pixels.
+fn document_row(p: &PlacedDocument) -> Value {
+    json!({ "format": "VectorCraft", "document": true, "pageWidth": p.width, "pageHeight": p.height })
+}
+
 /// Sort rank of a `links.list` status: missing, modified, ok, embedded.
 fn status_rank(status: &str) -> usize {
     ["missing", "modified", "ok", "embedded"].iter().position(|s| *s == status).unwrap_or(4)
@@ -709,17 +892,17 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, format!("show `{show}`: all, missing, modified or embedded")));
     }
     let statuses = statuses(st);
-    let mut images = vec![];
+    let mut objects = vec![];
     st.doc.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind {
-            images.push((n, im));
+        if matches!(n.kind, NodeKind::Image(_) | NodeKind::PlacedDocument(_)) {
+            objects.push(n);
         }
     });
     // Top first, as the Layers panel lists them.
-    images.reverse();
+    objects.reverse();
     let mut counts: BTreeMap<&str, usize> = BTreeMap::new();
     let mut rows = vec![];
-    for (n, im) in images {
+    for n in objects {
         let (status, found, preview) = match statuses.get(&n.id) {
             Some((s, f, p)) => (s.as_str(), f.as_deref(), *p),
             None => ("embedded", None, false),
@@ -728,17 +911,21 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
         if show != "all" && show != status {
             continue;
         }
-        let name = im.link.as_ref().map_or_else(|| n.display_name(), |l| l.name().to_string());
-        let mut row = json!({
-            "id": n.id.0,
-            "name": name,
-            "linked": im.link.is_some(),
-            "status": status,
-            "format": format_label(&st.doc, im),
-            "pixelWidth": im.width,
-            "pixelHeight": im.height,
-        });
-        if let Some(l) = &im.link {
+        let (link, mut row) = match &n.kind {
+            NodeKind::Image(im) => {
+                (im.link.as_ref(), json!({ "format": format_label(&st.doc, im), "pixelWidth": im.width, "pixelHeight": im.height }))
+            }
+            NodeKind::PlacedDocument(p) => (Some(&p.link), document_row(p)),
+            _ => continue,
+        };
+        let name = link.map_or_else(|| n.display_name(), |l| l.name().to_string());
+        if let Some(o) = row.as_object_mut() {
+            o.insert("id".into(), json!(n.id.0));
+            o.insert("name".into(), json!(name));
+            o.insert("linked".into(), json!(link.is_some()));
+            o.insert("status".into(), json!(status));
+        }
+        if let Some(l) = link {
             row["path"] = json!(l.path);
             if let Some(page) = l.page {
                 row["page"] = json!(page);
@@ -766,7 +953,7 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn go_to(s: &mut Session, p: &Value) -> Result<Value> {
     let st = s.doc()?;
-    let id = image_param(st, p, "links.goTo")?;
+    let id = linked_param(st, p, "links.goTo")?;
     let b = st.doc.node(id).and_then(Node::geometric_bounds).unwrap_or_default();
     s.select(|_, sel| sel.set([id]))?;
     Ok(json!({ "id": id.0, "bounds": [b.x0, b.y0, b.x1, b.y1] }))
@@ -775,9 +962,29 @@ fn go_to(s: &mut Session, p: &Value) -> Result<Value> {
 fn embed(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.embed";
     let st = s.doc()?;
-    let ids = images_param(st, p, C, |im| im.link.is_some())?;
+    let kind = |id: &NodeId| st.doc.node(*id).map(|n| &n.kind);
+    let linked = |id: &NodeId| match kind(id) {
+        Some(NodeKind::Image(im)) => im.link.is_some(),
+        Some(NodeKind::PlacedDocument(_)) => true,
+        _ => false,
+    };
+    let ids = ids_param(p, "ids").unwrap_or_else(|| st.selection.objects.iter().copied().filter(linked).collect());
+    if let Some(id) = ids.iter().find(|id| !matches!(kind(id), Some(NodeKind::Image(_) | NodeKind::PlacedDocument(_)))) {
+        return Err(bad(C, format!("object {} is not an image or a placed document", id.0)));
+    }
+    if ids.is_empty() {
+        return Err(bad(C, "select the linked images or placed documents, or pass ids"));
+    }
+    // Placed documents become editable copies of their art: those whose file can be read.
+    let (mut documents, mut missing) = (vec![], vec![]);
+    for id in ids.iter().copied() {
+        let Some(NodeKind::PlacedDocument(p)) = kind(&id) else { continue };
+        let readable = st.doc.images.get(&p.key).is_some_and(|b| vectorcraft_doc::placed_document::full_bytes(p, b).is_some());
+        if readable { documents.push(id) } else { missing.push(id) }
+    }
+    let ids: Vec<NodeId> = ids.into_iter().filter(|id| matches!(kind(id), Some(NodeKind::Image(_)))).collect();
     // Images showing their preview take their file's pixels first.
-    let (mut done, mut missing, mut reads) = (vec![], vec![], vec![]);
+    let (mut done, mut reads) = (vec![], vec![]);
     for g in groups(&st.doc, Some(&ids)) {
         if !previewing(&st.doc, &g.key) {
             done.extend(g.ids);
@@ -794,21 +1001,20 @@ fn embed(s: &mut Session, p: &Value) -> Result<Value> {
             _ => missing.extend(g.ids),
         }
     }
-    if !done.is_empty() {
+    if !done.is_empty() || !documents.is_empty() {
         s.edit("Embed", |d, _| {
             for (ids, read) in reads {
                 install(d, &ids, read, true)?;
             }
             for id in &done {
-                if let Some(n) = d.node_mut(*id)
-                    && let NodeKind::Image(im) = &mut n.kind
-                {
+                if let Some(Node { kind: NodeKind::Image(im), .. }) = d.node_mut(*id) {
                     im.link = None;
                 }
             }
-            Ok(())
+            documents.iter().try_for_each(|id| super::place::document::expand(d, *id, C))
         })?;
     }
+    done.extend(documents);
     Ok(json!({ "embedded": ids_json(&done), "missing": ids_json(&missing) }))
 }
 
@@ -862,41 +1068,77 @@ fn placement_json(o: PlacementOptions) -> Value {
     json!({ "preserve": o.preserve.id(), "align": o.align.id(), "clip": o.clip })
 }
 
+/// Link Info's fields of the linked file `l` (of object `id` of `st`) into `out`.
+fn file_fields(st: &crate::DocState, id: NodeId, l: &LinkInfo, out: &mut Value) {
+    let status = groups(&st.doc, Some(&[id])).first().map_or(Status::Missing, |g| probe(g, folder(st.path.as_deref())).0);
+    let stamp = file_stamp(&l.path);
+    let folder_len = l.path.len().saturating_sub(l.name().len());
+    out["status"] = json!(status.as_str());
+    out["path"] = json!(l.path);
+    out["fileName"] = json!(l.name());
+    out["location"] = json!(l.path.get(..folder_len).unwrap_or_default().trim_end_matches(['/', '\\']));
+    for (k, v) in [
+        ("page", l.page.map(u64::from)),
+        ("fileSize", stamp.map(|s| s.0).or(l.size)),
+        ("modified", stamp.and_then(|s| s.1).or(l.modified)),
+        ("created", file_created(&l.path)),
+    ] {
+        if let Some(v) = v {
+            out[k] = json!(v);
+        }
+    }
+}
+
+/// Scale (% of 100%, given points per unit at 100%) and counter-clockwise rotation of `xf`.
+fn scale_rotation(xf: Affine, (px, py): (f64, f64)) -> (Value, Value) {
+    let [a, b, c, d, ..] = xf.as_coeffs();
+    // Counter-clockwise on the page (y points down). Adding 0 turns -0 into 0.
+    (json!([a.hypot(b) / px * 100.0, c.hypot(d) / py * 100.0]), json!((-b).atan2(a).to_degrees() + 0.0))
+}
+
+/// Link Info of placed document `id`.
+fn placed_info(st: &crate::DocState, id: NodeId) -> Result<Value> {
+    let n = st.doc.node(id).ok_or(crate::EngineError::NoNode(id))?;
+    let NodeKind::PlacedDocument(pl) = &n.kind else { return Err(bad("links.info", format!("object {} is not a placed document", id.0))) };
+    let size = n.geometric_bounds().unwrap_or_default();
+    let (scale, rotation) = scale_rotation(pl.xf, (1.0, 1.0));
+    let mut out = document_row(pl);
+    let fields = [
+        ("id", json!(id.0)),
+        ("name", json!(n.display_name())),
+        ("linked", json!(true)),
+        ("link", json!(pl.link.path)),
+        ("width", json!(size.width())),
+        ("height", json!(size.height())),
+        ("scale", scale),
+        ("rotation", rotation),
+        ("placement", placement_json(pl.placement)),
+    ];
+    if let Some(o) = out.as_object_mut() {
+        o.extend(fields.into_iter().map(|(k, v)| (k.to_string(), v)));
+    }
+    file_fields(st, id, &pl.link, &mut out);
+    Ok(out)
+}
+
 fn info(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.info";
-    let id = image_param(s.doc()?, p, C)?;
+    let id = linked_param(s.doc()?, p, C)?;
+    if image_of(&s.doc()?.doc, id).is_none() {
+        return placed_info(s.doc()?, id);
+    }
     let mut out = super::place::image_info(s, &json!({ "id": id.0 }))?;
     let st = s.doc()?;
     let im = image_of(&st.doc, id).ok_or_else(|| bad(C, format!("object {} is not an image", id.0)))?;
     let (px, py) = file_pt(&st.doc, &im.key);
-    let [a, b, c, d, ..] = im.xf.as_coeffs();
     out["effectivePpi"] = out["ppi"].take();
     out["ppi"] = json!([72.0 / px, 72.0 / py]);
-    out["scale"] = json!([a.hypot(b) / px * 100.0, c.hypot(d) / py * 100.0]);
-    // Counter-clockwise on the page (y points down).
-    // Adding 0 turns -0 into 0.
-    out["rotation"] = json!((-b).atan2(a).to_degrees() + 0.0);
+    (out["scale"], out["rotation"]) = scale_rotation(im.xf, (px, py));
     out["format"] = json!(format_label(&st.doc, im));
     out["placement"] = placement_json(im.placement);
     out["status"] = json!("embedded");
     if let Some(l) = &im.link {
-        let status = groups(&st.doc, Some(&[id])).first().map_or(Status::Missing, |g| probe(g, folder(st.path.as_deref())).0);
-        let stamp = file_stamp(&l.path);
-        let folder_len = l.path.len().saturating_sub(l.name().len());
-        out["status"] = json!(status.as_str());
-        out["path"] = json!(l.path);
-        out["fileName"] = json!(l.name());
-        out["location"] = json!(l.path.get(..folder_len).unwrap_or_default().trim_end_matches(['/', '\\']));
-        for (k, v) in [
-            ("page", l.page.map(u64::from)),
-            ("fileSize", stamp.map(|s| s.0).or(l.size)),
-            ("modified", stamp.and_then(|s| s.1).or(l.modified)),
-            ("created", file_created(&l.path)),
-        ] {
-            if let Some(v) = v {
-                out[k] = json!(v);
-            }
-        }
+        file_fields(st, id, l, &mut out);
     }
     Ok(out)
 }
@@ -904,7 +1146,13 @@ fn info(s: &mut Session, p: &Value) -> Result<Value> {
 fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.placementOptions";
     let st = s.doc()?;
-    let ids = images_param(st, p, C, |_| true)?;
+    let ids = ids_param(p, "ids").unwrap_or_else(|| st.selection.objects.iter().copied().filter(|id| placement_of(&st.doc, *id).is_some()).collect());
+    if let Some(id) = ids.iter().find(|id| placement_of(&st.doc, **id).is_none()) {
+        return Err(bad(C, format!("object {} is not an image or a linked file", id.0)));
+    }
+    if ids.is_empty() {
+        return Err(bad(C, "select the images, or pass ids"));
+    }
     let choice = |k: &str| -> Result<Option<&str>> {
         match p.get(k) {
             None | Some(Value::Null) => Ok(None),
@@ -918,7 +1166,7 @@ fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
         None | Some(Value::Null) => None,
         Some(v) => Some(v.as_bool().ok_or_else(|| bad(C, "clip must be true or false"))?),
     };
-    let first = ids.first().and_then(|id| image_of(&st.doc, *id)).map(|im| im.placement).unwrap_or_default();
+    let first = ids.first().and_then(|id| placement_of(&st.doc, *id)).unwrap_or_default();
     if preserve.is_none() && align.is_none() && clip.is_none() {
         return Ok(json!({ "placement": placement_json(first) }));
     }
@@ -929,10 +1177,8 @@ fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
     };
     s.edit("Placement Options", |d, _| {
         for id in &ids {
-            if let Some(n) = d.node_mut(*id)
-                && let NodeKind::Image(im) = &mut n.kind
-            {
-                set(&mut im.placement);
+            if let Some(o) = d.node_mut(*id).and_then(placement_mut) {
+                set(o);
             }
         }
         Ok(())

crates/engine/src/cmd/menucmds.rs

@@ -1,5 +1,5 @@
 //! Object menu long tail: Lock/Hide All Artwork Above & Other Layers, Transform Each, Reset
-//! Bounding Box, Rasterize, Crop Image, Create Trim Marks, Convert to Shape and
+//! Bounding Box, Rasterize, Crop Image, Mask (an image), Create Trim Marks, Convert to Shape and
 //! Artboards → Convert / Rearrange. (Live blends are in `live.rs`.)
 
 use std::sync::Arc;
@@ -18,8 +18,6 @@ use super::*;
 /// Session-level (not saved) state owned by the menu commands.
 #[derive(Clone, Debug, Default)]
 pub struct MenuState {
-    /// Saved selections: (document title, name, object ids).
-    pub saved_selections: Vec<(String, String, Vec<NodeId>)>,
     /// View → Guides → Lock Guides.
     pub guides_locked: bool,
     /// Transparency panel menu: "New Opacity Masks Are Clipping" turned off.
@@ -77,7 +75,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Transform Each…",
             ["Object", "Transform"],
             Some("Cmd+Alt+Shift+D"),
-            "{scaleH?: % (100), scaleV?: % (100), moveH?: pt, moveV?: pt (down = +), rotate?: deg (counter-clockwise), reflectX?: bool (flip vertically), reflectY?: bool (flip horizontally), random?: bool, seed?: n, reference?: 0..8 (9-point grid, 4 = centre), copy?: bool, strokes?: bool (Scale Strokes & Effects), corners?: bool (Scale Corners; both default to the preferences)} transform every selected object about its own reference point → {ids}",
+            "{scaleH?: % (100), scaleV?: % (100), moveH?: pt, moveV?: pt (down = +), rotate?: deg (counter-clockwise), reflectX?: bool (flip vertically), reflectY?: bool (flip horizontally), random?: bool, seed?: n, reference?: 0..8 (9-point grid, 4 = centre), copy?: bool, strokes?: bool (Scale Strokes & Effects), corners?: bool (Scale Corners; both default to the preferences), patterns?: bool (Transform Patterns; default: prefs transformPatternTiles)} transform every selected object about its own reference point → {ids}",
             has_selection,
             transform_each
         ),
@@ -117,6 +115,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_image,
             crop_image
         ),
+        cmd!(
+            "object.maskImage",
+            "Mask",
+            [],
+            None,
+            "{} clip the selected image with a rectangle around it (its own outline, rotated with it) and select that clipping path, whose handles then crop it; one undo step → {id: the clip group, path: the clipping path}",
+            has_image,
+            mask_image
+        ),
         cmd!(
             "object.createTrimMarks",
             "Create Trim Marks",
@@ -149,7 +156,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Rearrange All Artboards…",
             ["Object", "Artboards"],
             None,
-            "{columns?: n (2), spacing?: pt (20), byColumn?: false, moveArtwork?: true} lay artboards out in a grid",
+            "{columns?: n (2), spacing?: pt (20), byColumn?: false, moveArtwork?: true (locked and hidden art only with prefs moveLockedWithArtboard)} lay artboards out in a grid",
             has_doc,
             rearrange_artboards
         ),
@@ -290,7 +297,8 @@ fn transform_each(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("object.transformEach", "scale must be non-zero"));
     }
     let mut rng = Rng(p.get("seed").and_then(Value::as_u64).unwrap_or(0x9E37_79B9_7F4A_7C15).max(1));
-    let sc = if sh != 100.0 || sv != 100.0 { super::object::scaling(s, p) } else { Default::default() };
+    let mut sc = if sh != 100.0 || sv != 100.0 { super::object::scaling(s, p) } else { Default::default() };
+    sc.patterns = super::object::transform_patterns(s, p, &roots)?;
     let ids = s.edit("Transform Each", |d, sel| {
         let targets = if copy { duplicate_in(d, sel, &roots, Affine::IDENTITY)? } else { roots.clone() };
         for id in &targets {
@@ -586,6 +594,36 @@ fn crop_image(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "id": id.0, "width": w, "height": h }))
 }
 
+/// The Control bar's Mask for an image: a clip group of the image and a clipping path on its
+/// outline, with that path selected so dragging its handles crops the image.
+fn mask_image(s: &mut Session, _: &Value) -> Result<Value> {
+    let st = s.doc()?;
+    let (id, outline) = st
+        .selection
+        .objects
+        .iter()
+        .find_map(|id| match st.doc.node(*id).map(|n| &n.kind) {
+            Some(NodeKind::Image(im)) => {
+                Some((*id, vectorcraft_geom::shapes::rectangle(Rect::new(0.0, 0.0, im.width as f64, im.height as f64)).transformed(im.xf)))
+            }
+            _ => None,
+        })
+        .ok_or_else(|| bad("object.maskImage", "select an image"))?;
+    let (gid, pid) = s.edit("Mask", |d, sel| {
+        let mut clip = super::pathops::shape_node(d, outline, None);
+        super::object::as_clipping_path(&mut clip)?;
+        let pid = clip.id;
+        let (par, idx, _) = d.position(id).ok_or(EngineError::NoNode(id))?;
+        let gid = d.alloc_id();
+        d.insert(par, idx + 1, Node::new(gid, NodeKind::Group { children: vec![], clip: true }))?;
+        d.insert(Some(gid), 0, clip)?;
+        d.move_node(id, Some(gid), usize::MAX)?;
+        sel.set([pid]);
+        Ok((gid, pid))
+    })?;
+    Ok(json!({ "id": gid.0, "path": pid.0 }))
+}
+
 // ---------- Trim marks ----------
 
 impl Session {
@@ -660,7 +698,7 @@ pub(crate) fn detect_shape(path: &PathData) -> Option<LiveShape> {
         }
         let rot = Affine::rotate(e0.y.atan2(e0.x));
         let flip = if e0.cross(e1) < 0.0 { Affine::scale_non_uniform(1.0, -1.0) } else { Affine::IDENTITY };
-        return Some(LiveShape::Rectangle { w, h, radii: [0.0; 4], xf: Affine::translate(a[0].p.to_vec2()) * rot * flip });
+        return Some(LiveShape::Rectangle { w, h, radii: [0.0; 4], kinds: Default::default(), xf: Affine::translate(a[0].p.to_vec2()) * rot * flip });
     }
     let b = path.bounds()?;
     let c = b.center();
@@ -744,6 +782,7 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
     let spacing = f64_or(p, "spacing", 20.0).clamp(-1.0e5, 1.0e5);
     let by_col = bool_or(p, "byColumn", false);
     let move_art = bool_or(p, "moveArtwork", true);
+    let locked_and_hidden = s.prefs.move_locked_with_artboard;
     let scale_strokes = false;
     s.edit("Rearrange Artboards", |d, _| {
         let rects: Vec<Rect> = d.artboards.iter().map(|a| a.rect).collect();
@@ -755,7 +794,9 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
             let tops: Vec<(NodeId, Point)> = d
                 .layers
                 .iter()
+                .filter(|l| l.rides_with_artboard(locked_and_hidden))
                 .flat_map(|l| l.children().into_iter().flatten())
+                .filter(|n| n.rides_with_artboard(locked_and_hidden))
                 .filter_map(|n| Some((n.id, n.geometric_bounds()?.center())))
                 .collect();
             for (id, c) in tops {
@@ -767,8 +808,13 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
                 }
             }
         }
+        let mut moved = vec![];
         for (a, dl) in d.artboards.iter_mut().zip(&deltas) {
             a.rect = a.rect + *dl;
+            moved.push((a.id, *dl));
+        }
+        for (id, dl) in moved {
+            d.move_artboard_guides(id, dl);
         }
         Ok(())
     })?;

crates/engine/src/cmd/mod.rs

@@ -30,6 +30,7 @@ pub(crate) mod graph;
 mod halftone;
 pub mod help;
 mod layer;
+mod layerpanel;
 pub mod links;
 mod live;
 pub(crate) mod maskedit;
@@ -47,7 +48,7 @@ mod pathops;
 mod patterncmds;
 pub mod pdfcmds;
 pub mod perspgrid;
-mod place;
+pub(crate) mod place;
 pub mod plugin;
 pub mod prefscmds;
 pub mod print;
@@ -143,6 +144,19 @@ pub fn has_selection(s: &Session) -> std::result::Result<(), String> {
     let st = s.active().ok_or("no document open")?;
     if st.selection.is_empty() { Err("nothing selected".into()) } else { Ok(()) }
 }
+/// Objects are selected, or the Artboard tool is chosen (Copy and Cut take its artboard).
+pub fn has_selection_or_artboard_tool(s: &Session) -> std::result::Result<(), String> {
+    if s.tool_id() == "artboard" { has_doc(s) } else { has_selection(s) }
+}
+/// Objects or ruler guides are selected (what Delete and the arrow keys act on).
+pub fn has_selection_or_guides(s: &Session) -> std::result::Result<(), String> {
+    let st = s.active().ok_or("no document open")?;
+    if st.selection.has_objects_or_guides() { Ok(()) } else { Err("nothing selected".into()) }
+}
+pub fn has_anchors(s: &Session) -> std::result::Result<(), String> {
+    let st = s.active().ok_or("no document open")?;
+    if st.selection.anchors.values().all(|a| a.is_empty()) { Err("no anchor points selected".into()) } else { Ok(()) }
+}
 pub fn has_multi(s: &Session) -> std::result::Result<(), String> {
     let st = s.active().ok_or("no document open")?;
     if st.selection.len() < 2 { Err("select at least two objects".into()) } else { Ok(()) }
@@ -191,6 +205,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(gradient::specs());
         v.extend(opacitymask::specs());
         v.extend(layer::specs());
+        v.extend(layerpanel::specs());
         v.extend(draw2::specs());
         v.extend(xform::specs());
         v.extend(effectcmd::specs());

crates/engine/src/cmd/object.rs

@@ -1,11 +1,14 @@
 //! Object menu: transforms, arrange, group, lock/hide, compound paths, clipping masks, isolation,
 //! align & distribute, object properties.
 
+use std::collections::BTreeSet;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
 use vectorcraft_color::{BlendMode, Paint};
-use vectorcraft_doc::{Appearance, Document, Knockout, Node, NodeId, NodeKind, OrientedBox, Scaling};
+use vectorcraft_doc::corners::set_corners;
+use vectorcraft_doc::{Appearance, Document, Knockout, LiveCorners, LiveShape, Node, NodeId, NodeKind, OrientedBox, Scaling};
+use vectorcraft_geom::shapes::CornerKind;
 use vectorcraft_geom::{Affine, FillRule, Point, Rect, Vec2};
 
 use super::edit::{duplicate_in, selected_roots};
@@ -20,17 +23,25 @@ pub fn specs() -> Vec<CommandSpec> {
             "Transform",
             [],
             None,
-            "{matrix: [a,b,c,d,e,f], copy?: bool, ids?, strokes?: bool, corners?: bool} apply an affine to the selection (or ids); strokes/corners: Scale Strokes & Effects / Scale Corners (default: the preferences)",
+            "{matrix: [a,b,c,d,e,f], copy?: bool, ids?, strokes?: bool, corners?: bool, typeAreas?: bool, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} apply an affine to the selection (or ids); strokes/corners: Scale Strokes & Effects / Scale Corners (default: the preferences); typeAreas: area type among them (not type inside a group) reshapes its frame by the matrix and its text reflows at its size, as a bounding-box handle drag does (default: the type transforms too)",
             has_doc,
             transform
         ),
-        cmd!("object.move", "Move…", ["Object", "Transform"], Some("Cmd+Shift+M"), "{dx, dy, copy?}", has_selection, move_cmd),
+        cmd!(
+            "object.move",
+            "Move…",
+            ["Object", "Transform"],
+            Some("Cmd+Shift+M"),
+            "{dx, dy, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
+            has_selection,
+            move_cmd
+        ),
         cmd!(
             "object.rotate",
             "Rotate…",
             ["Object", "Transform"],
             None,
-            "{angle: deg (counter-clockwise), absolute?: bool (angle is the bounding box's new angle, not an amount), origin?: [x,y] (default: the bounding box centre), copy?} → {ids}",
+            "{angle: deg (counter-clockwise), absolute?: bool (angle is the bounding box's new angle, not an amount), origin?: [x,y] (default: the bounding box centre), copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} → {ids}",
             has_selection,
             rotate
         ),
@@ -39,7 +50,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Scale…",
             ["Object", "Transform"],
             None,
-            "{sx: %, sy?: %, origin?: [x,y], copy?, strokes?: bool (Scale Strokes & Effects: stroke weights, dashes and effect distances scale; off keeps them, type strokes included), corners?: bool (Scale Corners: live corner radii scale)} (strokes/corners default to the preferences)",
+            "{sx: %, sy?: %, origin?: [x,y], copy?, strokes?: bool (Scale Strokes & Effects: stroke weights, dashes and effect distances scale; off keeps them, type strokes included), corners?: bool (Scale Corners: live corner radii scale), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} (strokes/corners default to the preferences)",
             has_selection,
             scale
         ),
@@ -48,7 +59,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reflect…",
             ["Object", "Transform"],
             None,
-            "{axis: \"vertical\"|\"horizontal\"|deg, origin?, copy?}",
+            "{axis: \"vertical\"|\"horizontal\"|deg, origin?, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
             has_selection,
             reflect
         ),
@@ -57,7 +68,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shear…",
             ["Object", "Transform"],
             None,
-            "{angle: deg, axis?: \"horizontal\"|\"vertical\", origin?, copy?}",
+            "{angle: deg, axis?: \"horizontal\"|\"vertical\", origin?, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
             has_selection,
             shear
         ),
@@ -67,8 +78,8 @@ pub fn specs() -> Vec<CommandSpec> {
             "Nudge",
             [],
             None,
-            "{dx: -1|0|1, dy: -1|0|1, big?: bool (×10), copy?: bool} arrow-key nudge by the keyboard increment",
-            has_selection,
+            "{dx: -1|0|1, dy: -1|0|1, big?: bool (×10), copy?: bool} arrow-key nudge by the keyboard increment (the selected anchors, else objects, else ruler guides)",
+            has_selection_or_guides,
             nudge
         ),
         cmd!("object.arrange.bringToFront", "Bring to Front", ["Object", "Arrange"], Some("Cmd+Shift+]"), "{}", has_selection, |s, _| arrange(
@@ -148,7 +159,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Align",
             ["Window", "Align"],
             None,
-            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", to?: \"selection\"|\"artboard\"|\"key\", bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
+            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", to?: \"selection\"|\"artboard\"|\"key\" (default: the key object when the selection has one, select.key, else the selection), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
             has_selection,
             align
         ),
@@ -166,7 +177,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Distribute Spacing",
             ["Window", "Align"],
             None,
-            "{axis: \"horizontal\"|\"vertical\", spacing?: pt, bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
+            "{axis: \"horizontal\"|\"vertical\", spacing?: pt (the key object, select.key, stays put and the others are spaced from it), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
             has_multi,
             distribute_spacing
         ),
@@ -180,7 +191,15 @@ pub fn specs() -> Vec<CommandSpec> {
             set_bounds
         ),
         cmd!("object.expandShape", "Expand Shape", ["Object", "Shape"], None, "{} convert live shapes to plain paths", has_selection, expand_shape),
-        cmd!("object.setLiveShape", "Live Shape Properties", [], None, "{id?, radius?: pt (all corners), sides?: n}", has_selection, set_live_shape),
+        cmd!(
+            "object.setLiveShape",
+            "Live Shape Properties",
+            [],
+            None,
+            "{id?, ids?, radius?: pt, kind?: \"round\"|\"invertedRound\"|\"chamfer\", corners?: [i…], sides?: n} (Live Corners on any path: radius and kind set its corners (anchors without handles between two straight sides): `corners` (anchor indices of the path with its corners uncut, counting every subpath's anchors in order: a rectangle's 0 top-left, 1 top-right, 2 bottom-right, 3 bottom-left; a polygon's from the first vertex clockwise), else the corners with a Direct-Selected anchor, else every corner; each radius is drawn no larger than half the corner's shorter side allows; a path that isn't a live shape keeps its uncut outline so its corners stay editable, and is plain again once none is cut; sides: a polygon's, which keep the radius they shared)",
+            has_selection,
+            set_live_shape
+        ),
     ]
 }
 
@@ -199,18 +218,45 @@ pub(crate) fn scaling(s: &mut Session, p: &Value) -> Scaling {
     let corners = bool_or(p, "corners", s.prefs.scale_corners);
     s.note_journal("strokes", json!(strokes));
     s.note_journal("corners", json!(corners));
-    Scaling { strokes, effects: strokes.then_some(vectorcraft_render::effects::scale_effect), keep_type_strokes: !strokes, keep_corners: !corners }
+    Scaling {
+        strokes,
+        effects: strokes.then_some(vectorcraft_render::effects::scale_effect),
+        keep_type_strokes: !strokes,
+        keep_corners: !corners,
+        ..Scaling::default()
+    }
 }
 
-/// Apply `xf` to `ids` (`copy` param: duplicate first; `strokes`/`corners`: see [`scaling`]).
-/// Records Transform Again.
+/// Transform Patterns: do the pattern fills and strokes of `ids` transform with them (`patterns`
+/// param, else General › Transform Pattern Tiles)? Noted in the journal when they use a pattern,
+/// so a replay moves their tiles alike whatever the preference is then.
+pub(crate) fn transform_patterns(s: &mut Session, p: &Value, ids: &[NodeId]) -> Result<bool> {
+    let on = bool_or(p, "patterns", s.prefs.transform_pattern_tiles);
+    let d = &s.doc()?.doc;
+    let mut uses = false;
+    for n in ids.iter().filter_map(|id| d.node(*id)) {
+        n.walk(&mut |c| uses |= vectorcraft_doc::pattern::uses_pattern(c, None));
+    }
+    if uses {
+        s.note_journal("patterns", json!(on));
+    }
+    Ok(on)
+}
+
+/// Apply `xf` to `ids` (`copy` param: duplicate first; `strokes`/`corners`: see [`scaling`];
+/// `patterns`: see [`transform_patterns`]; `typeAreas`: see [`resize_type_area`]). Records
+/// Transform Again.
 pub(crate) fn apply_transform(s: &mut Session, label: &str, ids: Vec<NodeId>, xf: Affine, p: &Value) -> Result<Value> {
     let copy = bool_or(p, "copy", false);
-    let sc = if Scaling::factor(xf).is_some() { scaling(s, p) } else { Scaling::default() };
+    let areas = bool_or(p, "typeAreas", false);
+    let mut sc = if Scaling::factor(xf).is_some() { scaling(s, p) } else { Scaling::default() };
+    sc.patterns = transform_patterns(s, p, &ids)?;
     let ids = s.edit(label, |d, sel| {
         let targets = if copy { duplicate_in(d, sel, &ids, Affine::IDENTITY)? } else { ids.clone() };
         for id in &targets {
-            if let Some(n) = d.node_mut(*id) {
+            if let Some(n) = d.node_mut(*id)
+                && !(areas && resize_type_area(n, xf))
+            {
                 n.transform(xf, sc);
             }
         }
@@ -224,6 +270,17 @@ pub(crate) fn apply_transform(s: &mut Session, label: &str, ids: Vec<NodeId>, xf
     Ok(json!({ "ids": ids.iter().map(|i| i.0).collect::<Vec<_>>() }))
 }
 
+/// Area type resized by its bounding box: `xf` reshapes its frame (the type area) and the text
+/// reflows at its size. False for anything else (and type in perspective), which transforms as
+/// usual.
+fn resize_type_area(n: &mut Node, xf: Affine) -> bool {
+    if n.perspective.is_some() {
+        return false;
+    }
+    let NodeKind::Text(t) = &mut n.kind else { return false };
+    super::typecmd::reshape_area_with(t, |t| t.transform_area(xf))
+}
+
 fn transform(s: &mut Session, p: &Value) -> Result<Value> {
     let m = matrix_param(p, "matrix").ok_or_else(|| bad("object.transform", "missing matrix [a,b,c,d,e,f]"))?;
     let ids = match ids_param(p, "ids") {
@@ -245,6 +302,9 @@ fn nudge(s: &mut Session, p: &Value) -> Result<Value> {
     if !s.doc()?.selection.anchors.is_empty() {
         return super::path::move_anchors(s, &json!({ "dx": dx, "dy": dy }));
     }
+    if s.doc()?.selection.is_empty() {
+        return super::docmenu::guide_move(s, &json!({ "dx": dx, "dy": dy, "copy": bool_or(p, "copy", false) }));
+    }
     let ids = selected_roots(s)?;
     apply_transform(s, "Move", ids, Affine::translate((dx, dy)), p)
 }
@@ -375,20 +435,26 @@ fn send_to_current_layer(s: &mut Session, _: &Value) -> Result<Value> {
 
 fn group(s: &mut Session, _: &Value) -> Result<Value> {
     let ids = selected_roots(s)?;
-    let Some(top) = ids.last().copied() else { return Err(EngineError::Other("nothing selected".into())) };
     let gid = s.edit("Group", |d, sel| {
-        let (par, idx, _) = d.position(top).ok_or(EngineError::NoNode(top))?;
-        let gid = d.alloc_id();
-        d.insert(par, idx + 1, Node::group(gid, vec![]))?;
-        for id in &ids {
-            d.move_node(*id, Some(gid), usize::MAX)?;
-        }
+        let gid = group_nodes(d, &ids)?;
         sel.set([gid]);
         Ok(gid)
     })?;
     Ok(json!({ "id": gid.0 }))
 }
 
+/// Put `ids` (top-level objects, in paint order) in a new group where the front-most one was.
+pub(crate) fn group_nodes(d: &mut Document, ids: &[NodeId]) -> Result<NodeId> {
+    let Some(top) = ids.last().copied() else { return Err(EngineError::Other("nothing selected".into())) };
+    let (par, idx, _) = d.position(top).ok_or(EngineError::NoNode(top))?;
+    let gid = d.alloc_id();
+    d.insert(par, idx + 1, Node::group(gid, vec![]))?;
+    for id in ids {
+        d.move_node(*id, Some(gid), usize::MAX)?;
+    }
+    Ok(gid)
+}
+
 fn ungroup(s: &mut Session, _: &Value) -> Result<Value> {
     let ids = selected_roots(s)?;
     s.edit("Ungroup", |d, sel| {
@@ -747,9 +813,15 @@ fn items_bounds(d: &Document, ids: &[NodeId], preview: bool) -> Vec<(NodeId, Rec
     ids.iter().filter_map(|id| Some((*id, d.bounds_of(&[*id], preview)?))).collect()
 }
 
+/// What `object.align` aligns to: `to`, else the key object when there is one, else the
+/// selection.
+fn align_to<'a>(s: &Session, p: &'a Value) -> Option<&'a str> {
+    str_param(p, "to").or_else(|| s.doc().ok()?.selection.key.map(|_| "key"))
+}
+
 fn reference_rect(s: &Session, p: &Value, ids: &[NodeId], preview: bool) -> Result<Rect> {
     let st = s.doc()?;
-    match str_param(p, "to") {
+    match align_to(s, p) {
         Some("artboard") => {
             let b = st.doc.bounds_of(ids, preview).unwrap_or_default();
             let i = st.doc.artboard_at(b.center()).unwrap_or(0);
@@ -774,7 +846,7 @@ fn align(s: &mut Session, p: &Value) -> Result<Value> {
         let d = &s.doc()?.doc;
         items_bounds(d, &ids, preview)
             .into_iter()
-            .filter(|(id, _)| Some(*id) != key || str_param(p, "to") != Some("key"))
+            .filter(|(id, _)| Some(*id) != key || align_to(s, p) != Some("key"))
             .map(|(id, b)| {
                 let dx = match h {
                     Some("left") => r.x0 - b.x0,
@@ -860,22 +932,31 @@ fn distribute_spacing(s: &mut Session, p: &Value) -> Result<Value> {
     let mut items = items_bounds(&s.doc()?.doc, &ids, preview);
     items.sort_by(|a, b| if horiz { a.1.x0.total_cmp(&b.1.x0) } else { a.1.y0.total_cmp(&b.1.y0) });
     let n = items.len();
+    let &[(_, first), .., (_, last)] = items.as_slice() else {
+        return Err(EngineError::Other("select two or more objects to distribute".into()));
+    };
     let size = |r: &Rect| if horiz { r.width() } else { r.height() };
     let start = |r: &Rect| if horiz { r.x0 } else { r.y0 };
-    let gap = match p.get("spacing").and_then(Value::as_f64) {
+    let spacing = p.get("spacing").and_then(Value::as_f64).filter(|g| g.is_finite());
+    let gap = match spacing {
         Some(g) => g,
         None => {
-            let span = if horiz { items[n - 1].1.x1 - items[0].1.x0 } else { items[n - 1].1.y1 - items[0].1.y0 };
+            let span = if horiz { last.x1 - first.x0 } else { last.y1 - first.y0 };
             (span - items.iter().map(|i| size(&i.1)).sum::<f64>()) / (n - 1) as f64
         }
     };
-    let mut pos = start(&items[0].1);
-    let mut moves = vec![];
+    let mut pos = start(&first);
+    let mut deltas = vec![];
     for (id, r) in &items {
-        let delta = pos - start(r);
-        moves.push((*id, if horiz { Vec2::new(delta, 0.0) } else { Vec2::new(0.0, delta) }));
+        deltas.push((*id, pos - start(r)));
         pos += size(r) + gap;
     }
+    // With a spacing (aligning to a key object) the key object stays where it is: the others
+    // are spaced from it.
+    let key = s.doc()?.selection.key;
+    let fixed = spacing.and_then(|_| deltas.iter().find(|(id, _)| Some(*id) == key)).map_or(0.0, |k| k.1);
+    let moves: Vec<(NodeId, Vec2)> =
+        deltas.into_iter().map(|(id, d)| (id, if horiz { Vec2::new(d - fixed, 0.0) } else { Vec2::new(0.0, d - fixed) })).collect();
     s.edit("Distribute Spacing", |d, _| {
         for (id, dv) in &moves {
             if let Some(n) = d.node_mut(*id) {
@@ -942,25 +1023,58 @@ fn expand_shape(s: &mut Session, _: &Value) -> Result<Value> {
     ok()
 }
 
+/// The `corners` of `object.setLiveShape`: anchor indices of a path's uncut outline.
+fn corners_param(p: &Value) -> Result<Option<BTreeSet<usize>>> {
+    let Some(v) = p.get("corners").filter(|v| !v.is_null()) else { return Ok(None) };
+    let err = || bad("object.setLiveShape", format!("`corners` must list anchor indices (0, 1, 2…), not {v}"));
+    let list = v.as_array().ok_or_else(err)?;
+    list.iter().map(|k| k.as_u64().and_then(|k| usize::try_from(k).ok()).ok_or_else(err)).collect::<Result<_>>().map(Some)
+}
+
 fn set_live_shape(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = targets(s, p)?;
-    s.edit("Live Shape", |d, _| {
+    let corners = corners_param(p)?;
+    let kind = p
+        .get("kind")
+        .filter(|v| !v.is_null())
+        .map(|v| {
+            serde_json::from_value::<CornerKind>(v.clone())
+                .map_err(|_| bad("object.setLiveShape", format!("`kind` must be \"round\", \"invertedRound\" or \"chamfer\", not {v}")))
+        })
+        .transpose()?;
+    let radius = p.get("radius").and_then(Value::as_f64);
+    let sides = p.get("sides").and_then(Value::as_u64);
+    s.edit("Live Shape", |d, sel| {
         for id in &ids {
-            let Some(NodeKind::Path { path, live: Some(live), .. }) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
-            match live {
-                vectorcraft_doc::LiveShape::Rectangle { radii, .. } => {
-                    if let Some(r) = p.get("radius").and_then(Value::as_f64) {
-                        *radii = [r.max(0.0); 4];
-                    }
+            let Some(NodeKind::Path { path, live, .. }) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
+            if let (Some(l @ LiveShape::Polygon { .. }), Some(n)) = (live.as_mut(), sides) {
+                l.set_sides(n);
+                *path = l.to_path();
+            }
+            if radius.is_none() && kind.is_none() {
+                continue;
+            }
+            let partial = sel.anchors.get_mut(id);
+            // The corners to edit, the Direct-Selected ones and the anchor layout before the edit.
+            let Some(c) = LiveCorners::new(path, live.as_ref()) else { continue };
+            let picked = match &corners {
+                Some(k) if k.last().is_some_and(|k| *k >= c.base.anchor_count()) => {
+                    let n = c.base.anchor_count();
+                    let past: Vec<_> = k.range(n..).collect();
+                    return Err(bad("object.setLiveShape", format!("object {id} has anchors 0–{} for `corners`, not {past:?}", n.saturating_sub(1))));
                 }
-                vectorcraft_doc::LiveShape::Polygon { sides, .. } => {
-                    if let Some(n) = p.get("sides").and_then(Value::as_u64) {
-                        *sides = n.clamp(3, 1000) as u32;
-                    }
-                }
-                _ => {}
+                Some(k) => k.clone(),
+                None => c.picked(partial.as_deref()),
+            };
+            let (selected, layout) = (partial.as_deref().map(|a| c.corners_of(a)), c.sources().to_vec());
+            set_corners(path, live, &picked, radius, kind);
+            // Direct-Selected corners stay selected as they gain or lose anchors.
+            if let (Some(anchors), Some(selected)) = (partial, selected)
+                && let Some(c) = LiveCorners::new(path, live.as_ref())
+                && c.sources() != layout
+            {
+                *anchors = c.anchors_of(&selected);
             }
-            *path = live.to_path();
         }
         Ok(())
     })?;

crates/engine/src/cmd/package.rs

@@ -4,12 +4,11 @@
 //! report). The packaged document links to the copies (Relink); the open document doesn't change.
 //! Without a folder (the web, agents) the same files come back as a zip archive.
 
-use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::collections::{BTreeMap, HashSet};
 use std::io::Write;
 use std::path::Path;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, Node, NodeKind};
 
 use super::fileio::{create_dir, write_file};
 use super::*;
@@ -51,21 +50,6 @@ fn font_ext(bytes: &[u8]) -> &'static str {
     }
 }
 
-/// The fonts (family, style) of the type in the layers and symbols of `d`.
-fn used_fonts(d: &Document) -> BTreeSet<(String, String)> {
-    let mut fonts = BTreeSet::new();
-    let mut add = |n: &Node| {
-        if let NodeKind::Text(t) = &n.kind {
-            fonts.extend(t.runs.iter().map(|r| (r.style.font_family.clone(), r.style.font_style.clone())));
-        }
-    };
-    d.walk(&mut add);
-    for s in &d.symbols {
-        s.art.walk(&mut add);
-    }
-    fonts
-}
-
 /// The options of a package.
 struct Options {
     copy_links: bool,
@@ -123,7 +107,7 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
         let db = vectorcraft_text::FontDb::global();
         let mut files = HashSet::new();
         lines.push("FONTS".to_string());
-        for (family, style) in used_fonts(&st.doc) {
+        for (family, style) in super::fonts::used_fonts(&st.doc) {
             let font = format!("{family} {style}");
             let reason = match db.face(&family, &style) {
                 Some(f) if f.family.eq_ignore_ascii_case(&family) && f.embeddable() => {

crates/engine/src/cmd/panelcmds.rs

@@ -1,11 +1,12 @@
-//! Commands the panels need beyond the core set: artboard reorder/duplicate and the advanced
+//! Commands the panels need beyond the core set: artboard reorder, duplicate, copy and cut, and the advanced
 //! Character/Paragraph attributes.
 
 use serde_json::{Value, json};
 use vectorcraft_doc::NodeKind;
+use vectorcraft_geom::{Rect, Vec2};
 
 use super::*;
-use crate::EngineError;
+use crate::{Clipboard, EngineError};
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
@@ -15,16 +16,34 @@ pub fn specs() -> Vec<CommandSpec> {
             "Duplicate Artboard",
             ["Window", "Artboards"],
             None,
-            "{index} copy placed right of the last artboard",
+            "{index?: n (default: the Artboard tool's artboard), art?: bool (default: the Artboard tool's moveArt option)} copy placed right of the last artboard, with copies of the art fully inside it when `art` (locked and hidden art only with prefs moveLockedWithArtboard) → {index, ids: the art's copies}",
             has_doc,
             artboard_duplicate
         ),
+        cmd!(
+            "artboard.copy",
+            "Copy Artboard",
+            [],
+            None,
+            "{index?, art?} (defaults as artboard.duplicate) put the artboard, and the art fully inside it when `art`, on the clipboard: edit.paste adds a copy right of the last artboard, edit.pasteInPlace/InFront/InBack where it was, in this or another document (one undo step; edit.pasteOnAllArtboards pastes only the art); edit.copy runs this while the Artboard tool is chosen → {copied: objects}",
+            has_doc,
+            |s, p| artboard_copy(s, p, false)
+        ),
+        cmd!(
+            "artboard.cut",
+            "Cut Artboard",
+            [],
+            None,
+            "{index?, art?} artboard.copy, then delete the artboard and that art in one undo step (not the only artboard); edit.cut runs this while the Artboard tool is chosen → {copied: objects}",
+            has_doc,
+            |s, p| artboard_copy(s, p, true)
+        ),
         cmd!(
             "text.setFormat",
             "Character / Paragraph",
             [],
             None,
-            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool}",
+            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\" (where characters smaller than the largest on their line line up with it), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\")}",
             has_doc,
             set_format
         ),
@@ -49,20 +68,114 @@ fn artboard_reorder(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
+/// The artboard (`index`) and whether its art comes along (`art`) for the artboard copy
+/// commands: by default the Artboard tool's artboard and its Move/Copy Artwork with Artboard option.
+fn board_and_art(s: &Session, p: &Value) -> (usize, bool) {
+    let t = s.tool_options_of("artboard");
+    let i = p.get("index").and_then(Value::as_u64).or_else(|| t["active"].as_u64()).unwrap_or(0) as usize;
+    (i, bool_or(p, "art", t["moveArt"].as_bool().unwrap_or(true)))
+}
+
+/// The art that goes with artboard `i` when `art`: the objects fully inside it (locked and hidden
+/// ones only with prefs moveLockedWithArtboard), in paint order.
+pub(crate) fn artboard_art(s: &Session, i: usize, art: bool) -> Result<Vec<NodeId>> {
+    let d = &s.doc()?.doc;
+    let rect = d.artboards.get(i).map(|a| a.rect).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+    Ok(if art { d.art_on_artboard(rect, s.prefs.move_locked_with_artboard) } else { vec![] })
+}
+
+/// How far a copy of `rect` moves to sit right of the last artboard (Duplicate Artboards, Paste).
+pub(crate) fn beside_artboards(d: &vectorcraft_doc::Document, rect: Rect) -> Vec2 {
+    let right = d.artboards.iter().map(|a| a.rect.x1).fold(f64::MIN, f64::max);
+    Vec2::new(right + 20.0 - rect.x0, 0.0)
+}
+
 fn artboard_duplicate(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = p.get("index").and_then(Value::as_u64).unwrap_or(0) as usize;
-    let index = s.edit("Duplicate Artboard", |d, _| {
-        let src = d.artboards.get(i).cloned().ok_or_else(|| EngineError::Other("no such artboard".into()))?;
-        let right = d.artboards.iter().map(|a| a.rect.x1).fold(f64::MIN, f64::max);
-        let mut a = src.clone();
-        a.id = d.artboards.iter().map(|a| a.id).max().unwrap_or(0) + 1;
-        a.name = format!("{} copy", src.name);
-        let dx = right + 20.0 - src.rect.x0;
-        a.rect = vectorcraft_geom::Rect::new(src.rect.x0 + dx, src.rect.y0, src.rect.x1 + dx, src.rect.y1);
-        d.artboards.push(a);
-        Ok(d.artboards.len() - 1)
+    let (i, art) = board_and_art(s, p);
+    let art = artboard_art(s, i, art)?;
+    let scale_strokes = s.prefs.scale_strokes;
+    let (index, ids) = s.edit("Duplicate Artboard", |d, _| {
+        let dv = d.artboards.get(i).map(|a| beside_artboards(d, a.rect)).unwrap_or_default();
+        copy_artboard(d, i, dv, &art, scale_strokes)
     })?;
-    Ok(json!({"index": index}))
+    Ok(json!({"index": index, "ids": ids.iter().map(|i| i.0).collect::<Vec<_>>()}))
+}
+
+/// Artboard Copy / Cut: the artboard and its art onto the clipboard (pasting brings both); a cut
+/// then deletes them.
+pub(crate) fn artboard_copy(s: &mut Session, p: &Value, cut: bool) -> Result<Value> {
+    let (i, art) = board_and_art(s, p);
+    let art = artboard_art(s, i, art)?;
+    let st = s.doc()?;
+    if cut && st.doc.artboards.len() <= 1 {
+        return Err(EngineError::Other("a document needs at least one artboard".into()));
+    }
+    let board = st.doc.artboards.get(i).cloned().ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+    let clip = Clipboard { source_artboard: Some(board.rect), artboard: Some(board), ..Clipboard::copy(st, &art) };
+    let copied = clip.nodes.len();
+    if cut {
+        s.edit("Cut Artboard", |d, sel| {
+            if i >= d.artboards.len() {
+                return Err(EngineError::Other("no such artboard".into()));
+            }
+            // Its guides go with it.
+            let gone = d.artboards.remove(i).id;
+            d.retain_guides(sel, |_, g| g.artboard != Some(gone));
+            for id in &art {
+                // Always there: none of the art is inside another of it.
+                let _ = d.remove(*id);
+            }
+            sel.prune(d);
+            Ok(())
+        })?;
+        if s.tool_id() == "artboard" {
+            s.set_tool_option("active", &json!(i.saturating_sub(1)));
+        }
+    }
+    s.clipboard = clip;
+    Ok(json!({"copied": copied}))
+}
+
+/// Add a copy of artboard `i` moved by `dv`, with copies of its guides and of its `art` (each just
+/// above its original) moved along → (the copy's index, the art's copies). Duplicate Artboards and
+/// Alt-drag.
+pub(crate) fn copy_artboard(
+    d: &mut vectorcraft_doc::Document,
+    i: usize,
+    dv: Vec2,
+    art: &[NodeId],
+    scale_strokes: bool,
+) -> Result<(usize, Vec<NodeId>)> {
+    let src = d.artboards.get(i).cloned().ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+    let index = push_artboard_copy(d, &src, src.rect + dv);
+    // Its guides come along.
+    if let Some(id) = d.artboards.get(index).map(|a| a.id) {
+        d.copy_artboard_guides(src.id, id, dv);
+    }
+    let mut copies = Vec::with_capacity(art.len());
+    for id in art {
+        let (Some((parent, at, _)), Some(n)) = (d.position(*id), d.node(*id).cloned()) else { continue };
+        let mut c = d.reid(&n);
+        c.transform(Affine::translate(dv), scale_strokes);
+        copies.push(d.insert(parent, at + 1, c)?);
+    }
+    Ok((index, copies))
+}
+
+/// Add a copy of artboard `src` at `rect`, with an id of its own and its name, or `<name> copy`
+/// (`<name> copy 2`…) when that is taken → its index.
+pub(crate) fn push_artboard_copy(d: &mut vectorcraft_doc::Document, src: &vectorcraft_doc::Artboard, rect: Rect) -> usize {
+    let mut a = src.clone();
+    a.id = d.artboards.iter().map(|a| a.id).max().unwrap_or(0).saturating_add(1);
+    let taken = |name: &str| d.artboards.iter().any(|a| a.name == name);
+    a.name = [src.name.clone(), format!("{} copy", src.name)]
+        .into_iter()
+        .chain((2u64..).map(|i| format!("{} copy {i}", src.name)))
+        .find(|name| !taken(name))
+        .unwrap_or_default();
+    a.rect = rect;
+    d.artboards.push(a);
+    d.artboards.len() - 1
 }
 
 // ---------- text ----------
@@ -101,11 +214,51 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
         "spaceBefore",
         "spaceAfter",
         "hyphenate",
+        "mojikumi",
+        "direction",
+        "leadingModel",
+        "charAlign",
+        "burasagari",
     ];
     if !keys.iter().any(|k| p.get(*k).is_some()) {
         return Err(bad(C, "nothing to change"));
     }
     let (position, small_caps) = super::docsetup::script_params(p, &s.doc()?.doc.setup, C)?;
+    let char_align = super::textedit::char_align_param(p, C)?;
+    let mojikumi = match p.get("mojikumi") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("none") => vectorcraft_doc::Mojikumi::None,
+            Some("lineEndHalf") => vectorcraft_doc::Mojikumi::LineEndHalf,
+            _ => return Err(bad(C, "`mojikumi` must be \"none\" or \"lineEndHalf\"")),
+        }),
+    };
+    let direction = match p.get("direction") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("auto") => None,
+            Some("leftToRight") => Some(vectorcraft_doc::ParaDirection::LeftToRight),
+            Some("rightToLeft") => Some(vectorcraft_doc::ParaDirection::RightToLeft),
+            _ => return Err(bad(C, "`direction` must be \"auto\", \"leftToRight\" or \"rightToLeft\"")),
+        }),
+    };
+    let leading_model = match p.get("leadingModel") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("romanBaseline") => vectorcraft_doc::LeadingModel::RomanBaseline,
+            Some("emBoxTop") => vectorcraft_doc::LeadingModel::EmBoxTop,
+            _ => return Err(bad(C, "`leadingModel` must be \"romanBaseline\" or \"emBoxTop\"")),
+        }),
+    };
+    let burasagari = match p.get("burasagari") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("none") => vectorcraft_doc::Burasagari::None,
+            Some("standard") => vectorcraft_doc::Burasagari::Standard,
+            Some("forced") => vectorcraft_doc::Burasagari::Forced,
+            _ => return Err(bad(C, "`burasagari` must be \"none\", \"standard\" or \"forced\"")),
+        }),
+    };
     s.edit("Character", |d, _| {
         for id in &ids {
             let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
@@ -141,6 +294,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
                 if let Some(v) = small_caps {
                     st.small_caps = v;
                 }
+                if let Some(v) = char_align {
+                    st.char_align = v;
+                }
             }
             let para = &mut t.para;
             if let Some(v) = num("leftIndent") {
@@ -161,6 +317,18 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = flag("hyphenate") {
                 para.hyphenate = v;
             }
+            if let Some(v) = mojikumi {
+                para.mojikumi = v;
+            }
+            if let Some(v) = direction {
+                para.direction = v;
+            }
+            if let Some(v) = leading_model {
+                para.leading_model = v;
+            }
+            if let Some(v) = burasagari {
+                para.burasagari = v;
+            }
             super::typecmd::refresh_bounds(t);
         }
         Ok(())

crates/engine/src/cmd/path.rs

@@ -4,7 +4,7 @@ use std::collections::BTreeSet;
 
 use serde_json::{Value, json};
 use vectorcraft_doc::{NodeId, NodeKind};
-use vectorcraft_geom::{Anchor, AnchorKind, PathData, Point, SubPath, Vec2};
+use vectorcraft_geom::{AnchorKind, PathData, Point, SubPath, Vec2};
 
 use super::create::anchor_from_json;
 use super::*;
@@ -81,17 +81,17 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert Anchor Points",
             [],
             None,
-            "{to: \"corner\"|\"smooth\"} (Control bar convert buttons)",
+            "{to: \"corner\"|\"smooth\"} convert the direct-selected anchors (all anchors of fully selected paths) as one undo step: corner retracts both handles, smooth pulls handles in line with the neighbours (smooth anchors keep theirs)",
             has_selection,
             convert_anchors
         ),
         cmd!(
             "path.deleteAnchors",
-            "Remove Anchor Points",
-            ["Object", "Path"],
+            "Delete Anchor Points",
+            [],
             None,
-            "{} delete direct-selected anchors",
-            has_selection,
+            "{} delete the direct-selected anchors and their segments, opening closed paths there (the Delete key)",
+            has_anchors,
             delete_anchors
         ),
         cmd!(
@@ -104,7 +104,15 @@ pub fn specs() -> Vec<CommandSpec> {
             reshape
         ),
         cmd!("path.insertAnchor", "Add Anchor Point", [], None, "{id, subpath, segment, t: 0..1}", has_doc, insert_anchor),
-        cmd!("path.cutAtAnchors", "Cut Path at Selected Anchor Points", [], None, "{}", has_selection, cut_at_anchors),
+        cmd!(
+            "path.cutAtAnchors",
+            "Cut Path at Selected Anchor Points",
+            [],
+            None,
+            "{} cut the paths at their direct-selected anchors (one undo step): a closed path opens there, an open one becomes one path per piece; one of each cut's two coincident anchors stays selected → {ids}",
+            has_anchors,
+            cut_at_anchors
+        ),
     ]
 }
 
@@ -386,41 +394,24 @@ fn average(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn convert_anchors(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "path.convertAnchors";
+    let smooth = match str_param(p, "to") {
+        Some("smooth") => true,
+        Some("corner") => false,
+        _ => return Err(bad(C, "`to` must be \"corner\" or \"smooth\"")),
+    };
     let t = anchor_targets(s)?;
-    let smooth = str_param(p, "to") == Some("smooth");
+    if t.is_empty() {
+        return Err(bad(C, "select paths or anchor points"));
+    }
     s.edit("Convert Anchor Points", |d, _| {
         for (id, v) in &t {
             let path = path_mut(d, *id)?;
             for &(si, ai) in v {
-                let sp = &path.subpaths[si];
-                let n = sp.anchors.len();
-                let prev = if ai > 0 {
-                    Some(sp.anchors[ai - 1].p)
-                } else if sp.closed {
-                    Some(sp.anchors[n - 1].p)
-                } else {
-                    None
-                };
-                let next = if ai + 1 < n {
-                    Some(sp.anchors[ai + 1].p)
-                } else if sp.closed {
-                    Some(sp.anchors[0].p)
-                } else {
-                    None
-                };
-                let a: &mut Anchor = &mut path.subpaths[si].anchors[ai];
+                let Some(sp) = path.subpaths.get_mut(si) else { continue };
                 if smooth {
-                    // Handles parallel to prev→next, a third of the neighbour distances.
-                    let (pp, nn) = (prev.unwrap_or(a.p), next.unwrap_or(a.p));
-                    let dir = nn - pp;
-                    let l = dir.hypot();
-                    if l > 1e-9 {
-                        let u = dir / l;
-                        a.h_in = a.p - u * (a.p.distance(pp) / 3.0);
-                        a.h_out = a.p + u * (a.p.distance(nn) / 3.0);
-                        a.kind = AnchorKind::Smooth;
-                    }
-                } else {
+                    sp.smooth_anchor(ai);
+                } else if let Some(a) = sp.anchors.get_mut(ai) {
                     a.retract();
                 }
             }
@@ -519,40 +510,50 @@ fn insert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn cut_at_anchors(s: &mut Session, _: &Value) -> Result<Value> {
-    let sel = s.doc()?.selection.anchors.clone();
-    s.edit("Cut Path", |d, _| {
-        for (id, set) in &sel {
-            let path = path_mut(d, *id)?;
-            let mut out = vec![];
-            for (si, sp) in path.subpaths.iter().enumerate() {
-                let cuts: Vec<usize> = set.iter().filter(|(s, _)| *s == si).map(|(_, a)| *a).collect();
-                if cuts.is_empty() {
-                    out.push(sp.clone());
-                    continue;
-                }
-                let mut anchors = sp.anchors.clone();
-                if sp.closed {
-                    anchors.rotate_left(cuts[0]);
-                    anchors.push(anchors[0]);
-                }
-                let base = if sp.closed { cuts[0] } else { 0 };
-                let n = sp.anchors.len();
-                let rel: Vec<usize> = cuts.iter().map(|c| (c + n - base) % n).collect();
-                let mut cur = vec![];
-                for (i, a) in anchors.iter().enumerate() {
-                    cur.push(*a);
-                    if rel.contains(&(i % n)) && cur.len() > 1 {
-                        out.push(SubPath::new(std::mem::take(&mut cur), false));
-                        cur.push(*a);
-                    }
-                }
-                if cur.len() > 1 {
-                    out.push(SubPath::new(cur, false));
-                }
-            }
-            path.subpaths = out;
+    const C: &str = "path.cutAtAnchors";
+    let st = s.doc()?;
+    // Each selected path's subpaths cut at its selected anchors, those that cut anything.
+    let mut cuts: Vec<(NodeId, Vec<SubPath>, Vec<bool>)> = vec![];
+    for (id, set) in &st.selection.anchors {
+        let Some(pd) = st.doc.node(*id).and_then(|n| n.path_data()) else { continue };
+        let (mut subs, mut starts) = (vec![], vec![]);
+        for (si, sp) in pd.subpaths.iter().enumerate() {
+            let at: BTreeSet<usize> = set.iter().filter(|(s, _)| *s == si).map(|(_, a)| *a).collect();
+            let pieces = sp.cut_at(&at);
+            // The pieces that start at a cut: every piece of an opened closed subpath, all but the
+            // first of an open one.
+            starts.extend(pieces.iter().enumerate().map(|(k, piece)| if sp.closed { !piece.closed } else { k > 0 }));
+            subs.extend(pieces);
         }
-        Ok(())
+        if starts.contains(&true) {
+            cuts.push((*id, subs, starts));
+        }
+    }
+    if cuts.is_empty() {
+        return Err(bad(C, "direct-select anchor points to cut at (not the end points of open paths)"));
+    }
+    let ids = s.edit("Cut Path", |d, sel| {
+        let (mut all, mut picked) = (vec![], vec![]);
+        for (id, subs, starts) in cuts {
+            // A path of one subpath becomes one path per piece (the first keeps the id); the
+            // pieces of a compound shape stay subpaths of it.
+            if d.node(id).and_then(|n| n.path_data()).is_some_and(|pd| pd.subpaths.len() == 1) {
+                let ids = super::draw2::replace_with_pieces(d, id, subs.into_iter().map(PathData::single).collect())?;
+                picked.extend(ids.iter().zip(&starts).filter(|(_, s)| **s).map(|(id, _)| (*id, (0, 0))));
+                all.extend(ids);
+            } else {
+                path_mut(d, id)?.subpaths = subs;
+                picked.extend(starts.iter().enumerate().filter(|(_, s)| **s).map(|(si, _)| (id, (si, 0))));
+                all.push(id);
+            }
+        }
+        // Each cut leaves one of its two coincident anchors selected, so a drag pulls the ends apart.
+        sel.clear();
+        for (id, a) in picked {
+            sel.add(id);
+            sel.anchors.entry(id).or_default().insert(a);
+        }
+        Ok(all)
     })?;
-    ok()
+    Ok(super::draw2::ids_json(&ids))
 }