Fix #442: alike circular corners on rectangles that aren't square

Live rectangles drew elliptical corners after an uneven scale in v0.4.0;
inconsistent on a rectangle that isn't square:

- doc: LiveShape::fold_scale moves an uneven scale left in `xf` (files
  saved before #291) into the size and radii; `transform` uses it, and
  `folded()`/`corner_style` give Live Corners document units.
- engine: object.setLiveShape folds that scale first, so setting a radius
  or kind (fields, dialog, widgets, MCP) gives circular corners on such
  shapes instead of keeping the ellipses.
- geom: max_corner_radius/fitted_corner_radius are the one limit every
  corner shares (half the shorter side).
- tools: corner widgets sit at the centres of the corners as drawn (a
  radius past the limit put them off the arc, further in along the long
  side), drag in document units on stretched shapes, and outline the
  edited corners in red at the limit, as the reference app does.
- svg: CSS export writes the drawn radii (CSS would draw a radius past the
  limit when its neighbours leave room).
- docs: mcp.md Live Corners, ROADMAP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -63,7 +63,7 @@ jobs:
   macos:
     name: macOS universal
     needs: version
-    runs-on: macos-15
+    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
     environment: release
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}

.github/workflows/windows7.yml

@@ -0,0 +1,43 @@
+# Experimental, unsupported Windows 7 SP1 x64 portable build (docs/windows7.md). It runs by hand and
+# weekly, so ordinary PRs never wait on it, and the weekly run shows when a dependency update starts
+# importing a post-Windows-7 API. packaging/windows/windows7.ps1 does the work: it is the only build
+# that uses the patched vendor/windows-link. A modern Windows runner proves compilation and host
+# smoke tests only: run the checklist in docs/windows7.md on actual Windows 7 before claiming support.
+name: Windows 7 x64 compatibility
+
+on:
+  schedule:
+    - cron: "23 5 * * 1" # weekly
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  build:
+    runs-on: windows-2022
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+        with:
+          arch: x64
+      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # master
+        with:
+          toolchain: nightly-2026-10-01
+          components: rust-src
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows7-x64
+      - name: Build, check and test the portable package
+        shell: pwsh
+        run: ./packaging/windows/windows7.ps1 -Test
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vectorcraft-windows7-x64-portable
+          path: dist/release/vectorcraft-windows7-x64-portable.zip
+          if-no-files-found: error

AGENTS.md

@@ -55,3 +55,21 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
 - Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.
+
+## Contributor credits (About window)
+
+- About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
+  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  themselves). See `docs/contributors.md`.
+- **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
+  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
+  whether they want to be credited by more than their username: a real name, a display name, and/or
+  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
+  (copy the template at the top of the file, or run
+  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  and include it in their PR, committed as them. If no, change nothing: they are credited as
+  `@username` anyway.
+- Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
+  GitHub profiles). Never hand-edit `contributors.json`.
+- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
+  re-verifies who wrote each `people.toml` entry; `--check` only verifies).

Cargo.lock

@@ -217,6 +217,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "windows-sys 0.60.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -952,6 +953,7 @@ dependencies = [
  "egui-wgpu",
  "egui-winit",
  "egui_glow",
+ "glow",
  "glutin",
  "glutin-winit",
  "image",
@@ -1241,6 +1243,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -2366,6 +2374,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2753,6 +2770,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -2813,6 +2840,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -4066,6 +4104,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "ttf-parser"
 version = "0.25.1"
@@ -4331,13 +4380,16 @@ name = "vectorcraft-doc"
 version = "0.4.0"
 dependencies = [
  "image",
+ "jpeg-encoder",
  "kurbo 0.13.1",
  "proptest",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
+ "tiff",
  "vectorcraft-color",
  "vectorcraft-geom",
+ "zune-jpeg",
 ]
 
 [[package]]
@@ -4483,6 +4535,7 @@ dependencies = [
  "hayro-interpret",
  "hayro-syntax",
  "image",
+ "jpeg-encoder",
  "krilla",
  "kurbo 0.13.1",
  "log",
@@ -4596,6 +4649,7 @@ dependencies = [
  "unicode-script",
  "vectorcraft-doc",
  "vectorcraft-geom",
+ "windows-registry",
  "write-fonts",
 ]
 
@@ -4637,6 +4691,7 @@ dependencies = [
  "log",
  "serde",
  "serde_json",
+ "toml",
  "vectorcraft-cad",
  "vectorcraft-color",
  "vectorcraft-doc",
@@ -5367,6 +5422,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -5635,6 +5701,24 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"

Cargo.toml

@@ -62,6 +62,10 @@ linesweeper = "0.4"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
+# CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG
+# decoders, read directly (the image crate converts CMYK to RGB).
+tiff = "0.11"
+zune-jpeg = "0.5"
 
 # ui
 egui = "0.36"

NOTICE

@@ -30,6 +30,11 @@ based in part on the work of the Independent JPEG Group.
 WebAssembly plug-ins run in the wasmi interpreter (MIT OR Apache-2.0); its wasmparser dependency is
 under the Apache License 2.0 with the LLVM exception.
 
+The experimental Windows 7 build (packaging/windows/windows7.ps1) compiles a modified copy of the
+windows-link crate 0.2.1 (vendor/windows-link; Microsoft, MIT OR Apache-2.0) that binds CoTaskMemFree
+through ole32.dll. Its license texts are in vendor/windows-link and ship in that build's ZIP; every
+other build uses the unmodified crate from crates.io.
+
 Builds made with craft-fonts (the CRAFT_FONTS_DIR build option; all official releases) embed the
 fonts listed in https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic,
 Shippori Mincho, BIZ UDMincho, Noto Sans CJK SC and Noto Sans Arabic in the current manifest;

README.md

@@ -176,6 +176,8 @@ claude mcp add vectorcraft -- /path/to/vectorcraft-cli mcp
 
 The details are in [`docs/mcp.md`](docs/mcp.md) and [`docs/control-protocol.md`](docs/control-protocol.md).
 
+For the experimental, unsupported 64-bit Windows 7 build, see [Windows 7 instructions](docs/windows7.md).
+
 ## Status
 
 VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) covers what ships today, the
@@ -184,7 +186,9 @@ milestones, and honest time-to-parity estimates.
 **Where we are (2026-10-07):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
-files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The scores are
+files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
+speaks English, Japanese, Traditional and Simplified Chinese and Spanish (and Czech and Brazilian Portuguese in the menus).
+The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 
 **What's missing:**

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages, the font menu, saved selections, MCP and EPS; see [Honest assessment](#honest-assessment-2026-10-05))._
+_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442); see [Honest assessment](#honest-assessment-2026-10-05))._
 
 ## Where we are
 
@@ -42,8 +42,9 @@ since 2026-10-01.
 | **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
 | **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
 | **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
-| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); hybrid-graphics laptops render on the power-saving GPU by default (#306); web drops land in the document they were dropped on (#359); Windows/Linux packaging and accessibility are pending |
+| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); hybrid-graphics laptops render on the power-saving GPU by default (#306); web drops land in the document they were dropped on (#359); a web page that loses its WebGPU device or WebGL context restarts its graphics with the same documents (#369); on Linux/Wayland the clipboard reads the compositor's own (data-control) and copied image files paste, but files can't be dropped on the window under Wayland until eframe moves to winit 0.31 (#398; the Wayland side is verified by compilation only); Windows/Linux packaging and accessibility are pending; an experimental, unsupported Windows 7 x64 OpenGL build exists (community-contributed, not verified by maintainers) |
 | **Agent automation** | beyond Illustrator | Every command, gesture and dialog is drivable over MCP, the CLI and the control channel |
+| **Scrubby numeric fields** | beyond Illustrator | As in Photoshop, dragging a numeric field's label (`W:`, `Opacity:`, the Character panel's icons) left or right steps its value live; one undo step per drag, Escape cancels (#400) |
 
 ### Where we're lacking (in priority order)
 
@@ -63,7 +64,8 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
    spell-check dictionary (open licence), Touch Type and Snap to Glyph. Vertical point, area and path type have
    initial support. 35–48 h across type core and advanced.
 5. **Brushes, symbols and libraries:** brush options depth; original brush, symbol and graphic-style libraries
-   generated in code (never Adobe's); dynamic symbols; Start Global Edit. 14–22 h.
+   generated in code (never Adobe's); dynamic symbols; Start Global Edit; brushes driven by pen tilt, bearing and
+   barrel rotation (6D art pens, #372), which needs tablet input beyond pressure on every platform. 20–32 h.
 6. **Automation:** Variables (data merge), a scripting surface over the command registry, batch. 8–12 h.
 7. **Views and windows:** multiple windows and arrange, Consolidate All Windows, video
    rulers. 15–25 h.
@@ -89,65 +91,71 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - Actions panel (record/playback, persisted), generic parameter dialogs for every "…" command.
   - JSON-lines control channel with real egui pointer and keyboard injection.
   - MCP server with 25 tools (drawing, text, effects, Pathfinder, transforms, graphs, text wrap, export, screenshots, any command), attached to the running app or headless. Tool descriptions and replies agree with the engine: format lists come from its format table, `save_file` says it keeps the document's own format, `inspect_document` reports the paint type's characters show, and selection exports report the encoder's warnings.
-  - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
+  - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
   - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`).
   - Actions panel that records and plays back commands.
 - **UI:** Illustrator 2026 layout restyled to measured values:
-  - Medium Dark theme, categorized and Advanced toolbars, 35 pt document tabs, 33 pt panel tabs.
+  - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
   - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
+  - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
   - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
-  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland) and Japanese ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows and Linux, a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese and Spanish ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
   - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool.
   - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats.
   - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
   - Save / Don't Save / Cancel before closing or quitting with unsaved documents (tabs, Close, Close All, Quit, window close).
   - Four brightness themes, persistent preferences.
-  - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…).
+  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 45 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, the smart guide display options, performance, devices…).
+  - Dialogs move by dragging their heading (the band down from the top edge, as a title bar), stay on screen and keep where they were moved for the session; the form dialogs' choices are dropdowns (Offset Path's Joins, Average's and Shear's and Reflect's axis), and Offset Path lists Offset, Joins, Miter Limit and previews (#423).
+  - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…). Number fields in panels and dialogs step with Up/Down (Shift: ten, Ctrl/Cmd: a tenth of their unit), applied at once.
+  - Scrubby labels (#400, beyond Illustrator, as in Photoshop): dragging a numeric field's label left or right (the ↔ cursor shows over it) steps the value one unit every 2 points (Shift: ten, Ctrl/Cmd: a tenth; counts stay whole), in the field's unit and within its limits, applied live as the art follows; the whole drag is one undo step and Escape puts the value back. A click on the label focuses the field; the text box itself never scrubs, and a field with no label doesn't. Text labels before a field (Transform, Properties, Control bar, Stroke, Transparency, form rows in dialogs) and the Character and Paragraph panels' icons act as labels. Preferences › General › Scrub Numeric Fields by Dragging (on by default) turns it off.
+  - Tab shows and hides the panels (in the Type tool it types a tab) without moving the keyboard focus onto a field, so the next shortcut or letter still works; in dialogs and panel fields it moves between fields.
+  - Cmd/Ctrl+A follows the keyboard: in a panel, dialog or search field it selects the field's text, while the Type tool edits it selects all of that text (also `select.all` over MCP), and only otherwise every object. On macOS the menu bar's Select All, Cut, Copy and Paste (keys or clicks) act on a focused field too. Not yet: Select All across threaded frames (one frame's text is selected).
   - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content. As on a native menu bar, once one menu is open, moving the pointer onto another title opens that one.
 - **Tools:**
-  - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso.
+  - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso. Dragging a path segment with Direct Selection bends it when it's curved (its anchors stay) and moves its two anchors when it's straight, one undo step; the fill, Shift or Alt still pick the whole path (Alt-drag copies it).
   - **Saved selections:** Select ▸ Save Selection… asks for a name and keeps the selection in the document (saved with the file, undoable, up to 25); each one is listed at the bottom of the Select menu and a click selects its objects again; Edit Selection… lists them to rename or delete, applied together on OK. A file's saved selections are capped and checked against its objects when it opens. Not yet: Update Selection and the Layers panel's saved-selection menu.
   - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join. Direction handles dragged with Direct Selection or the Anchor Point tool snap to smart guides, and Shift keeps them at 45° steps from their anchor.
   - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers).
   - **Cutting:** Eraser, Scissors, Knife, Mirror & Cut, Line Cut and Rectangle Cut (real geometry, compound paths keep their holes).
-  - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
-  - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout. Corners stay circular when the rectangle is scaled unevenly or along its own sides when rotated (the radius keeps its size, or scales by the mean scale with Scale Corners on); only a shear distorts them.
+  - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres; Alt-click opens the tool's dialog, and a drag with Alt down at the release, from the press or pressed mid-drag, transforms a copy), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
+  - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout; with Direct Selection, select corner anchors to show and round just those corners (#381). Each corner keeps its own radius and kind (Round, Inverted Round, Chamfer): Alt-click a widget to cycle the kind, double-click it for the Corners dialog, and the Properties and Transform radius fields set the selected corners (`object.setLiveShape {corners, radius, kind}`). Corners stay circular when the rectangle is scaled unevenly or along its own sides when rotated (the radius keeps its size, or scales by the mean scale with Scale Corners on); only a shear distorts them. On a rectangle that isn't square every corner is the same circle: a radius past half the shorter side stops there for all of them, the widgets sit on the corners as drawn and turn the edited corners red at that limit, CSS export writes the drawn radii, and rectangles saved stretched by older versions get circular corners when their corners are next set (#442).
   - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead.
   - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
   - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on), Measure, Type, Hand, Zoom, Rotate View.
   - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
   - **Temporary tools:** Cmd with any other tool drags with the selection tool used last (Selection, Direct Selection or Group Selection). Held Space pans and Cmd+Space zooms (Cmd+Alt+Space out) whatever the tool.
   - **Panel drag and drop:** art dragged off the canvas onto the Symbols panel becomes a symbol, onto the Swatches panel a pattern swatch and onto the Brushes panel an Art brush; a symbol dragged onto the canvas places an instance where it is dropped, and a brush dragged onto a path is applied to it.
-  - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, Gradient, Eyedropper, Blend and the Liquify tools their panels or options.
-- **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies, the trash deletes), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting.
-- **Drawing aids:** Smart Guides and snapping (moving, and resizing by the bounding-box handles: the dragged edges align with the other objects; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H), guides dragged out of the rulers, and Draw Normal / Behind / Inside modes.
+  - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, the Selection, Direct Selection and Group Selection tools the Move dialog (Enter opens these seven tools' dialogs too), Gradient, Eyedropper, Blend and the Liquify tools their panels or options, and the Pencil, Paintbrush, Smooth, Blob Brush and Eraser tools their Tool Options (Fidelity, fill, the tolerances, the brush size).
+- **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies) and a dimmed copy of the row under the pointer (dropped on the trash rows are deleted, on New Layer duplicated, as in Illustrator), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets, each with a chip of its colour, or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting.
+- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles: the dragged edges align with the other objects; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H), guides dragged out of the rulers (Shift snaps them to the ruler's ticks) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the art's edges, centres and anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), and Draw Normal / Behind / Inside modes.
 - **Views:** the status bar's artboard navigator (first, previous, next, last; `view.goToArtboard`) goes to an artboard and fits it, and Fit Artboard in Window and Actual Size show the navigator's artboard. The Artboards panel highlights that active artboard: clicking a row makes it active (the Artboard tool's too, while it is chosen) as does clicking an artboard with the Artboard tool, double-clicking its number also fits it in the window and double-clicking its name renames it.
 - **Geometry and effects:**
   - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected.
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
-- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text.
-- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese and Japanese cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech ones from the bundled UI fonts. The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width, and puts a quarter em between Japanese and Latin letters or digits; Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text.
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese and Spanish (neutral international Spanish, for every `es-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish also translates status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech and Spanish ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline; Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
-- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder, Live Paint (every path an edge, open lines included), Image Trace (12 presets), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
   - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved and loaded as `.vcswatches`, `.gpl` or CSS. Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
-  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers, panels have their shortcuts, and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening.
+  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers, panels have their shortcuts, and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
   - **Gradients:** lossless, validated gradient params; gradients follow rotate, reflect, shear, non-uniform scale and distortions; the Gradient tool edits the fill or stroke of the active proxy, type included; an interactive on-canvas annotator (move, length/angle, rotate, add/move/delete/duplicate stops, midpoints, a stop popover, Delete and arrow keys). The Gradient panel has the Fill/Stroke proxy, a gradient-swatch dropdown with Save to Swatches, midpoint locations, Alt-drag to copy or swap stops, swatch drops on the ramp and a stop eyedropper; copied appearances and graphic styles place gradients on each target's own bounds; gradient handles snap and honour Constrain Angle. Gradient stops stay linked to global and spot swatches. Freeform gradients (points and lines) are edited on the canvas; radial gradients have an extent ellipse, an aspect handle and an off-centre focal point (SVG `fx`/`fy`, PDF two-point radials). A stroke's gradient runs within, along or across it. Object ▸ Expand turns gradients into N objects or a gradient mesh.
-  - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units, shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
-  - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups; Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
+  - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units (its weight presets are round values in that unit: `0.25 mm`, `0.0625 in`, `1 px`, #426; fields show four decimals in mm, cm and inches, three in points), shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
+  - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups, whose blend-mode list and opacity slider stay open inside them (#430; the Control bar's Stroke popover too); Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
   - **Masks and clipping:** opacity-mask controls work while the mask is being edited; transparency commands take ids and work without a selection; clipping sets clip by compound paths, even-odd paths, text and groups on screen and in raster export, matching SVG/PDF. Alt-click shows only the mask; SVG masks keep Clip and Invert; the transparency grid is per-document state; a clipping path's own fill and stroke paint behind and over the clipped art; layers can be clipping masks.
   - **Transparency:** three-state Knockout Group (on, neutral, off), Opacity & Mask Define Knockout Shape, Page Isolated Blending and Page Knockout Group, on screen and in SVG/PDF. Blend modes match the standard formulas on screen, in SVG and in PDF, and non-isolated groups blend with the art below. Flatten Transparency with presets, a dialog and a Flattener Preview panel.
   - **Graphic styles:** styles keep opacity and blend mode, capture groups and type, apply on top with Alt, and link to the objects using them; Redefine, Break Link, Graphic Style Options, Select All Unused, Sort by Name, and Select > Same Graphic Style / Appearance Attribute. The panel has list and thumbnail views with rendered previews, merge, reorder and drag and drop, plus a Control bar Style picker; six generated style libraries save and load as `.vcstyles`.
   - **Neutral wording:** labels, MCP tool text, docs and packaging use neutral names, and `cargo xtask brands` (part of `cargo xtask ci`) fails on vendor names.
 - **Colour, type and file workflows:** Recolor Artwork (dialog with harmonies), Edit Colors, Find & Replace, Change Case, Smart Punctuation, Guides, Lock/Hide Above, Transform Each, Rasterize.
-- **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed.
+- **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
 - **Files (M4):**
-  - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash, background save and export.
-  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units; PDF and PDF-compatible `.ai` in and out (layers, masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3).
+  - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export.
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
   - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs Illustrator's AGM/CoolType prologs (resource categories, `resourceforall`, `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters, `cshow`, metadata skipped with `flushfile`), so Illustrator 30 EPS files open as vectors, and falls back to its palette TIFF preview. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
-  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours.
+  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
-- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so the desktop app asks for the power-saving GPU by default (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306). Preferences › Performance › Graphics Processor (`gpuPreference`) or `WGPU_POWER_PREF` picks the discrete one; Help › About and `ui.inspect` name the adapter in use.
+- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so the desktop app asks for the power-saving GPU by default (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306). Preferences › Performance › Graphics Processor (`gpuPreference`) or `WGPU_POWER_PREF` picks the discrete one; Help › About and `ui.inspect` name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369).
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).
 
 ## Milestones and estimates
@@ -156,19 +164,19 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 |---|---|---|---|
 | M0 | Skeleton + vertical slice | ✅ done | — |
 | M1 | Selection, transform, layers, MCP | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
-| M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging landed; Shaper, the remaining Pen modifier nuances) | 15–20 |
+| M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging and per-corner radii and kinds landed; Shaper, the remaining Pen modifier nuances) | 15–20 |
 | M3 | Paint & appearance (swatches, color, gradient, stroke, appearance, transparency, styles) | ✅ done (M3.7–M3.98): swatches, groups, libraries, tints, Lab spots and Registration; Color Picker, Color panel, Color Guide, Color Themes, Edit Colors and Recolor Artwork; gradients that follow every transform, the annotator, linked stops, freeform gradients, focal points, gradients on strokes and Expand; stroke geometry, arrowheads, dashes fitted to corners, stroke on type, width profiles and the Width tool, Scale Strokes and preview bounds; Appearance targeting, container appearance, target circles, Expand Appearance; knockout, isolation, blend accuracy, CMYK blending, overprint, Attributes, masks and clipping, Flatten Transparency; graphic styles, links and libraries. Left: freeform and mixed spot/process gradients export as stops or process colours to SVG/PDF; confirm the Scale Strokes & Effects default | 4–8 |
 | M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info. Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, polish | 3–6 |
 | M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
-| M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder edge erase, large-offset bug open) | 3–6 |
-| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects, tab stops + Tabs panel, Hebrew/Arabic bidirectional text and Paragraph Direction done; tab leaders, spell check, vertical type pending | 45–60 |
+| M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
+| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, Hebrew/Arabic bidirectional text and Paragraph Direction done; tab leaders, spell check, vertical type pending | 45–60 |
 | M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
 | M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
 | M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
 | M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (12 presets, 18 ms/1k² image), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
 | M13 | Automation (Actions ✅ record/playback, persisted; variables, scripting, batch) | 🟡 | 18–27 |
-| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs and menus that scroll when longer than the window done; accessibility, Windows/Linux packaging pending | 18–28 |
+| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs and menus that scroll when longer than the window done; an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
 | — | Interaction fidelity pass (every tool's modifiers, Properties panel per context, isolation, nuance) | ⬜ | 60–90 |
 | — | Hardening at scale (big-file corpus, fuzzing, cross-platform + browser QA) | 🟡 | 50–80 |
 | | **Total to full parity** (one agent; re-derived from the [Parity estimate](#parity-estimate) table) | | **~320–500** |
@@ -188,26 +196,26 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Area | Weight | Done | Missing (main items) | One agent (h) |
 |---|---:|---:|---|---:|
 | Selection, transform & align tools | 6 | 85% | Free Transform/Scale/Reflect along a rotated box, Start Global Edit, transform nuances (the rotated persistent bounding box is done) | 4–6 |
-| Drawing tools | 7 | 85% | Shaper Groups (merge/punch overlapping shapes), pencil and the remaining pen modifier nuances, Touch Type | 10–15 |
-| Path operations, Pathfinder, Shape Builder, Live Paint | 5 | 86% | Live Paint gap options, Shape Builder edge cases | 3–6 |
+| Drawing tools | 7 | 85% | Shaper Groups (merge/punch overlapping shapes), pencil and the remaining pen modifier nuances, the freehand Tool Options' Keep selected, Alt to the Smooth tool, Blob Brush Merge Only with Selection and brush angle/roundness, Touch Type, Live Corners on plain paths and polygons (and Relative rounding) | 10–15 |
+| Path operations, Pathfinder, Shape Builder, Live Paint | 5 | 86% | Live Paint gap options, Shape Builder gap detection, options (Tool Options dialog, clicking a stroke in merge mode) and Shift-drag marquee | 3–6 |
 | Colour, swatches, gradients, patterns, mesh, recolor | 7 | 96% | freeform and mixed spot/process gradients in SVG/PDF (exported as stops or process colours), pattern fills in Expand | 2–4 |
-| Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code) | 6–10 |
+| Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code), brushes driven by pen tilt, bearing and barrel rotation (6D art pens) | 12–20 |
 | Appearance, transparency, graphic styles, masks | 5 | 98% | raster effect reach in preview bounds (flattener presets apply in PDF, EPS and print) | 1–2 |
 | Live vector effects | 5 | 85% | Outline Object, Pathfinder Hard/Soft Mix and Trap, SVG Filters | 6–10 |
 | Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 20% | ~55 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery; Document Raster Effects Settings and raster effects in PDF are done | 28–42 |
 | 3D and Materials | 4 | 0% | Extrude & Bevel, Revolve, Inflate, Rotate, lighting, materials (software renderer) | 50–80 |
 | Type core | 9 | 79% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); composer/hyphenation options, Optical Margin Alignment, hidden characters, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 15–20 |
-| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — hanging punctuation, line-start brackets, kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
+| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), hanging punctuation, kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko, Character Alignment on the ICF top and bottom), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
 | Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (Vector Halftone is done) | 6–10 |
 | Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard presets/rearrange polish (Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
 | View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
-| Guides, grids, smart guides, snapping, rulers | 3 | 75% | global/video rulers, smart-guide preference depth, ruler-drag modifiers (Shift snaps to ticks, Alt swaps orientation) and dragging existing guides | 4–8 |
+| Guides, grids, smart guides, snapping, rulers | 3 | 80% | global/video rulers, smart-guide preference depth, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click) and on layers (dragging existing guides is done, #414) | 3–6 |
 | File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, Illustrator EPS checked against more real files (two Illustrator 30 files open as vectors so far), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
-| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done) | 15–25 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 45 Preferences options stored but not yet acted on (#394: smart guide display options, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Show Pixel Grid, performance, devices…) | 16–26 |
 | Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done | 5–8 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |

apps/vectorcraft-cli/tests/cli.rs

@@ -160,6 +160,42 @@ fn mcp_protocol_over_stdio() {
     send(&mut stdin, json!({"jsonrpc":"2.0","id":10,"method":"resources/read","params":{"uri":"vectorcraft://object/"}}));
     assert_eq!(recv(&mut lines, &mut notes, 10)["error"]["code"], -32602);
 
+    // Large containers slice through run_command document.node: a truncated level reports
+    // childCount, and a bad limit is a tool error, not a crash or a full read.
+    send(
+        &mut stdin,
+        json!({"jsonrpc":"2.0","id":20,"method":"tools/call","params":{"name":"draw_shape","arguments":{"shape":"ellipse","x":90,"y":10,"width":30,"height":30}}}),
+    );
+    assert_eq!(recv(&mut lines, &mut notes, 20)["result"]["isError"], false);
+    let run = |id: u64, command: &str, params: Value| json!({"jsonrpc":"2.0","id":id,"method":"tools/call","params":{"name":"run_command","arguments":{"command":command,"params":params}}});
+    send(&mut stdin, run(21, "select.all", json!({})));
+    recv(&mut lines, &mut notes, 21);
+    send(&mut stdin, run(22, "object.group", json!({})));
+    let r = recv(&mut lines, &mut notes, 22);
+    let group = serde_json::from_str::<Value>(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap()["id"].clone();
+    send(&mut stdin, run(23, "document.node", json!({"id": group, "summary": true, "childLimit": 1})));
+    let r = recv(&mut lines, &mut notes, 23);
+    let sliced: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(sliced["children"].as_array().map(Vec::len), Some(1), "{sliced}");
+    assert_eq!(sliced["childCount"], 2, "{sliced}");
+    send(&mut stdin, run(24, "document.node", json!({"id": group, "summary": true, "depth": -1})));
+    assert_eq!(recv(&mut lines, &mut notes, 24)["result"]["isError"], true);
+
+    // Skeleton then drill: a depth-0 inspect is the layer skeleton with counts, and
+    // document.find locates nodes without dumping the tree.
+    send(&mut stdin, run(25, "document.inspect", json!({"depth": 0})));
+    let r = recv(&mut lines, &mut notes, 25);
+    let skel: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert!(skel["layers"][0].get("children").is_none(), "{skel}");
+    assert!(skel["artboards"].as_array().is_some_and(|a| !a.is_empty()), "{skel}");
+    send(&mut stdin, run(26, "document.find", json!({"kind": "ellipse"})));
+    let r = recv(&mut lines, &mut notes, 26);
+    let found: Value = serde_json::from_str(r["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+    assert_eq!(found["total"], 1, "{found}");
+    assert!(found["matches"][0]["path"].as_array().is_some_and(|p| !p.is_empty()), "{found}");
+    send(&mut stdin, run(27, "document.find", json!({})));
+    assert_eq!(recv(&mut lines, &mut notes, 27)["result"]["isError"], true);
+
     // The binary installed its logger: records arrive as notifications/message, and only
     // after the client asked for them.
     send(&mut stdin, json!({"jsonrpc":"2.0","id":11,"method":"logging/setLevel","params":{"level":"debug"}}));

apps/vectorcraft-web/Cargo.toml

@@ -27,4 +27,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator"] }

apps/vectorcraft-web/src/locks.rs

@@ -0,0 +1,122 @@
+//! The browser's Web Locks (`navigator.locks`), which tell Data Recovery whether another tab still
+//! runs ([`vectorcraft_engine::cmd::recovery::RecoveryStore::announce`]). A tab holds a lock named
+//! after its recovery area for as long as it lives; the browser releases it only when the tab is
+//! gone (closed, crashed or reloaded), not while its timers are paused in the background, which a
+//! heartbeat can't tell apart.
+//!
+//! web-sys has Web Locks only as an unstable API, so they are reached through `js_sys::Reflect`.
+//! Pages that aren't secure (plain `http://` other than localhost) and older browsers have none:
+//! heartbeats alone decide there.
+
+use std::cell::RefCell;
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::{Arc, Mutex};
+
+use js_sys::{Function, Promise, Reflect};
+use vectorcraft_engine::cmd::recovery::Hold;
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+
+/// How often the snapshot of the locks held is refreshed (ms).
+const REFRESH_MS: i32 = 10_000;
+/// How old a snapshot may be and still be trusted (ms). A lock asked for after the snapshot was
+/// taken comes with a heartbeat, which stays fresh for at least three minutes, so anything under
+/// that is safe; an older snapshot counts every area as held.
+const FRESH_MS: f64 = 60_000.0;
+
+thread_local! {
+    /// What releases each lock this tab holds, by name: it resolves the promise the lock is held
+    /// by (wasm runs on one thread).
+    static RELEASE: RefCell<BTreeMap<String, Function>> = const { RefCell::new(BTreeMap::new()) };
+}
+
+/// The locks of the page, named `<prefix><area>`.
+#[derive(Clone)]
+pub struct WebLocks {
+    prefix: &'static str,
+    /// The areas whose locks were held at the last snapshot, and when it was asked for (ms since
+    /// the epoch). `navigator.locks.query()` is asynchronous, so the snapshot is refreshed every
+    /// [`REFRESH_MS`] and read from here.
+    seen: Arc<Mutex<(f64, BTreeSet<String>)>>,
+}
+
+/// `navigator.locks`, if the browser has it here.
+fn manager() -> Option<JsValue> {
+    let locks = Reflect::get(&web_sys::window()?.navigator(), &"locks".into()).ok()?;
+    locks.is_object().then_some(locks)
+}
+
+/// Method `name` of `obj`.
+fn method(obj: &JsValue, name: &str) -> Option<Function> {
+    Reflect::get(obj, &name.into()).ok()?.dyn_into().ok()
+}
+
+impl WebLocks {
+    /// The page's Web Locks with a first snapshot of them, kept fresh from then on; `None` when
+    /// the browser has none or won't say which are held (heartbeats alone decide then).
+    pub async fn start(prefix: &'static str) -> Option<Self> {
+        let locks = Self { prefix, seen: Arc::new(Mutex::new((f64::NEG_INFINITY, BTreeSet::new()))) };
+        locks.refresh().await?;
+        let again = locks.clone();
+        let tick = Closure::<dyn FnMut()>::new(move || {
+            let locks = again.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                // A failed refresh leaves the snapshot to age, and every area counts as held.
+                let _ = locks.refresh().await;
+            });
+        });
+        web_sys::window()?.set_interval_with_callback_and_timeout_and_arguments_0(tick.as_ref().unchecked_ref(), REFRESH_MS).ok()?;
+        // The timer lives as long as the page.
+        tick.forget();
+        Some(locks)
+    }
+
+    /// Take a new snapshot of the locks held.
+    async fn refresh(&self) -> Option<()> {
+        let m = manager()?;
+        let asked = js_sys::Date::now();
+        let query: Promise = method(&m, "query")?.call0(&m).ok()?.dyn_into().ok()?;
+        let snapshot = wasm_bindgen_futures::JsFuture::from(query).await.ok()?;
+        let held = js_sys::Array::from(&Reflect::get(&snapshot, &"held".into()).ok()?);
+        let areas = held
+            .iter()
+            .filter_map(|l| Reflect::get(&l, &"name".into()).ok()?.as_string())
+            .filter_map(|n| n.strip_prefix(self.prefix).map(str::to_string))
+            .collect();
+        *self.seen.lock().unwrap_or_else(|e| e.into_inner()) = (asked, areas);
+        Some(())
+    }
+
+    /// Does a tab hold `area`'s lock? Yes when the last snapshot is too old to tell.
+    pub fn held(&self, area: &str) -> bool {
+        let seen = self.seen.lock().unwrap_or_else(|e| e.into_inner());
+        js_sys::Date::now() - seen.0 > FRESH_MS || seen.1.contains(area)
+    }
+
+    /// Hold `area`'s lock until the returned hold is dropped (or the page goes).
+    pub fn hold(&self, area: &str) -> Option<Hold> {
+        let m = manager()?;
+        let name = format!("{}{area}", self.prefix);
+        // The lock is held until this promise resolves: when the hold is dropped.
+        let mut release = None;
+        let until = Promise::new(&mut |resolve, _| release = Some(resolve));
+        let release = release?;
+        let granted = Closure::once_into_js(move |_lock: JsValue| until);
+        method(&m, "request")?.call2(&m, &name.clone().into(), &granted).ok()?;
+        RELEASE.with(|r| r.borrow_mut().insert(name.clone(), release));
+        Some(Box::new(LockHold(name)))
+    }
+}
+
+/// A lock this tab holds (by name), released when dropped.
+struct LockHold(String);
+
+impl Drop for LockHold {
+    fn drop(&mut self) {
+        if let Some(resolve) = RELEASE.with(|r| r.borrow_mut().remove(&self.0)) {
+            // Resolving can't fail in a way worth reporting: the lock goes with the page anyway.
+            let _ = resolve.call0(&JsValue::NULL);
+        }
+    }
+}

apps/vectorcraft-web/src/main.rs

@@ -11,8 +11,11 @@
 //! - Save / Export trigger a browser download;
 //! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox.
 //!
-//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
+//! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod locks;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/web.rs

@@ -1,17 +1,22 @@
-//! The browser shell: web `Services`, drag-and-drop, and the eframe web runner.
+//! The browser shell: web `Services`, drag-and-drop, the eframe web runner, and starting again
+//! with new graphics when the page loses them (#369).
 
-use std::cell::Cell;
+use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_engine::cmd::recovery::RecoveryStore;
+use vectorcraft_engine::cmd::recovery::{self, Hold, RecoveryStore};
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
+use vectorcraft_ui_egui::i18n;
 use vectorcraft_ui_egui::place::{DropTarget, PlaceArrival, PlaceInbox};
 use vectorcraft_ui_egui::print::{PrintJob, PrintService, Printer};
 use vectorcraft_ui_egui::{Services, VectorcraftApp};
 use wasm_bindgen::JsCast as _;
 
+use crate::locks::WebLocks;
+
 type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
@@ -21,56 +26,145 @@ type DragPos = Rc<Cell<Option<(f32, f32, bool)>>>;
 const CANVAS_ID: &str = "vectorcraft_canvas";
 const LOADING_ID: &str = "vectorcraft_loading";
 
+/// How many times the page starts again with new graphics after losing them before it gives up
+/// (a GPU that keeps failing).
+const MAX_RESTARTS: u32 = 3;
+
+/// What the page keeps while the app runs, across graphics restarts.
+#[derive(Clone)]
+struct Host {
+    runner: eframe::WebRunner,
+    inbox: Inbox,
+    place_inbox: PlaceInbox,
+    drag: DragPos,
+    /// The page's Web Locks for Data Recovery, started once before the first frame: a graphics
+    /// restart keeps them, so the tab stays the owner of its recovery area.
+    locks: Option<WebLocks>,
+    /// Graphics restarts so far.
+    restarts: u32,
+}
+
 pub fn start() {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
-    wasm_bindgen_futures::spawn_local(async {
-        let Some(document) = web_sys::window().and_then(|w| w.document()) else {
-            log::error!("no document");
-            return;
+    let Some(canvas) = element(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
+        log::error!("missing <canvas id=\"{CANVAS_ID}\">");
+        return;
+    };
+    detect_language();
+    wasm_bindgen_futures::spawn_local(async move {
+        // Before the first frame, which looks for copies a crash left behind.
+        let locks = WebLocks::start(RECOVERY_PREFIX).await;
+        let host = Host {
+            runner: eframe::WebRunner::new(),
+            inbox: Arc::default(),
+            place_inbox: Arc::default(),
+            drag: DragPos::default(),
+            locks,
+            restarts: 0,
         };
-        let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
-            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
-            return;
-        };
-        let drag = track_drag(&canvas);
-        let mut options = eframe::WebOptions::default();
-        if query().contains("webgl")
-            && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
-        {
-            create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
-        }
-        let result = eframe::WebRunner::new()
-            .start(
-                canvas,
-                options,
-                Box::new(move |cc| {
-                    if let Some(rs) = &cc.wgpu_render_state {
-                        log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+        run(host, canvas, None).await;
+    });
+}
+
+/// An app whose graphics were lost, on its way to new ones.
+struct Moving {
+    app: VectorcraftApp,
+    /// Its unsaved changes are kept in recovery copies ([`VectorcraftApp::graphics_lost`]).
+    kept: bool,
+}
+
+/// Run the app on `canvas`: the `moving` one when starting again after losing the graphics, else
+/// a new one.
+async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Moving>) {
+    track_drag(&canvas, &host.drag);
+    let kept = moving.as_ref().map(|m| m.kept);
+    // The app until the new runner takes it (still here if starting fails before).
+    let slot = Rc::new(RefCell::new(moving.map(|m| m.app)));
+    let (runner, taken, page) = (host.runner.clone(), slot.clone(), canvas.clone());
+    let result = runner
+        .start(
+            canvas,
+            web_options(),
+            Box::new(move |cc| {
+                let ctx = &cc.egui_ctx;
+                let loss = GraphicsLoss::default();
+                watch_canvas(&page, &loss, ctx);
+                if let Some(rs) = &cc.wgpu_render_state {
+                    log::info!("vectorcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
+                    let (loss, ctx) = (loss.clone(), ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                let services = services(host.inbox.clone(), host.place_inbox.clone(), ctx.clone(), host.locks.clone());
+                let app = match taken.borrow_mut().take() {
+                    Some(mut app) => {
+                        // The old services asked the old context for frames.
+                        app.services = services;
+                        app.status("The graphics were lost and have been restarted");
+                        app
                     }
-                    let inbox: Inbox = Arc::default();
-                    let place_inbox: PlaceInbox = Arc::default();
-                    let app = VectorcraftApp::new(Session::new(), services(inbox.clone(), place_inbox.clone(), cc.egui_ctx.clone()));
-                    Ok(Box::new(WebShell { app, inbox, place_inbox, drag }))
-                }),
-            )
-            .await;
-        if let Some(el) = document.get_element_by_id(LOADING_ID) {
-            match result {
-                Ok(()) => el.remove(),
-                Err(e) => el.set_inner_html(&format!("<p>VectorCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>")),
+                    None => VectorcraftApp::new(Session::new(), services),
+                };
+                Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
+            }),
+        )
+        .await;
+    match (result, kept) {
+        (Ok(()), _) => {
+            if let Some(el) = element(LOADING_ID) {
+                el.remove();
             }
         }
-    });
+        (Err(e), None) => notice(&[&format!("VectorCraft failed to start: {}", js_err(e)), "A browser with WebGPU or WebGL2 is required."]),
+        (Err(e), Some(kept)) => {
+            log::error!("vectorcraft-web: couldn't restart the graphics: {}", js_err(e));
+            give_up(slot.borrow_mut().take(), kept);
+        }
+    }
+}
+
+/// The runner's options: wgpu (WebGPU where available, else WebGL2; `?webgl` forces WebGL2).
+fn web_options() -> eframe::WebOptions {
+    let mut options = eframe::WebOptions::default();
+    if query().contains("webgl")
+        && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
+    {
+        create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
+    }
+    options
+}
+
+/// Tell the UI the browser's languages (`?lang=es` in the address first, as `VECTORCRAFT_LOCALE`
+/// does on the desktop) before the first frame, so the Automatic interface language follows the
+/// browser; and show the loading text in that language.
+fn detect_language() {
+    let mut tags: Vec<String> = query_param("lang").into_iter().collect();
+    if let Some(navigator) = web_sys::window().map(|w| w.navigator()) {
+        tags.extend(navigator.languages().iter().filter_map(|v| v.as_string()));
+        tags.extend(navigator.language());
+    }
+    i18n::set_system_locales(tags.as_slice());
+    if let Some(el) = element(LOADING_ID) {
+        el.set_text_content(Some(i18n::message(i18n::system_lang(), "Loading VectorCraft…").as_str()));
+    }
+}
+
+/// The value of `name=` in the address's query, if given.
+fn query_param(name: &str) -> Option<String> {
+    let query = query();
+    query.trim_start_matches('?').split('&').find_map(|kv| kv.strip_prefix(name)?.strip_prefix('=').map(str::to_string)).filter(|v| !v.is_empty())
 }
 
 fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
-/// Follow file drags over the canvas: drag events carry the pointer position, which egui doesn't
-/// get during a drag.
-fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
-    let pos = DragPos::default();
+fn element(id: &str) -> Option<web_sys::Element> {
+    web_sys::window()?.document()?.get_element_by_id(id)
+}
+
+/// Follow file drags over `canvas` into `pos`: drag events carry the pointer position, which egui
+/// doesn't get during a drag.
+fn track_drag(canvas: &web_sys::HtmlCanvasElement, pos: &DragPos) {
     let p = pos.clone();
     let on_drag = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::DragEvent)>::new(move |e: web_sys::DragEvent| {
         p.set(Some((e.offset_x() as f32, e.offset_y() as f32, e.shift_key())));
@@ -80,29 +174,123 @@ fn track_drag(canvas: &web_sys::HtmlCanvasElement) -> DragPos {
             log::error!("couldn't follow {kind} events: {e:?}");
         }
     }
-    // The listener lives as long as the page.
+    // The listener lives as long as the canvas.
     on_drag.forget();
-    pos
+}
+
+/// Report the loss of `canvas`'s WebGL context to `loss` (WebGPU devices report theirs through
+/// wgpu).
+fn watch_canvas(canvas: &web_sys::HtmlCanvasElement, loss: &GraphicsLoss, ctx: &egui::Context) {
+    let (loss, ctx) = (loss.clone(), ctx.clone());
+    let on_lost = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::Event)>::new(move |_: web_sys::Event| {
+        loss.report(&ctx, "the WebGL context was lost");
+    });
+    if let Err(e) = canvas.add_event_listener_with_callback("webglcontextlost", on_lost.as_ref().unchecked_ref()) {
+        log::error!("couldn't watch for a lost WebGL context: {e:?}");
+    }
+    // The listener lives as long as the canvas.
+    on_lost.forget();
+}
+
+/// A new canvas in place of `old`, whose graphics were lost (a canvas whose WebGL context is lost
+/// can't get another).
+fn fresh_canvas(old: &web_sys::HtmlCanvasElement) -> Result<web_sys::HtmlCanvasElement, String> {
+    let new: web_sys::HtmlCanvasElement = old.clone_node().map_err(js_err)?.dyn_into().map_err(|_| "not a canvas")?;
+    old.replace_with_with_node_1(&new).map_err(js_err)?;
+    Ok(new)
+}
+
+/// The graphics are lost for good: the dead canvas goes (it would show a stale picture), the app
+/// (if still here) lets go of its recovery copies so the reloaded page offers them at once, and
+/// the page says what to do.
+fn give_up(app: Option<VectorcraftApp>, kept: bool) {
+    if let Some(mut app) = app {
+        recovery::leave(&mut app.session);
+    }
+    if let Some(canvas) = element(CANVAS_ID) {
+        canvas.remove();
+    }
+    notice(&[
+        "The graphics were lost and couldn't be restarted.",
+        if kept {
+            "Your unsaved changes are kept in this browser: reload the page to get them back."
+        } else {
+            "Reload the page to go on (changes not saved yet may be lost)."
+        },
+    ]);
+}
+
+/// Show `lines` in the middle of the page (where the loading message was).
+fn notice(lines: &[&str]) {
+    let Some(document) = web_sys::window().and_then(|w| w.document()) else { return };
+    let el = match document.get_element_by_id(LOADING_ID) {
+        Some(el) => el,
+        None => {
+            let Ok(el) = document.create_element("div") else { return };
+            el.set_id(LOADING_ID);
+            let Some(body) = document.body() else { return };
+            if let Err(e) = body.append_child(&el) {
+                log::error!("couldn't show a message: {e:?}");
+            }
+            el
+        }
+    };
+    el.set_text_content(None);
+    for line in lines {
+        if let Ok(p) = document.create_element("p") {
+            p.set_text_content(Some(i18n::message(i18n::system_lang(), line).as_str()));
+            // Best effort: the log has the message too.
+            el.append_child(&p).ok();
+        }
+    }
 }
 
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
 /// and feed them through the inboxes: placed where they were dropped on the canvas, else opened.
+/// When the graphics are lost it hands the app to a new runner on a new canvas.
 struct WebShell {
-    app: VectorcraftApp,
-    inbox: Inbox,
-    place_inbox: PlaceInbox,
-    drag: DragPos,
+    /// `None` once handed on.
+    app: Option<VectorcraftApp>,
+    host: Host,
+    canvas: web_sys::HtmlCanvasElement,
+    loss: GraphicsLoss,
+}
+
+impl WebShell {
+    /// The graphics were lost (`why`): keep recovery copies, then start again on a new canvas
+    /// with the same app once this frame is over (the runner is busy with it until then).
+    fn restart(&mut self, why: &str) {
+        let Some(mut app) = self.app.take() else { return };
+        let kept = app.graphics_lost(why);
+        let mut host = self.host.clone();
+        host.restarts += 1;
+        let canvas =
+            if host.restarts > MAX_RESTARTS { Err(format!("the graphics were lost {MAX_RESTARTS} times")) } else { fresh_canvas(&self.canvas) };
+        match canvas {
+            Ok(canvas) => wasm_bindgen_futures::spawn_local(run(host, canvas, Some(Moving { app, kept }))),
+            Err(e) => {
+                log::error!("vectorcraft-web: giving up on the graphics: {e}");
+                let runner = host.runner;
+                wasm_bindgen_futures::spawn_local(async move { runner.destroy() });
+                give_up(Some(app), kept);
+            }
+        }
+    }
 }
 
 impl eframe::App for WebShell {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if let Some(why) = self.loss.take() {
+            self.restart(&why);
+        }
+        let Some(app) = &mut self.app else { return };
         let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
         if !dropped.is_empty() {
-            let at = self.drag.take();
+            let at = self.host.drag.take();
             let z = ctx.zoom_factor();
-            let target = self.app.drop_target(at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
+            let target = app.drop_target(at.map(|(x, y, _)| egui::pos2(x / z, y / z)), at.is_some_and(|a| a.2));
             for f in dropped {
-                let (inbox, place_inbox, ctx) = (self.inbox.clone(), self.place_inbox.clone(), ctx.clone());
+                let (inbox, place_inbox, ctx) = (self.host.inbox.clone(), self.host.place_inbox.clone(), ctx.clone());
                 wasm_bindgen_futures::spawn_local(async move {
                     let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
                     match f.bytes_async().await {
@@ -120,19 +308,23 @@ impl eframe::App for WebShell {
                 });
             }
         }
-        self.app.logic(ctx);
+        app.logic(ctx);
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.app.raw_input_hook(raw);
+        if let Some(app) = &mut self.app {
+            app.raw_input_hook(raw);
+        }
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.app.ui(ui);
+        if let Some(app) = &mut self.app {
+            app.ui(ui);
+        }
     }
 }
 
-fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Services {
+fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Option<WebLocks>) -> Services {
     let open_inbox = inbox.clone();
     let picked = place_inbox.clone();
     let place_ctx = ctx.clone();
@@ -174,7 +366,7 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
             }
         })),
         inbox: Some(inbox),
-        recovery_store: Some(Arc::new(BrowserStore)),
+        recovery_store: Some(Arc::new(BrowserStore { locks })),
         // File → Print: the browser's print dialog.
         print: Some(Box::new(BrowserPrint)),
         ..Default::default()
@@ -183,8 +375,12 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context) -> Servic
 
 /// Data Recovery's store on the web: the browser's local storage (kept across visits and shared by
 /// the site's tabs), each entry as base64 under [`RECOVERY_PREFIX`]`<area>/<name>`. It has no
-/// locks: each tab holds its area with a heartbeat, judged by the browser's clock.
-struct BrowserStore;
+/// locks: each tab holds its area with a heartbeat, judged by the browser's clock, and with a Web
+/// Lock named after it where the browser has them (`locks`), which a tab whose timers are paused
+/// in the background keeps.
+struct BrowserStore {
+    locks: Option<WebLocks>,
+}
 
 const RECOVERY_PREFIX: &str = "vectorcraft-recovery/";
 
@@ -220,6 +416,12 @@ impl RecoveryStore for BrowserStore {
     fn now(&self) -> Option<i64> {
         Some((js_sys::Date::now() / 1000.0) as i64)
     }
+    fn announce(&self, area: &str) -> Option<Hold> {
+        self.locks.as_ref()?.hold(area)
+    }
+    fn announced(&self, area: &str) -> Option<bool> {
+        self.locks.as_ref().map(|l| l.held(area))
+    }
 }
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.

apps/vectorcraft/Cargo.toml

@@ -9,17 +9,25 @@ default-run = "vectorcraft"
 [lints]
 workspace = true
 
+[features]
+default = ["wgpu", "accessibility"]
+wgpu = ["eframe/wgpu"]
+accessibility = ["eframe/accesskit"]
+# Build with --no-default-features --features windows7 and the win7 Rust target.
+windows7 = ["eframe/glow"]
+
 [dependencies]
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+# wayland-data-control: native Wayland clipboard (Linux; X11 through XWayland only sees what X11 apps copied).
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
 image = { workspace = true }
 webbrowser = { workspace = true }
 # The window's monitors, size and position (the same winit eframe runs on).

apps/vectorcraft/src/clipboard.rs

@@ -4,11 +4,16 @@
 //! - Windows: text, SVG, PDF, PNG and an opaque bitmap (for apps that don't read PNG) in one go;
 //!   Paste reads each of them.
 //! - macOS and Linux: one format at a time, the text (a type-only copy's text or the SVG markup),
-//!   else the PNG as a bitmap; Paste reads text and bitmaps.
+//!   else the PNG as a bitmap; Paste reads text and bitmaps. On Wayland, arboard's data-control
+//!   backend reads the compositor's clipboard (X11 through XWayland only sees what X11 apps
+//!   copied), falling back to X11 where the compositor lacks the protocol.
+//! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, a
+//!   metafile or a bitmap), before the clipboard's other formats (the files' paths as text).
 
-use std::io::Cursor;
+use std::io::{Cursor, Read};
+use std::path::PathBuf;
 
-use vectorcraft_engine::cmd::clipboard::{BITMAP, Flavour, PNG, TEXT};
+use vectorcraft_engine::cmd::clipboard::{BITMAP, FILE_HEAD, Flavour, PNG, TEXT, file_flavour};
 use vectorcraft_ui_egui::SystemClipboard;
 
 /// This platform's system clipboard.
@@ -29,6 +34,23 @@ fn decode_png(png: &[u8]) -> Option<image::RgbaImage> {
     Some(image::load_from_memory_with_format(png, image::ImageFormat::Png).ok()?.to_rgba8())
 }
 
+/// The first of `paths` (files copied in a file manager) that pastes as one of `mimes`, read
+/// whole. Only its first bytes are read to tell, so other files cost little.
+fn copied_file(paths: Vec<PathBuf>, mimes: &[&'static str]) -> Option<Flavour> {
+    paths.into_iter().find_map(|path| {
+        // text/uri-list lines end in CRLF (RFC 2483), but arboard splits them on LF only.
+        let path = match path.to_str() {
+            Some(p) if p.ends_with('\r') => PathBuf::from(p.trim_end_matches('\r')),
+            _ => path,
+        };
+        let mut head = Vec::with_capacity(FILE_HEAD);
+        std::fs::File::open(&path).ok()?.take(FILE_HEAD as u64).read_to_end(&mut head).ok()?;
+        let mime = file_flavour(&path.to_string_lossy(), &head, mimes)?;
+        let data = std::fs::read(&path).ok()?;
+        (!data.is_empty()).then_some(Flavour { mime, data })
+    })
+}
+
 #[cfg(windows)]
 mod win {
     use std::num::NonZeroU32;
@@ -123,16 +145,26 @@ mod win {
         }
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
-            let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
-            mimes.iter().find_map(|m| read_one(m))
+            let mut files = vec![];
+            {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                // None copied when the clipboard holds no file list.
+                let _ = raw::get_file_list_path(&mut files);
+            }
+            // The files are read with the clipboard closed again, not keeping other apps waiting.
+            copied_file(files, mimes).or_else(|| {
+                let _open = clipboard_win::Clipboard::new_attempts(10).ok()?;
+                mimes.iter().find_map(|m| read_one(m))
+            })
         }
 
         fn has(&mut self, mimes: &[&'static str]) -> bool {
-            mimes.iter().any(|m| match *m {
-                TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
-                BITMAP => raw::is_format_avail(formats::CF_BITMAP) || formats_of(PNG).any(raw::is_format_avail),
-                m => formats_of(m).any(raw::is_format_avail),
-            })
+            raw::is_format_avail(formats::CF_HDROP)
+                || mimes.iter().any(|m| match *m {
+                    TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
+                    BITMAP => raw::is_format_avail(formats::CF_BITMAP) || formats_of(PNG).any(raw::is_format_avail),
+                    m => formats_of(m).any(raw::is_format_avail),
+                })
         }
     }
 
@@ -245,6 +277,9 @@ mod portable {
 
         fn read(&mut self, mimes: &[&'static str]) -> Option<Flavour> {
             let cb = self.cb().ok()?;
+            if let Some(f) = cb.get().file_list().ok().and_then(|paths| copied_file(paths, mimes)) {
+                return Some(f);
+            }
             mimes.iter().find_map(|m| match *m {
                 TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
                 BITMAP => {
@@ -262,3 +297,48 @@ mod portable {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use vectorcraft_engine::cmd::clipboard::{PASTE_ORDER, SVG};
+
+    use super::*;
+
+    fn dir(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("vectorcraft-clipboard-{name}-{}", std::process::id()));
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    fn png(w: u32, h: u32) -> Vec<u8> {
+        let mut out = vec![];
+        image::RgbaImage::new(w, h).write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).unwrap();
+        out
+    }
+
+    #[test]
+    fn the_first_copied_file_that_is_art_pastes() {
+        let d = dir("art");
+        let (notes, red, art) = (d.join("notes.txt"), d.join("red image.png"), d.join("art.svg"));
+        std::fs::write(&notes, "not art").unwrap();
+        std::fs::write(&red, png(3, 2)).unwrap();
+        std::fs::write(&art, "<svg xmlns=\"http://www.w3.org/2000/svg\"/>").unwrap();
+        // Missing files, folders and text are skipped.
+        let f = copied_file(vec![d.join("gone.png"), d.clone(), notes.clone(), red.clone(), art.clone()], &PASTE_ORDER).unwrap();
+        assert_eq!((f.mime, f.data), (PNG, png(3, 2)));
+        assert_eq!(copied_file(vec![art.clone(), red.clone()], &PASTE_ORDER).map(|f| f.mime), Some(SVG));
+        // Only what Paste asks for.
+        assert_eq!(copied_file(vec![art, red.clone()], &[BITMAP]).map(|f| f.mime), Some(PNG));
+        assert!(copied_file(vec![red], &[TEXT]).is_none());
+        assert!(copied_file(vec![notes], &PASTE_ORDER).is_none());
+        assert!(copied_file(vec![], &PASTE_ORDER).is_none());
+    }
+
+    #[test]
+    fn a_crlf_left_by_the_uri_list_is_ignored() {
+        let red = dir("crlf").join("red.png");
+        std::fs::write(&red, png(2, 2)).unwrap();
+        let with_cr = PathBuf::from(format!("{}\r", red.display()));
+        assert_eq!(copied_file(vec![with_cr], &PASTE_ORDER).map(|f| f.mime), Some(PNG));
+    }
+}

apps/vectorcraft/src/main.rs

@@ -7,6 +7,13 @@
 //! See `vectorcraft_ui_egui::control` for the methods.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
+#[cfg(all(feature = "windows7", any(feature = "wgpu", feature = "accessibility")))]
+compile_error!("windows7 requires --no-default-features (wgpu and accessibility must be disabled)");
+#[cfg(all(windows, feature = "windows7", not(target_vendor = "win7")))]
+compile_error!("windows7 requires --target x86_64-win7-windows-msvc; the ordinary Windows target still imports newer APIs");
+#[cfg(all(target_vendor = "win7", not(feature = "windows7")))]
+compile_error!("the win7 target requires --no-default-features --features windows7");
+
 mod clipboard;
 mod control_server;
 #[cfg(target_os = "macos")]
@@ -18,40 +25,69 @@ mod window;
 
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
+use vectorcraft_ui_egui::graphics::GraphicsLoss;
 use vectorcraft_ui_egui::{FilePick, Services, VectorcraftApp};
 
-struct App(VectorcraftApp, #[cfg(target_os = "macos")] Option<native_menu::NativeMenu>);
+struct App {
+    app: VectorcraftApp,
+    /// Reported by wgpu when the window's graphics device is lost (a driver reset).
+    graphics_loss: GraphicsLoss,
+    /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
+    graphics_lost: bool,
+    #[cfg(target_os = "macos")]
+    menu: Option<native_menu::NativeMenu>,
+}
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if let Some(why) = self.graphics_loss.take() {
+            // eframe can't give a window a new device: the user saves and starts again.
+            self.graphics_lost = self.app.graphics_lost(&why);
+            self.app.status(if self.graphics_lost {
+                "The graphics device was lost: unsaved changes are kept for Data Recovery. Save your documents and restart VectorCraft"
+            } else {
+                "The graphics device was lost: save your documents and restart VectorCraft"
+            });
+        }
+        if self.graphics_lost && ctx.input(|i| i.viewport().close_requested()) {
+            // The window can't show the Save Changes question: it closes, and the next launch
+            // offers the changes back.
+            vectorcraft_ui_egui::background::wait_all(&mut self.app);
+            return;
+        }
         #[cfg(target_os = "macos")]
         {
-            if self.1.is_none() && std::env::var_os("VECTORCRAFT_NO_NATIVE_MENU").is_none() {
-                self.1 = Some(native_menu::NativeMenu::install(&mut self.0));
+            if self.menu.is_none() && std::env::var_os("VECTORCRAFT_NO_NATIVE_MENU").is_none() {
+                self.menu = Some(native_menu::NativeMenu::install(&mut self.app));
             }
-            if let Some(m) = &mut self.1 {
-                m.poll(&mut self.0);
+            if let Some(m) = &mut self.menu {
+                m.poll(&mut self.app, ctx);
             }
-            open_files(&mut self.0, open_documents::take());
+            open_files(&mut self.app, open_documents::take());
         }
-        self.0.logic(ctx);
-        window::track(ctx, &mut self.0.ui.window);
-        if self.0.ui.status == "quit" {
+        self.app.logic(ctx);
+        window::track(ctx, &mut self.app.ui.window);
+        if self.app.ui.status == "quit" {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+        self.app.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.0.ui(ui);
+        self.app.ui(ui);
         #[cfg(target_os = "macos")]
-        if self.0.take_ime_discard() {
+        if self.app.take_ime_discard() {
             discard_marked_text();
         }
     }
+    #[cfg(not(feature = "windows7"))]
     fn on_exit(&mut self) {
-        save_prefs(&self.0);
+        save_prefs(&self.app);
+    }
+    #[cfg(feature = "windows7")]
+    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        save_prefs(&self.app);
     }
 }
 
@@ -262,6 +298,7 @@ fn app_icon() -> egui::IconData {
 /// integrated GPU of a hybrid-graphics laptop does easily, while presenting frames rendered on the
 /// discrete GPU through the integrated one made the window flicker on some laptops. With a single
 /// GPU both preferences pick it.
+#[cfg(feature = "wgpu")]
 fn power_preference(pref: Option<&str>, env: Option<eframe::wgpu::PowerPreference>) -> eframe::wgpu::PowerPreference {
     use eframe::wgpu::PowerPreference;
     match (env, pref) {
@@ -272,6 +309,7 @@ fn power_preference(pref: Option<&str>, env: Option<eframe::wgpu::PowerPreferenc
 }
 
 /// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
+#[cfg(feature = "wgpu")]
 fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
     format!("{} ({:?}, {:?})", info.name.trim(), info.backend, info.device_type)
 }
@@ -297,9 +335,11 @@ fn main() -> eframe::Result {
     }
     let saved = read_prefs();
     let saved_window = saved.as_ref().and_then(|ui| ui.window);
+    #[cfg(feature = "wgpu")]
     let gpu_pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("gpuPreference")).and_then(serde_json::Value::as_str);
+    #[cfg(feature = "wgpu")]
     let power = power_preference(gpu_pref, eframe::wgpu::PowerPreference::from_env());
-    let mut options = eframe::NativeOptions {
+    let options = eframe::NativeOptions {
         viewport: egui::ViewportBuilder::default()
             .with_title("VectorCraft")
             .with_inner_size(window::DEFAULT_SIZE)
@@ -311,11 +351,18 @@ fn main() -> eframe::Result {
             .with_title_shown(false)
             .with_icon(app_icon())
             .with_app_id("ai.storyteller.vectorcraft"),
+        #[cfg(feature = "windows7")]
+        renderer: eframe::Renderer::Glow,
         ..Default::default()
     };
-    if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
-        create.power_preference = power;
-    }
+    #[cfg(feature = "wgpu")]
+    let options = {
+        let mut options = options;
+        if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
+            create.power_preference = power;
+        }
+        options
+    };
     // Files opened from Finder and the Dock arrive as events, not arguments.
     #[cfg(target_os = "macos")]
     open_documents::install();
@@ -340,10 +387,18 @@ fn main() -> eframe::Result {
                 let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
                 app.session.recovery.set_default_folder(recovery);
             }
+            let graphics_loss = GraphicsLoss::default();
+            #[cfg(feature = "wgpu")]
             if let Some(rs) = &cc.wgpu_render_state {
                 let summary = adapter_summary(&rs.adapter.get_info());
                 log::info!("vectorcraft: rendering with {summary} (power preference {power:?})");
                 app.graphics_adapter = Some(summary);
+                let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
+                rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+            }
+            #[cfg(feature = "windows7")]
+            {
+                app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
             }
             app.integrated_titlebar = cfg!(target_os = "macos");
             app.custom_titlebar = CUSTOM_TITLEBAR;
@@ -354,16 +409,18 @@ fn main() -> eframe::Result {
             #[cfg(target_os = "macos")]
             open_documents::set_ui(&cc.egui_ctx);
             open_files(&mut app, files);
-            Ok(Box::new(App(
+            Ok(Box::new(App {
                 app,
+                graphics_loss,
+                graphics_lost: false,
                 #[cfg(target_os = "macos")]
-                None,
-            )))
+                menu: None,
+            }))
         }),
     )
 }
 
-#[cfg(test)]
+#[cfg(all(test, feature = "wgpu"))]
 mod tests {
     use super::*;
     use eframe::wgpu::PowerPreference;

apps/vectorcraft/src/native_menu.rs

@@ -33,7 +33,7 @@ pub struct NativeMenu {
 }
 
 /// Accelerator for a shortcut like "Cmd+Shift+]" (modifier-less shortcuts stay in the app so they
-/// don't steal keys from text fields).
+/// don't steal keys from text fields; a focused field still gets Cmd+A/X/C/V, see [`NativeMenu::poll`]).
 fn accel(sc: &str) -> Option<Accelerator> {
     if !(sc.contains("Cmd") || sc.contains("Ctrl") || sc.contains("Alt") || sc.starts_with('F')) {
         return None;
@@ -72,12 +72,13 @@ impl NativeMenu {
         }
     }
 
-    /// Dispatch clicked items and refresh state.
-    pub fn poll(&mut self, app: &mut VectorcraftApp) {
+    /// Dispatch chosen items (a focused text field takes Select All and the clipboard) and refresh
+    /// state.
+    pub fn poll(&mut self, app: &mut VectorcraftApp, ctx: &egui::Context) {
         while let Ok(ev) = MenuEvent::receiver().try_recv() {
             if let Some((cmd, params, _, _)) = self.items.get(ev.id.as_ref()) {
                 let p = if params.is_null() { serde_json::json!({}) } else { params.clone() };
-                menus::invoke(app, cmd, p);
+                menus::invoke_from_system_menu(app, ctx, cmd, p);
             }
         }
         let now = vectorcraft_ui_egui::now_ms();

apps/vectorcraft/src/printing.rs

@@ -156,6 +156,9 @@ mod system {
     }
 
     pub fn printers() -> Vec<Printer> {
+        #[cfg(feature = "windows7")]
+        let script = "Get-WmiObject Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
+        #[cfg(not(feature = "windows7"))]
         let script = "Get-CimInstance Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
         output(&mut powershell(script)).map(|t| windows_printers(&t)).unwrap_or_default()
     }
@@ -174,7 +177,19 @@ mod system {
     }
 
     pub fn setup(_printer: Option<&str>) -> Result<(), String> {
-        Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+        #[cfg(feature = "windows7")]
+        let mut command = {
+            let mut command = Command::new("control.exe");
+            command.arg("printers");
+            command
+        };
+        #[cfg(not(feature = "windows7"))]
+        let mut command = {
+            let mut command = Command::new("explorer");
+            command.arg("ms-settings:printers");
+            command
+        };
+        command.spawn().map(|_| ()).map_err(|e| e.to_string())
     }
 }
 

contributors/contributors.json

@@ -0,0 +1,348 @@
+{
+  "schema": 1,
+  "repo": "storytold/vectorcraft",
+  "branch": "main",
+  "head": "fe9f3afcb7d32032e8f332b0594692a03e275b84",
+  "head_date": "2026-10-08T00:36:16Z",
+  "commits": 607,
+  "unattributed_commits": 0,
+  "contributors": [
+    {
+      "login": "echelon",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 15,
+      "commits": 119,
+      "lines_added": 172276,
+      "lines_deleted": 40329,
+      "binary_added": 37,
+      "binary_deleted": 2,
+      "first_commit": "2026-09-30T09:12:46Z",
+      "last_commit": "2026-10-07T22:04:30Z"
+    },
+    {
+      "login": "bflatastic",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 176,
+      "commits": 394,
+      "lines_added": 212929,
+      "lines_deleted": 24160,
+      "binary_added": 2,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-02T15:22:29Z",
+      "last_commit": "2026-10-08T00:36:16Z"
+    },
+    {
+      "login": "storybored379",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 7,
+      "commits": 7,
+      "lines_added": 456,
+      "lines_deleted": 49,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-04T06:45:57Z",
+      "last_commit": "2026-10-04T08:14:20Z"
+    },
+    {
+      "login": "theironchef",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 38,
+      "commits": 41,
+      "lines_added": 2803,
+      "lines_deleted": 232,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T14:40:20Z",
+      "last_commit": "2026-10-07T22:39:00Z"
+    },
+    {
+      "login": "midasdf",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 2,
+      "lines_added": 579,
+      "lines_deleted": 43,
+      "binary_added": 1,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T16:10:37Z",
+      "last_commit": "2026-10-07T20:53:30Z"
+    },
+    {
+      "login": "japbcoelho",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 57,
+      "lines_deleted": 13,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T01:45:49Z",
+      "last_commit": "2026-10-06T01:45:49Z"
+    },
+    {
+      "login": "p0lyg0n",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 6,
+      "lines_added": 780,
+      "lines_deleted": 69,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T09:22:46Z",
+      "last_commit": "2026-10-07T04:33:45Z"
+    },
+    {
+      "login": "imachus",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 12,
+      "commits": 12,
+      "lines_added": 6302,
+      "lines_deleted": 212,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T10:06:18Z",
+      "last_commit": "2026-10-07T22:20:10Z"
+    },
+    {
+      "login": "petrleocompel",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 784,
+      "lines_deleted": 36,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:23:11Z",
+      "last_commit": "2026-10-06T12:23:11Z"
+    },
+    {
+      "login": "fahrim",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 3,
+      "commits": 6,
+      "lines_added": 1964,
+      "lines_deleted": 76,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T12:48:28Z",
+      "last_commit": "2026-10-07T23:36:17Z"
+    },
+    {
+      "login": "EthanSuquet",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 4,
+      "lines_added": 413,
+      "lines_deleted": 71,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T19:30:49Z",
+      "last_commit": "2026-10-07T14:24:14Z"
+    },
+    {
+      "login": "realwitt",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 607,
+      "lines_deleted": 3,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:12:52Z",
+      "last_commit": "2026-10-07T00:12:52Z"
+    },
+    {
+      "login": "WildfootW",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 6809,
+      "lines_deleted": 2627,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T00:37:02Z",
+      "last_commit": "2026-10-07T00:37:02Z"
+    },
+    {
+      "login": "coygeek",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 4,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:29:03Z",
+      "last_commit": "2026-10-07T02:29:03Z"
+    },
+    {
+      "login": "Luskish",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 261,
+      "lines_deleted": 32,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T02:50:35Z",
+      "last_commit": "2026-10-07T02:50:35Z"
+    },
+    {
+      "login": "daniel-efrat",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 547,
+      "lines_deleted": 43,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T08:13:19Z",
+      "last_commit": "2026-10-07T08:13:19Z"
+    },
+    {
+      "login": "Pengjingyu1992",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 3132,
+      "lines_deleted": 4,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T09:56:23Z",
+      "last_commit": "2026-10-07T09:56:23Z"
+    },
+    {
+      "login": "MillhioreBT",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 564,
+      "lines_deleted": 41,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T12:58:33Z",
+      "last_commit": "2026-10-07T12:58:33Z"
+    },
+    {
+      "login": "fabian-co",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 270,
+      "lines_deleted": 48,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:05:26Z",
+      "last_commit": "2026-10-07T19:32:11Z"
+    },
+    {
+      "login": "Haven-King",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 467,
+      "lines_deleted": 76,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T18:10:39Z",
+      "last_commit": "2026-10-07T18:40:49Z"
+    },
+    {
+      "login": "njmueller",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 619,
+      "lines_deleted": 11,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:14:42Z",
+      "last_commit": "2026-10-07T21:14:42Z"
+    },
+    {
+      "login": "RicSchonfelder",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2592,
+      "lines_deleted": 9,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T21:44:42Z",
+      "last_commit": "2026-10-07T21:44:42Z"
+    },
+    {
+      "login": "DWAA1660",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 76,
+      "lines_deleted": 21,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T23:09:37Z",
+      "last_commit": "2026-10-07T23:09:37Z"
+    }
+  ],
+  "models": [
+    {
+      "id": "anthropic/claude-opus/5.5",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "5.5",
+      "commits": 567,
+      "lines_added": 382239,
+      "lines_deleted": 67174
+    },
+    {
+      "id": "anthropic/claude-sonnet/5.5",
+      "company": "Anthropic",
+      "model": "Claude Sonnet",
+      "version": "5.5",
+      "commits": 6,
+      "lines_added": 660,
+      "lines_deleted": 34
+    },
+    {
+      "id": "anthropic/claude-opus/4.8",
+      "company": "Anthropic",
+      "model": "Claude Opus",
+      "version": "4.8",
+      "commits": 3,
+      "lines_added": 1672,
+      "lines_deleted": 42
+    },
+    {
+      "id": "anthropic/claude-fable/5.1",
+      "company": "Anthropic",
+      "model": "Claude Fable",
+      "version": "5.1",
+      "commits": 1,
+      "lines_added": 6809,
+      "lines_deleted": 2627
+    }
+  ]
+}

contributors/people.toml

@@ -0,0 +1,23 @@
+# Contributor names for the About window (craftrules standards/contributors.md).
+#
+# Everyone who contributes is credited by GitHub username automatically. Anything more is up to
+# you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
+# maintainer may add a person only when that person asked, recording where in consent_source.
+#
+# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
+#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
+#
+# Or copy this block, replacing your-github-username (every field is optional):
+#
+#   [people.your-github-username]
+#   real_name = "Your Name"        # shown when the viewer picks "Real name"
+#   display_name = "Nickname"      # shown when the viewer picks "Display name"
+#   sync_github_name = true        # or: use the name on your public GitHub profile as display name
+#
+# To remove your names, delete your entry (or set fields empty) in a PR. The next
+# contributors.py run, and the next build, drop them.
+
+[people.echelon]
+real_name = "Brandon Thomas"
+display_name = "Brandon Thomas"
+sync_github_name = false

crates/color/src/cms/mod.rs

@@ -662,6 +662,60 @@ impl ProofLut {
     }
 }
 
+/// A 17⁴ CMYK → four values lookup table with quadrilinear interpolation: ink amounts to a
+/// colour (XYZ, RGB, or CMYK in another space).
+pub struct CmykLut {
+    data: Vec<[f32; 4]>,
+}
+
+impl CmykLut {
+    pub fn build(f: impl Fn([f32; 4]) -> [f32; 4]) -> Self {
+        let s = (LUT_N - 1) as f32;
+        let mut data = Vec::with_capacity(LUT_N.pow(4));
+        for c in 0..LUT_N {
+            for m in 0..LUT_N {
+                for y in 0..LUT_N {
+                    for k in 0..LUT_N {
+                        data.push(f([c, m, y, k].map(|i| i as f32 / s)));
+                    }
+                }
+            }
+        }
+        Self { data }
+    }
+
+    pub fn apply(&self, inks: [f32; 4]) -> [f32; 4] {
+        const STRIDE: [usize; 4] = [LUT_N * LUT_N * LUT_N, LUT_N * LUT_N, LUT_N, 1];
+        let p = inks.map(|v| v.clamp(0.0, 1.0) * (LUT_N - 1) as f32);
+        let i = p.map(|v| (v as usize).min(LUT_N - 2));
+        let base: usize = (0..4).map(|d| i[d] * STRIDE[d]).sum();
+        let mut out = [0.0f32; 4];
+        for corner in 0..16 {
+            let (mut w, mut at) = (1.0f32, base);
+            for d in 0..4 {
+                let t = p[d] - i[d] as f32;
+                if corner >> d & 1 == 1 {
+                    w *= t;
+                    at += STRIDE[d];
+                } else {
+                    w *= 1.0 - t;
+                }
+            }
+            if w > 0.0 {
+                for (o, v) in out.iter_mut().zip(self.data[at]) {
+                    *o += w * v;
+                }
+            }
+        }
+        out
+    }
+
+    /// [`Self::apply`] to 8-bit ink amounts, for 8-bit values.
+    pub fn apply8(&self, inks: [u8; 4]) -> [u8; 4] {
+        self.apply(inks.map(|v| v as f32 / 255.0)).map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8)
+    }
+}
+
 // ---------- the active (process-wide) settings ----------
 
 static ACTIVE: RwLock<Option<Arc<Cms>>> = RwLock::new(None);

crates/doc/Cargo.toml

@@ -13,9 +13,12 @@ vectorcraft-geom = { workspace = true }
 vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
+tiff = { workspace = true }
+zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+jpeg-encoder = { workspace = true }
 proptest = { workspace = true }

crates/doc/src/cmyk.rs

@@ -0,0 +1,188 @@
+//! CMYK images: the ink amounts of image blobs that hold CMYK samples.
+//!
+//! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
+//! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
+//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
+//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+
+use std::io::Cursor;
+
+use zune_jpeg::zune_core::bytestream::ZCursor;
+use zune_jpeg::zune_core::colorspace::ColorSpace;
+use zune_jpeg::zune_core::options::DecoderOptions;
+
+use crate::ImageBlob;
+
+/// Most pixels a CMYK image is decoded with (256 MB of samples): larger ones decode as RGB.
+pub const MAX_CMYK_PIXELS: u64 = 1 << 26;
+
+/// The ink amounts of a CMYK image: C, M, Y and K bytes per pixel, 0 is no ink.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Inks {
+    pub width: u32,
+    pub height: u32,
+    pub data: Vec<u8>,
+}
+
+impl Inks {
+    /// `data` as a `width` × `height` image; `None` when it doesn't hold that many pixels, the
+    /// image is empty or it has more than [`MAX_CMYK_PIXELS`].
+    pub fn new(width: u32, height: u32, data: Vec<u8>) -> Option<Self> {
+        let n = pixels(width, height)?;
+        (data.len() as u64 == n * 4).then_some(Self { width, height, data })
+    }
+}
+
+/// `width` × `height` when it is a CMYK image's size: not empty, at most [`MAX_CMYK_PIXELS`].
+fn pixels(width: u32, height: u32) -> Option<u64> {
+    let n = width as u64 * height as u64;
+    (n > 0 && n <= MAX_CMYK_PIXELS).then_some(n)
+}
+
+/// The number of colour components of JPEG `bytes` (its frame header); `None` when they aren't a
+/// JPEG.
+pub fn jpeg_components(bytes: &[u8]) -> Option<usize> {
+    if !bytes.starts_with(&[0xFF, 0xD8]) {
+        return None;
+    }
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    Some(d.info()?.components as usize)
+}
+
+fn is_tiff(bytes: &[u8]) -> bool {
+    bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
+}
+
+/// The colour type of TIFF `bytes` and its decoder.
+fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
+    if !is_tiff(bytes) {
+        return None;
+    }
+    let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
+    Some((d.colortype().ok()?, d))
+}
+
+impl ImageBlob {
+    /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
+    pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
+        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        let mut out = Cursor::new(Vec::new());
+        TiffEncoder::new(&mut out)
+            .ok()?
+            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
+            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
+            .ok()?;
+        Some(Self::new("image/tiff", out.into_inner()))
+    }
+
+    /// Does the image hold CMYK samples (a four-component JPEG or a CMYK TIFF)? Reads only its
+    /// header.
+    pub fn is_cmyk(&self) -> bool {
+        jpeg_components(&self.bytes) == Some(4) || tiff(&self.bytes).is_some_and(|(t, _)| matches!(t, tiff::ColorType::CMYK(8 | 16)))
+    }
+
+    /// The ink amounts of a CMYK image; `None` for other images, and ones that can't be decoded
+    /// or are larger than [`MAX_CMYK_PIXELS`].
+    pub fn cmyk(&self) -> Option<Inks> {
+        let bytes = self.bytes.as_slice();
+        if bytes.starts_with(&[0xFF, 0xD8]) { jpeg_inks(bytes) } else { tiff_inks(bytes) }
+    }
+}
+
+/// The ink amounts of a four-component JPEG (its samples inverted back; YCCK converted to CMYK
+/// first, as JPEG readers do).
+fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
+    let mut d = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), DecoderOptions::default());
+    d.decode_headers().ok()?;
+    let space = d.input_colorspace()?;
+    if d.info()?.components != 4 || !matches!(space, ColorSpace::CMYK | ColorSpace::YCCK) {
+        return None;
+    }
+    let (w, h) = d.dimensions()?;
+    let (w, h) = (u32::try_from(w).ok()?, u32::try_from(h).ok()?);
+    pixels(w, h)?;
+    d.set_options(DecoderOptions::default().jpeg_set_out_colorspace(space));
+    let mut data = d.decode().ok()?;
+    for p in data.as_chunks_mut::<4>().0 {
+        if space == ColorSpace::YCCK {
+            let [y, cb, cr] = [p[0], p[1], p[2]].map(f32::from);
+            // libjpeg's YCCK → CMYK: the complement of the YCbCr colour's RGB.
+            p[0] = (434.456 - y - 1.402 * cr).clamp(0.0, 255.0) as u8;
+            p[1] = (119.541 - y + 0.344 * cb + 0.714 * cr).clamp(0.0, 255.0) as u8;
+            p[2] = (481.816 - y - 1.772 * cb).clamp(0.0, 255.0) as u8;
+        }
+        for v in p.iter_mut() {
+            *v = 255 - *v;
+        }
+    }
+    Inks::new(w, h, data)
+}
+
+/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
+    let (kind, mut d) = tiff(bytes)?;
+    let (w, h) = d.dimensions().ok()?;
+    // Planar samples (one plane per ink) would read as interleaved.
+    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+        return None;
+    }
+    let data = match d.read_image().ok()? {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    Inks::new(w, h, data)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn inks() -> Inks {
+        Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
+    }
+
+    #[test]
+    fn a_cmyk_tiff_keeps_its_ink_amounts_and_shows_as_rgb() {
+        let b = ImageBlob::cmyk_tiff(&inks()).unwrap();
+        assert_eq!(b.mime, "image/tiff");
+        assert!(b.is_cmyk());
+        assert_eq!(b.cmyk(), Some(inks()), "lossless");
+        // Every image reader sees an RGB image: cyan is (0, 255, 255).
+        let rgb = image::load_from_memory(&b.bytes).unwrap().to_rgb8();
+        assert_eq!(rgb.get_pixel(1, 0).0, [0, 255, 255]);
+    }
+
+    #[test]
+    fn a_cmyk_jpeg_reads_back_as_ink_amounts() {
+        // A flat CMYK JPEG: Adobe's inverted samples with its marker.
+        let flat = [10u8, 40, 100, 20];
+        let px: Vec<u8> = (0..16 * 16).flat_map(|_| flat).collect();
+        let mut jpg = Vec::new();
+        jpeg_encoder::Encoder::new(&mut jpg, 100).encode(&px, 16, 16, jpeg_encoder::ColorType::Cmyk).unwrap();
+        let b = ImageBlob::new("image/jpeg", jpg);
+        assert_eq!(jpeg_components(&b.bytes), Some(4));
+        assert!(b.is_cmyk());
+        let back = b.cmyk().unwrap();
+        assert_eq!((back.width, back.height), (16, 16));
+        for p in back.data.as_chunks::<4>().0 {
+            assert!(p.iter().zip(flat).all(|(a, b)| a.abs_diff(b) <= 2), "{p:?}");
+        }
+    }
+
+    #[test]
+    fn other_images_are_not_cmyk() {
+        let mut png = Vec::new();
+        image::RgbaImage::new(2, 2).write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        let mut jpg = Vec::new();
+        image::RgbImage::new(8, 8).write_to(&mut Cursor::new(&mut jpg), image::ImageFormat::Jpeg).unwrap();
+        for b in [ImageBlob::png(png), ImageBlob::new("image/jpeg", jpg), ImageBlob::new("image/tiff", b"II*\0junk".to_vec())] {
+            assert!(!b.is_cmyk() && b.cmyk().is_none(), "{}", b.mime);
+        }
+        assert_eq!(Inks::new(2, 2, vec![0; 15]), None, "too few samples");
+        assert_eq!(Inks::new(0, 2, vec![]), None, "empty");
+        assert_eq!(Inks::new(1 << 14, 1 << 13, vec![]), None, "too large");
+    }
+}

crates/doc/src/hit.rs

@@ -60,6 +60,25 @@ impl Default for HitOptions {
 
 /// Topmost editable object under `p`.
 pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
+    hit_test_skipping(doc, p, opt, &|_| false)
+}
+
+/// The objects under `p` that [`Hit::top_object`] picks in `scope` (isolation mode), topmost
+/// first: what clicks there select, one below the other (Cmd/Ctrl-click selects behind).
+pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
+    let mut tops: Vec<NodeId> = vec![];
+    // Each round leaves out the objects found so far (and everything inside them).
+    while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id)).map(|h| h.top_object(scope)) {
+        if tops.contains(&top) {
+            break;
+        }
+        tops.push(top);
+    }
+    tops
+}
+
+/// [`hit_test`] passing over the nodes `skip` names (and their contents).
+fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool) -> Option<Hit> {
     let mut chain = Vec::new();
     for layer in doc.layers.iter().rev() {
         if !layer.visible || layer.locked {
@@ -74,7 +93,7 @@ pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
         }
         chain.push(layer.id);
         let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
-        if let Some(mut h) = hit_children(layer, p, opt, &mut chain) {
+        if let Some(mut h) = hit_children(layer, p, opt, skip, &mut chain) {
             h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
             h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
             return Some(h);
@@ -99,7 +118,7 @@ fn clip_contains(clip: &Node, p: Point) -> bool {
     clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
 }
 
-fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId>) -> Option<Hit> {
+fn hit_children(parent: &Node, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, chain: &mut Vec<NodeId>) -> Option<Hit> {
     let children = parent.children()?;
     // A clip group (or a layer with a clipping mask) only hits inside its clipping path.
     if parent.clips()
@@ -110,7 +129,7 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
     }
     for c in children.iter().rev() {
         // Hidden, locked and template sublayers block clicks like top-level layers do.
-        if !c.visible || c.locked || c.is_template() {
+        if !c.visible || c.locked || c.is_template() || skip(c.id) {
             continue;
         }
         // (An envelope's content sits where it was, not where the envelope draws it.)
@@ -123,13 +142,13 @@ fn hit_children(parent: &Node, p: Point, opt: HitOptions, chain: &mut Vec<NodeId
         chain.push(c.id);
         let hit = match &c.kind {
             // A sublayer whose Preview is off is clicked in outline, like an outline view.
-            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, chain),
-            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, chain),
+            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain),
+            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain),
             // Edit Contents: the envelope's content hits, undistorted.
-            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, chain),
+            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain),
             // A blend's key objects first (Direct and Group Selection pick them); its steps hit
             // as the blend.
-            NodeKind::Blend { .. } => hit_children(c, p, opt, chain)
+            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain)
                 .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
             _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
         };
@@ -169,7 +188,7 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
             if let Some(k) = hit_stroke(n, &bp, *rule, p, opt) {
                 return Some(k);
             }
-            (!opt.outline && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
+            (!opt.outline && !opt.path_only && fill_contains(&bp, *rule, p)).then_some(HitKind::Fill)
         }
         NodeKind::Text(_) | NodeKind::Image(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
             n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
@@ -366,6 +385,46 @@ mod tests {
         assert!(hit_test(&d, Point::new(0.5, 25.0), HitOptions::default()).is_some());
     }
 
+    /// Object Selection by Path Only: a filled path or compound path hits on its outline only.
+    #[test]
+    fn path_only_leaves_out_fills() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let (a, c) = (d.alloc_id(), d.alloc_id());
+        d.insert(Some(l), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+        let inner = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default());
+        let mut compound = Node::new(c, NodeKind::Compound { children: vec![Arc::new(inner)], rule: vectorcraft_geom::FillRule::NonZero });
+        compound.appearance = Appearance::default_art();
+        d.insert(Some(l), 9, compound).unwrap();
+        let path_only = HitOptions { path_only: true, ..Default::default() };
+        for (id, inside, edge) in [(a, Point::new(25.0, 25.0), Point::new(0.5, 25.0)), (c, Point::new(125.0, 25.0), Point::new(100.5, 25.0))] {
+            assert_eq!(hit_test(&d, inside, HitOptions::default()).map(|h| h.leaf), Some(id), "the fill hits");
+            assert!(hit_test(&d, inside, path_only).is_none(), "path only: the fill of {id:?} doesn't hit");
+            assert_eq!(hit_test(&d, edge, path_only).map(|h| h.leaf), Some(id), "path only: the outline does");
+        }
+    }
+
+    /// `objects_at`: every object under the point, topmost first; a group counts once.
+    #[test]
+    fn objects_at_lists_the_stack() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let rect =
+            |d: &mut Document, x: f64| Node::path(d.alloc_id(), shapes::rectangle(Rect::new(x, 0.0, x + 50.0, 50.0)), Appearance::default_art());
+        let a = rect(&mut d, 0.0);
+        let (b, c) = (rect(&mut d, 10.0), rect(&mut d, 20.0));
+        let (a_id, b_id, c_id, g) = (a.id, b.id, c.id, d.alloc_id());
+        d.insert(Some(l), 0, a).unwrap();
+        d.insert(Some(l), 9, Node::group(g, vec![Arc::new(b), Arc::new(c)])).unwrap();
+        let far = rect(&mut d, 120.0);
+        d.insert(Some(l), 9, far).unwrap();
+        let at = |x: f64, scope| objects_at(&d, Point::new(x, 25.0), HitOptions::default(), scope);
+        assert_eq!(at(30.0, None), vec![g, a_id]);
+        assert_eq!(at(30.0, Some(g))[..2], [c_id, b_id], "isolated: the group's own objects");
+        assert_eq!(at(5.0, None), vec![a_id]);
+        assert!(at(90.0, None).is_empty());
+    }
+
     #[test]
     fn locked_and_hidden_skip() {
         let mut d = Document::new(200.0, 200.0);

crates/doc/src/lib.rs

@@ -9,6 +9,7 @@ pub mod appearance;
 pub mod assets;
 pub mod blend;
 pub mod clipnest;
+pub mod cmyk;
 pub mod graph;
 pub mod hit;
 pub mod inks;
@@ -77,8 +78,8 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaOptions, CharPosition, CharStyle, FirstBaseline, Justify, Mojikumi, ParaDirection, ParaStyle, PathEffect, ScriptMetrics, TabAlign, TabStop,
-    TextKind, TextObject, TextRun, TextStyleDef, TextWrap, WrapShape,
+    AreaOptions, CharAlign, CharPosition, CharStyle, FirstBaseline, Justify, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect,
+    ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, WrapShape,
 };
 pub use vectorcraft_color as color;
 pub use vectorcraft_geom as geom;
@@ -166,6 +167,18 @@ impl Unit {
             Unit::Feet => "Feet",
         }
     }
+    /// The rulers' label step at `zoom` (screen pixels per point), in this unit: the first of
+    /// 1, 2, 5 × 10ⁿ that puts labels at least 50 pixels apart. Ticks mark every tenth of it.
+    pub fn ruler_step(self, zoom: f64) -> f64 {
+        const STEPS: [f64; 19] =
+            [0.01, 0.02, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0, 50.0, 100.0, 200.0, 500.0, 1000.0, 2000.0, 5000.0, 10000.0];
+        STEPS.iter().copied().find(|s| s * self.points() * zoom >= 50.0).unwrap_or(10000.0)
+    }
+    /// `v` (points) on the nearest ruler tick at `zoom` ([`Self::ruler_step`]).
+    pub fn snap_to_ruler_tick(self, v: f64, zoom: f64) -> f64 {
+        let tick = self.ruler_step(zoom) / 10.0 * self.points();
+        (v / tick).round() * tick
+    }
     pub fn from_pt(self, v: f64) -> f64 {
         v / self.points()
     }
@@ -178,7 +191,10 @@ impl Unit {
     }
     /// [`Unit::format`] without the suffix (`12.5`), for narrow fields.
     pub fn number(self, pt: f64) -> String {
-        let s = format!("{:.3}", self.from_pt(pt));
+        // Three decimals for the small units (`595.276 pt`), four for the large ones (`8.2677 in`,
+        // `35.2778 mm`, the `0.0078 in` stroke preset); trailing zeros are trimmed (`1 pt` is `1`).
+        let decimals = if matches!(self, Unit::Points | Unit::Pixels | Unit::Picas) { 3 } else { 4 };
+        let s = format!("{:.*}", decimals, self.from_pt(pt));
         let s = s.trim_end_matches('0').trim_end_matches('.');
         if s == "-0" { "0".into() } else { s.into() }
     }
@@ -901,16 +917,15 @@ impl Document {
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
         self.artboards.iter().rposition(|a| a.rect.contains(p))
     }
-    /// The art that moves with an artboard at `rect`: unlocked top-level objects (children of
-    /// unlocked layers and sublayers) lying entirely inside it.
-    pub fn art_on_artboard(&self, rect: Rect) -> Vec<NodeId> {
-        fn collect(n: &Node, rect: Rect, out: &mut Vec<NodeId>) {
-            for c in n.children().into_iter().flatten() {
-                if c.locked {
-                    continue;
-                }
+    /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
+    /// sublayers) lying entirely inside it. Locked and hidden objects and layers stay put unless
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn art_on_artboard(&self, rect: Rect, locked_and_hidden: bool) -> Vec<NodeId> {
+        fn collect(n: &Node, rect: Rect, all: bool, out: &mut Vec<NodeId>) {
+            for c in n.children().into_iter().flatten().filter(|c| c.rides_with_artboard(all)) {
                 if c.is_layer() {
-                    collect(c, rect, out);
+                    collect(c, rect, all, out);
                 } else if let Some(b) = c.geometric_bounds()
                     && rect.contains(Point::new(b.x0, b.y0))
                     && rect.contains(Point::new(b.x1, b.y1))
@@ -920,8 +935,8 @@ impl Document {
             }
         }
         let mut art = vec![];
-        for l in self.layers.iter().filter(|l| !l.locked) {
-            collect(l, rect, &mut art);
+        for l in self.layers.iter().filter(|l| l.rides_with_artboard(locked_and_hidden)) {
+            collect(l, rect, locked_and_hidden, &mut art);
         }
         art
     }
@@ -1075,12 +1090,18 @@ mod tests {
     #[test]
     fn art_on_artboard_takes_unlocked_objects_wholly_inside() {
         let (mut d, a, b) = doc_with_rects();
-        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 15.0, 15.0)), vec![a]);
-        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 25.0, 15.0)), vec![a], "b only half inside");
+        let wide = Rect::new(-1.0, -1.0, 40.0, 15.0);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 15.0, 15.0), false), vec![a]);
+        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 25.0, 15.0), false), vec![a], "b only half inside");
         d.node_mut(a).unwrap().locked = true;
-        assert_eq!(d.art_on_artboard(Rect::new(-1.0, -1.0, 40.0, 15.0)), vec![b]);
+        assert_eq!(d.art_on_artboard(wide, false), vec![b]);
+        // Move Locked and Hidden Artwork with Artboard (#394): hidden art stays too, unless on.
+        d.node_mut(b).unwrap().visible = false;
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b]);
         Arc::make_mut(&mut d.layers[0]).locked = true;
-        assert!(d.art_on_artboard(Rect::new(-1.0, -1.0, 40.0, 15.0)).is_empty());
+        assert!(d.art_on_artboard(wide, false).is_empty());
+        assert_eq!(d.art_on_artboard(wide, true), vec![a, b], "a locked layer's art too");
     }
 
     #[test]

crates/doc/src/node.rs

@@ -1,14 +1,17 @@
 //! Document nodes.
 
+use std::collections::BTreeSet;
 use std::sync::Arc;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::BlendMode;
-use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect, shapes};
+use vectorcraft_geom::shapes::{self, CornerKind};
+use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
 
 use crate::appearance::Appearance;
 use crate::live::{BlendSpec, EnvelopeKind, GradientMesh, Outliner};
 use crate::pattern::RepeatSpec;
+use crate::selection::AnchorRef;
 use crate::text::TextObject;
 
 /// Stable per-document object id. Never reused.
@@ -82,6 +85,9 @@ pub enum LiveShape {
         /// Corner radii: top-left, top-right, bottom-right, bottom-left. In the same units as
         /// `w`/`h`: the corners are circular arcs in the document whenever `xf` doesn't scale.
         radii: [f64; 4],
+        /// Corner kinds, in the same order (Live Corners' corner types).
+        #[serde(default, skip_serializing_if = "all_round")]
+        kinds: [CornerKind; 4],
         /// Maps the untransformed shape (origin at its top-left) into the document. A rotation
         /// or reflection plus a move, unless a shear (or a file saved before transforms folded
         /// their scale into `w`/`h`) put more in it.
@@ -118,15 +124,8 @@ impl LiveShape {
     /// Regenerate the path.
     pub fn to_path(&self) -> PathData {
         match self {
-            LiveShape::Rectangle { w, h, radii, xf } => {
-                let r = Rect::new(0.0, 0.0, *w, *h);
-                let p = if radii.iter().all(|x| (x - radii[0]).abs() < 1e-9) {
-                    shapes::rounded_rectangle(r, radii[0])
-                } else {
-                    // Per-corner radii: generate uniformly then adjust (approximation until M2.5).
-                    shapes::rounded_rectangle(r, radii.iter().cloned().fold(0.0, f64::max))
-                };
-                p.transformed(*xf)
+            LiveShape::Rectangle { w, h, radii, kinds, xf } => {
+                shapes::rectangle_with_corners(Rect::new(0.0, 0.0, *w, *h), *radii, *kinds).transformed(*xf)
             }
             LiveShape::Ellipse { w, h, xf, .. } => shapes::ellipse(Rect::new(0.0, 0.0, *w, *h)).transformed(*xf),
             LiveShape::Polygon { radius, sides, xf } => shapes::polygon(Point::ZERO, *radius, *sides, 0.0).transformed(*xf),
@@ -144,24 +143,11 @@ impl LiveShape {
     /// scale in `xf` keep their exact geometry until they're next transformed).
     pub fn transform(&mut self, a: Affine) -> bool {
         match self {
-            LiveShape::Rectangle { w, h, radii, xf } => {
-                let m = a * *xf;
+            LiveShape::Rectangle { xf, .. } => {
+                *xf = a * *xf;
                 let [a0, a1, a2, a3, _, _] = a.as_coeffs();
                 let moves_only = (a0 - 1.0).abs() < 1e-12 && a1.abs() < 1e-12 && a2.abs() < 1e-12 && (a3 - 1.0).abs() < 1e-12;
-                let [m0, m1, m2, m3, m4, m5] = m.as_coeffs();
-                let (sx, sy) = (m0.hypot(m1), m2.hypot(m3));
-                let orthogonal = sx > 1e-12 && sy > 1e-12 && (m0 * m2 + m1 * m3).abs() <= 1e-9 * sx * sy;
-                let finite = m.as_coeffs().iter().all(|c| c.is_finite()) && w.is_finite() && h.is_finite();
-                if moves_only || !orthogonal || !finite {
-                    *xf = m;
-                    return false;
-                }
-                let k = (sx * sy).sqrt();
-                radii.iter_mut().for_each(|r| *r *= k);
-                *w *= sx;
-                *h *= sy;
-                *xf = Affine::new([m0 / sx, m1 / sx, m2 / sy, m3 / sy, m4, m5]);
-                true
+                !moves_only && self.fold_scale()
             }
             LiveShape::Ellipse { xf, .. } | LiveShape::Polygon { xf, .. } => {
                 *xf = a * *xf;
@@ -174,6 +160,35 @@ impl LiveShape {
             }
         }
     }
+    /// Move the scale of a rectangle's `xf` into `w`/`h` (and its radii, by the mean scale), so
+    /// `xf` keeps only a rotation or reflection plus a move and the corners are circular in the
+    /// document. False (and nothing changes) when there is no scale to move, when `xf` shears or
+    /// isn't finite, and for other shapes. Files saved before transforms did this (#291) carry an
+    /// uneven scale in `xf`: their corners are elliptical until this runs.
+    pub fn fold_scale(&mut self) -> bool {
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = self else { return false };
+        let [m0, m1, m2, m3, m4, m5] = xf.as_coeffs();
+        let (sx, sy) = (m0.hypot(m1), m2.hypot(m3));
+        let orthogonal = sx > 1e-12 && sy > 1e-12 && (m0 * m2 + m1 * m3).abs() <= 1e-9 * sx * sy;
+        let finite = xf.as_coeffs().iter().all(|c| c.is_finite()) && w.is_finite() && h.is_finite();
+        let unscaled = (sx - 1.0).abs() < 1e-12 && (sy - 1.0).abs() < 1e-12;
+        if !orthogonal || !finite || unscaled {
+            return false;
+        }
+        let k = (sx * sy).sqrt();
+        radii.iter_mut().for_each(|r| *r *= k);
+        *w *= sx;
+        *h *= sy;
+        *xf = Affine::new([m0 / sx, m1 / sx, m2 / sy, m3 / sy, m4, m5]);
+        true
+    }
+    /// This shape with [`LiveShape::fold_scale`] applied: a rectangle's size and radii in document
+    /// units (what Live Corners show and edit).
+    pub fn folded(&self) -> Self {
+        let mut s = self.clone();
+        s.fold_scale();
+        s
+    }
     /// Divide live corner radii by `k`, the mean scale of a transform just applied, so the corners
     /// keep their size (Scale Corners off). False when nothing changed.
     pub fn keep_corners(&mut self, k: f64) -> bool {
@@ -185,6 +200,45 @@ impl LiveShape {
             _ => false,
         }
     }
+    /// The corner (radii order) of each anchor of a rectangle's path; empty for other shapes.
+    pub fn anchor_corners(&self) -> Vec<usize> {
+        match self {
+            LiveShape::Rectangle { w, h, radii, .. } => shapes::rectangle_anchor_corners(Rect::new(0.0, 0.0, *w, *h), *radii),
+            _ => vec![],
+        }
+    }
+    /// The corners of a rectangle that hold one of `anchors` (of its only subpath).
+    pub fn corners_of(&self, anchors: &BTreeSet<AnchorRef>) -> [bool; 4] {
+        let map = self.anchor_corners();
+        let mut out = [false; 4];
+        for k in anchors.iter().filter(|(si, _)| *si == 0).filter_map(|(_, ai)| map.get(*ai)) {
+            if let Some(c) = out.get_mut(*k) {
+                *c = true;
+            }
+        }
+        out
+    }
+    /// The corners Live Corners edit for a selection: those holding a selected anchor when the
+    /// shape is partly selected (Direct Selection), else all four.
+    pub fn picked_corners(&self, partial: Option<&BTreeSet<AnchorRef>>) -> [bool; 4] {
+        let picked = partial.map_or([true; 4], |a| self.corners_of(a));
+        if picked.contains(&true) { picked } else { [true; 4] }
+    }
+    /// The anchors of a rectangle's `corners` (to keep them selected as its path changes).
+    pub fn corner_anchors(&self, corners: [bool; 4]) -> BTreeSet<AnchorRef> {
+        self.anchor_corners().into_iter().enumerate().filter(|(_, k)| corners.get(*k) == Some(&true)).map(|(ai, _)| (0, ai)).collect()
+    }
+    /// The radius (in document units, see [`LiveShape::folded`]) and kind the `corners` of a
+    /// rectangle share (each `None` when they differ).
+    pub fn corner_style(&self, corners: [bool; 4]) -> (Option<f64>, Option<CornerKind>) {
+        let LiveShape::Rectangle { radii, kinds, .. } = self.folded() else { return (None, None) };
+        fn shared<T: Copy>(v: [T; 4], corners: [bool; 4], same: impl Fn(T, T) -> bool) -> Option<T> {
+            let mut it = v.into_iter().zip(corners).filter(|(_, on)| *on).map(|(x, _)| x);
+            let first = it.next()?;
+            it.all(|x| same(x, first)).then_some(first)
+        }
+        (shared(radii, corners, |a, b| (a - b).abs() < 1e-9), shared(kinds, corners, |a, b| a == b))
+    }
     /// Rotation angle of the live shape in degrees (shown in the Properties panel).
     pub fn angle_deg(&self) -> f64 {
         match self {
@@ -197,6 +251,10 @@ impl LiveShape {
     }
 }
 
+fn all_round(kinds: &[CornerKind; 4]) -> bool {
+    kinds.iter().all(|k| *k == CornerKind::Round)
+}
+
 /// What a transform scales besides geometry, by its mean scale (the square root of its
 /// determinant). `Scaling::default()` (and `false`) scales nothing else; `true` scales stroke
 /// weights and dashes only. Transforms the user asks for take theirs from Scale Strokes & Effects
@@ -211,6 +269,9 @@ pub struct Scaling {
     pub keep_type_strokes: bool,
     /// Live corner radii keep their size.
     pub keep_corners: bool,
+    /// Pattern fills and strokes move with the art (Transform Patterns; General › Transform
+    /// Pattern Tiles is its default): their tiles transform too, instead of staying put.
+    pub patterns: bool,
 }
 
 impl Scaling {
@@ -485,6 +546,12 @@ impl Node {
             _ => None,
         }
     }
+    /// Does this object or layer move with its artboard? Locked and hidden ones only with
+    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
+    /// Artboard).
+    pub fn rides_with_artboard(&self, locked_and_hidden: bool) -> bool {
+        locked_and_hidden || (!self.locked && self.visible)
+    }
     pub fn is_layer(&self) -> bool {
         matches!(self.kind, NodeKind::Layer { .. })
     }
@@ -680,6 +747,9 @@ impl Node {
             }
         }
         self.appearance.transform_gradients(a);
+        if sc.patterns {
+            crate::pattern::transform_pattern_paints(self, a);
+        }
         match &mut self.kind {
             NodeKind::Path { path, live, .. } => {
                 path.transform(a);
@@ -1200,14 +1270,44 @@ mod tests {
 
     #[test]
     fn rect_live_shape_roundtrip() {
-        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], xf: Affine::translate((5.0, 5.0)) };
+        let l = LiveShape::Rectangle { w: 10.0, h: 20.0, radii: [0.0; 4], kinds: Default::default(), xf: Affine::translate((5.0, 5.0)) };
         assert_eq!(l.to_path().bounds(), Some(Rect::new(5.0, 5.0, 15.0, 25.0)));
         assert_eq!(l.label(), "Rectangle");
     }
 
+    #[test]
+    fn rectangle_corners_map_to_their_anchors() {
+        let mut l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
+        // Anchors: top-left, the top-right corner's two, bottom-right, bottom-left.
+        assert_eq!(l.anchor_corners(), [0, 1, 1, 2, 3]);
+        assert_eq!(l.to_path().anchor_count(), 5);
+        let set = |v: &[usize]| v.iter().map(|ai| (0, *ai)).collect::<BTreeSet<AnchorRef>>();
+        assert_eq!(l.corners_of(&set(&[2, 4])), [false, true, false, true]);
+        assert_eq!(l.corners_of(&set(&[9])), [false; 4], "out of range");
+        assert_eq!(l.corner_anchors([false, true, false, true]), set(&[1, 2, 4]));
+        // Partly selected: the corners of the selected anchors; wholly (or no anchor): all four.
+        assert_eq!(l.picked_corners(Some(&set(&[0]))), [true, false, false, false]);
+        assert_eq!(l.picked_corners(None), [true; 4]);
+        assert_eq!(l.picked_corners(Some(&set(&[]))), [true; 4]);
+        assert_eq!(l.corner_style([false, true, false, false]), (Some(10.0), Some(CornerKind::Round)));
+        assert_eq!(l.corner_style([true, true, false, false]), (None, Some(CornerKind::Round)));
+        assert_eq!(l.corner_style([true, false, true, true]), (Some(0.0), Some(CornerKind::Round)));
+        // Corner kinds save only when some corner isn't round, and older files read as round.
+        let json = serde_json::to_value(&l).unwrap();
+        assert!(json.get("kinds").is_none(), "{json}");
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        if let LiveShape::Rectangle { kinds, .. } = &mut l {
+            kinds[1] = CornerKind::Chamfer;
+        }
+        let json = serde_json::to_value(&l).unwrap();
+        assert_eq!(json["kinds"], serde_json::json!(["round", "chamfer", "round", "round"]));
+        assert_eq!(serde_json::from_value::<LiveShape>(json).unwrap(), l);
+        assert!(LiveShape::Ellipse { w: 1.0, h: 1.0, pie: (0.0, 360.0), xf: Affine::IDENTITY }.anchor_corners().is_empty());
+    }
+
     /// A node holding a live rectangle (`w` × `h`, all radii `r`, placed by `xf`) and its path.
     fn live_rect(w: f64, h: f64, r: f64, xf: Affine) -> Node {
-        let live = LiveShape::Rectangle { w, h, radii: [r; 4], xf };
+        let live = LiveShape::Rectangle { w, h, radii: [r; 4], kinds: Default::default(), xf };
         let mut n = Node::path(NodeId(1), live.to_path(), Appearance::default_art());
         if let NodeKind::Path { live: slot, .. } = &mut n.kind {
             *slot = Some(live);
@@ -1216,7 +1316,7 @@ mod tests {
     }
 
     fn live_of(n: &Node) -> (f64, f64, [f64; 4], Affine) {
-        let NodeKind::Path { live: Some(LiveShape::Rectangle { w, h, radii, xf }), .. } = &n.kind else { panic!("not a live rectangle") };
+        let NodeKind::Path { live: Some(LiveShape::Rectangle { w, h, radii, xf, .. }), .. } = &n.kind else { panic!("not a live rectangle") };
         (*w, *h, *radii, *xf)
     }
 
@@ -1247,7 +1347,7 @@ mod tests {
         }
     }
 
-    const KEEP_CORNERS: Scaling = Scaling { strokes: false, effects: None, keep_type_strokes: false, keep_corners: true };
+    const KEEP_CORNERS: Scaling = Scaling { strokes: false, effects: None, keep_type_strokes: false, keep_corners: true, patterns: false };
 
     #[test]
     fn uneven_scales_keep_live_corners_circular() {
@@ -1312,6 +1412,33 @@ mod tests {
         assert_round_corners(&n, Affine::IDENTITY, 20.0 * 2f64.sqrt() * 2.0);
     }
 
+    /// A rectangle saved with an uneven scale in `xf` (before #291) has elliptical corners; Live
+    /// Corners see and edit it in document units, with circular corners (#442).
+    #[test]
+    fn a_scale_left_in_the_transform_folds_into_the_size() {
+        let legacy = Affine::translate((5.0, 5.0)) * Affine::scale_non_uniform(4.0, 1.0);
+        let n = live_rect(50.0, 80.0, 20.0, legacy);
+        let NodeKind::Path { live: Some(live), .. } = &n.kind else { panic!("not live") };
+        let folded = live.folded();
+        assert_eq!(live_of(&n).3, legacy, "folded() leaves the shape alone");
+        let LiveShape::Rectangle { w, h, radii, xf, .. } = &folded else { panic!("not a rectangle") };
+        // Drawn 200 × 80 with 80 × 20 corners; folded, the corners are circles of the mean radius.
+        assert!(near(*w, 200.0) && near(*h, 80.0) && radii.iter().all(|r| near(*r, 40.0)), "{w} × {h} r {radii:?}");
+        assert!(near_xf(*xf, Affine::translate((5.0, 5.0))));
+        let (a, b) = (folded.to_path().bounds().unwrap(), live.to_path().bounds().unwrap());
+        assert!(near(a.x0, b.x0) && near(a.y0, b.y0) && near(a.x1, b.x1) && near(a.y1, b.y1), "same place and size: {a:?} {b:?}");
+        assert_eq!(live.corner_style([true; 4]).0, Some(40.0), "the radius in document units");
+        // Nothing to fold: a moved, rotated or reflected rectangle and a sheared one stay as they are.
+        let place = Affine::translate((5.0, 5.0)) * Affine::rotate(0.5) * Affine::scale_non_uniform(-1.0, 1.0);
+        let shear = Affine::new([1.0, 0.0, 0.5, 1.0, 0.0, 0.0]);
+        for xf in [place, shear] {
+            let mut l = live_rect(100.0, 160.0, 20.0, xf);
+            let NodeKind::Path { live: Some(live), .. } = &mut l.kind else { panic!("not live") };
+            assert!(!live.fold_scale());
+            assert_eq!(live_of(&l), (100.0, 160.0, [20.0; 4], xf));
+        }
+    }
+
     #[test]
     fn default_transparency() {
         let p = || Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());

crates/doc/src/selection.rs

@@ -1,4 +1,4 @@
-//! Selection state (objects and, for direct selection, individual anchors).
+//! Selection state (objects and, for direct selection, individual anchors; ruler guides).
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -29,12 +29,20 @@ pub struct Selection {
     /// clears them.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub slices: Vec<NodeId>,
+    /// Ruler guides selected with a selection tool, as indexes into [`Document::guides`]. They are
+    /// selected on their own: any change to the object selection clears them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub guides: Vec<usize>,
 }
 
 impl Selection {
     pub fn is_empty(&self) -> bool {
         self.objects.is_empty()
     }
+    /// Is anything selected that Delete and the arrow keys act on: objects or ruler guides?
+    pub fn has_objects_or_guides(&self) -> bool {
+        !self.objects.is_empty() || !self.guides.is_empty()
+    }
     pub fn len(&self) -> usize {
         self.objects.len()
     }
@@ -47,6 +55,7 @@ impl Selection {
         self.key = None;
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
     }
     pub fn set(&mut self, ids: impl IntoIterator<Item = NodeId>) {
         self.clear();
@@ -57,6 +66,7 @@ impl Selection {
     pub fn add(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         if !self.objects.contains(&id) {
             self.objects.push(id);
         }
@@ -64,6 +74,7 @@ impl Selection {
     pub fn remove(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.guides.clear();
         self.objects.retain(|x| *x != id);
         self.anchors.remove(&id);
         if self.key == Some(id) {
@@ -79,6 +90,15 @@ impl Selection {
             }
         }
     }
+    /// Select ruler guides `indexes` (see [`Selection::guides`]) and nothing else.
+    pub fn set_guides(&mut self, indexes: impl IntoIterator<Item = usize>) {
+        self.clear();
+        for i in indexes {
+            if !self.guides.contains(&i) {
+                self.guides.push(i);
+            }
+        }
+    }
     pub fn toggle(&mut self, id: NodeId) {
         if self.contains(id) { self.remove(id) } else { self.add(id) }
     }
@@ -97,6 +117,7 @@ impl Selection {
             self.target = None;
         }
         self.slices.retain(|id| doc.is_slice(*id));
+        self.guides.retain(|i| *i < doc.guides.len());
     }
     /// Target `id` (see [`Selection::target`]): a layer gets its visible, unlocked art selected
     /// (the art of its sublayers too), anything else is selected itself.
@@ -138,6 +159,23 @@ mod tests {
         assert!(s.is_empty());
     }
 
+    #[test]
+    fn guides_are_selected_on_their_own() {
+        let mut s = Selection::default();
+        s.add(NodeId(1));
+        s.set_guides([2, 0, 2]);
+        assert_eq!((s.objects.clone(), s.guides.clone()), (vec![], vec![2, 0]));
+        assert!(s.has_objects_or_guides() && s.is_empty());
+        s.add(NodeId(1));
+        assert!(s.guides.is_empty());
+        // Pruning drops guides the document no longer has.
+        let mut d = Document::new(100.0, 100.0);
+        d.guides.push(crate::Guide { vertical: true, pos: 10.0 });
+        s.set_guides([0, 1]);
+        s.prune(&d);
+        assert_eq!(s.guides, vec![0]);
+    }
+
     #[test]
     fn selection_changes_clear_the_target() {
         let mut s = Selection::default();

crates/doc/src/tests_units.rs

@@ -60,6 +60,9 @@ fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");
     assert_eq!(Unit::Millimeters.readout(72.0), "25.40 mm");
     assert_eq!(Unit::Inches.readout(-36.0), "-0.50 in");
-    assert_eq!(Unit::Millimeters.number(1.0), "0.353");
-    assert_eq!(Unit::Points.number(-0.0001), "0");
+    assert_eq!(Unit::Millimeters.number(1.0), "0.3528");
+    // Four decimals for the large units, three for the small ones.
+    assert_eq!(Unit::Inches.number(0.5616), "0.0078");
+    assert_eq!((Unit::Inches.number(595.2756), Unit::Points.number(595.2756)), ("8.2677".into(), "595.276".into()));
+    assert_eq!(Unit::Points.number(-0.00001), "0");
 }

crates/doc/src/text.rs

@@ -86,6 +86,23 @@ pub struct CharStyle {
     /// size (Document Setup → Type → Small Caps); None = off.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub small_caps: Option<f64>,
+    /// Character Alignment (Character panel menu): where characters smaller than the largest on
+    /// their line line up with it.
+    #[serde(default, rename = "charAlign", skip_serializing_if = "crate::skip::is_default")]
+    pub char_align: CharAlign,
+}
+
+/// Where a character smaller than the largest on its line lines up with it: on the Roman
+/// baseline, or at the top (right, in vertical type), centre or bottom (left) of the ideographic
+/// em boxes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum CharAlign {
+    #[default]
+    RomanBaseline,
+    EmBoxTop,
+    EmBoxCenter,
+    EmBoxBottom,
 }
 
 /// Superscript or subscript proportions in percent of the font size (Document Setup → Type).
@@ -178,6 +195,7 @@ impl Default for CharStyle {
             stroke_miter_limit: 10.0,
             stroke_dash: None,
             position: CharPosition::Normal,
+            char_align: CharAlign::RomanBaseline,
             small_caps: None,
         }
     }
@@ -293,6 +311,9 @@ pub struct ParaStyle {
     /// bidirectional text (UAX #9). None: from each paragraph's first strong character (Hebrew or
     /// Arabic: right to left).
     pub direction: Option<ParaDirection>,
+    /// How leading is measured (Paragraph panel menu): from baseline to baseline, or from the top
+    /// of one line's ideographic em box to the next.
+    pub leading_model: LeadingModel,
 }
 
 /// [`ParaStyle`] as saved. [`Justify::Auto`] is written as the alignment it has in the paragraph
@@ -324,6 +345,8 @@ struct ParaStyleFile {
     mojikumi: Mojikumi,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     direction: Option<ParaDirection>,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    leading_model: LeadingModel,
 }
 
 impl From<ParaStyle> for ParaStyleFile {
@@ -345,6 +368,7 @@ impl From<ParaStyle> for ParaStyleFile {
             style_name,
             mojikumi,
             direction,
+            leading_model,
             ..
         } = p;
         Self {
@@ -360,6 +384,7 @@ impl From<ParaStyle> for ParaStyleFile {
             style_name,
             mojikumi,
             direction,
+            leading_model,
         }
     }
 }
@@ -378,9 +403,23 @@ impl From<ParaStyleFile> for ParaStyle {
             style_name,
             mojikumi,
             direction,
+            leading_model,
             ..
         } = f;
-        Self { justify, left_indent, right_indent, first_line_indent, space_before, space_after, hyphenate, tabs, style_name, mojikumi, direction }
+        Self {
+            justify,
+            left_indent,
+            right_indent,
+            first_line_indent,
+            space_before,
+            space_after,
+            hyphenate,
+            tabs,
+            style_name,
+            mojikumi,
+            direction,
+            leading_model,
+        }
     }
 }
 
@@ -392,6 +431,20 @@ pub enum ParaDirection {
     RightToLeft,
 }
 
+/// How a paragraph's leading is measured.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum LeadingModel {
+    /// From one line's baseline to the next's: a line's leading is the space above it, and area
+    /// type's first baseline follows Area Type Options › First Baseline.
+    #[default]
+    RomanBaseline,
+    /// From the top of one line's ideographic em box (the right side, in vertical type) to the
+    /// next's: a line's leading is the space below it, and area type's first line touches the top
+    /// of the frame. Japanese layout's usual model.
+    EmBoxTop,
+}
+
 /// How Japanese punctuation is spaced (JLREQ 3.1). Full-width punctuation is half a glyph and half
 /// a space: an opening bracket's space before it, a closing bracket's, a comma's or a full stop's
 /// after it.
@@ -486,6 +539,36 @@ impl PathEffect {
     }
 }
 
+/// Type on a Path Options › Align to Path: which height of the type runs along the path.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum PathAlign {
+    /// The font's top edge: the type hangs below the path.
+    Ascender,
+    /// The font's bottom edge: the type stands above the path.
+    Descender,
+    /// Halfway between the ascender and the descender.
+    Center,
+    /// The baseline (the default).
+    #[default]
+    Baseline,
+}
+
+impl PathAlign {
+    pub const ALL: [PathAlign; 4] = [PathAlign::Ascender, PathAlign::Descender, PathAlign::Center, PathAlign::Baseline];
+    pub fn id(self) -> &'static str {
+        match self {
+            PathAlign::Ascender => "ascender",
+            PathAlign::Descender => "descender",
+            PathAlign::Center => "center",
+            PathAlign::Baseline => "baseline",
+        }
+    }
+    pub fn parse(s: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|a| a.id().eq_ignore_ascii_case(s.trim()))
+    }
+}
+
 /// Area Type Options: rows and columns, gutters, inset and first baseline of area type.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -530,8 +613,48 @@ pub enum TextKind {
     Point,
     /// Area type flowed inside `frame` (document coordinates, untransformed by `xf`).
     Area { frame: PathData },
-    /// Type on a path, starting at `start` (0..1 of the path length).
-    OnPath { path: PathData, start: f64 },
+    /// Type on a path, flowing from its start bracket `start` to its end bracket `end` (0..1 of the
+    /// path length; no `end`: the end of the path, or once round a closed path). See
+    /// [`TextKind::path_span`].
+    OnPath {
+        path: PathData,
+        start: f64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        end: Option<f64>,
+    },
+}
+
+impl TextKind {
+    /// Type on a path's span: from its start to its end bracket, as fractions of its path's length.
+    /// Round a closed path the end may be past 1 (the span runs on past the path's start), a full
+    /// turn without an end or with the end at the start. None for other type.
+    pub fn path_span(&self) -> Option<(f64, f64)> {
+        let TextKind::OnPath { path, start, end } = self else { return None };
+        let s = fraction(*start);
+        Some(if path.is_closed() {
+            let run = end.map_or(0.0, |e| (fraction(e) - s).rem_euclid(1.0));
+            (s, s + if run < 1e-9 { 1.0 } else { run })
+        } else {
+            (s, end.map_or(1.0, |e| fraction(e).max(s)))
+        })
+    }
+}
+
+/// `x` as a fraction of a path's length (0..1; 0 when not finite).
+fn fraction(x: f64) -> f64 {
+    if x.is_finite() { x.clamp(0.0, 1.0) } else { 0.0 }
+}
+
+/// `path` run the other way, each point as far from its new start as it was from its old end
+/// (the subpaths in reverse order, a closed one keeping its first anchor first).
+fn reverse_from_end(path: &mut PathData) {
+    path.subpaths.reverse();
+    for sp in &mut path.subpaths {
+        sp.reverse();
+        if sp.closed && !sp.anchors.is_empty() {
+            sp.anchors.rotate_right(1);
+        }
+    }
 }
 
 /// A text object. `runs` split into paragraphs at `\n`.
@@ -552,6 +675,14 @@ pub struct TextObject {
     /// Type on a Path effect (type on a path only).
     #[serde(default, rename = "pathEffect", skip_serializing_if = "crate::skip::is_default")]
     pub path_effect: PathEffect,
+    /// Type on a Path Options › Align to Path (type on a path only).
+    #[serde(default, rename = "pathAlign", skip_serializing_if = "crate::skip::is_default")]
+    pub path_align: PathAlign,
+    /// Type on a Path Options › Spacing in points (type on a path only): glyphs are spaced as if
+    /// set this far above the path, which closes them up round the outside of a curve and opens
+    /// them up round the inside.
+    #[serde(default, rename = "pathSpacing", skip_serializing_if = "crate::skip::is_default")]
+    pub path_spacing: f64,
     /// Wrap objects above this area type, resolved by the engine after each edit (text space).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub wrap: Vec<WrapShape>,
@@ -570,6 +701,8 @@ impl TextObject {
             para: ParaStyle::default(),
             area: AreaOptions::default(),
             path_effect: PathEffect::default(),
+            path_align: PathAlign::default(),
+            path_spacing: 0.0,
             wrap: Vec::new(),
             cached_bounds: None,
         }
@@ -599,6 +732,29 @@ impl TextObject {
     pub fn transform(&mut self, a: Affine) {
         self.xf = a * self.xf;
     }
+    /// Type on a path's path in document space; None for other type.
+    pub fn type_path(&self) -> Option<PathData> {
+        match &self.kind {
+            TextKind::OnPath { path, .. } => Some(path.transformed(self.xf)),
+            _ => None,
+        }
+    }
+    /// Flip type on a path to the other side of its path (Type on a Path Options › Flip, or its
+    /// centre bracket dragged across the path): the path runs the other way and the brackets swap
+    /// ends, so the type keeps its stretch of the path. False, changing nothing, for other type.
+    pub fn flip_on_path(&mut self) -> bool {
+        let Some((s, e)) = self.kind.path_span() else { return false };
+        let TextKind::OnPath { path, start, end } = &mut self.kind else { return false };
+        reverse_from_end(path);
+        if path.is_closed() {
+            *start = (1.0 - e).rem_euclid(1.0);
+            *end = (e - s < 1.0 - 1e-9).then(|| (1.0 - s).rem_euclid(1.0));
+        } else {
+            *start = 1.0 - e;
+            *end = (s > 1e-9).then_some(1.0 - s);
+        }
+        true
+    }
     /// Area type's frame (the type area) in document space; None for other type.
     pub fn area_frame(&self) -> Option<PathData> {
         match &self.kind {

crates/engine/src/cmd/buildcmds.rs

@@ -16,10 +16,11 @@ use serde_json::{Value, json};
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::appearance::{AppearanceItem, FillLayer, StrokeLayer};
 use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind, Selection};
-use vectorcraft_geom::{FillRule, Point, Rect, Shape as _};
+use vectorcraft_geom::{FillRule, PathData, Point, Rect, SubPath};
 use vectorcraft_pathops as po;
 use vectorcraft_tools::builder::{
-    self as b, EDGE_NAME, FACE_NAME, LIVE_PAINT_NAME, SOURCES_NAME, edge_near, face_at, is_live_paint, sample_polyline, shapes_for, sorted_roots,
+    self as b, BuilderMap, EDGE_NAME, FACE_NAME, LIVE_PAINT_NAME, SOURCES_NAME, Touched, edge_near, face_at, is_live_paint, sample_polyline,
+    sorted_roots,
 };
 use vectorcraft_trace as tr;
 
@@ -38,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shape Builder",
             [],
             None,
-            "{ids?: [id…] (default: selection), points: [[x,y]…] (drag path; one point = click), erase?: bool (Alt-drag deletes the regions), fill?: \"#rrggbb\" | {color|swatch|gradient|none} (default: the fill of the object under the first point)} → {ids, merged, regions}",
+            "{ids?: [id…] (default: selection), points: [[x,y]…] (drag path; one point = click), erase?: bool (erase mode, Alt: deletes the regions touched, and the pieces of unfilled open paths and the edges (outline pieces between the points where paths meet; see shapeBuilder.regions) within tolerance; a deleted edge opens its path there, and edges bounding a deleted region go with it), tolerance?: pt (2, erase only), fill?: \"#rrggbb\" | {color|swatch|gradient|none} (default: the fill of the object under the first point; the current fill for an area only lines enclose)} → {ids, merged, regions, lines, edges} (counts deleted or merged)",
             has_selection_or_ids,
             sb_merge
         ),
@@ -47,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shape Builder Regions",
             [],
             None,
-            "{ids?} → {regions: [{bounds: [x0,y0,x1,y1], area, sources: [id…]}]} faces of the planar arrangement",
+            "{ids?} → {regions: [{bounds: [x0,y0,x1,y1], area, sources: [id…]}], lines: [{bounds, source: id}], edges: [{bounds, source: id}]} faces of the planar arrangement (unfilled open paths cut them; sources is empty for an area only they enclose), the pieces of those open paths and the edges (the other paths' outlines cut where paths meet; source: the front-most path along it), which erasing deletes",
             has_selection_or_ids,
             sb_regions
         ),
@@ -224,47 +225,80 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "points must be a non-empty list of finite [x,y]"));
     }
     let erase = bool_or(p, "erase", false);
+    // Line pieces and edges are only deleted (erase mode), never merged.
+    let piece_tol = erase.then(|| f64_or(p, "tolerance", 2.0).clamp(0.0, 1000.0));
     let fill = fill_param(s, p, C)?;
+    let current_fill = s.paint.fill.clone();
     let roots = root_ids(s, p)?;
     let label = if erase { "Shape Builder Delete" } else { "Shape Builder" };
-    let (ids, merged, count) = s.edit(label, |d, sel| {
-        let (shapes, leaves) = shapes_for(d, &roots);
+    let (ids, merged, touched) = s.edit(label, |d, sel| {
+        let (map, leaves) = BuilderMap::new(d, &roots, erase);
         let leaves: Vec<Node> = leaves.into_iter().cloned().collect();
-        if shapes.is_empty() {
+        if map.shapes.is_empty() {
             return Err(EngineError::Other("Shape Builder: select paths or compound paths".into()));
         }
-        let regs = po::regions(&shapes);
-        let shapes_r: Vec<(kurbo::BezPath, Rect)> = regs.iter().map(|r| (r.path.to_bezpath(), r.path.bounds().unwrap_or(Rect::ZERO))).collect();
         let step = (d.bounds_of(&roots, false).map(|r| r.width().max(r.height())).unwrap_or(100.0) / 2000.0).max(0.25);
-        let mut touched: Vec<usize> = vec![];
+        let mut touched = Touched::default();
         for q in sample_polyline(&pts, step) {
-            if let Some(i) = shapes_r.iter().position(|(bp, bb)| bb.contains(q) && bp.winding(q) != 0)
-                && !touched.contains(&i)
-            {
-                touched.push(i);
-            }
+            touched.add(map.hit(q, piece_tol));
         }
+        touched.edges = map.erased_edges(&touched);
         if touched.is_empty() {
             return Err(EngineError::Other("Shape Builder: no region under the pointer".into()));
         }
-        let picked: Vec<&po::Region> = touched.iter().map(|&i| &regs[i]).collect();
-        let union = po::merge_regions(&picked);
-        let affected: Vec<bool> = (0..shapes.len()).map(|i| picked.iter().any(|r| r.sources.contains(&i))).collect();
-        let style_src = regs[touched[0]].top();
+        let cuts: Vec<&SubPath> = touched.edges.iter().filter_map(|&k| map.edges.get(k)?.0.path.subpaths.first()).collect();
+        // Edges come back from the planar map within a few hundredths of the outlines they follow.
+        let cut_tol = step * 0.2;
+        let picked: Vec<&po::Region> = touched.regions.iter().filter_map(|&i| map.regions.get(i).map(|r| &r.0)).collect();
+        let union = if picked.is_empty() { PathData::default() } else { po::merge_regions(&picked) };
+        // The merged shape takes the look of the front-most object over the first region, or (for an
+        // area only lines enclose) of the front-most object and the current fill.
+        let covered = picked.iter().find_map(|r| r.top());
+        let style_src = covered.or(map.shapes.len().checked_sub(1));
+        let merged_fill = fill.or_else(|| covered.is_none().then_some(current_fill));
         let mut new_nodes: Vec<Node> = vec![];
         let mut merged_id = None;
-        for (i, (sh, leaf)) in shapes.iter().zip(&leaves).enumerate() {
-            if !affected[i] {
-                new_nodes.push(d.reid(leaf));
+        for (i, (sh, leaf)) in map.shapes.iter().zip(&leaves).enumerate() {
+            let pieces: Vec<usize> = map.lines.iter().enumerate().filter(|(_, (l, _))| l.key == i as u64).map(|(k, _)| k).collect();
+            if !pieces.is_empty() {
+                // An open path loses the pieces deleted and those between merged (or deleted) regions.
+                let keep: Vec<usize> =
+                    pieces.iter().copied().filter(|k| !touched.lines.contains(k) && !map.line_between(*k, &touched.regions)).collect();
+                if keep.len() == pieces.len() {
+                    new_nodes.push(d.reid(leaf));
+                } else {
+                    for k in keep {
+                        if let Some((l, _)) = map.lines.get(k) {
+                            new_nodes.push(shape_node(d, l.path.clone(), Some(leaf)));
+                        }
+                    }
+                }
             } else {
-                let rest = po::boolean(&sh.path, sh.rule, &union, FillRule::NonZero, po::BoolOp::Difference);
-                if !rest.is_empty() {
+                // A shape loses the regions deleted or merged, then the edges deleted (each one on
+                // its outline, shared edges from every shape along them).
+                let in_union = picked.iter().any(|r| r.sources.contains(&i));
+                let mut rest = if in_union {
+                    po::boolean(&sh.path, sh.rule, &union, FillRule::NonZero, po::BoolOp::Difference)
+                } else {
+                    b::node_outline(leaf).map_or_else(|| sh.path.clone(), |o| o.0)
+                };
+                let fill_closes = !leaf.appearance.fill_paint().is_none();
+                let mut cut = false;
+                for piece in &cuts {
+                    if let Some(r) = po::cut_out(&rest, piece, fill_closes, cut_tol) {
+                        rest = r;
+                        cut = true;
+                    }
+                }
+                if !in_union && !cut {
+                    new_nodes.push(d.reid(leaf));
+                } else if !rest.is_empty() {
                     new_nodes.push(shape_node(d, rest, Some(leaf)));
                 }
             }
-            if !erase && Some(i) == style_src {
+            if !erase && !union.is_empty() && Some(i) == style_src {
                 let mut m = shape_node(d, union.clone(), Some(leaf));
-                if let Some(f) = &fill {
+                if let Some(f) = &merged_fill {
                     m.appearance.set_fill(f.clone());
                 }
                 merged_id = Some(m.id);
@@ -273,9 +307,15 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
         }
         let new_ids = replace_roots(d, &roots, new_nodes)?;
         sel.set(new_ids.iter().copied());
-        Ok((new_ids, merged_id, touched.len()))
+        Ok((new_ids, merged_id, touched))
     })?;
-    Ok(json!({ "ids": ids_json(&ids), "merged": merged.map(|m| m.0), "regions": count }))
+    Ok(json!({
+        "ids": ids_json(&ids),
+        "merged": merged.map(|m| m.0),
+        "regions": touched.regions.len(),
+        "lines": touched.lines.len(),
+        "edges": touched.edges.len(),
+    }))
 }
 
 /// Remove the roots and insert `nodes` where the front-most root was. Returns the new ids.
@@ -300,20 +340,23 @@ fn replace_roots(d: &mut Document, roots: &[NodeId], nodes: Vec<Node>) -> Result
 fn sb_regions(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = root_ids(s, p)?;
     let d = &s.doc()?.doc;
-    let (shapes, leaves) = shapes_for(d, &roots);
-    let regs = po::regions(&shapes);
-    let out: Vec<Value> = regs
+    let (map, leaves) = BuilderMap::new(d, &roots, true);
+    let id_of = |i: usize| leaves.get(i).map(|n| n.id.0);
+    let regions: Vec<Value> = map
+        .regions
         .iter()
-        .filter_map(|r| {
-            let bb = r.path.bounds()?;
-            Some(json!({
+        .map(|(r, _, bb)| {
+            json!({
                 "bounds": [bb.x0, bb.y0, bb.x1, bb.y1],
                 "area": po::area(&r.path, FillRule::NonZero),
-                "sources": r.sources.iter().map(|&i| leaves[i].id.0).collect::<Vec<_>>(),
-            }))
+                "sources": r.sources.iter().filter_map(|&i| id_of(i)).collect::<Vec<_>>(),
+            })
         })
         .collect();
-    Ok(json!({ "regions": out }))
+    let pieces = |list: &[(po::Shape, Rect)]| -> Vec<Value> {
+        list.iter().map(|(l, bb)| json!({ "bounds": [bb.x0, bb.y0, bb.x1, bb.y1], "source": id_of(l.key as usize) })).collect()
+    };
+    Ok(json!({ "regions": regions, "lines": pieces(&map.lines), "edges": pieces(&map.edges) }))
 }
 
 // ---------- Live Paint ----------

crates/engine/src/cmd/clipboard.rs

@@ -21,7 +21,7 @@ use vectorcraft_color::Swatch;
 use vectorcraft_doc::{Document, GraphicStyle, ImageBlob, Node, NodeId, PatternDef, Symbol, TextStyleDef};
 use vectorcraft_geom::Rect;
 
-pub use flavours::{BITMAP, EMF, Flavour, PASTE_ORDER, PDF, PNG, SVG, TEXT};
+pub use flavours::{BITMAP, EMF, FILE_HEAD, Flavour, PASTE_ORDER, PDF, PNG, SVG, TEXT, file_flavour};
 pub(crate) use resources::SwatchChoices;
 
 use super::*;

crates/engine/src/cmd/clipboard/flavours.rs

@@ -30,6 +30,23 @@ pub const EMF: &str = "image/emf";
 /// What Paste reads from other apps, best first: vector art before text, text before bitmaps
 /// (word processors offer a picture of copied text too).
 pub const PASTE_ORDER: [&str; 5] = [SVG, PDF, EMF, TEXT, BITMAP];
+/// How much of a copied file [`file_flavour`] needs to tell what it is.
+pub const FILE_HEAD: usize = 4096;
+
+/// What a file copied in a file manager pastes as, if one of `mimes` (`image/*`: any bitmap):
+/// SVG, PDF, a Windows metafile or a bitmap (its own `image/…` type), told from its first
+/// [`FILE_HEAD`] bytes and its name. The file's bytes are that flavour's data.
+pub fn file_flavour(name: &str, head: &[u8], mimes: &[&str]) -> Option<&'static str> {
+    let f = fileio::detect(name, head)?;
+    let (asked, mime) = match f.id {
+        "svg" => (SVG, SVG),
+        "pdf" => (PDF, PDF),
+        "emf" | "wmf" => (EMF, EMF),
+        _ if f.raster => (BITMAP, f.mime),
+        _ => return None,
+    };
+    mimes.contains(&asked).then_some(mime)
+}
 
 /// One representation of the clipboard's contents.
 #[derive(Clone, Debug, PartialEq, Eq)]

crates/engine/src/cmd/colormgmt.rs

@@ -8,9 +8,11 @@
 //! become active when assigned.
 
 use std::collections::BTreeMap;
+use std::sync::Arc;
 
 use serde_json::{Value, json};
 use vectorcraft_color::cms::{self, ColorSettings, Intent, Model, ProofTarget};
+use vectorcraft_color::recolor::Neutral;
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::ColorMode;
 use vectorcraft_render::proof;
@@ -55,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert Document Color Mode",
             [],
             None,
-            "same as file.documentColorMode: {mode: \"cmyk\"|\"rgb\", convert?: true, intent?} → {changed} (an alias kept for older scripts; the command palette leaves it out)",
+            "same as file.documentColorMode: {mode: \"cmyk\"|\"rgb\", convert?: true, intent?, grays?} → {changed} (an alias kept for older scripts; the command palette leaves it out)",
             has_doc,
             convert_mode
         ),
@@ -232,6 +234,28 @@ fn assign_profile(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"rgb": rgb, "cmyk": cmyk}))
 }
 
+/// How Document Color Mode converts neutral RGB greys (R = G = B) to CMYK (the `grays` param).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Grays {
+    /// Through the CMYK profile like any colour: four-colour greys and a rich black.
+    #[default]
+    Profile,
+    /// On the black plate only: K is the grey's ink percentage (as Convert to Grayscale and then
+    /// to CMYK would give).
+    Black,
+}
+
+impl Grays {
+    /// The `grays` param of `cmd`: `"profile"` (default) or `"black"`.
+    pub(crate) fn param(cmd: &str, p: &Value) -> Result<Self> {
+        match str_param(p, "grays").map(str::to_ascii_lowercase).as_deref() {
+            None | Some("profile") => Ok(Grays::Profile),
+            Some("black") => Ok(Grays::Black),
+            Some(g) => Err(bad(cmd, format!("grays must be \"profile\" or \"black\", not `{g}`"))),
+        }
+    }
+}
+
 /// File → Document Color Mode (`file.documentColorMode` and its alias
 /// `object.convertDocumentColorMode`): set the mode and, unless `convert: false`, convert every
 /// colour through the colour settings.
@@ -243,6 +267,7 @@ pub(crate) fn convert_mode(s: &mut Session, p: &Value) -> Result<Value> {
         _ => return Err(bad(C, "mode must be \"cmyk\" or \"rgb\"")),
     };
     let intent = intent_param(p, C)?;
+    let grays = Grays::param(C, p)?;
     // Choosing the mode the document already has (the checked menu item) is not an edit.
     if s.doc()?.doc.color_mode == mode {
         return Ok(json!({ "changed": 0 }));
@@ -250,18 +275,20 @@ pub(crate) fn convert_mode(s: &mut Session, p: &Value) -> Result<Value> {
     let convert = bool_or(p, "convert", true);
     let mut changed = 0usize;
     s.edit("Document Color Mode", |d, _| {
-        changed = set_color_mode(d, mode, convert, intent);
+        changed = set_color_mode(d, mode, convert, intent, grays);
         Ok(())
     })?;
     Ok(json!({ "changed": changed }))
 }
 
-/// Put `d` in colour `mode` and, with `convert`, convert every colour of its art, symbols and
-/// swatches through the colour settings (`intent`, default: theirs) → how many colours changed.
-/// Greys stay greys (they print on the black plate in either mode); Lab colours (spot colour
+/// Put `d` in colour `mode` and, with `convert`, convert every colour of its art, symbols,
+/// pattern tiles and swatches through the colour settings (`intent`, default: theirs) → how many
+/// colours of the art, symbols and patterns changed. Gray colours stay Gray (they print on the
+/// black plate in either mode); RGB greys are colours like any other and separate through the
+/// CMYK profile, unless `grays` puts them on the black plate. Lab colours (spot colour
 /// definitions) are device independent and fit either mode. Document Color Mode and
 /// `document.open {colorMode}` both convert this way.
-pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode, convert: bool, intent: Option<Intent>) -> usize {
+pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode, convert: bool, intent: Option<Intent>, grays: Grays) -> usize {
     d.color_mode = mode;
     if !convert {
         return 0;
@@ -269,15 +296,25 @@ pub(crate) fn set_color_mode(d: &mut vectorcraft_doc::Document, mode: ColorMode,
     let c = cms::active();
     let intent = intent.unwrap_or(c.settings().intent);
     let model = if mode == ColorMode::Cmyk { Model::Cmyk } else { Model::Rgb };
-    let conv = |col: &Color| if matches!(col, Color::Gray { .. } | Color::Lab { .. }) { *col } else { c.convert(col, model, intent) };
+    let k_only = model == Model::Cmyk && grays == Grays::Black;
+    let conv = |col: &Color| match col {
+        Color::Gray { .. } | Color::Lab { .. } => *col,
+        // Grey ink percentage, then K only (a Gray colour's CMYK).
+        Color::Rgb { .. } if k_only && Neutral::of(col).is_some() => c.convert(&c.convert(col, Model::Gray, intent), Model::Cmyk, intent),
+        _ => c.convert(col, model, intent),
+    };
     let mut changed = 0usize;
-    proof::map_document_colors(d, &mut |col, _| {
+    let mut count = |col: &Color, _: proof::Link| {
         let n = conv(col);
         if n != *col {
             changed += 1;
         }
         n
-    });
+    };
+    proof::map_document_colors(d, &mut count);
+    for a in d.patterns.iter_mut().flat_map(|p| &mut p.art) {
+        proof::map_node_colors(Arc::make_mut(a), &mut count);
+    }
     for sw in d.swatches_iter_mut() {
         match &mut sw.paint {
             Paint::Solid { color, .. } => *color = conv(color),

crates/engine/src/cmd/create.rs

@@ -50,7 +50,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Create Text",
             [],
             None,
-            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height}} → {id}",
+            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText)} → {id}",
             has_doc,
             text_create
         ),
@@ -166,7 +166,13 @@ fn rect_of(p: &Value, cmd: &str) -> Result<Rect> {
 fn rectangle(s: &mut Session, p: &Value) -> Result<Value> {
     let r = rect_of(p, "shape.rectangle")?;
     let radius = f64_or(p, "radius", 0.0).max(0.0);
-    let live = LiveShape::Rectangle { w: r.width(), h: r.height(), radii: [radius; 4], xf: Affine::translate(r.origin().to_vec2()) };
+    let live = LiveShape::Rectangle {
+        w: r.width(),
+        h: r.height(),
+        radii: [radius; 4],
+        kinds: Default::default(),
+        xf: Affine::translate(r.origin().to_vec2()),
+    };
     let label = if radius > 0.0 { "Rounded Rectangle" } else { "Rectangle" };
     add_art(s, label, path_kind(live.to_path(), Some(live)), None)
 }
@@ -408,8 +414,11 @@ fn text_create(s: &mut Session, p: &Value) -> Result<Value> {
         let h = f64_or(a, "height", 100.0);
         t.kind = vectorcraft_doc::TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, w, h)) };
     }
-    let lay = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t);
-    t.cached_bounds = Some(lay.bounds);
+    if bool_or(p, "placeholder", false) {
+        super::typemenu::fill_with_placeholder(&mut t);
+    } else {
+        super::typecmd::refresh_bounds(&mut t);
+    }
     add_node(s, "Type", NodeKind::Text(Box::new(t)), Appearance::default(), None)
 }
 

crates/engine/src/cmd/docmenu.rs

@@ -155,15 +155,41 @@ pub fn specs() -> Vec<CommandSpec> {
             clear_guides
         ),
         cmd!("guide.add", "Add Guide", [], None, "{vertical: bool, pos: pt (x for vertical, y for horizontal)} → {index}", has_doc, guide_add),
-        cmd!("guide.remove", "Remove Guide", [], None, "{index}", guides_unlocked, guide_remove),
-        cmd!("guide.move", "Move Guide", [], None, "{index, pos: pt}", guides_unlocked, guide_move),
+        cmd!(query "guide.list", "Guides", [], None, "{} → [{index, vertical, pos, selected}…] the ruler guides", has_doc, guide_list),
+        cmd!(
+            "guide.select",
+            "Select Guides",
+            [],
+            None,
+            "{indexes: [index…], toggle?: bool} select ruler guides on their own (deselecting the art); toggle adds or removes them instead → {selected: [index…]}",
+            guides_unlocked,
+            guide_select
+        ),
+        cmd!(
+            "guide.remove",
+            "Remove Guide",
+            [],
+            None,
+            "{index?} delete ruler guide `index`, else the selected ones (as Delete / edit.clear does) → {count}",
+            guides_unlocked,
+            guide_remove
+        ),
+        cmd!(
+            "guide.move",
+            "Move Guide",
+            [],
+            None,
+            "{index, pos: pt} put ruler guide `index` at `pos` | {dx?, dy?: pt, copy?: bool} move the selected guides (vertical ones by dx, horizontal ones by dy); copy leaves them and selects the moved copies",
+            guides_unlocked,
+            guide_move
+        ),
         cmd!("file.closeAll", "Close All", ["File"], Some("Cmd+Alt+W"), "{} → {closed}", has_doc, close_all),
         cmd!(
             "file.documentColorMode",
             "Document Color Mode",
             ["File", "Document Color Mode"],
             None,
-            "{mode: \"cmyk\"|\"rgb\", convert?: true (convert every colour of the art, symbols and swatches through the colour settings; swatch links kept; greys stay greys), intent?} → {changed}",
+            "{mode: \"cmyk\"|\"rgb\", convert?: true (convert every colour of the art, symbols, pattern tiles and swatches through the colour settings; swatch links kept; Gray colours stay Gray, on the black plate), intent?, grays?: \"profile\" (default: RGB greys separate through the CMYK profile like any colour, into four-colour greys and a rich black) | \"black\" (to CMYK, RGB greys with R = G = B go on the black plate only, K = their grey value)} → {changed}",
             has_doc,
             super::colormgmt::convert_mode
         ),
@@ -428,6 +454,10 @@ fn release_guides(s: &mut Session, _: &Value) -> Result<Value> {
 fn lock_guides(s: &mut Session, p: &Value) -> Result<Value> {
     let v = p.get("locked").and_then(Value::as_bool).unwrap_or(!s.menu.guides_locked);
     s.menu.guides_locked = v;
+    // Locked guides can't stay selected.
+    if v && !s.doc()?.selection.guides.is_empty() {
+        s.select(|_, sel| sel.guides.clear())?;
+    }
     Ok(json!({ "locked": v }))
 }
 
@@ -458,28 +488,95 @@ fn guide_add(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "index": i }))
 }
 
-fn guide_index(s: &Session, p: &Value, cmd: &str) -> Result<usize> {
-    let i = p.get("index").and_then(Value::as_u64).ok_or_else(|| bad(cmd, "missing index"))? as usize;
+fn guide_list(s: &mut Session, _: &Value) -> Result<Value> {
+    let st = s.doc()?;
+    let row = |(i, g): (usize, &Guide)| json!({ "index": i, "vertical": g.vertical, "pos": g.pos, "selected": st.selection.guides.contains(&i) });
+    Ok(Value::Array(st.doc.guides.iter().enumerate().map(row).collect()))
+}
+
+/// Ruler guide `index` of the active document (`index` validated).
+fn guide_index(s: &Session, v: Option<&Value>, cmd: &str) -> Result<usize> {
+    let i = v.and_then(Value::as_u64).and_then(|i| usize::try_from(i).ok()).ok_or_else(|| bad(cmd, "an index must be a whole number"))?;
     if i >= s.doc()?.doc.guides.len() {
-        return Err(bad(cmd, "no such guide"));
+        return Err(bad(cmd, format!("no guide {i}")));
     }
     Ok(i)
 }
 
-fn guide_remove(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = guide_index(s, p, "guide.remove")?;
-    s.edit("Delete Guide", |d, _| {
-        d.guides.remove(i);
-        Ok(())
-    })?;
-    ok()
+fn guide_select(s: &mut Session, p: &Value) -> Result<Value> {
+    let list = p.get("indexes").and_then(Value::as_array).ok_or_else(|| bad("guide.select", "missing indexes"))?;
+    let picked = list.iter().map(|v| guide_index(s, Some(v), "guide.select")).collect::<Result<Vec<_>>>()?;
+    if bool_or(p, "toggle", false) {
+        let mut now = s.doc()?.selection.guides.clone();
+        for i in picked {
+            if let Some(k) = now.iter().position(|g| *g == i) {
+                now.remove(k);
+            } else {
+                now.push(i);
+            }
+        }
+        s.select(|_, sel| sel.set_guides(now))?;
+    } else {
+        s.select(|_, sel| sel.set_guides(picked))?;
+    }
+    Ok(json!({ "selected": s.doc()?.selection.guides }))
 }
 
-fn guide_move(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = guide_index(s, p, "guide.move")?;
-    let pos = f64_req(p, "pos", "guide.move")?;
-    s.edit("Move Guide", |d, _| {
-        d.guides[i].pos = pos;
+/// Delete ruler guide `index`, else the selected guides, in one undo step → {count}.
+pub(crate) fn guide_remove(s: &mut Session, p: &Value) -> Result<Value> {
+    let gone: Vec<usize> = match p.get("index") {
+        Some(v) => vec![guide_index(s, Some(v), "guide.remove")?],
+        None => s.doc()?.selection.guides.clone(),
+    };
+    if gone.is_empty() {
+        return Err(bad("guide.remove", "no guide selected"));
+    }
+    let label = if gone.len() == 1 { "Delete Guide" } else { "Delete Guides" };
+    s.edit(label, |d, sel| {
+        let kept = |i: &usize| !gone.contains(i);
+        // The guides left selected keep their place among the rest.
+        let left: Vec<usize> = sel.guides.iter().filter(|i| kept(i)).map(|i| i - gone.iter().filter(|g| *g < i).count()).collect();
+        d.guides = std::mem::take(&mut d.guides).into_iter().enumerate().filter(|(i, _)| kept(i)).map(|(_, g)| g).collect();
+        sel.set_guides(left);
+        Ok(())
+    })?;
+    Ok(json!({ "count": gone.len() }))
+}
+
+/// Put ruler guide `index` at `pos`, else move (or copy) the selected guides, in one undo step.
+pub(crate) fn guide_move(s: &mut Session, p: &Value) -> Result<Value> {
+    if let Some(v) = p.get("index") {
+        let i = guide_index(s, Some(v), "guide.move")?;
+        let pos = f64_req(p, "pos", "guide.move")?;
+        s.edit("Move Guide", |d, _| {
+            if let Some(g) = d.guides.get_mut(i) {
+                g.pos = pos;
+            }
+            Ok(())
+        })?;
+        return ok();
+    }
+    let moving = s.doc()?.selection.guides.clone();
+    if moving.is_empty() {
+        return Err(bad("guide.move", "no guide selected (or give an index)"));
+    }
+    let (dx, dy, copy) = (f64_or(p, "dx", 0.0), f64_or(p, "dy", 0.0), bool_or(p, "copy", false));
+    s.edit(if copy { "Copy Guide" } else { "Move Guide" }, |d, sel| {
+        let mut copies = vec![];
+        for &i in &moving {
+            let Some(g) = d.guides.get_mut(i) else { continue };
+            let moved = Guide { vertical: g.vertical, pos: g.pos + if g.vertical { dx } else { dy } };
+            if copy {
+                copies.push(moved);
+            } else {
+                *g = moved;
+            }
+        }
+        if copy {
+            let first = d.guides.len();
+            d.guides.extend(copies);
+            sel.set_guides(first..d.guides.len());
+        }
         Ok(())
     })?;
     ok()

crates/engine/src/cmd/edit.rs

@@ -24,8 +24,9 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         cmd!("file.close", "Close", ["File"], Some("Cmd+W"), "{index?}", has_doc, file_close),
         cmd!("document.activate", "Activate Document", [], None, "{index}", always, doc_activate),
-        cmd!(query "document.inspect", "Inspect Document", [], None, "{} → layer tree, artboards, selection, history", has_doc, |s, _| Ok(inspect::document(s))),
-        cmd!(query "document.node", "Inspect Object", [], None, "{id, summary?: the compact document.inspect-style summary instead of the full object JSON} → one object", has_doc, doc_node),
+        cmd!(query "document.inspect", "Inspect Document", [], None, "{depth?, childLimit?} → layer tree, artboards, selection, history (a sliced tree reports childCount)", has_doc, |s, p| Ok(inspect::document_opts(s, slice_opts(p, "document.inspect")?))),
+        cmd!(query "document.node", "Inspect Object", [], None, "{id, summary?: compact summary, depth?: child levels in the summary (default all), childLimit?: children shown per node (default all; a level that shows fewer reports childCount)} → one object", has_doc, doc_node),
+        cmd!(query "document.find", "Find Objects", [], None, "{name?: substring of the Layers panel name, kind?: panel label such as Group, Path, Type or Image (exact), text?: substring of type content, limit?: max matches (default 100, 0 counts only)} → {matches: [{id, name, kind, path}], total}", has_doc, doc_find),
         cmd!(query "document.json", "Document JSON", [], None, "{} → complete document model", has_doc, |s, _| Ok(serde_json::to_value(&*s.doc()?.doc).unwrap_or(Value::Null))),
         cmd!(
             "document.setUnits",
@@ -85,7 +86,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_clipboard,
             |s, p| paste(s, p, PasteMode::AllArtboards)
         ),
-        cmd!("edit.clear", "Clear", ["Edit"], Some("Delete"), "{ids?}", has_selection, clear),
+        cmd!(
+            "edit.clear",
+            "Clear",
+            ["Edit"],
+            Some("Delete"),
+            "{ids?} delete the objects `ids`, else the selection (direct-selected anchors, else objects, else ruler guides)",
+            has_selection_or_guides,
+            clear
+        ),
         cmd!("edit.duplicate", "Duplicate", [], None, "{dx?, dy?} duplicate the selection in place (offset optional)", has_selection, duplicate),
     ]
 }
@@ -105,8 +114,45 @@ fn doc_activate(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn doc_node(s: &mut Session, p: &Value) -> Result<Value> {
     let id = id_param(p, "id").ok_or_else(|| bad("document.node", "missing id"))?;
+    let opts = slice_opts(p, "document.node")?;
+    let summary = bool_or(p, "summary", false);
+    if !summary && (opts.depth.is_some() || opts.child_limit.is_some()) {
+        // The full object JSON is never truncated: a slice without `summary` would
+        // otherwise silently return the whole subtree.
+        return Err(bad("document.node", "`depth` and `childLimit` slice the summary: pass `summary: true`"));
+    }
     let n = s.doc()?.doc.node(id).ok_or(EngineError::NoNode(id))?;
-    if bool_or(p, "summary", false) { Ok(inspect::node_summary(n)) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
+    if summary { Ok(inspect::node_summary_opts(n, opts)) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
+}
+
+/// `depth` / `childLimit` for a summary read: absent (or null) means no limit.
+fn slice_opts(p: &Value, cmd: &str) -> Result<inspect::SummaryOpts> {
+    Ok(inspect::SummaryOpts { depth: opt_u64(p, cmd, "depth")?, child_limit: opt_u64(p, cmd, "childLimit")? })
+}
+
+/// An optional count: absent (or null) is `None`; a present value that is not a
+/// non-negative integer is rejected rather than silently reinterpreted.
+fn opt_u64(p: &Value, cmd: &str, key: &str) -> Result<Option<u64>> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v.as_u64().map(Some).ok_or_else(|| bad(cmd, format!("`{key}` must be a non-negative integer"))),
+    }
+}
+
+fn doc_find(s: &mut Session, p: &Value) -> Result<Value> {
+    // A filter of the wrong type is an error, not dropped: dropping it would widen the search.
+    let needle = |key: &str| match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(v)) => Ok(Some(v.to_lowercase()).filter(|v| !v.is_empty())),
+        Some(_) => Err(bad("document.find", format!("`{key}` must be a string"))),
+    };
+    let filter = inspect::FindFilter { name: needle("name")?, kind: needle("kind")?, text: needle("text")? };
+    if filter.is_empty() {
+        return Err(bad("document.find", "give at least one of `name`, `kind`, `text`"));
+    }
+    let limit = opt_u64(p, "document.find", "limit")?.unwrap_or(100);
+    let (matches, total) = inspect::find_nodes(&s.doc()?.doc, &filter, limit);
+    Ok(json!({"matches": matches, "total": total}))
 }
 
 /// Document Setup's units (also `document.setup {units}`).
@@ -117,7 +163,7 @@ fn set_units(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 /// A typing session in progress (the Type tool previews the whole session as one interaction).
-fn typing_in_progress(s: &Session) -> bool {
+pub(crate) fn typing_in_progress(s: &Session) -> bool {
     s.active().and_then(|d| d.interaction.as_ref()).is_some_and(|it| it.label == "Typing" && it.preview.is_some())
 }
 
@@ -206,6 +252,10 @@ fn clear(s: &mut Session, p: &Value) -> Result<Value> {
     if ids_param(p, "ids").is_none() && !s.doc()?.selection.anchors.is_empty() {
         return super::path::delete_anchors(s, p);
     }
+    // Selected ruler guides (selected on their own).
+    if ids_param(p, "ids").is_none() && s.doc()?.selection.is_empty() {
+        return super::docmenu::guide_remove(s, &json!({}));
+    }
     let ids = match ids_param(p, "ids") {
         Some(v) => v,
         None => selected_roots(s)?,

crates/engine/src/cmd/fileio/encode.rs

@@ -355,7 +355,8 @@ pub fn encode(doc: &Document, format: &str, p: &Value) -> Result<Vec<u8>> {
 }
 
 /// Like [`encode`], also returning the encoder's warnings (PDF and SVG: options not applied yet,
-/// features approximated or left out; the other formats have none).
+/// features approximated or left out; every format that draws type: fonts written in the fallback
+/// font).
 pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(Vec<u8>, Vec<String>)> {
     let f = super::writable(C, Some(format), None)?;
     encode_all(doc, f.id, p)?.single(f)
@@ -364,6 +365,19 @@ pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(
 /// [`encode`], with every file the export writes.
 pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
     let f = super::writable(C, Some(format), None)?;
+    let mut enc = encode_files(doc, f, p)?;
+    // Formats that draw type: missing fonts come out in the fallback font (PDF and SVG say so
+    // themselves: SVG only when it outlines or embeds fonts).
+    if (f.raster || matches!(f.id, "eps" | "emf" | "wmf"))
+        && let Some(w) = crate::cmd::fonts::substitution_warning(doc)
+    {
+        enc.warnings.push(w);
+    }
+    Ok(enc)
+}
+
+/// [`encode_all`] without the font substitution warning.
+fn encode_files(doc: &Document, f: &Format, p: &Value) -> Result<Encoded> {
     let doc = &*doc.without_edit_modes();
     let n = doc.artboards.len();
     // SVG reads its own `useArtboards` (an SVG option).
@@ -374,7 +388,7 @@ pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
         if let Some(o) = q.as_object_mut() {
             o.remove("useArtboards");
         }
-        return encode_all(&single_artboard(doc, bounds, "Art"), f.id, &q);
+        return encode_files(&single_artboard(doc, bounds, "Art"), f, &q);
     }
     let bytes = match f.id {
         "vectorcraft" => super::native::encode(C, f, doc, p)?,

crates/engine/src/cmd/fileio/load.rs

@@ -178,7 +178,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
         _ => return Err(err(format!("{} files can't be opened yet", format.label))),
     };
     if let Some(mode) = opts.color_mode.filter(|m| *m != doc.color_mode) {
-        super::super::colormgmt::set_color_mode(&mut doc, mode, true, None);
+        super::super::colormgmt::set_color_mode(&mut doc, mode, true, None, opts.grays);
     }
     // Imports are named after the file; a native document keeps its own title (the tab shows the
     // file name once it has a path).
@@ -282,13 +282,15 @@ pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
     open_template(s, src.name, &src.bytes, src.path)
 }
 
-/// Decode an image's header (and, for formats stored as PNG, its pixels).
+/// Decode an image's header (and, for formats stored as PNG, its pixels). CMYK TIFFs are kept as
+/// they are, with their ink amounts ([`ImageBlob::cmyk`]).
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     let reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
     let kind = reader.format().ok_or_else(|| err("not an image VectorCraft reads (see document.formats)"))?;
     let f = image_format(kind).ok_or_else(|| err(format!("{kind:?} images can't be opened (see document.formats)")))?;
     let ppi = super::ppi::resolution(bytes);
-    let (bytes, mime, (width, height)) = if matches!(f.id, "png" | "jpg" | "gif" | "webp") {
+    let cmyk = || ImageBlob::new(f.mime, bytes.to_vec()).cmyk().is_some();
+    let (bytes, mime, (width, height)) = if matches!(f.id, "png" | "jpg" | "gif" | "webp") || (f.id == "tiff" && cmyk()) {
         (bytes.to_vec(), f.mime, reader.into_dimensions().map_err(err)?)
     } else {
         let img = reader.decode().map_err(err)?.to_rgba8();

crates/engine/src/cmd/fileio/mod.rs

@@ -78,7 +78,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Open Document",
             [],
             None,
-            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
+            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
             always,
             load::open
         ),

crates/engine/src/cmd/fileio/pdf.rs

@@ -276,6 +276,7 @@ pub(super) fn encode_carrying(cmd: &str, doc: &Document, p: &Value, native: impl
     }
     let r = super::super::rasterfx::export_pdf_with_report(flat.as_ref().unwrap_or(doc), &opts).map_err(|e| pdf_error(cmd, e))?;
     warnings.extend(r.warnings);
+    warnings.extend(crate::cmd::fonts::substitution_warning(doc));
     Ok((r.bytes, warnings))
 }
 

crates/engine/src/cmd/fileio/pdfimport.rs

@@ -6,6 +6,7 @@ use serde_json::{Value, json};
 use vectorcraft_doc::{ColorMode, Document};
 use vectorcraft_pdf::{Choice, CropTo, ImportOptions, PdfError, TextAs};
 
+use super::super::colormgmt::Grays;
 use super::super::*;
 use super::{err, source};
 
@@ -22,6 +23,8 @@ pub struct LoadOptions {
     /// The colour mode the document opens in, its colours converted as Document Color Mode does
     /// (default: the file's; a PDF painted mostly in CMYK opens in CMYK).
     pub color_mode: Option<ColorMode>,
+    /// How that conversion separates RGB greys (`grays`).
+    pub grays: Grays,
     /// What a PDF's text becomes.
     pub text_as: TextAs,
     /// A PDF's optional content groups become layers (else one layer per page, without the art
@@ -38,6 +41,7 @@ impl Default for LoadOptions {
             crop: CropTo::default(),
             password: None,
             color_mode: None,
+            grays: Grays::default(),
             text_as: TextAs::default(),
             layers: true,
             dxf: Default::default(),
@@ -47,7 +51,7 @@ impl Default for LoadOptions {
 
 impl LoadOptions {
     /// From command params: `pages` (`"2-3, 5"`, a page number or `"all"`), `page` (one page, when
-    /// `pages` isn't given), `cropTo` (or `crop`), `password`, `colorMode` (`rgb` | `cmyk`),
+    /// `pages` isn't given), `cropTo` (or `crop`), `password`, `colorMode` (`rgb` | `cmyk`) with `grays`,
     /// `textAs` (`text` | `outlines`), `layers` (true | false) and `dxf` (the DXF import options).
     pub fn from_params(cmd: &str, p: &Value) -> Result<Self> {
         let pages = match p.get("pages").filter(|v| !v.is_null()).or_else(|| p.get("page").filter(|v| !v.is_null())) {
@@ -65,13 +69,14 @@ impl LoadOptions {
             Some("cmyk") => Some(ColorMode::Cmyk),
             Some(m) => return Err(bad(cmd, format!("colorMode must be rgb or cmyk, not `{m}`"))),
         };
+        let grays = Grays::param(cmd, p)?;
         let text_as = choice(cmd, "textAs", str_param(p, "textAs"))?;
         let layers = match p.get("layers").filter(|v| !v.is_null()) {
             None => true,
             Some(v) => v.as_bool().ok_or_else(|| bad(cmd, "layers must be true or false"))?,
         };
         let dxf = super::dxfimport::options(cmd, p.get("dxf"))?;
-        Ok(Self { pages, crop, password, color_mode, text_as, layers, dxf })
+        Ok(Self { pages, crop, password, color_mode, grays, text_as, layers, dxf })
     }
 
     /// Does the document read only part of the file, or read it differently (a page range, another

crates/engine/src/cmd/fileio/svg.rs

@@ -166,5 +166,11 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
         }
         enc.files.push((artboard, if compressed { vectorcraft_svg::compress_bytes(&bytes) } else { bytes }));
     }
+    // Live type names its fonts; outlines and embedded fonts are the fallback font's.
+    if (opts.outline_text || opts.embed_fonts)
+        && let Some(w) = crate::cmd::fonts::substitution_warning(doc)
+    {
+        enc.warnings.push(w);
+    }
     Ok(enc)
 }

crates/engine/src/cmd/fileio/tests.rs

@@ -103,6 +103,17 @@ fn webp_opens_at_its_pixel_size() {
     assert_eq!((r.width, r.height, r.blob.mime.as_str()), (3, 2, "image/webp"));
 }
 
+#[test]
+fn cmyk_tiffs_keep_their_inks_and_other_tiffs_become_png() {
+    let inks = vectorcraft_doc::cmyk::Inks::new(2, 1, vec![0, 102, 255, 0, 10, 20, 30, 40]).unwrap();
+    let tiff = vectorcraft_doc::ImageBlob::cmyk_tiff(&inks).unwrap();
+    let r = raster_image(&tiff.bytes).unwrap();
+    assert_eq!((r.width, r.height, r.blob.mime.as_str()), (2, 1, "image/tiff"));
+    assert_eq!(r.blob.cmyk(), Some(inks));
+    let rgb = raster_image(&image_bytes(2, 1, image::ImageFormat::Tiff)).unwrap();
+    assert_eq!(rgb.blob.mime, "image/png");
+}
+
 #[test]
 fn content_beats_a_wrong_extension() {
     let png = image_bytes(2, 2, image::ImageFormat::Png);

crates/engine/src/cmd/fileio/tests_pdffidelity.rs

@@ -67,3 +67,40 @@ fn load_options_read_text_and_layers() {
     let d = LoadOptions::default();
     assert_eq!((d.text_as, d.layers, d.is_partial()), (TextAs::Text, true, false));
 }
+
+#[test]
+fn exports_that_draw_type_in_a_missing_font_say_it_is_the_fallback_font() {
+    let page = PdfPage {
+        resources: "/Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Zyxwvu-Serif >> >>".into(),
+        ..PdfPage::new(200.0, 100.0, "BT /F1 12 Tf 10 50 Td (Hello) Tj ET")
+    };
+    let mut s = Session::new();
+    let r = open(&mut s, &pdf(&[page], None), json!({})).unwrap();
+    let fonts = s.execute("text.fonts", &json!({})).unwrap();
+    let family = fonts[0]["family"].as_str().unwrap().to_string();
+    assert_eq!(fonts[0]["status"], "missing", "{fonts}");
+    assert!(r["warnings"].to_string().contains(&family), "opening lists it: {r}");
+    let warned = |s: &mut Session, p: Value| {
+        let w = s.execute("document.serialize", &p).unwrap()["warnings"].to_string();
+        w.contains(&family) && w.contains(vectorcraft_text::FALLBACK_FAMILY)
+    };
+    for p in [
+        json!({"format": "pdf"}),
+        json!({"format": "pdf", "advanced": {"outlineText": false}}),
+        json!({"format": "png"}),
+        json!({"format": "eps"}),
+        json!({"format": "emf"}),
+        json!({"format": "svg", "outlineText": true}),
+        json!({"format": "svg", "embedFonts": true}),
+    ] {
+        assert!(warned(&mut s, p.clone()), "{p}");
+    }
+    // Live SVG type and the native file name the font itself.
+    for p in [json!({"format": "svg", "outlineText": false}), json!({"format": "vectorcraft"}), json!({"format": "txt"})] {
+        assert!(!warned(&mut s, p.clone()), "{p}");
+    }
+    let pdf_export = s.execute("document.exportPdf", &json!({})).unwrap();
+    assert!(pdf_export["warnings"].to_string().contains(&family), "{pdf_export}");
+    s.execute("text.replaceFont", &json!({"from": {"family": family}, "to": {"family": "Source Serif 4"}})).unwrap();
+    assert!(!warned(&mut s, json!({"format": "pdf"})), "replaced: nothing is substituted");
+}

crates/engine/src/cmd/fonts.rs

@@ -2,10 +2,10 @@
 //! another everywhere or in the selection, and selecting the text that uses a font. Also the fonts
 //! available (the bundled and installed ones) and rescanning the installed fonts.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, NodeId, NodeKind};
+use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
 
 use super::typecmd::refresh_bounds;
 use super::*;
@@ -85,6 +85,41 @@ fn scope(s: &Session, selection_only: bool) -> Result<Vec<NodeId>> {
     Ok(v)
 }
 
+/// The fonts (family, style) of the type in the layers and symbols of `d`.
+pub(super) fn used_fonts(d: &Document) -> BTreeSet<(String, String)> {
+    let mut fonts = BTreeSet::new();
+    let mut add = |n: &Node| {
+        if let NodeKind::Text(t) = &n.kind {
+            fonts.extend(t.runs.iter().map(|r| (r.style.font_family.clone(), r.style.font_style.clone())));
+        }
+    };
+    d.walk(&mut add);
+    for s in &d.symbols {
+        s.art.walk(&mut add);
+    }
+    fonts
+}
+
+/// What an export that draws type (as outlines, embedded fonts or pixels) says when `d` uses font
+/// families that aren't available: their type is drawn in the fallback font, not the font it names.
+pub(super) fn substitution_warning(d: &Document) -> Option<String> {
+    let db = vectorcraft_text::FontDb::global();
+    let mut missing: Vec<String> = used_fonts(d)
+        .into_iter()
+        .filter(|(family, style)| db.resolve(family, style).is_none_or(|(_, m)| m == vectorcraft_text::FontMatch::Missing))
+        .map(|(family, _)| family)
+        .collect();
+    // Sorted by family: its styles are neighbours.
+    missing.dedup();
+    (!missing.is_empty()).then(|| {
+        format!(
+            "fonts that aren't available were written in the fallback font, {}: {} (install them, or replace them with Find Font)",
+            vectorcraft_text::FALLBACK_FAMILY,
+            missing.join(", ")
+        )
+    })
+}
+
 fn text(d: &Document, id: NodeId) -> Option<&vectorcraft_doc::TextObject> {
     match d.node(id).map(|n| &n.kind) {
         Some(NodeKind::Text(t)) => Some(t),

crates/engine/src/cmd/menucmds.rs

@@ -75,7 +75,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Transform Each…",
             ["Object", "Transform"],
             Some("Cmd+Alt+Shift+D"),
-            "{scaleH?: % (100), scaleV?: % (100), moveH?: pt, moveV?: pt (down = +), rotate?: deg (counter-clockwise), reflectX?: bool (flip vertically), reflectY?: bool (flip horizontally), random?: bool, seed?: n, reference?: 0..8 (9-point grid, 4 = centre), copy?: bool, strokes?: bool (Scale Strokes & Effects), corners?: bool (Scale Corners; both default to the preferences)} transform every selected object about its own reference point → {ids}",
+            "{scaleH?: % (100), scaleV?: % (100), moveH?: pt, moveV?: pt (down = +), rotate?: deg (counter-clockwise), reflectX?: bool (flip vertically), reflectY?: bool (flip horizontally), random?: bool, seed?: n, reference?: 0..8 (9-point grid, 4 = centre), copy?: bool, strokes?: bool (Scale Strokes & Effects), corners?: bool (Scale Corners; both default to the preferences), patterns?: bool (Transform Patterns; default: prefs transformPatternTiles)} transform every selected object about its own reference point → {ids}",
             has_selection,
             transform_each
         ),
@@ -147,7 +147,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Rearrange All Artboards…",
             ["Object", "Artboards"],
             None,
-            "{columns?: n (2), spacing?: pt (20), byColumn?: false, moveArtwork?: true} lay artboards out in a grid",
+            "{columns?: n (2), spacing?: pt (20), byColumn?: false, moveArtwork?: true (locked and hidden art only with prefs moveLockedWithArtboard)} lay artboards out in a grid",
             has_doc,
             rearrange_artboards
         ),
@@ -288,7 +288,8 @@ fn transform_each(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("object.transformEach", "scale must be non-zero"));
     }
     let mut rng = Rng(p.get("seed").and_then(Value::as_u64).unwrap_or(0x9E37_79B9_7F4A_7C15).max(1));
-    let sc = if sh != 100.0 || sv != 100.0 { super::object::scaling(s, p) } else { Default::default() };
+    let mut sc = if sh != 100.0 || sv != 100.0 { super::object::scaling(s, p) } else { Default::default() };
+    sc.patterns = super::object::transform_patterns(s, p, &roots)?;
     let ids = s.edit("Transform Each", |d, sel| {
         let targets = if copy { duplicate_in(d, sel, &roots, Affine::IDENTITY)? } else { roots.clone() };
         for id in &targets {
@@ -658,7 +659,7 @@ pub(crate) fn detect_shape(path: &PathData) -> Option<LiveShape> {
         }
         let rot = Affine::rotate(e0.y.atan2(e0.x));
         let flip = if e0.cross(e1) < 0.0 { Affine::scale_non_uniform(1.0, -1.0) } else { Affine::IDENTITY };
-        return Some(LiveShape::Rectangle { w, h, radii: [0.0; 4], xf: Affine::translate(a[0].p.to_vec2()) * rot * flip });
+        return Some(LiveShape::Rectangle { w, h, radii: [0.0; 4], kinds: Default::default(), xf: Affine::translate(a[0].p.to_vec2()) * rot * flip });
     }
     let b = path.bounds()?;
     let c = b.center();
@@ -742,6 +743,7 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
     let spacing = f64_or(p, "spacing", 20.0).clamp(-1.0e5, 1.0e5);
     let by_col = bool_or(p, "byColumn", false);
     let move_art = bool_or(p, "moveArtwork", true);
+    let locked_and_hidden = s.prefs.move_locked_with_artboard;
     let scale_strokes = false;
     s.edit("Rearrange Artboards", |d, _| {
         let rects: Vec<Rect> = d.artboards.iter().map(|a| a.rect).collect();
@@ -753,7 +755,9 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
             let tops: Vec<(NodeId, Point)> = d
                 .layers
                 .iter()
+                .filter(|l| l.rides_with_artboard(locked_and_hidden))
                 .flat_map(|l| l.children().into_iter().flatten())
+                .filter(|n| n.rides_with_artboard(locked_and_hidden))
                 .filter_map(|n| Some((n.id, n.geometric_bounds()?.center())))
                 .collect();
             for (id, c) in tops {

crates/engine/src/cmd/mod.rs

@@ -144,6 +144,11 @@ pub fn has_selection(s: &Session) -> std::result::Result<(), String> {
     let st = s.active().ok_or("no document open")?;
     if st.selection.is_empty() { Err("nothing selected".into()) } else { Ok(()) }
 }
+/// Objects or ruler guides are selected (what Delete and the arrow keys act on).
+pub fn has_selection_or_guides(s: &Session) -> std::result::Result<(), String> {
+    let st = s.active().ok_or("no document open")?;
+    if st.selection.has_objects_or_guides() { Ok(()) } else { Err("nothing selected".into()) }
+}
 pub fn has_anchors(s: &Session) -> std::result::Result<(), String> {
     let st = s.active().ok_or("no document open")?;
     if st.selection.anchors.values().all(|a| a.is_empty()) { Err("no anchor points selected".into()) } else { Ok(()) }

crates/engine/src/cmd/object.rs

@@ -6,6 +6,7 @@ use std::sync::Arc;
 use serde_json::{Value, json};
 use vectorcraft_color::{BlendMode, Paint};
 use vectorcraft_doc::{Appearance, Document, Knockout, Node, NodeId, NodeKind, OrientedBox, Scaling};
+use vectorcraft_geom::shapes::CornerKind;
 use vectorcraft_geom::{Affine, FillRule, Point, Rect, Vec2};
 
 use super::edit::{duplicate_in, selected_roots};
@@ -20,17 +21,25 @@ pub fn specs() -> Vec<CommandSpec> {
             "Transform",
             [],
             None,
-            "{matrix: [a,b,c,d,e,f], copy?: bool, ids?, strokes?: bool, corners?: bool, typeAreas?: bool} apply an affine to the selection (or ids); strokes/corners: Scale Strokes & Effects / Scale Corners (default: the preferences); typeAreas: area type among them (not type inside a group) reshapes its frame by the matrix and its text reflows at its size, as a bounding-box handle drag does (default: the type transforms too)",
+            "{matrix: [a,b,c,d,e,f], copy?: bool, ids?, strokes?: bool, corners?: bool, typeAreas?: bool, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} apply an affine to the selection (or ids); strokes/corners: Scale Strokes & Effects / Scale Corners (default: the preferences); typeAreas: area type among them (not type inside a group) reshapes its frame by the matrix and its text reflows at its size, as a bounding-box handle drag does (default: the type transforms too)",
             has_doc,
             transform
         ),
-        cmd!("object.move", "Move…", ["Object", "Transform"], Some("Cmd+Shift+M"), "{dx, dy, copy?}", has_selection, move_cmd),
+        cmd!(
+            "object.move",
+            "Move…",
+            ["Object", "Transform"],
+            Some("Cmd+Shift+M"),
+            "{dx, dy, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
+            has_selection,
+            move_cmd
+        ),
         cmd!(
             "object.rotate",
             "Rotate…",
             ["Object", "Transform"],
             None,
-            "{angle: deg (counter-clockwise), absolute?: bool (angle is the bounding box's new angle, not an amount), origin?: [x,y] (default: the bounding box centre), copy?} → {ids}",
+            "{angle: deg (counter-clockwise), absolute?: bool (angle is the bounding box's new angle, not an amount), origin?: [x,y] (default: the bounding box centre), copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} → {ids}",
             has_selection,
             rotate
         ),
@@ -39,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Scale…",
             ["Object", "Transform"],
             None,
-            "{sx: %, sy?: %, origin?: [x,y], copy?, strokes?: bool (Scale Strokes & Effects: stroke weights, dashes and effect distances scale; off keeps them, type strokes included), corners?: bool (Scale Corners: live corner radii scale)} (strokes/corners default to the preferences)",
+            "{sx: %, sy?: %, origin?: [x,y], copy?, strokes?: bool (Scale Strokes & Effects: stroke weights, dashes and effect distances scale; off keeps them, type strokes included), corners?: bool (Scale Corners: live corner radii scale), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} (strokes/corners default to the preferences)",
             has_selection,
             scale
         ),
@@ -48,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reflect…",
             ["Object", "Transform"],
             None,
-            "{axis: \"vertical\"|\"horizontal\"|deg, origin?, copy?}",
+            "{axis: \"vertical\"|\"horizontal\"|deg, origin?, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
             has_selection,
             reflect
         ),
@@ -57,7 +66,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Shear…",
             ["Object", "Transform"],
             None,
-            "{angle: deg, axis?: \"horizontal\"|\"vertical\", origin?, copy?}",
+            "{angle: deg, axis?: \"horizontal\"|\"vertical\", origin?, copy?, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
             has_selection,
             shear
         ),
@@ -67,8 +76,8 @@ pub fn specs() -> Vec<CommandSpec> {
             "Nudge",
             [],
             None,
-            "{dx: -1|0|1, dy: -1|0|1, big?: bool (×10), copy?: bool} arrow-key nudge by the keyboard increment",
-            has_selection,
+            "{dx: -1|0|1, dy: -1|0|1, big?: bool (×10), copy?: bool} arrow-key nudge by the keyboard increment (the selected anchors, else objects, else ruler guides)",
+            has_selection_or_guides,
             nudge
         ),
         cmd!("object.arrange.bringToFront", "Bring to Front", ["Object", "Arrange"], Some("Cmd+Shift+]"), "{}", has_selection, |s, _| arrange(
@@ -180,7 +189,15 @@ pub fn specs() -> Vec<CommandSpec> {
             set_bounds
         ),
         cmd!("object.expandShape", "Expand Shape", ["Object", "Shape"], None, "{} convert live shapes to plain paths", has_selection, expand_shape),
-        cmd!("object.setLiveShape", "Live Shape Properties", [], None, "{id?, radius?: pt (all corners), sides?: n}", has_selection, set_live_shape),
+        cmd!(
+            "object.setLiveShape",
+            "Live Shape Properties",
+            [],
+            None,
+            "{id?, ids?, radius?: pt, kind?: \"round\"|\"invertedRound\"|\"chamfer\", corners?: [0..3…], sides?: n} (Live Corners: radius and kind set a rectangle's corners: `corners` (0 top-left, 1 top-right, 2 bottom-right, 3 bottom-left), else the corners with a Direct-Selected anchor, else all four; sides: a polygon's)",
+            has_selection,
+            set_live_shape
+        ),
     ]
 }
 
@@ -199,15 +216,39 @@ pub(crate) fn scaling(s: &mut Session, p: &Value) -> Scaling {
     let corners = bool_or(p, "corners", s.prefs.scale_corners);
     s.note_journal("strokes", json!(strokes));
     s.note_journal("corners", json!(corners));
-    Scaling { strokes, effects: strokes.then_some(vectorcraft_render::effects::scale_effect), keep_type_strokes: !strokes, keep_corners: !corners }
+    Scaling {
+        strokes,
+        effects: strokes.then_some(vectorcraft_render::effects::scale_effect),
+        keep_type_strokes: !strokes,
+        keep_corners: !corners,
+        ..Scaling::default()
+    }
+}
+
+/// Transform Patterns: do the pattern fills and strokes of `ids` transform with them (`patterns`
+/// param, else General › Transform Pattern Tiles)? Noted in the journal when they use a pattern,
+/// so a replay moves their tiles alike whatever the preference is then.
+pub(crate) fn transform_patterns(s: &mut Session, p: &Value, ids: &[NodeId]) -> Result<bool> {
+    let on = bool_or(p, "patterns", s.prefs.transform_pattern_tiles);
+    let d = &s.doc()?.doc;
+    let mut uses = false;
+    for n in ids.iter().filter_map(|id| d.node(*id)) {
+        n.walk(&mut |c| uses |= vectorcraft_doc::pattern::uses_pattern(c, None));
+    }
+    if uses {
+        s.note_journal("patterns", json!(on));
+    }
+    Ok(on)
 }
 
 /// Apply `xf` to `ids` (`copy` param: duplicate first; `strokes`/`corners`: see [`scaling`];
-/// `typeAreas`: see [`resize_type_area`]). Records Transform Again.
+/// `patterns`: see [`transform_patterns`]; `typeAreas`: see [`resize_type_area`]). Records
+/// Transform Again.
 pub(crate) fn apply_transform(s: &mut Session, label: &str, ids: Vec<NodeId>, xf: Affine, p: &Value) -> Result<Value> {
     let copy = bool_or(p, "copy", false);
     let areas = bool_or(p, "typeAreas", false);
-    let sc = if Scaling::factor(xf).is_some() { scaling(s, p) } else { Scaling::default() };
+    let mut sc = if Scaling::factor(xf).is_some() { scaling(s, p) } else { Scaling::default() };
+    sc.patterns = transform_patterns(s, p, &ids)?;
     let ids = s.edit(label, |d, sel| {
         let targets = if copy { duplicate_in(d, sel, &ids, Affine::IDENTITY)? } else { ids.clone() };
         for id in &targets {
@@ -259,6 +300,9 @@ fn nudge(s: &mut Session, p: &Value) -> Result<Value> {
     if !s.doc()?.selection.anchors.is_empty() {
         return super::path::move_anchors(s, &json!({ "dx": dx, "dy": dy }));
     }
+    if s.doc()?.selection.is_empty() {
+        return super::docmenu::guide_move(s, &json!({ "dx": dx, "dy": dy, "copy": bool_or(p, "copy", false) }));
+    }
     let ids = selected_roots(s)?;
     apply_transform(s, "Move", ids, Affine::translate((dx, dy)), p)
 }
@@ -962,15 +1006,53 @@ fn expand_shape(s: &mut Session, _: &Value) -> Result<Value> {
     ok()
 }
 
+/// The `corners` of `object.setLiveShape`: a mask of corner indices 0–3.
+fn corners_param(p: &Value) -> Result<Option<[bool; 4]>> {
+    let Some(v) = p.get("corners").filter(|v| !v.is_null()) else { return Ok(None) };
+    let err = || {
+        bad(
+            "object.setLiveShape",
+            format!("`corners` must list corner indices 0–3 (0 top-left, 1 top-right, 2 bottom-right, 3 bottom-left), not {v}"),
+        )
+    };
+    let mut mask = [false; 4];
+    for k in v.as_array().ok_or_else(err)? {
+        let slot = k.as_u64().and_then(|k| mask.get_mut(usize::try_from(k).ok()?)).ok_or_else(err)?;
+        *slot = true;
+    }
+    Ok(Some(mask))
+}
+
 fn set_live_shape(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = targets(s, p)?;
-    s.edit("Live Shape", |d, _| {
+    let corners = corners_param(p)?;
+    let kind = p
+        .get("kind")
+        .filter(|v| !v.is_null())
+        .map(|v| {
+            serde_json::from_value::<CornerKind>(v.clone())
+                .map_err(|_| bad("object.setLiveShape", format!("`kind` must be \"round\", \"invertedRound\" or \"chamfer\", not {v}")))
+        })
+        .transpose()?;
+    let radius = p.get("radius").and_then(Value::as_f64);
+    s.edit("Live Shape", |d, sel| {
         for id in &ids {
             let Some(NodeKind::Path { path, live: Some(live), .. }) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
+            // Radii are document lengths and corners circular, also on a rectangle from a file
+            // that kept an uneven scale in its transform (#442).
+            live.fold_scale();
+            let partial = sel.anchors.get_mut(id);
+            let picked = corners.unwrap_or_else(|| live.picked_corners(partial.as_deref()));
+            let (layout, selected) = (live.anchor_corners(), partial.as_deref().map(|a| live.corners_of(a)));
             match live {
-                vectorcraft_doc::LiveShape::Rectangle { radii, .. } => {
-                    if let Some(r) = p.get("radius").and_then(Value::as_f64) {
-                        *radii = [r.max(0.0); 4];
+                vectorcraft_doc::LiveShape::Rectangle { radii, kinds, .. } => {
+                    for ((_, r), k) in picked.iter().zip(radii.iter_mut()).zip(kinds.iter_mut()).filter(|((on, _), _)| **on) {
+                        if let Some(radius) = radius {
+                            *r = radius.max(0.0);
+                        }
+                        if let Some(kind) = kind {
+                            *k = kind;
+                        }
                     }
                 }
                 vectorcraft_doc::LiveShape::Polygon { sides, .. } => {
@@ -981,6 +1063,12 @@ fn set_live_shape(s: &mut Session, p: &Value) -> Result<Value> {
                 _ => {}
             }
             *path = live.to_path();
+            // Direct-Selected corners stay selected as they gain or lose anchors.
+            if let (Some(anchors), Some(selected)) = (partial, selected)
+                && live.anchor_corners() != layout
+            {
+                *anchors = live.corner_anchors(selected);
+            }
         }
         Ok(())
     })?;

crates/engine/src/cmd/package.rs

@@ -4,12 +4,11 @@
 //! report). The packaged document links to the copies (Relink); the open document doesn't change.
 //! Without a folder (the web, agents) the same files come back as a zip archive.
 
-use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::collections::{BTreeMap, HashSet};
 use std::io::Write;
 use std::path::Path;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, Node, NodeKind};
 
 use super::fileio::{create_dir, write_file};
 use super::*;
@@ -51,21 +50,6 @@ fn font_ext(bytes: &[u8]) -> &'static str {
     }
 }
 
-/// The fonts (family, style) of the type in the layers and symbols of `d`.
-fn used_fonts(d: &Document) -> BTreeSet<(String, String)> {
-    let mut fonts = BTreeSet::new();
-    let mut add = |n: &Node| {
-        if let NodeKind::Text(t) = &n.kind {
-            fonts.extend(t.runs.iter().map(|r| (r.style.font_family.clone(), r.style.font_style.clone())));
-        }
-    };
-    d.walk(&mut add);
-    for s in &d.symbols {
-        s.art.walk(&mut add);
-    }
-    fonts
-}
-
 /// The options of a package.
 struct Options {
     copy_links: bool,
@@ -123,7 +107,7 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
         let db = vectorcraft_text::FontDb::global();
         let mut files = HashSet::new();
         lines.push("FONTS".to_string());
-        for (family, style) in used_fonts(&st.doc) {
+        for (family, style) in super::fonts::used_fonts(&st.doc) {
             let font = format!("{family} {style}");
             let reason = match db.face(&family, &style) {
                 Some(f) if f.family.eq_ignore_ascii_case(&family) && f.embeddable() => {

crates/engine/src/cmd/panelcmds.rs

@@ -24,7 +24,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character / Paragraph",
             [],
             None,
-            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character)}",
+            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\" (where characters smaller than the largest on their line line up with it)}",
             has_doc,
             set_format
         ),
@@ -113,11 +113,14 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
         "hyphenate",
         "mojikumi",
         "direction",
+        "leadingModel",
+        "charAlign",
     ];
     if !keys.iter().any(|k| p.get(*k).is_some()) {
         return Err(bad(C, "nothing to change"));
     }
     let (position, small_caps) = super::docsetup::script_params(p, &s.doc()?.doc.setup, C)?;
+    let char_align = super::textedit::char_align_param(p, C)?;
     let mojikumi = match p.get("mojikumi") {
         None => None,
         Some(v) => Some(match v.as_str() {
@@ -135,6 +138,14 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             _ => return Err(bad(C, "`direction` must be \"auto\", \"leftToRight\" or \"rightToLeft\"")),
         }),
     };
+    let leading_model = match p.get("leadingModel") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("romanBaseline") => vectorcraft_doc::LeadingModel::RomanBaseline,
+            Some("emBoxTop") => vectorcraft_doc::LeadingModel::EmBoxTop,
+            _ => return Err(bad(C, "`leadingModel` must be \"romanBaseline\" or \"emBoxTop\"")),
+        }),
+    };
     s.edit("Character", |d, _| {
         for id in &ids {
             let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
@@ -170,6 +181,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
                 if let Some(v) = small_caps {
                     st.small_caps = v;
                 }
+                if let Some(v) = char_align {
+                    st.char_align = v;
+                }
             }
             let para = &mut t.para;
             if let Some(v) = num("leftIndent") {
@@ -196,6 +210,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = direction {
                 para.direction = v;
             }
+            if let Some(v) = leading_model {
+                para.leading_model = v;
+            }
             super::typecmd::refresh_bounds(t);
         }
         Ok(())

crates/engine/src/cmd/prefscmds.rs

@@ -130,6 +130,7 @@ pub const PREF_SPECS: &[PrefSpec] = &[
     p!("scaleCorners", "General", "Options", "Scale Corners", bool),
     p!("scaleStrokes", "General", "Options", "Scale Strokes & Effects", bool),
     p!("zoomWithMouseWheel", "General", "Options", "Zoom with Mouse Wheel", bool),
+    p!("scrubNumericFields", "General", "Options", "Scrub Numeric Fields by Dragging", bool),
     // Selection & Anchor Display
     p!("selectionTolerance", "Selection & Anchor Display", "Selection", "Tolerance", num(1.0, 8.0, "px")),
     p!("objectSelectionByPathOnly", "Selection & Anchor Display", "Selection", "Object Selection by Path Only", bool),

crates/engine/src/cmd/recovery.rs

@@ -13,9 +13,17 @@
 //!
 //! Every running app (each browser tab) keeps its copies in an area of its own, `<area>/…`, and
 //! holds it while it runs: a lock on the area for its lifetime where the store has locks (folders:
-//! [`FolderStore`]), else a heartbeat it refreshes ([`heartbeat`]; browser storage). Only areas
-//! nobody holds any more (their app is gone) are offered, and while their copies are restored or
-//! discarded the area is held, so two apps launched together never both take it.
+//! [`FolderStore`]), else a heartbeat it refreshes ([`heartbeat`]; browser storage) plus, where the
+//! store can, an announcement that lasts as long as the app ([`RecoveryStore::announce`]: the
+//! browser's Web Locks). Only areas nobody holds any more (their app is gone) are offered, and
+//! while their copies are restored or discarded the area is held, so two apps launched together
+//! never both take it.
+//!
+//! A heartbeat alone can't tell a gone app from one whose timers stopped (a background tab), so
+//! when unsure an area counts as held, and its app repairs what another app did meanwhile: each
+//! heartbeat and each recovery save write again the copies missing from its area ([`repair`]), and
+//! a heartbeat newer than the one another app wrote when taking the area over marks it running
+//! again.
 //!
 //! Each copy is two entries: `<area>/<file>.vectorcraft` (the native document, written as a save
 //! writes it) and `<area>/<file>.json` (its title, original path and format, and when it was
@@ -86,6 +94,17 @@ pub trait RecoveryStore: Send + Sync {
     fn lock(&self, _area: &str) -> std::result::Result<Lock, String> {
         Ok(Lock::Unsupported)
     }
+    /// Stores without locks: also hold area `area` in a way other apps can see that lasts exactly as
+    /// long as this app runs, if the store has one (the browser's Web Locks) → it, until dropped.
+    fn announce(&self, _area: &str) -> Option<Hold> {
+        None
+    }
+    /// Stores without locks: does a running app hold area `area` by [`RecoveryStore::announce`]?
+    /// `None`: the store can't tell (heartbeats alone decide). A store that can tell but isn't sure
+    /// right now says `Some(true)`: a copy kept loses nothing, one deleted may.
+    fn announced(&self, _area: &str) -> Option<bool> {
+        None
+    }
     /// Tidy away area `area` once it holds no copies and nobody holds it (its lock file and folder).
     fn remove_area(&self, _area: &str) {}
     /// The clock heartbeats are judged by (Unix seconds; `None`: none, so no area counts as gone).
@@ -96,17 +115,19 @@ pub trait RecoveryStore: Send + Sync {
 
 /// A store in memory (tests, and hosts without storage). Areas are locked in memory, so sessions
 /// sharing one store behave like apps sharing a folder; [`MemoryStore::without_locks`] uses
-/// heartbeats like browser storage, judged by a clock tests set ([`MemoryStore::set_now`]).
+/// heartbeats like browser storage, judged by a clock tests set ([`MemoryStore::set_now`]), and
+/// [`MemoryStore::announcing`] adds announcements like the browser's Web Locks.
 pub struct MemoryStore {
     entries: Mutex<BTreeMap<String, Vec<u8>>>,
     held: Arc<Mutex<BTreeSet<String>>>,
     locks: bool,
+    announces: bool,
     now: Mutex<Option<i64>>,
 }
 
 impl Default for MemoryStore {
     fn default() -> Self {
-        Self { entries: Default::default(), held: Default::default(), locks: true, now: Mutex::new(Some(1_000_000)) }
+        Self { entries: Default::default(), held: Default::default(), locks: true, announces: false, now: Mutex::new(Some(1_000_000)) }
     }
 }
 
@@ -116,6 +137,19 @@ impl MemoryStore {
         Self { locks: false, ..Self::default() }
     }
 
+    /// A store without locks whose apps also announce the areas they hold for as long as they run
+    /// (as the browser's Web Locks do).
+    pub fn announcing() -> Self {
+        Self { announces: true, ..Self::without_locks() }
+    }
+
+    fn hold(&self, area: &str) -> Option<Hold> {
+        if !self.held.lock().unwrap_or_else(|e| e.into_inner()).insert(area.to_string()) {
+            return None;
+        }
+        Some(Box::new(MemoryHold { held: self.held.clone(), area: area.to_string() }))
+    }
+
     /// Set the clock heartbeats are judged by.
     pub fn set_now(&self, t: i64) {
         *self.now.lock().unwrap_or_else(|e| e.into_inner()) = Some(t);
@@ -160,10 +194,16 @@ impl RecoveryStore for MemoryStore {
         if !self.locks {
             return Ok(Lock::Unsupported);
         }
-        if !self.held.lock().unwrap_or_else(|e| e.into_inner()).insert(area.to_string()) {
-            return Ok(Lock::Busy);
+        Ok(self.hold(area).map_or(Lock::Busy, Lock::Held))
+    }
+    fn announce(&self, area: &str) -> Option<Hold> {
+        if !self.announces {
+            return None;
         }
-        Ok(Lock::Held(Box::new(MemoryHold { held: self.held.clone(), area: area.to_string() })))
+        self.hold(area)
+    }
+    fn announced(&self, area: &str) -> Option<bool> {
+        self.announces.then(|| self.held.lock().unwrap_or_else(|e| e.into_inner()).contains(area))
     }
     fn now(&self) -> Option<i64> {
         *self.now.lock().unwrap_or_else(|e| e.into_inner())
@@ -288,8 +328,11 @@ struct Own {
     /// The store it is in (copies are removed from there even after the preference moves on).
     store: Arc<dyn RecoveryStore>,
     area: String,
-    /// The lock held for the session's lifetime; none in stores with heartbeats.
+    /// What holds the area for the session's lifetime: its lock, else its announcement (stores
+    /// without locks that have them).
     hold: Option<Hold>,
+    /// Held with a heartbeat (stores without locks).
+    beats: bool,
 }
 
 /// The session's recovery store settings and its own area ([`crate::Session::recovery`]).
@@ -300,9 +343,10 @@ pub struct Recovery {
     /// The folder the desktop app keeps copies in when the `recoveryFolder` preference is empty.
     default_folder: Option<String>,
     own: Option<Own>,
-    /// Gone apps' areas this session took over by heartbeat (stores without locks), so its own
-    /// fresh heartbeat there doesn't make them look running.
-    adopted: BTreeSet<String>,
+    /// Gone apps' areas this session took over by heartbeat (stores without locks), with the
+    /// heartbeat it wrote there: that one doesn't make them look running, a newer one does (their
+    /// app was only paused and came back).
+    adopted: BTreeMap<String, i64>,
 }
 
 impl Recovery {
@@ -354,31 +398,52 @@ fn stale_after(s: &Session) -> i64 {
     (i64::from(s.prefs.autosave_interval.max(1)) * 180).max(MIN_STALE)
 }
 
-/// Record that `area`'s app runs (stores without locks).
-fn beat(store: &dyn RecoveryStore, area: &str) -> std::result::Result<(), String> {
+/// Record that `area`'s app runs (stores without locks) → the heartbeat written.
+fn beat(store: &dyn RecoveryStore, area: &str) -> std::result::Result<i64, String> {
     let now = store.now().ok_or("no clock to keep a heartbeat by")?;
-    store.write(&format!("{area}/{BEAT}"), now.to_string().as_bytes())
+    store.write(&format!("{area}/{BEAT}"), now.to_string().as_bytes())?;
+    Ok(now)
 }
 
-/// Has `area`'s app said it runs within `stale` seconds (stores without locks)? Without a clock
-/// every app counts as running.
-fn beating(store: &dyn RecoveryStore, area: &str, stale: i64) -> bool {
+/// Has `area`'s app said it runs within `stale` seconds (stores without locks)? `mine`: the
+/// heartbeat this session wrote there itself when taking the area over, which doesn't count.
+/// Without a clock every app counts as running.
+fn beating(store: &dyn RecoveryStore, area: &str, stale: i64, mine: Option<i64>) -> bool {
     let Some(now) = store.now() else { return true };
     let at = store.read(&format!("{area}/{BEAT}")).ok().and_then(|b| String::from_utf8(b).ok()).and_then(|t| t.trim().parse::<i64>().ok());
-    at.is_some_and(|t| now.saturating_sub(t) <= stale)
+    at.is_some_and(|t| now.saturating_sub(t) <= stale && Some(t) != mine)
 }
 
-/// Refresh this session's heartbeat in a store without locks (the app does this every
-/// [`HEARTBEAT_EVERY`] seconds). Best effort: a missed beat only lets another app offer the copies
-/// once three intervals have passed.
-pub fn heartbeat(s: &Session) {
-    if let Some(own) = s.recovery.own.as_ref().filter(|o| o.hold.is_none()) {
+/// Refresh this session's hold on its area (the app does this every [`HEARTBEAT_EVERY`] seconds,
+/// so also on its first frame after its timers were paused): its heartbeat in a store without
+/// locks, and its copies ([`repair`]) → the documents whose copies went missing (write them now).
+/// Best effort: a missed beat only lets another app offer the copies once three intervals have
+/// passed.
+pub fn heartbeat(s: &mut Session) -> Vec<u64> {
+    if let Some(own) = s.recovery.own.as_ref().filter(|o| o.beats) {
         let _ = beat(own.store.as_ref(), &own.area);
     }
+    repair(s)
+}
+
+/// Forget this session's copies that are missing from its area, so the next recovery save writes
+/// them again → their documents' uids. Another app removes them only when it took this one for
+/// gone (its heartbeat stopped while its timers were paused, as browsers do to background tabs); a
+/// copy it restored is its own now, so both are kept. A store that can't be listed changes nothing.
+pub fn repair(s: &mut Session) -> Vec<u64> {
+    let Some(names) = s.recovery.own.as_ref().and_then(|o| o.store.list().ok()) else { return vec![] };
+    let mut lost = vec![];
+    for st in &mut s.docs {
+        if st.recovery.as_ref().is_some_and(|c| !names.iter().any(|n| n.strip_suffix(DOC_EXT) == Some(c.file.as_str()))) {
+            st.recovery = None;
+            lost.push(st.uid);
+        }
+    }
+    lost
 }
 
 /// This session's area in `store`, taken now if it has none there yet: a fresh area, held for the
-/// session's lifetime (locked, or with a heartbeat).
+/// session's lifetime (locked, or with a heartbeat and an announcement where the store has them).
 pub fn claim(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<String> {
     if let Some(own) = &s.recovery.own {
         if own.store.location() == store.location() {
@@ -394,15 +459,15 @@ pub fn claim(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<String>
         if taken.contains(&area) {
             continue;
         }
-        let hold = match store.lock(&area).map_err(EngineError::Other)? {
-            Lock::Held(h) => Some(h),
+        let (hold, beats) = match store.lock(&area).map_err(EngineError::Other)? {
+            Lock::Held(h) => (Some(h), false),
             Lock::Busy => continue,
             Lock::Unsupported => {
                 beat(store.as_ref(), &area).map_err(EngineError::Other)?;
-                None
+                (store.announce(&area), true)
             }
         };
-        s.recovery.own = Some(Own { store: store.clone(), area: area.clone(), hold });
+        s.recovery.own = Some(Own { store: store.clone(), area: area.clone(), hold, beats });
         return Ok(area);
     }
     Err(EngineError::Other("no free recovery area".into()))
@@ -413,7 +478,7 @@ pub fn release(s: &mut Session) {
     for st in &mut s.docs {
         st.recovery = None;
     }
-    let Some(Own { store, area, hold }) = s.recovery.own.take() else { return };
+    let Some(Own { store, area, hold, .. }) = s.recovery.own.take() else { return };
     let mine = |n: &String| n.split_once('/').is_some_and(|(a, _)| a == area);
     for name in store.list().unwrap_or_default().iter().filter(|n| mine(n)) {
         let _ = store.remove(name);
@@ -422,6 +487,22 @@ pub fn release(s: &mut Session) {
     store.remove_area(&area);
 }
 
+/// Let go of this session's area but leave its copies, as a crash would, so the next app started
+/// offers them at once instead of waiting for the heartbeat to go stale: for an app that can't go
+/// on (the web page lost its graphics and has to be reloaded). Its documents keep no copies.
+pub fn leave(s: &mut Session) {
+    for st in &mut s.docs {
+        st.recovery = None;
+    }
+    let Some(Own { store, area, hold, beats }) = s.recovery.own.take() else { return };
+    if beats {
+        // Best effort: if the heartbeat stays, the copies are offered once it is stale.
+        let _ = store.remove(&format!("{area}/{BEAT}"));
+    }
+    // The lock or announcement goes too.
+    drop(hold);
+}
+
 /// A document's recovery copy: its entry and the document it holds.
 #[derive(Clone, Debug)]
 pub struct RecoveryCopy {
@@ -531,6 +612,8 @@ fn fresh_name(area: &str, stem: &str, taken: &[String]) -> String {
 /// when it has none and a copy is needed) → (jobs, skipped: `[{title, reason}]` for modified
 /// documents that get none).
 pub fn jobs(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<(Vec<RecoveryJob>, Vec<Value>)> {
+    // Copies another app removed are written again.
+    repair(s);
     let skipped: Vec<Value> = s
         .documents()
         .iter()
@@ -628,7 +711,9 @@ enum Owner {
 
 /// Whose `area` of `store` is. A gone app's area is held by the caller (its lock in `hold` until
 /// dropped) and, with `take` in a store without locks, taken over with a fresh heartbeat, so
-/// another app leaves it alone meanwhile.
+/// another app leaves it alone meanwhile. In a store without locks an area is gone only when
+/// nothing says its app runs: no announcement (or the store can't tell) and no heartbeat for three
+/// intervals but the one this session wrote taking it over.
 fn owner(s: &mut Session, store: &dyn RecoveryStore, area: &str, hold: &mut Vec<Hold>, take: bool) -> Owner {
     if s.recovery.own.as_ref().is_some_and(|o| o.area == area && o.store.location() == store.location()) {
         return Owner::Mine;
@@ -640,14 +725,12 @@ fn owner(s: &mut Session, store: &dyn RecoveryStore, area: &str, hold: &mut Vec<
         }
         Ok(Lock::Busy) | Err(_) => Owner::Running,
         Ok(Lock::Unsupported) => {
-            if !s.recovery.adopted.contains(area) && beating(store, area, stale_after(s)) {
+            if store.announced(area).unwrap_or(false) || beating(store, area, stale_after(s), s.recovery.adopted.get(area).copied()) {
                 return Owner::Running;
             }
-            if take {
-                // Best effort: without it another app might offer the copies too, which loses
-                // nothing.
-                let _ = beat(store, area);
-                s.recovery.adopted.insert(area.to_string());
+            // Best effort: without it another app might offer the copies too, which loses nothing.
+            if take && let Ok(t) = beat(store, area) {
+                s.recovery.adopted.insert(area.to_string(), t);
             }
             Owner::Gone
         }

crates/engine/src/cmd/select.rs

@@ -3,13 +3,22 @@
 use std::collections::BTreeSet;
 
 use serde_json::{Value, json};
+use vectorcraft_color::Paint;
 use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
 
 use super::*;
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
-        cmd!("select.all", "All", ["Select"], Some("Cmd+A"), "{}", has_doc, all),
+        cmd!(
+            "select.all",
+            "All",
+            ["Select"],
+            Some("Cmd+A"),
+            "{} → {count}; while the Type tool edits text, all of that text instead → {editing, start, end} (byte offsets)",
+            has_doc,
+            all
+        ),
         cmd!("select.allOnArtboard", "All on Active Artboard", ["Select"], Some("Cmd+Alt+A"), "{artboard?: index}", has_doc, all_on_artboard),
         cmd!("select.none", "Deselect", ["Select"], Some("Cmd+Shift+A"), "{}", has_doc, none),
         cmd!("select.reselect", "Reselect", ["Select"], Some("Cmd+6"), "{}", has_doc, reselect),
@@ -22,26 +31,50 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("select.key", "Set Key Object", [], None, "{id?} (none clears)", has_doc, key),
         cmd!("select.anchors", "Select Anchors", [], None, "{id, anchors: [[subpath, anchor]…], mode: \"set\"|\"add\"|\"toggle\"}", has_doc, anchors),
         cmd!("select.anchorsMany", "Select Anchors", [], None, "{items: [{id, anchors}], add?: bool}", has_doc, anchors_many),
-        cmd!("select.same.fillColor", "Fill Color", ["Select", "Same"], None, "{}", has_selection, |s, _| same(
-            s,
+        cmd!(
             "select.same.fillColor",
-            |a, b| a.appearance.fill_paint() == b.appearance.fill_paint()
-        )),
-        cmd!("select.same.strokeColor", "Stroke Color", ["Select", "Same"], None, "{}", has_selection, |s, _| same(
-            s,
+            "Fill Color",
+            ["Select", "Same"],
+            None,
+            "{} the objects filled with the first selected object's fill colour (any tint of its global or spot swatch, the same tint with prefs selectSameTintPercent)",
+            has_selection,
+            |s, _| {
+                let tint = s.prefs.select_same_tint_percent;
+                same(s, "select.same.fillColor", |a, b| same_paint(&a.appearance.fill_paint(), &b.appearance.fill_paint(), tint))
+            }
+        ),
+        cmd!(
             "select.same.strokeColor",
-            |a, b| a.appearance.stroke_paint() == b.appearance.stroke_paint()
-        )),
+            "Stroke Color",
+            ["Select", "Same"],
+            None,
+            "{} the objects stroked with the first selected object's stroke colour (tints as select.same.fillColor)",
+            has_selection,
+            |s, _| {
+                let tint = s.prefs.select_same_tint_percent;
+                same(s, "select.same.strokeColor", |a, b| same_paint(&a.appearance.stroke_paint(), &b.appearance.stroke_paint(), tint))
+            }
+        ),
         cmd!("select.same.strokeWeight", "Stroke Weight", ["Select", "Same"], None, "{}", has_selection, |s, _| same(
             s,
             "select.same.strokeWeight",
             |a, b| (a.appearance.stroke_width() - b.appearance.stroke_width()).abs() < 1e-9
         )),
-        cmd!("select.same.fillAndStroke", "Fill & Stroke", ["Select", "Same"], None, "{}", has_selection, |s, _| same(
-            s,
+        cmd!(
             "select.same.fillAndStroke",
-            |a, b| a.appearance.fill_paint() == b.appearance.fill_paint() && a.appearance.stroke_paint() == b.appearance.stroke_paint()
-        )),
+            "Fill & Stroke",
+            ["Select", "Same"],
+            None,
+            "{} the objects with the first selected object's fill and stroke colours (tints as select.same.fillColor)",
+            has_selection,
+            |s, _| {
+                let tint = s.prefs.select_same_tint_percent;
+                same(s, "select.same.fillAndStroke", |a, b| {
+                    let (x, y) = (&a.appearance, &b.appearance);
+                    same_paint(&x.fill_paint(), &y.fill_paint(), tint) && same_paint(&x.stroke_paint(), &y.stroke_paint(), tint)
+                })
+            }
+        ),
         cmd!("select.same.opacity", "Opacity", ["Select", "Same"], None, "{}", has_selection, |s, _| same(s, "select.same.opacity", |a, b| (a
             .opacity
             - b.opacity)
@@ -107,6 +140,18 @@ fn selectable(d: &Document, iso: Option<NodeId>) -> Vec<NodeId> {
 }
 
 fn all(s: &mut Session, _: &Value) -> Result<Value> {
+    // While the Type tool edits text, Select All takes all of that text and leaves the art
+    // selection as it is (Illustrator: text cursor in a text object).
+    if s.tool_wants_text() {
+        s.set_tool_option("selectAll", &json!(true));
+        let editing = s.tool_options()["editing"].clone();
+        let id = editing.as_u64().map(NodeId);
+        let end = id.and_then(|id| match &s.doc().ok()?.doc.node(id)?.kind {
+            NodeKind::Text(t) => Some(t.plain_text().len()),
+            _ => None,
+        });
+        return Ok(json!({ "editing": editing, "start": 0, "end": end.unwrap_or(0) }));
+    }
     let st = s.doc()?;
     let ids = selectable(&st.doc, st.isolation);
     s.select(|_, sel| sel.set(ids.iter().copied()))?;
@@ -235,7 +280,16 @@ fn anchors_many(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
-fn same(s: &mut Session, cmd: &str, eq: fn(&Node, &Node) -> bool) -> Result<Value> {
+/// Select › Same › Fill/Stroke Color: is `a` the same colour as `b`? Tints of one global or spot
+/// swatch are, unless `tint` (General › Select Same Tint %) asks for the same tint too.
+fn same_paint(a: &Paint, b: &Paint, tint: bool) -> bool {
+    match (a, b) {
+        (Paint::Solid { swatch: Some(x), tint: ta, .. }, Paint::Solid { swatch: Some(y), tint: tb, .. }) if x == y => !tint || (ta - tb).abs() < 1e-4,
+        _ => a == b,
+    }
+}
+
+fn same(s: &mut Session, cmd: &str, eq: impl Fn(&Node, &Node) -> bool) -> Result<Value> {
     let st = s.doc()?;
     let refn = st.selection.objects.first().and_then(|id| st.doc.node(*id)).cloned().ok_or_else(|| bad(cmd, "nothing selected"))?;
     select_where(s, cmd, &json!({}), |_, n| !n.is_container() && eq(n, &refn))

crates/engine/src/cmd/textedit.rs

@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character",
             [],
             None,
-            "{id, start?: byte, end?: byte (default: all text), font?, style?, size?: pt, leading?: pt|\"auto\", tracking?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, fill?: colour|\"none\", stroke?: colour|\"none\", strokeWidth?: pt, strokeOptions?: {weight?, cap?, join?, miterLimit?, dash?, dashOffset?, alignDashes?} (as stroke.set: the character stroke), underline?, strikethrough?, allCaps?: bool, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), features?: [\"dlig\", \"-liga\", …]} style a character range (runs are split at the range ends) → {id, runs}",
+            "{id, start?: byte, end?: byte (default: all text), font?, style?, size?: pt, leading?: pt|\"auto\", tracking?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, fill?: colour|\"none\", stroke?: colour|\"none\", strokeWidth?: pt, strokeOptions?: {weight?, cap?, join?, miterLimit?, dash?, dashOffset?, alignDashes?} (as stroke.set: the character stroke), underline?, strikethrough?, allCaps?: bool, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), features?: [\"dlig\", \"-liga\", …], charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"} style a character range (runs are split at the range ends) → {id, runs}",
             has_doc,
             set_range_style
         ),
@@ -45,7 +45,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Area / Path Type",
             [],
             None,
-            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id}",
+            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?, placeholder?: bool (placeholder text instead, as text.create)} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id}",
             has_doc,
             create_in_path
         ),
@@ -58,6 +58,33 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             fit_headline
         ),
+        cmd!(
+            "type.step",
+            "Step Type",
+            [],
+            None,
+            "{attribute: \"size\"|\"leading\"|\"tracking\"|\"kerning\"|\"baselineShift\", by?: steps (1; negative steps down), id?, start?: byte, end?: byte} step type by the Preferences › Type increments (size and leading: typeSizeIncrement, pt; tracking and kerning: trackingIncrement, 1/1000 em; baseline shift: baselineShiftIncrement, pt), what the Type tool's Alt+arrows do (Cmd/Ctrl too: five steps; ←/→ kerning at the caret or tracking of the selection, ↑/↓ leading, Shift+↑/↓ baseline shift). The range of `id`, else the text the Type tool has selected (at a caret: kerning steps the character before it, leading its paragraph), else every selected type object → {ids}",
+            has_doc,
+            type_step
+        ),
+        cmd!(
+            "type.size.increase",
+            "Increase Font Size",
+            [],
+            Some("Cmd+Shift+."),
+            "{by?: steps (1)} type.step {attribute: size}",
+            has_selection,
+            |s, p| type_step(s, &json!({"attribute": "size", "by": f64_or(p, "by", 1.0)}))
+        ),
+        cmd!(
+            "type.size.decrease",
+            "Decrease Font Size",
+            [],
+            Some("Cmd+Shift+,"),
+            "{by?: steps (1)} type.step {attribute: size, by: -by}",
+            has_selection,
+            |s, p| type_step(s, &json!({"attribute": "size", "by": -f64_or(p, "by", 1.0)}))
+        ),
         cmd!(
             "text.discardEmpty",
             "Discard Empty Type",
@@ -151,6 +178,7 @@ pub(crate) struct CharChange {
     features: Option<Vec<String>>,
     position: Option<vectorcraft_doc::CharPosition>,
     small_caps: Option<Option<f64>>,
+    char_align: Option<vectorcraft_doc::CharAlign>,
 }
 
 /// `features: ["dlig", "-liga", …]` → the canonical tag list (differences from the defaults).
@@ -163,6 +191,19 @@ pub(crate) fn features_param(p: &Value, cmd: &str) -> Result<Option<Vec<String>>
     Ok(Some(vectorcraft_text::OtFeatures::default().with_tags(tags).to_tags()))
 }
 
+/// `charAlign: "romanBaseline"|"emBoxTop"|"emBoxCenter"|"emBoxBottom"` (Character Alignment).
+pub(crate) fn char_align_param(p: &Value, cmd: &str) -> Result<Option<vectorcraft_doc::CharAlign>> {
+    use vectorcraft_doc::CharAlign;
+    let Some(v) = p.get("charAlign").filter(|v| !v.is_null()) else { return Ok(None) };
+    Ok(Some(match v.as_str() {
+        Some("romanBaseline") => CharAlign::RomanBaseline,
+        Some("emBoxTop") => CharAlign::EmBoxTop,
+        Some("emBoxCenter") => CharAlign::EmBoxCenter,
+        Some("emBoxBottom") => CharAlign::EmBoxBottom,
+        _ => return Err(bad(cmd, "`charAlign` must be \"romanBaseline\", \"emBoxTop\", \"emBoxCenter\" or \"emBoxBottom\"")),
+    }))
+}
+
 fn paint_param(p: &Value, k: &str, cmd: &str) -> Result<Option<Paint>> {
     match p.get(k) {
         None | Some(Value::Null) => Ok(None),
@@ -213,6 +254,7 @@ impl CharChange {
             features: features_param(p, cmd)?,
             position,
             small_caps,
+            char_align: char_align_param(p, cmd)?,
         };
         if c.size.is_some_and(|v| v <= 0.0) {
             return Err(bad(cmd, "size must be positive"));
@@ -240,6 +282,7 @@ impl CharChange {
             && self.features.is_none()
             && self.position.is_none()
             && self.small_caps.is_none()
+            && self.char_align.is_none()
     }
 
     pub(crate) fn apply(&self, st: &mut CharStyle) {
@@ -310,6 +353,48 @@ impl CharChange {
         if let Some(v) = self.small_caps {
             st.small_caps = v;
         }
+        if let Some(v) = self.char_align {
+            st.char_align = v;
+        }
+    }
+}
+
+/// Type › Enable Missing Glyph Protection: after a font change, the characters of `runs` their new
+/// font has no glyph for, but their font `before` the change had, keep that font.
+pub(crate) fn protect_missing_glyphs(before: &[TextRun], runs: &mut Vec<TextRun>) {
+    fn chars(runs: &[TextRun]) -> impl Iterator<Item = (usize, char, &CharStyle)> {
+        runs.iter()
+            .scan(0, |at, r| {
+                let start = *at;
+                *at += r.text.len();
+                Some(r.text.char_indices().map(move |(i, c)| (start + i, c, &r.style)))
+            })
+            .flatten()
+    }
+    let db = vectorcraft_text::FontDb::global();
+    let mut faces = std::collections::HashMap::new();
+    let mut covers = |st: &CharStyle, c: char| {
+        let face = faces.entry((st.font_family.clone(), st.font_style.clone())).or_insert_with(|| db.face(&st.font_family, &st.font_style));
+        face.as_ref().map(|f| f.covers(c))
+    };
+    // Byte ranges that keep a font (family, style).
+    let mut keep: Vec<(usize, usize, &CharStyle)> = vec![];
+    for ((at, c, old), (_, _, new)) in chars(before).zip(chars(runs)) {
+        let changed = (&old.font_family, &old.font_style) != (&new.font_family, &new.font_style);
+        if !changed || c.is_whitespace() || c.is_control() || covers(new, c) != Some(false) || covers(old, c) != Some(true) {
+            continue;
+        }
+        let end = at + c.len_utf8();
+        match keep.last_mut() {
+            Some((_, e, st)) if *e == at && (&st.font_family, &st.font_style) == (&old.font_family, &old.font_style) => *e = end,
+            _ => keep.push((at, end, old)),
+        }
+    }
+    for (a, b, old) in keep {
+        edit::style_range(runs, a, b, |st| {
+            st.font_family.clone_from(&old.font_family);
+            st.font_style.clone_from(&old.font_style);
+        });
     }
 }
 
@@ -320,6 +405,7 @@ fn set_range_style(s: &mut Session, p: &Value) -> Result<Value> {
     if change.is_empty() {
         return Err(bad(C, "nothing to change"));
     }
+    let protect = s.prefs.missing_glyph_protection && (change.font.is_some() || change.style.is_some());
     let t = text_ref(s, id)?;
     let (a, b) = range_of(p, edit::runs_len(&t.runs));
     let n = s.edit("Character", |d, _| {
@@ -328,7 +414,11 @@ fn set_range_style(s: &mut Session, p: &Value) -> Result<Value> {
             // An empty range inside text styles nothing (Illustrator keeps it for the next typing).
             return Ok(t.runs.len());
         }
+        let before = protect.then(|| t.runs.clone());
         edit::style_range(&mut t.runs, a, b, |st| change.apply(st));
+        if let Some(before) = before {
+            protect_missing_glyphs(&before, &mut t.runs);
+        }
         refresh_bounds(t);
         Ok(t.runs.len())
     })?;
@@ -363,10 +453,10 @@ fn create_in_path(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let text = str_param(p, "text").unwrap_or("").to_string();
     let start = match point_param(p, "at") {
-        Some(at) if on_path => vectorcraft_text::path_fraction_at(&path.to_bezpath(), at).0,
+        Some(at) if on_path => vectorcraft_geom::ArcPath::new(path).fraction_at(at).unwrap_or(0.0),
         _ => 0.0,
     };
-    let kind = if on_path { TextKind::OnPath { path: path.clone(), start } } else { TextKind::Area { frame: path.clone() } };
+    let kind = if on_path { TextKind::OnPath { path: path.clone(), start, end: None } } else { TextKind::Area { frame: path.clone() } };
     let mut t = TextObject {
         vertical: p.get("vertical").and_then(Value::as_bool).unwrap_or(false),
         kind,
@@ -375,10 +465,16 @@ fn create_in_path(s: &mut Session, p: &Value) -> Result<Value> {
         para: super::create::new_type_para(),
         area: Default::default(),
         path_effect: Default::default(),
+        path_align: Default::default(),
+        path_spacing: 0.0,
         wrap: Vec::new(),
         cached_bounds: None,
     };
-    refresh_bounds(&mut t);
+    if bool_or(p, "placeholder", false) {
+        super::typemenu::fill_with_placeholder(&mut t);
+    } else {
+        refresh_bounds(&mut t);
+    }
     let id = s.edit(if on_path { "Type on a Path" } else { "Area Type" }, |d, sel| {
         let (par, idx, _) = d.position(pid).ok_or(EngineError::NoNode(pid))?;
         d.remove(pid)?;
@@ -394,6 +490,95 @@ fn create_in_path(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"id": id.0}))
 }
 
+/// What `type.step` changes.
+#[derive(Clone, Copy, PartialEq)]
+enum Step {
+    Size,
+    Leading,
+    Tracking,
+    Kerning,
+    BaselineShift,
+}
+
+/// The Type tool's selected text while it edits (its typing session ends first: one undo step).
+fn editing_range(s: &mut Session) -> Result<Option<(NodeId, usize, usize)>> {
+    let o = s.tool_options();
+    let Some(id) = o.get("editing").and_then(Value::as_u64).map(NodeId) else { return Ok(None) };
+    if super::edit::typing_in_progress(s) {
+        s.set_tool_option("commitTyping", &Value::Bool(true));
+        s.commit_interaction()?;
+    }
+    let at = |k: &str| byte_param(&o, k).unwrap_or(0);
+    Ok(Some((id, at("start"), at("end"))))
+}
+
+fn type_step(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "type.step";
+    let step = match str_param(p, "attribute") {
+        Some("size") => Step::Size,
+        Some("leading") => Step::Leading,
+        Some("tracking") => Step::Tracking,
+        Some("kerning") => Step::Kerning,
+        Some("baselineShift") => Step::BaselineShift,
+        _ => return Err(bad(C, "attribute must be size|leading|tracking|kerning|baselineShift")),
+    };
+    let by = f64_or(p, "by", 1.0);
+    if !by.is_finite() {
+        return Err(bad(C, "by must be a number"));
+    }
+    let prefs = &s.prefs;
+    let inc = by.clamp(-1000.0, 1000.0)
+        * match step {
+            Step::Size | Step::Leading => prefs.type_size_increment,
+            Step::Tracking | Step::Kerning => prefs.tracking_increment,
+            Step::BaselineShift => prefs.baseline_shift_increment,
+        };
+    // (text, its range; None: all of it).
+    let targets: Vec<(NodeId, Option<(usize, usize)>)> = match id_param(p, "id") {
+        Some(id) => vec![(id, Some(range_of(p, edit::runs_len(&text_ref(s, id)?.runs))))],
+        None => match editing_range(s)? {
+            Some((id, a, b)) => vec![(id, Some((a.min(b), a.max(b))))],
+            None => super::typecmd::text_targets(s, p, C)?.into_iter().map(|id| (id, None)).collect(),
+        },
+    };
+    // The ranges stepped. At a caret: kerning is the space after the character before it, leading
+    // the paragraph's; the rest wait for a selection.
+    let mut ranges = vec![];
+    for (id, range) in targets {
+        let text = text_ref(s, id)?.plain_text();
+        let (a, b) = range.map_or((0, text.len()), |(a, b)| (a.min(text.len()), b.min(text.len())));
+        let (a, b) = match step {
+            _ if a < b => (a, b),
+            Step::Kerning => (edit::prev_char(&text, a), a),
+            Step::Leading => {
+                let para = edit::paragraph_at(&text, a);
+                (para.start, para.end)
+            }
+            _ => continue,
+        };
+        if a < b {
+            ranges.push((id, a, b));
+        }
+    }
+    if !ranges.is_empty() {
+        s.edit("Character", |d, _| {
+            for &(id, a, b) in &ranges {
+                let t = text_mut(d, id).ok_or(EngineError::NoNode(id))?;
+                edit::style_range(&mut t.runs, a, b, |st| match step {
+                    Step::Size => st.size = (st.size + inc).clamp(0.1, 1296.0),
+                    Step::Leading => st.leading = Some((st.effective_leading() + inc).clamp(0.1, 5000.0)),
+                    Step::Tracking => st.tracking = (st.tracking + inc).clamp(-1000.0, 10000.0),
+                    Step::Kerning => st.kerning = Some((st.kerning.unwrap_or(0.0) + inc).clamp(-1000.0, 10000.0)),
+                    Step::BaselineShift => st.baseline_shift = (st.baseline_shift + inc).clamp(-1296.0, 1296.0),
+                });
+                refresh_bounds(t);
+            }
+            Ok(())
+        })?;
+    }
+    Ok(json!({ "ids": ranges.iter().map(|(id, ..)| id.0).collect::<Vec<_>>() }))
+}
+
 /// Tracking (1/1000 em) that makes the first paragraph of `t` exactly `target` wide, if it fits
 /// on one line at all.
 fn headline_tracking(t: &TextObject, target: f64) -> Option<f64> {
@@ -412,6 +597,8 @@ fn headline_tracking(t: &TextObject, target: f64) -> Option<f64> {
             para: Default::default(),
             area: Default::default(),
             path_effect: Default::default(),
+            path_align: Default::default(),
+            path_spacing: 0.0,
             wrap: Vec::new(),
             cached_bounds: None,
         };

crates/engine/src/cmd/typecmd.rs

@@ -238,9 +238,11 @@ fn set_style(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "nothing to change"));
     }
     let ids = text_targets(s, p, C)?;
+    let protect = s.prefs.missing_glyph_protection && (font.is_some() || style.is_some());
     s.edit("Character", |d, _| {
         for id in &ids {
             let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
+            let before = protect.then(|| t.runs.clone());
             for r in &mut t.runs {
                 let st = &mut r.style;
                 if let Some(f) = &font {
@@ -265,6 +267,9 @@ fn set_style(s: &mut Session, p: &Value) -> Result<Value> {
                     st.features = f.clone();
                 }
             }
+            if let Some(before) = before {
+                super::textedit::protect_missing_glyphs(&before, &mut t.runs);
+            }
             if let Some(j) = justify {
                 t.para.justify = j;
             }
@@ -408,6 +413,57 @@ fn reshape_area(s: &mut Session, p: &Value) -> Result<Value> {
 mod area_tests {
     use super::*;
 
+    #[test]
+    fn leading_model_is_set_per_paragraph_and_saved_only_when_top_to_top() {
+        use vectorcraft_doc::LeadingModel;
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+        let id = s.execute("text.create", &json!({"x": 10, "y": 10, "text": "一\n二", "area": {"width": 200, "height": 100}})).unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let text = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(id)).unwrap().kind {
+            NodeKind::Text(t) => (**t).clone(),
+            _ => panic!("text"),
+        };
+        assert_eq!(text(&s).para.leading_model, LeadingModel::RomanBaseline);
+        s.execute("select.set", &json!({"ids": [id]})).unwrap();
+        assert!(s.execute("text.setFormat", &json!({"leadingModel": "middle"})).is_err());
+        let before = text(&s).cached_bounds;
+        s.execute("text.setFormat", &json!({"leadingModel": "emBoxTop"})).unwrap();
+        let t = text(&s);
+        assert_eq!(t.para.leading_model, LeadingModel::EmBoxTop);
+        assert_ne!(t.cached_bounds, before, "the first line moves up to the frame's top");
+        assert_eq!(serde_json::to_value(&t.para).unwrap()["leading_model"], "emBoxTop");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert!(serde_json::to_value(&text(&s).para).unwrap().get("leading_model").is_none());
+    }
+
+    #[test]
+    fn character_alignment_is_a_character_attribute_saved_only_when_set() {
+        use vectorcraft_doc::CharAlign;
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+        let id = s.execute("text.create", &json!({"x": 10, "y": 50, "text": "雅楽"})).unwrap()["id"].as_u64().unwrap();
+        let runs = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(id)).unwrap().kind {
+            NodeKind::Text(t) => t.runs.clone(),
+            _ => panic!("text"),
+        };
+        assert_eq!(runs(&s)[0].style.char_align, CharAlign::RomanBaseline);
+        assert!(serde_json::to_value(&runs(&s)[0].style).unwrap().get("charAlign").is_none());
+        s.execute("select.set", &json!({"ids": [id]})).unwrap();
+        assert!(s.execute("text.setFormat", &json!({"charAlign": "middle"})).is_err());
+        s.execute("text.setFormat", &json!({"charAlign": "emBoxCenter"})).unwrap();
+        assert!(runs(&s).iter().all(|r| r.style.char_align == CharAlign::EmBoxCenter));
+        assert_eq!(serde_json::to_value(&runs(&s)[0].style).unwrap()["charAlign"], "emBoxCenter");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(runs(&s)[0].style.char_align, CharAlign::RomanBaseline);
+        // Characters selected with the Type tool: only the range takes it (雅 is 3 bytes).
+        assert!(s.execute("text.setRangeStyle", &json!({"id": id, "start": 3, "end": 6, "charAlign": "top"})).is_err());
+        s.execute("text.setRangeStyle", &json!({"id": id, "start": 3, "end": 6, "charAlign": "emBoxTop"})).unwrap();
+        let aligns: Vec<_> = runs(&s).iter().map(|r| (r.text.clone(), r.style.char_align)).collect();
+        assert_eq!(aligns, [("雅".to_string(), CharAlign::RomanBaseline), ("楽".to_string(), CharAlign::EmBoxTop)]);
+    }
+
     #[test]
     fn new_type_is_composed_with_line_end_half_width_punctuation() {
         use vectorcraft_doc::Mojikumi;

crates/engine/src/cmd/typemenu.rs

@@ -3,7 +3,7 @@
 //! commands of the Edit menu (Find and Replace, Find Next, Paste without Formatting).
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{CharStyle, Document, Justify, NodeId, NodeKind, Quotes, TextKind, TextRun};
+use vectorcraft_doc::{CharStyle, Document, Justify, NodeId, NodeKind, Quotes, TextKind, TextObject, TextRun};
 use vectorcraft_geom::{Affine, Rect, shapes};
 
 use super::typecmd::refresh_bounds;
@@ -52,7 +52,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Type on a Path Options…",
             ["Type", "Type on a Path"],
             None,
-            "{start?: 0..1 (fraction of the path length), flip?: bool (reverse the path), effect?: rainbow|skew|3dRibbon|stairStep|gravity, ids?}",
+            "{ids?, start?: 0..1, end?: 0..1|null, flip?: bool, effect?: rainbow|skew|3dRibbon|stairStep|gravity, alignToPath?: ascender|descender|center|baseline, spacing?: pt} set the selected type on a path's options: start and end place its start and end brackets as fractions of the path's length (end null: the end of the path, or once round a closed path), and flip then turns the type to the other side of its path (the path runs the other way, the brackets swap ends); none given: query → the first object's {start, end, flip: false, effect, alignToPath, spacing}",
             has_selection,
             path_options
         ),
@@ -343,38 +343,95 @@ fn to_point(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(ids_json(&ids))
 }
 
+/// The options `type.pathOptions` sets; with none of them given it queries.
+const PATH_OPTIONS: [&str; 6] = ["start", "end", "flip", "effect", "alignToPath", "spacing"];
+
+/// Type on a path's text, if `n` is type on a path.
+fn path_text(n: Option<&vectorcraft_doc::Node>) -> Option<&TextObject> {
+    match n.map(|n| &n.kind) {
+        Some(NodeKind::Text(t)) if matches!(t.kind, TextKind::OnPath { .. }) => Some(t),
+        _ => None,
+    }
+}
+
+/// Type on a Path Options of `t`, as `type.pathOptions` takes them (`flip` is an action: false).
+fn path_options_of(t: &TextObject) -> Value {
+    let (start, end) = match &t.kind {
+        TextKind::OnPath { start, end, .. } => (*start, *end),
+        _ => (0.0, None),
+    };
+    json!({
+        "start": start,
+        "end": end,
+        "flip": false,
+        "effect": t.path_effect.id(),
+        "alignToPath": t.path_align.id(),
+        "spacing": t.path_spacing,
+    })
+}
+
 fn path_options(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "type.pathOptions";
-    let ids = texts(s, p, C)?;
-    let start = p.get("start").and_then(Value::as_f64);
+    let ids: Vec<NodeId> = {
+        let d = &s.doc()?.doc;
+        texts(s, p, C)?.into_iter().filter(|i| path_text(d.node(*i)).is_some()).collect()
+    };
+    let first = *ids.first().ok_or_else(|| bad(C, "select type on a path"))?;
+    let options = |s: &Session| -> Result<Value> {
+        let t = path_text(s.doc()?.doc.node(first)).ok_or_else(|| bad(C, "select type on a path"))?;
+        Ok(path_options_of(t))
+    };
+    if !PATH_OPTIONS.iter().any(|k| p.get(k).is_some()) {
+        return options(s);
+    }
+    // A bracket: a fraction of the path's length.
+    let fraction = |k: &str| -> Result<Option<f64>> {
+        match p.get(k) {
+            None | Some(Value::Null) => Ok(None),
+            Some(v) => v.as_f64().filter(|x| x.is_finite()).map(|x| Some(x.clamp(0.0, 1.0))).ok_or_else(|| bad(C, format!("`{k}` is a number 0..1"))),
+        }
+    };
+    let start = fraction("start")?;
+    // `end: null` puts the end bracket back at the end of the path.
+    let end = p.get("end").map(|_| fraction("end")).transpose()?;
     let flip = bool_or(p, "flip", false);
     let effect = match str_param(p, "effect") {
         Some(e) => Some(vectorcraft_doc::PathEffect::parse(e).ok_or_else(|| bad(C, format!("unknown effect `{e}`")))?),
         None => None,
     };
-    let n = s.edit("Type on a Path Options", |d, _| {
-        let mut n = 0;
+    let align = match str_param(p, "alignToPath") {
+        Some(a) => Some(vectorcraft_doc::PathAlign::parse(a).ok_or_else(|| bad(C, format!("unknown alignToPath `{a}`")))?),
+        None => None,
+    };
+    let spacing = p.get("spacing").and_then(Value::as_f64).filter(|x| x.is_finite()).map(|x| x.clamp(-1000.0, 1000.0));
+    s.edit("Type on a Path Options", |d, _| {
         for id in &ids {
             let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
-            let TextKind::OnPath { path, start: st } = &mut t.kind else { continue };
+            let TextKind::OnPath { start: st, end: en, .. } = &mut t.kind else { continue };
             if let Some(v) = start {
-                *st = v.clamp(0.0, 1.0);
+                *st = v;
             }
+            if let Some(v) = end {
+                *en = v;
+            }
+            // After the brackets: they are given on the path as it runs before the flip.
             if flip {
-                path.reverse();
+                t.flip_on_path();
             }
             if let Some(e) = effect {
                 t.path_effect = e;
             }
-            n += 1;
+            if let Some(a) = align {
+                t.path_align = a;
+            }
+            if let Some(v) = spacing {
+                t.path_spacing = v;
+            }
             refresh_bounds(t);
         }
-        if n == 0 {
-            return Err(bad(C, "select type on a path"));
-        }
-        Ok(n)
+        Ok(())
     })?;
-    Ok(json!({ "changed": n }))
+    options(s)
 }
 
 // ---------- placeholder / insert ----------
@@ -388,36 +445,44 @@ fn fill_placeholder(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = texts(s, p, "type.fillPlaceholder")?;
     s.edit("Fill with Placeholder Text", |d, _| {
         for id in &ids {
-            let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) else { continue };
-            let style = t.first_style();
-            let text = match &t.kind {
-                TextKind::Area { frame } => {
-                    let b = frame.bounds().unwrap_or_default();
-                    let chars_per_line = (b.width() / (style.size * 0.5)).max(1.0);
-                    let lines = (b.height() / style.effective_leading()).max(1.0);
-                    let want = (chars_per_line * lines) as usize;
-                    let mut out = String::new();
-                    let words: Vec<&str> = PLACEHOLDER.split(' ').collect();
-                    let mut i = 0;
-                    while out.len() < want && i < 10_000 {
-                        if !out.is_empty() {
-                            out.push(' ');
-                        }
-                        out.push_str(words[i % words.len()]);
-                        i += 1;
-                    }
-                    out
-                }
-                _ => PLACEHOLDER.split(". ").next().unwrap_or(PLACEHOLDER).to_string() + ".",
-            };
-            t.runs = vec![TextRun { text, style }];
-            refresh_bounds(t);
+            if let Some(NodeKind::Text(t)) = d.node_mut(*id).map(|n| &mut n.kind) {
+                fill_with_placeholder(t);
+            }
         }
         Ok(())
     })?;
     Ok(ids_json(&ids))
 }
 
+/// Replace `t`'s text with placeholder text in its first style: area type is filled to its frame,
+/// other type gets a sentence (Type › Fill with Placeholder Text, and new type with Preferences ›
+/// Type › Fill New Type Objects With Placeholder Text).
+pub(crate) fn fill_with_placeholder(t: &mut TextObject) {
+    let style = t.first_style();
+    let text = match &t.kind {
+        TextKind::Area { frame } => {
+            let b = frame.bounds().unwrap_or_default();
+            let chars_per_line = (b.width() / (style.size * 0.5)).max(1.0);
+            let lines = (b.height() / style.effective_leading()).max(1.0);
+            let want = (chars_per_line * lines) as usize;
+            let mut out = String::new();
+            for (i, w) in PLACEHOLDER.split(' ').cycle().enumerate() {
+                if out.len() >= want || i >= 10_000 {
+                    break;
+                }
+                if !out.is_empty() {
+                    out.push(' ');
+                }
+                out.push_str(w);
+            }
+            out
+        }
+        _ => PLACEHOLDER.split(". ").next().unwrap_or(PLACEHOLDER).to_string() + ".",
+    };
+    t.runs = vec![TextRun { text, style }];
+    refresh_bounds(t);
+}
+
 pub(crate) fn special_char(name: &str) -> Option<&'static str> {
     Some(match name {
         "bullet" => "•",

crates/engine/src/cmd/xform.rs

@@ -45,7 +45,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Move Artboard",
             [],
             None,
-            "{index, dx, dy, moveArt?: bool, copy?: bool} move an artboard (and the unlocked art fully inside it); `copy` (Alt-drag) leaves them and moves copies → {index, moved: the art moved or the copies}",
+            "{index, dx, dy, moveArt?: bool, copy?: bool} move an artboard (and the art fully inside it; locked and hidden art only with prefs moveLockedWithArtboard); `copy` (Alt-drag) leaves them and moves copies → {index, moved: the art moved or the copies}",
             has_doc,
             artboard_move
         ),
@@ -374,7 +374,7 @@ fn artboard_move(s: &mut Session, p: &Value) -> Result<Value> {
     let move_art = bool_or(p, "moveArt", false);
     let st = s.doc()?;
     let rect = st.doc.artboards.get(i).map(|a| a.rect).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
-    let art = if move_art { st.doc.art_on_artboard(rect) } else { vec![] };
+    let art = if move_art { st.doc.art_on_artboard(rect, s.prefs.move_locked_with_artboard) } else { vec![] };
     let scale_strokes = s.prefs.scale_strokes;
     let copy = bool_or(p, "copy", false);
     let (index, moved) = s.edit(if copy { "Duplicate Artboard" } else { "Move Artboard" }, |d, _| {

crates/engine/src/inspect.rs

@@ -1,7 +1,7 @@
 //! Agent-friendly document summaries and view-models for panels.
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{ArrowAlign, LineCap, LineJoin, Node, NodeKind, StrokeAlign, StrokeLayer, WidthProfile};
+use vectorcraft_doc::{ArrowAlign, Document, LineCap, LineJoin, Node, NodeKind, StrokeAlign, StrokeLayer, WidthProfile};
 
 use crate::Session;
 
@@ -12,8 +12,23 @@ fn rect_json(r: Option<vectorcraft_geom::Rect>) -> Value {
     }
 }
 
-/// Compact tree summary of a node (for `document.inspect`).
+/// How much of the subtree a node summary carries.
+#[derive(Clone, Copy, Default)]
+pub struct SummaryOpts {
+    /// Child levels to include (`None`: the whole subtree). `0` is the node alone.
+    pub depth: Option<u64>,
+    /// Children shown per node (`None`: all, top of the stack first). A level that shows
+    /// fewer children than it has reports `childCount`, so truncation is never silent.
+    pub child_limit: Option<u64>,
+}
+
+/// Compact tree summary of a node (for `document.inspect`): the whole subtree.
 pub fn node_summary(n: &Node) -> Value {
+    node_summary_opts(n, SummaryOpts::default())
+}
+
+/// The same summary with [`SummaryOpts`] applied.
+pub fn node_summary_opts(n: &Node, opts: SummaryOpts) -> Value {
     let mut v = json!({
         "id": n.id.0,
         "name": n.display_name(),
@@ -69,12 +84,26 @@ pub fn node_summary(n: &Node) -> Value {
         _ => {}
     }
     if let Some(ch) = n.children() {
-        v["children"] = Value::Array(ch.iter().rev().map(|c| node_summary(c)).collect());
+        let total = ch.len();
+        let take_n = opts.child_limit.map_or(total, |l| l.min(total as u64) as usize);
+        if opts.depth.is_none_or(|d| d > 0) {
+            let next = SummaryOpts { depth: opts.depth.map(|d| d.saturating_sub(1)), child_limit: opts.child_limit };
+            v["children"] = Value::Array(ch.iter().rev().take(take_n).map(|c| node_summary_opts(c, next)).collect());
+        }
+        if take_n < total || v.get("children").is_none() {
+            v["childCount"] = json!(total);
+        }
     }
     v
 }
 
 pub fn document(s: &Session) -> Value {
+    document_opts(s, SummaryOpts::default())
+}
+
+/// The same summary with [`SummaryOpts`] applied to the layer tree (artboards and
+/// the rest always come whole): `depth: 0` is the skeleton — top layers with counts.
+pub fn document_opts(s: &Session, opts: SummaryOpts) -> Value {
     let Some(st) = s.active() else { return Value::Null };
     let d = &st.doc;
     json!({
@@ -86,7 +115,7 @@ pub fn document(s: &Session) -> Value {
         "colorMode": format!("{:?}", d.color_mode),
         "artboards": d.artboards.iter().map(|a| json!({"name": a.name, "x": a.rect.x0, "y": a.rect.y0, "width": a.rect.width(), "height": a.rect.height()})).collect::<Vec<_>>(),
         // Top of the stack first, like the Layers panel.
-        "layers": d.layers.iter().rev().map(|l| node_summary(l)).collect::<Vec<_>>(),
+        "layers": d.layers.iter().rev().map(|l| node_summary_opts(l, opts)).collect::<Vec<_>>(),
         "currentLayer": st.active_layer.map(|l| l.0),
         // The rows highlighted in the Layers panel (`layer.setCurrent`, `layer.highlight`).
         "layerRows": st.highlighted_rows().iter().map(|i| i.0).collect::<Vec<_>>(),
@@ -106,6 +135,69 @@ pub fn document(s: &Session) -> Value {
     })
 }
 
+/// What `document.find` matches: every given filter must hit (AND). All matching is
+/// case-insensitive; `name` and `text` are substrings, `kind` is the exact panel label
+/// (`Layer`, `Group`, `Path`, `Type`, `Image`, ...).
+pub struct FindFilter {
+    pub name: Option<String>,
+    pub kind: Option<String>,
+    pub text: Option<String>,
+}
+
+impl FindFilter {
+    /// True when no effective filter was given (empty strings count as absent).
+    pub fn is_empty(&self) -> bool {
+        [self.name.as_ref(), self.kind.as_ref(), self.text.as_ref()].iter().all(|f| f.is_none())
+    }
+
+    fn hits(&self, n: &Node) -> bool {
+        if let Some(needle) = &self.name
+            && !n.display_name().to_lowercase().contains(needle)
+        {
+            return false;
+        }
+        if let Some(kind) = &self.kind
+            && !n.kind_label().eq_ignore_ascii_case(kind)
+        {
+            return false;
+        }
+        if let Some(needle) = &self.text {
+            let NodeKind::Text(t) = &n.kind else { return false };
+            if !t.plain_text().to_lowercase().contains(needle) {
+                return false;
+            }
+        }
+        true
+    }
+}
+
+/// Search the whole layer tree, top of the stack first like the Layers panel.
+/// Returns at most `limit` hits as `{id, name, kind, path}` (`path` is the ancestor
+/// chain, layer first) plus the total hit count, so a capped reply stays explicit.
+pub fn find_nodes(doc: &Document, filter: &FindFilter, limit: u64) -> (Vec<Value>, u64) {
+    use std::sync::Arc;
+    let mut out = Vec::new();
+    let mut total = 0u64;
+    let mut ancestors: Vec<u64> = Vec::new();
+    fn walk(nodes: &[Arc<Node>], ancestors: &mut Vec<u64>, filter: &FindFilter, limit: u64, out: &mut Vec<Value>, total: &mut u64) {
+        for n in nodes.iter().rev() {
+            if filter.hits(n) {
+                *total += 1;
+                if (out.len() as u64) < limit {
+                    out.push(json!({"id": n.id.0, "name": n.display_name(), "kind": n.kind_label(), "path": ancestors}));
+                }
+            }
+            if let Some(ch) = n.children() {
+                ancestors.push(n.id.0);
+                walk(ch, ancestors, filter, limit, out, total);
+                ancestors.pop();
+            }
+        }
+    }
+    walk(&doc.layers, &mut ancestors, filter, limit, &mut out, &mut total);
+    (out, total)
+}
+
 /// Cap names as `stroke.set` takes them.
 pub const CAPS: [(LineCap, &str); 3] = [(LineCap::Butt, "butt"), (LineCap::Round, "round"), (LineCap::Square, "square")];
 /// Join names as `stroke.set` takes them.

crates/engine/src/lib.rs

@@ -79,14 +79,25 @@ pub struct Interaction {
     pub doc: Arc<Document>,
     pub selection: Selection,
     pub preview: Option<(String, Value)>,
-    /// Per-document state restored on cancel (current layer, isolation).
+    /// Per-document state restored on cancel (current layer, highlighted Layers panel rows,
+    /// isolation).
     pub active_layer: Option<NodeId>,
+    pub layer_rows: Vec<NodeId>,
     pub isolation: Option<NodeId>,
     /// The perspective transform the previews make (`perspective.transform` params): Transform
     /// Again repeats it once the drag is committed.
     pub perspective_again: Option<Value>,
 }
 
+/// An open undo group ([`Session::begin_undo_group`]): the edits made in it are one undo step.
+#[derive(Clone, Debug)]
+pub struct UndoGroup {
+    /// The document before the group's first edit, as the undo step that edit recorded keeps it.
+    first: Option<Arc<Document>>,
+    /// The journal's length when the group began: a cancelled group drops the entries after it.
+    journal: usize,
+}
+
 /// Per-document editing state.
 #[derive(Clone, Debug)]
 pub struct DocState {
@@ -110,6 +121,8 @@ pub struct DocState {
     /// Isolation mode container.
     pub isolation: Option<NodeId>,
     pub interaction: Option<Interaction>,
+    /// Edits made while this is open are one undo step (a scrubbed numeric field).
+    pub undo_group: Option<UndoGroup>,
     /// For Object → Transform → Transform Again (⌘D).
     pub last_transform: Option<(Affine, bool)>,
     /// Selection saved by Select → Reselect.
@@ -164,6 +177,7 @@ impl DocState {
             layer_rows: vec![],
             isolation: None,
             interaction: None,
+            undo_group: None,
             last_transform: None,
             last_selection_cmd: None,
             uid: NEXT_DOC_UID.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
@@ -195,17 +209,33 @@ impl DocState {
     /// Keep what interaction `it` (taken from this document) changed, as one undo step.
     pub(crate) fn keep_interaction(&mut self, it: Interaction) {
         if !Arc::ptr_eq(&it.doc, &self.doc) {
-            self.history.undo.push(HistoryEntry { label: it.label, doc: it.doc, selection: it.selection });
-            self.history.redo.clear();
+            self.push_undo(HistoryEntry { label: it.label, doc: it.doc, selection: it.selection });
             self.revision += 1;
         }
     }
+    /// Record undo step `e` (the document before an edit). In an undo group only the group's first
+    /// edit records one: the edits after it extend that step.
+    fn push_undo(&mut self, e: HistoryEntry) {
+        if let Some(g) = &mut self.undo_group {
+            let recorded = |first: &Arc<Document>| self.history.undo.last().is_some_and(|l| Arc::ptr_eq(&l.doc, first));
+            if g.first.as_ref().is_some_and(recorded) {
+                return;
+            }
+            g.first = Some(e.doc.clone());
+        }
+        self.history.undo.push(e);
+        if self.history.undo.len() > self.history.limit {
+            self.history.undo.remove(0);
+        }
+        self.history.redo.clear();
+    }
     /// End the interaction in progress, undoing what it changed.
     pub(crate) fn undo_interaction(&mut self) {
         if let Some(it) = self.interaction.take() {
             self.doc = it.doc;
             self.selection = it.selection;
             self.active_layer = it.active_layer;
+            self.layer_rows = it.layer_rows;
             self.isolation = it.isolation;
             self.revision += 1;
         }
@@ -290,7 +320,9 @@ fn strip_replay_only(id: &str, p: &mut Value) {
 /// have finite, in-range geometry, so saved files always reload and renderers never see NaN/∞.
 fn doc_sane(d: &Document, sel: &Selection) -> bool {
     let ok = |r: vectorcraft_geom::Rect| [r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_COORD);
-    d.artboards.iter().all(|a| ok(a.rect)) && sel.objects.iter().all(|id| d.node(*id).and_then(|n| n.geometric_bounds()).is_none_or(ok))
+    d.artboards.iter().all(|a| ok(a.rect))
+        && d.guides.iter().all(|g| g.pos.is_finite() && g.pos.abs() <= MAX_COORD)
+        && sel.objects.iter().all(|id| d.node(*id).and_then(|n| n.geometric_bounds()).is_none_or(ok))
 }
 
 /// Where new art goes (Illustrator's drawing modes, Shift+D cycles).
@@ -327,6 +359,8 @@ pub struct Prefs {
     /// Scale Strokes & Effects.
     pub scale_strokes: bool,
     pub zoom_with_mouse_wheel: bool,
+    /// A horizontal drag on a numeric field or its label steps its value (#400).
+    pub scrub_numeric_fields: bool,
     /// Offset for Paste / duplicate (Illustrator pastes to the view centre; we offset by this).
     pub paste_offset: f64,
     // Selection & Anchor Display
@@ -547,6 +581,7 @@ impl Default for Prefs {
             scale_corners: false,
             scale_strokes: false,
             zoom_with_mouse_wheel: false,
+            scrub_numeric_fields: true,
             paste_offset: 10.0,
             selection_tolerance: 3.0,
             object_selection_by_path_only: false,
@@ -1061,11 +1096,7 @@ impl Session {
                 st.selection.prune(&st.doc);
                 st.revision += 1;
                 if st.interaction.is_none() {
-                    st.history.undo.push(HistoryEntry { label: label.to_string(), doc: before, selection: before_sel });
-                    if st.history.undo.len() > st.history.limit {
-                        st.history.undo.remove(0);
-                    }
-                    st.history.redo.clear();
+                    st.push_undo(HistoryEntry { label: label.to_string(), doc: before, selection: before_sel });
                 }
                 Ok(v)
             }
@@ -1114,6 +1145,7 @@ impl Session {
             selection: st.selection.clone(),
             preview: None,
             active_layer: st.active_layer,
+            layer_rows: st.layer_rows.clone(),
             isolation: st.isolation,
             perspective_again: None,
         });
@@ -1178,6 +1210,44 @@ impl Session {
         self.active().is_some_and(|d| d.interaction.is_some())
     }
 
+    // ---------- undo groups (scrubbed numeric fields) ----------
+
+    /// Open an undo group in the active document: until [`Session::end_undo_group`], the edits
+    /// made there (commands, committed interactions) are one undo step. A scrubbed numeric field
+    /// applies each value it passes as its own command, as a typed value is applied; the drag is
+    /// one step.
+    pub fn begin_undo_group(&mut self) {
+        let journal = self.journal.len();
+        if let Some(st) = self.active_mut()
+            && st.undo_group.is_none()
+        {
+            st.undo_group = Some(UndoGroup { first: None, journal });
+        }
+    }
+
+    /// Close the open undo groups: their edits stay one undo step or, `cancel`led (Escape), are
+    /// undone and dropped from the journal.
+    pub fn end_undo_group(&mut self, cancel: bool) {
+        let mut journal = None;
+        for st in &mut self.docs {
+            let Some(g) = st.undo_group.take() else { continue };
+            // Only while the group's step is still the newest one.
+            if cancel
+                && let Some(first) = g.first
+                && st.history.undo.last().is_some_and(|e| Arc::ptr_eq(&e.doc, &first))
+                && let Some(e) = st.history.undo.pop()
+            {
+                st.doc = e.doc;
+                st.selection = e.selection;
+                st.revision += 1;
+                journal = Some(g.journal);
+            }
+        }
+        if let Some(len) = journal {
+            self.journal.truncate(len);
+        }
+    }
+
     /// Commands with enablement (for menus, palette, MCP `list_commands`).
     pub fn commands(&self) -> Vec<CommandInfo> {
         command_specs().iter().map(|c| c.info(self)).collect()
@@ -1301,6 +1371,8 @@ mod tests_liquify;
 #[cfg(test)]
 mod tests_live;
 #[cfg(test)]
+mod tests_livecorners;
+#[cfg(test)]
 mod tests_maskview;
 #[cfg(test)]
 mod tests_menucmds;
@@ -1327,6 +1399,8 @@ mod tests_panelcmds;
 #[cfg(test)]
 mod tests_pathops;
 #[cfg(test)]
+mod tests_pathtype;
+#[cfg(test)]
 mod tests_pattern;
 #[cfg(test)]
 mod tests_pdffidelity;

crates/engine/src/tests.rs

@@ -294,6 +294,43 @@ fn direct_selection_moves_one_anchor() {
     assert_eq!(p.subpaths[0].anchors[1].p, vectorcraft_geom::Point::new(200.0, 100.0));
 }
 
+/// Dragging a curved segment with Direct Selection bends it (its anchors stay), and dragging a
+/// straight one moves its two anchors, not the whole path; each is one undo step.
+#[test]
+fn direct_selection_drags_segments() {
+    let mut s = session();
+    let v = ViewInfo::default();
+    let drag = |s: &mut Session, from: (f64, f64), to: (f64, f64)| {
+        s.pointer(&PointerEvent::new(PointerKind::Down, from.0, from.1), v).unwrap();
+        s.pointer(&PointerEvent::new(PointerKind::Drag, to.0, to.1), v).unwrap();
+        s.pointer(&PointerEvent::new(PointerKind::Up, to.0, to.1), v).unwrap();
+    };
+    let arch = &json!({"anchors": [{"x": 100, "y": 200, "out": [100, 100]}, {"x": 300, "y": 200, "in": [300, 100]}]});
+    let arch = NodeId(s.execute("path.create", arch).unwrap()["id"].as_u64().unwrap());
+    let square = &json!({"anchors": [{"x": 150, "y": 400}, {"x": 150, "y": 300}, {"x": 250, "y": 300}, {"x": 250, "y": 400}], "closed": true});
+    let square = NodeId(s.execute("path.create", square).unwrap()["id"].as_u64().unwrap());
+    s.execute("select.none", &json!({})).unwrap();
+    s.select_tool("directSelection", v).unwrap();
+    let steps = |s: &Session| s.doc().unwrap().history.undo.len();
+    let before = steps(&s);
+    // The arch's middle, 40 up: the curve bends, its two anchors stay.
+    drag(&mut s, (200.0, 125.0), (200.0, 85.0));
+    let sp = s.doc().unwrap().doc.node(arch).unwrap().path_data().unwrap().subpaths[0].clone();
+    let (a, b) = (sp.anchors[0], sp.anchors[1]);
+    assert_eq!((a.p, b.p), (vectorcraft_geom::Point::new(100.0, 200.0), vectorcraft_geom::Point::new(300.0, 200.0)), "the anchors stay");
+    assert!(a.h_out.y < 100.0 && b.h_in.y < 100.0, "the curve bent up: {a:?} {b:?}");
+    assert_eq!(steps(&s), before + 1);
+    // The square's top edge, 40 up: its two anchors move, the bottom two stay.
+    drag(&mut s, (200.0, 300.0), (200.0, 260.0));
+    let sq = s.doc().unwrap().doc.node(square).unwrap().geometric_bounds().unwrap();
+    assert_eq!((sq.y0, sq.y1, sq.x0, sq.x1), (260.0, 400.0, 150.0, 250.0), "the edge moved, the rest stayed");
+    assert_eq!(steps(&s), before + 2);
+    // Its fill still moves the whole square.
+    drag(&mut s, (200.0, 350.0), (200.0, 330.0));
+    let sq = s.doc().unwrap().doc.node(square).unwrap().geometric_bounds().unwrap();
+    assert_eq!((sq.y0, sq.y1), (240.0, 380.0), "the whole path moved");
+}
+
 #[test]
 fn text_create_has_bounds() {
     let mut s = session();
@@ -327,6 +364,112 @@ fn document_node_summary_matches_inspect() {
     assert!(s.execute("document.node", &json!({"id": 999999, "summary": true})).is_err());
 }
 
+/// `depth` and `childLimit` slice a summary read; a level that shows fewer children
+/// than it has reports `childCount`, and invalid values are rejected, not reinterpreted.
+#[test]
+fn document_node_summary_slices_with_depth_and_limit() {
+    let mut s = session();
+    rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    rect(&mut s, 20.0, 0.0, 10.0, 10.0);
+    s.execute("select.all", &json!({})).unwrap();
+    let inner = s.execute("object.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+    rect(&mut s, 40.0, 0.0, 10.0, 10.0);
+    s.execute("select.all", &json!({})).unwrap();
+    let outer = s.execute("object.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+    let mut read = |p: Value| s.execute("document.node", &p).unwrap();
+
+    let g = read(json!({"id": outer, "summary": true}));
+    assert_eq!(g["children"].as_array().map(Vec::len), Some(2));
+    assert!(g.get("childCount").is_none(), "nothing truncated: {g}");
+    // Limits beyond the tree are the whole tree, byte for byte.
+    assert_eq!(read(json!({"id": outer, "summary": true, "depth": u64::MAX, "childLimit": u64::MAX})), g);
+
+    let one = read(json!({"id": outer, "summary": true, "childLimit": 1}));
+    assert_eq!(one["children"].as_array().map(Vec::len), Some(1));
+    assert_eq!(one["childCount"], 2);
+
+    let flat = read(json!({"id": outer, "summary": true, "depth": 0}));
+    assert!(flat.get("children").is_none(), "{flat}");
+    assert_eq!(flat["childCount"], 2);
+
+    // Limits compose per level: the outer children show; the inner group's own
+    // children don't, and it says so.
+    let shallow = read(json!({"id": outer, "summary": true, "depth": 1}));
+    let kids = shallow["children"].as_array().unwrap();
+    assert_eq!(kids.len(), 2);
+    assert!(shallow.get("childCount").is_none(), "{shallow}");
+    let nested = kids.iter().find(|n| n["id"] == inner).unwrap();
+    assert!(nested.get("children").is_none(), "{nested}");
+    assert_eq!(nested["childCount"], 2);
+
+    for bad in [
+        json!({"id": outer, "summary": true, "depth": -1}),
+        json!({"id": outer, "summary": true, "depth": 1.5}),
+        json!({"id": outer, "summary": true, "childLimit": "many"}),
+        // A slice of the full object JSON would silently be the whole subtree.
+        json!({"id": outer, "depth": 0}),
+        json!({"id": outer, "summary": false, "childLimit": 1}),
+    ] {
+        assert!(s.execute("document.node", &bad).is_err(), "{bad}");
+    }
+}
+
+/// `document.inspect` slices the layer tree with the same options; artboards and the
+/// rest always come whole, and the default output is unchanged.
+#[test]
+fn document_inspect_slices_the_layer_tree() {
+    let mut s = session();
+    rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    rect(&mut s, 20.0, 0.0, 10.0, 10.0);
+    s.execute("select.all", &json!({})).unwrap();
+    s.execute("object.group", &json!({})).unwrap();
+
+    let full = s.execute("document.inspect", &json!({})).unwrap();
+    assert!(full["layers"][0].get("childCount").is_none(), "{full}");
+    let flat = s.execute("document.inspect", &json!({"depth": 0})).unwrap();
+    assert!(flat["layers"][0].get("children").is_none(), "{flat}");
+    assert_eq!(flat["layers"][0]["childCount"], 1);
+    assert_eq!(flat["artboards"], full["artboards"]);
+    assert_eq!(flat["objects"], full["objects"]);
+    let one = s.execute("document.inspect", &json!({"childLimit": 0})).unwrap();
+    assert_eq!(one["layers"][0]["children"], json!([]));
+    assert_eq!(one["layers"][0]["childCount"], 1);
+    assert!(s.execute("document.inspect", &json!({"depth": "deep"})).is_err());
+}
+
+/// `document.find` searches names, kinds and type content across the whole tree and
+/// answers ids with ancestor paths plus the total, so capped replies stay explicit.
+#[test]
+fn document_find_searches_names_kinds_and_text() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0).0;
+    s.execute("object.setProps", &json!({"ids": [a], "name": "Hero Banner"})).unwrap();
+    rect(&mut s, 20.0, 0.0, 10.0, 10.0);
+    s.execute("select.all", &json!({})).unwrap();
+    let group = s.execute("object.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+    let mut find = |p: Value| s.execute("document.find", &p).unwrap();
+
+    let v = find(json!({"name": "hero"}));
+    assert_eq!(v["total"], 1);
+    assert_eq!(v["matches"][0]["id"], a);
+    assert_eq!(v["matches"][0]["path"], json!([1, group]));
+
+    let v = find(json!({"kind": "group"}));
+    assert_eq!(v["total"], 1);
+    assert_eq!(v["matches"][0]["id"], group);
+
+    // `limit: 0` counts without listing; a missing filter is rejected, not a full dump.
+    let v = find(json!({"kind": "rectangle", "limit": 0}));
+    assert_eq!(v["matches"].as_array().map(Vec::len), Some(0));
+    assert_eq!(v["total"], 2);
+    assert!(s.execute("document.find", &json!({})).is_err());
+    assert!(s.execute("document.find", &json!({"name": ""})).is_err());
+    assert!(s.execute("document.find", &json!({"name": "hero", "limit": "many"})).is_err());
+    // A filter of the wrong type is rejected, not dropped (dropping it would widen the search).
+    assert!(s.execute("document.find", &json!({"kind": "group", "name": 5})).is_err());
+    assert_eq!(s.execute("document.find", &json!({"kind": "nope"})).unwrap()["total"], 0);
+}
+
 /// Type reports the paint its characters show, and its own object-level paint apart from it.
 #[test]
 fn inspect_reports_the_paint_of_types_characters() {

crates/engine/src/tests_build.rs

@@ -172,6 +172,217 @@ fn shape_builder_tool_drives_the_command() {
     assert_eq!(layer_children(&s), 1);
 }
 
+/// A red 100 × 100 square crossed by a stroke-only vertical line at x = 50, both selected.
+fn square_and_line(s: &mut Session) -> (NodeId, NodeId) {
+    let a = rect(s, 0.0, 0.0, 100.0, 100.0);
+    set_fill(s, a, Color::rgb(1.0, 0.0, 0.0));
+    let l = line(s, (50.0, -20.0), (50.0, 120.0));
+    s.execute("select.set", &json!({"ids": [a.0, l.0]})).unwrap();
+    (a, l)
+}
+
+/// The open paths among `ids`, as (anchors, bounds).
+fn open_paths(s: &Session, ids: &[NodeId]) -> Vec<(usize, Rect)> {
+    ids.iter()
+        .map(|i| node(s, *i))
+        .filter(|n| !outline(n).0.is_closed())
+        .map(|n| (outline(&n).0.anchor_count(), n.geometric_bounds().unwrap()))
+        .collect()
+}
+
+#[test]
+fn shape_builder_line_splits_a_shape_into_regions() {
+    let mut s = session();
+    let (a, l) = square_and_line(&mut s);
+    let r = s.execute("shapeBuilder.regions", &json!({})).unwrap();
+    let regs = r["regions"].as_array().unwrap();
+    assert_eq!(regs.len(), 2, "{r}");
+    for x in regs {
+        assert!((x["area"].as_f64().unwrap() - 5000.0).abs() < 1e-6);
+        assert_eq!(x["sources"], json!([a.0]));
+    }
+    let lines = r["lines"].as_array().unwrap();
+    assert_eq!(lines.len(), 3, "the line cut at both sides of the square");
+    assert!(lines.iter().all(|x| x["source"] == l.0));
+}
+
+#[test]
+fn shape_builder_click_on_a_side_of_a_line_splits_the_shape() {
+    let mut s = session();
+    square_and_line(&mut s);
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[25, 50]]})).unwrap();
+    assert_eq!(r["regions"], 1);
+    let out = ids(&r);
+    let merged = NodeId(r["merged"].as_u64().unwrap());
+    assert_eq!(node(&s, merged).geometric_bounds().unwrap(), Rect::new(0.0, 0.0, 50.0, 100.0));
+    assert_eq!(node(&s, merged).appearance.fill_paint(), Paint::solid(Color::rgb(1.0, 0.0, 0.0)));
+    let closed: Vec<f64> = out.iter().filter(|i| outline(&node(&s, **i)).0.is_closed()).map(|i| area(&s, *i)).collect();
+    assert_eq!(closed.len(), 2, "both halves");
+    assert!(closed.iter().all(|a| (a - 5000.0).abs() < 1.0), "{closed:?}");
+    // The line only bounds the region: it stays whole.
+    assert_eq!(open_paths(&s, &out), vec![(2, Rect::new(50.0, -20.0, 50.0, 120.0))]);
+}
+
+#[test]
+fn shape_builder_merge_across_a_line_removes_the_piece_between() {
+    let mut s = session();
+    square_and_line(&mut s);
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[25, 50], [75, 50]]})).unwrap();
+    assert_eq!(r["regions"], 2);
+    let out = ids(&r);
+    let merged = NodeId(r["merged"].as_u64().unwrap());
+    assert!((area(&s, merged) - 10000.0).abs() < 1.0);
+    assert_eq!(out.len(), 3, "merged square + the line's two loose ends");
+    let mut ends = open_paths(&s, &out);
+    ends.sort_by(|a, b| a.1.y0.total_cmp(&b.1.y0));
+    assert_eq!(ends, vec![(2, Rect::new(50.0, -20.0, 50.0, 0.0)), (2, Rect::new(50.0, 100.0, 50.0, 120.0))]);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(layer_children(&s), 2);
+}
+
+#[test]
+fn shape_builder_alt_deletes_a_region_or_a_line_piece() {
+    let mut s = session();
+    square_and_line(&mut s);
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[75, 50]], "erase": true})).unwrap();
+    assert!(r["merged"].is_null());
+    let out = ids(&r);
+    let left: Vec<NodeId> = out.iter().copied().filter(|i| outline(&node(&s, *i)).0.is_closed()).collect();
+    assert_eq!(left.len(), 1);
+    assert_eq!(node(&s, left[0]).geometric_bounds().unwrap(), Rect::new(0.0, 0.0, 50.0, 100.0));
+    assert_eq!(open_paths(&s, &out).len(), 1, "the line stays whole");
+
+    // Alt on the line inside the square deletes that piece only.
+    let mut s = session();
+    square_and_line(&mut s);
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[51, 50]], "erase": true, "tolerance": 2})).unwrap();
+    assert_eq!((r["regions"].as_u64(), r["lines"].as_u64()), (Some(0), Some(1)));
+    let out = ids(&r);
+    assert_eq!(out.len(), 3);
+    let sq: Vec<NodeId> = out.iter().copied().filter(|i| outline(&node(&s, *i)).0.is_closed()).collect();
+    assert_eq!(sq.len(), 1);
+    assert!((area(&s, sq[0]) - 10000.0).abs() < 1.0, "the square is untouched");
+    assert_eq!(open_paths(&s, &out).len(), 2);
+}
+
+#[test]
+fn shape_builder_fills_an_area_lines_enclose() {
+    let mut s = session();
+    let l1 = line(&mut s, (0.0, 0.0), (100.0, 100.0));
+    let l2 = line(&mut s, (100.0, 0.0), (0.0, 100.0));
+    let l3 = line(&mut s, (-10.0, 80.0), (110.0, 80.0));
+    s.execute("select.set", &json!({"ids": [l1.0, l2.0, l3.0]})).unwrap();
+    let r = s.execute("shapeBuilder.regions", &json!({})).unwrap();
+    assert_eq!(r["regions"].as_array().unwrap().len(), 1);
+    assert_eq!(r["regions"][0]["sources"], json!([]));
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[50, 70]]})).unwrap();
+    let merged = NodeId(r["merged"].as_u64().unwrap());
+    assert!((area(&s, merged) - 900.0).abs() < 1e-6, "{}", area(&s, merged));
+    assert_eq!(node(&s, merged).appearance.fill_paint(), s.paint.fill, "the current fill");
+    assert!(!node(&s, merged).appearance.stroke_paint().is_none(), "the lines' stroke");
+    assert_eq!(ids(&r).len(), 4, "the triangle + the three lines, which only bound it");
+}
+
+#[test]
+fn shape_builder_closes_filled_open_paths() {
+    let mut s = session();
+    let r = s.execute("path.create", &json!({"anchors": [{"x": 0, "y": 0}, {"x": 100, "y": 0}, {"x": 100, "y": 100}]})).unwrap();
+    let p = NodeId(r["id"].as_u64().unwrap());
+    set_fill(&mut s, p, Color::rgb(0.0, 1.0, 0.0));
+    s.execute("select.set", &json!({"ids": [p.0]})).unwrap();
+    let r = s.execute("shapeBuilder.regions", &json!({})).unwrap();
+    assert_eq!(r["regions"].as_array().unwrap().len(), 1, "the fill's area, closed by an invisible edge");
+    assert!((r["regions"][0]["area"].as_f64().unwrap() - 5000.0).abs() < 1e-6);
+    assert_eq!(r["lines"], json!([]));
+    // Unfilled, it is only an edge.
+    s.edit("t", |d, _| {
+        d.node_mut(p).unwrap().appearance.set_fill(Paint::None);
+        Ok(())
+    })
+    .unwrap();
+    let r = s.execute("shapeBuilder.regions", &json!({})).unwrap();
+    assert_eq!(r["regions"], json!([]));
+    assert_eq!(r["lines"].as_array().unwrap().len(), 1);
+}
+
+#[test]
+fn shape_builder_tool_alt_deletes_line_pieces() {
+    let mut s = session();
+    square_and_line(&mut s);
+    let v = ViewInfo::default();
+    s.select_tool("shapeBuilder", v).unwrap();
+    let alt = Mods { alt: true, ..Default::default() };
+    s.pointer(&PointerEvent::new(PointerKind::Move, 51.0, 50.0).with_mods(alt), v).unwrap();
+    assert_eq!(s.overlays(v).len(), 1, "the line piece is highlighted");
+    s.pointer(&PointerEvent::new(PointerKind::Down, 51.0, 50.0).with_mods(alt), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 51.0, 50.0).with_mods(alt), v).unwrap();
+    assert_eq!(s.journal.last().unwrap().0, "shapeBuilder.merge");
+    assert_eq!(layer_children(&s), 3, "square + the line's two loose ends");
+}
+
+/// Red square A (0..100) and blue square B (50..150 both ways), overlapping at a corner, selected.
+fn corner(s: &mut Session) -> (NodeId, NodeId) {
+    let a = rect(s, 0.0, 0.0, 100.0, 100.0);
+    let b = rect(s, 50.0, 50.0, 100.0, 100.0);
+    set_fill(s, a, Color::rgb(1.0, 0.0, 0.0));
+    set_fill(s, b, Color::rgb(0.0, 0.0, 1.0));
+    s.execute("select.set", &json!({"ids": [a.0, b.0]})).unwrap();
+    (a, b)
+}
+
+/// (closed, anchors, length) of each of `ids`.
+fn shapes_of(s: &Session, ids: &[NodeId]) -> Vec<(bool, usize, f64)> {
+    ids.iter()
+        .map(|i| {
+            let (p, _) = outline(&node(s, *i));
+            (p.is_closed(), p.anchor_count(), (p.length() * 1e6).round() / 1e6)
+        })
+        .collect()
+}
+
+#[test]
+fn shape_builder_erase_click_on_an_edge_opens_its_path() {
+    let mut s = session();
+    corner(&mut s);
+    let r = s.execute("shapeBuilder.regions", &json!({})).unwrap();
+    assert_eq!(r["edges"].as_array().unwrap().len(), 4, "each outline cut in two where the other crosses it: {r}");
+    // A's side inside B (1 pt off it).
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[101, 75]], "erase": true})).unwrap();
+    assert_eq!((r["regions"].as_u64(), r["lines"].as_u64(), r["edges"].as_u64()), (Some(0), Some(0), Some(1)));
+    let out = ids(&r);
+    // A opens where B's outline crosses it and keeps its look; B is untouched.
+    assert_eq!(shapes_of(&s, &out), vec![(false, 5, 300.0), (true, 4, 400.0)]);
+    assert_eq!(node(&s, out[0]).appearance.fill_paint(), Paint::solid(Color::rgb(1.0, 0.0, 0.0)));
+    assert_eq!(s.journal.last().unwrap().0, "shapeBuilder.merge");
+    s.execute("edit.undo", &json!({})).unwrap();
+    let back: Vec<NodeId> = s.doc().unwrap().doc.children(s.doc().unwrap().doc.default_layer()).unwrap().iter().map(|n| n.id).collect();
+    assert_eq!(shapes_of(&s, &back), vec![(true, 4, 400.0); 2], "one undo step");
+}
+
+#[test]
+fn shape_builder_erase_drag_along_edges_deletes_each() {
+    let mut s = session();
+    corner(&mut s);
+    // Down A's side inside B, round the corner and along B's side inside A.
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[100, 75], [100, 50], [75, 50]], "erase": true})).unwrap();
+    assert_eq!((r["regions"].as_u64(), r["edges"].as_u64()), (Some(0), Some(2)));
+    assert_eq!(shapes_of(&s, &ids(&r)), vec![(false, 5, 300.0); 2]);
+}
+
+#[test]
+fn shape_builder_erase_drag_into_regions_deletes_them_not_the_edges_it_crosses() {
+    let mut s = session();
+    corner(&mut s);
+    let r = s.execute("shapeBuilder.merge", &json!({"points": [[25, 25], [75, 75]], "erase": true})).unwrap();
+    assert_eq!((r["regions"].as_u64(), r["edges"].as_u64()), (Some(2), Some(0)));
+    // A is gone; what is left of B stays closed and blue.
+    let out = ids(&r);
+    assert_eq!(out.len(), 1);
+    assert!((area(&s, out[0]) - 7500.0).abs() < 1e-6);
+    assert!(outline(&node(&s, out[0])).0.is_closed());
+    assert_eq!(node(&s, out[0]).appearance.fill_paint(), Paint::solid(Color::rgb(0.0, 0.0, 1.0)));
+}
+
 // ---------- Live Paint ----------
 
 fn live(s: &mut Session) -> NodeId {

crates/engine/src/tests_clipflavours.rs

@@ -7,7 +7,7 @@ use vectorcraft_geom::Point;
 use vectorcraft_tools::{Mods, PointerEvent, PointerKind, ToolKey};
 
 use super::*;
-use crate::cmd::clipboard::{PDF, PNG, SVG, TEXT};
+use crate::cmd::clipboard::{BITMAP, FILE_HEAD, PASTE_ORDER, PDF, PNG, SVG, TEXT, file_flavour};
 
 fn session() -> Session {
     let mut s = Session::new();
@@ -118,6 +118,29 @@ fn import_image_then_paste_gives_an_image() {
     assert!(s.execute("clipboard.importImage", &json!({"dataBase64": "!!"})).is_err());
 }
 
+#[test]
+fn copied_files_paste_by_their_content() {
+    let mut s = session();
+    copy_red_square(&mut s);
+    let png = decode(&run(&mut s, "clipboard.exportPng", json!({})));
+    let pdf = decode(&run(&mut s, "clipboard.exportPdf", json!({})));
+    let mut jpeg = vec![];
+    image::RgbImage::new(2, 2).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\"><rect width=\"4\" height=\"4\"/></svg>";
+    let of = |name: &str, bytes: &[u8]| file_flavour(name, &bytes[..bytes.len().min(FILE_HEAD)], &PASTE_ORDER);
+    assert_eq!(of("red.png", &png), Some(PNG));
+    // The content tells, whatever the name says; bitmaps keep their own type.
+    assert_eq!(of("photo.txt", &jpeg), Some("image/jpeg"));
+    assert_eq!(of("art.svg", svg), Some(SVG));
+    assert_eq!(of("doc.pdf", &pdf), Some(PDF));
+    // Files that aren't art paste as nothing (not as their path).
+    assert_eq!(of("notes.txt", b"hello"), None);
+    assert_eq!(of("archive.zip", b"PK\x03\x04"), None);
+    // Only what was asked for.
+    assert_eq!(file_flavour("red.png", &png, &[TEXT, SVG]), None);
+    assert_eq!(file_flavour("art.svg", svg, &[BITMAP]), None);
+}
+
 #[test]
 fn import_text_then_paste_gives_point_text() {
     let mut s = session();

crates/engine/src/tests_emptytype.rs

@@ -8,7 +8,9 @@ use vectorcraft_tools::{Mods, PointerEvent, PointerKind, ToolKey};
 use super::*;
 
 fn session() -> Session {
+    // Type placed by the Type tools starts empty (Fill New Type Objects With Placeholder Text off).
     let mut s = Session::new();
+    s.prefs.placeholder_text = false;
     s.execute("file.new", &json!({"width": 800, "height": 600})).unwrap();
     s
 }

crates/engine/src/tests_journal.rs

@@ -231,3 +231,68 @@ fn a_failed_batch_brings_back_a_document_it_reverted() {
     assert!(st.is_dirty() && st.interaction.is_none());
     assert!(st.revision > revision, "the restored document redraws");
 }
+
+#[test]
+fn a_failed_batch_gives_back_the_highlighted_rows_and_the_current_layer() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"created": null})).unwrap();
+    let layer = s.doc().unwrap().doc.layers[0].id;
+    // A step that highlights the layer's row, then one that fails: the highlight goes back too.
+    let steps = json!([{"command": "layer.setCurrent", "params": {"id": layer.0}}, {"command": "no.such.command"}]);
+    assert!(s.execute("command.batch", &json!({ "commands": steps })).is_err());
+    assert!(s.doc().unwrap().layer_rows.is_empty(), "no row stays highlighted");
+    assert_eq!(s.doc().unwrap().active_layer, Some(layer));
+    // So Collect in New Layer acts on the drawn rectangle, as it does when the journal is replayed
+    // (a failed batch isn't journaled).
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 1, "height": 1})).unwrap();
+    s.execute("layer.collectInNew", &json!({})).unwrap();
+    let r = replayed(&s);
+    assert_eq!(documents(&r), documents(&s));
+}
+
+/// The edits made in an undo group (a scrubbed numeric field, #400) are one undo step, journaled
+/// one by one; a cancelled group undoes them and leaves the journal as it was.
+#[test]
+fn an_undo_group_is_one_undo_step() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 50})).unwrap();
+    let width = |s: &Session| s.transform_box(&s.doc().unwrap().selection.objects).unwrap().rect.width();
+    let undo_len = |s: &Session| s.doc().unwrap().history.undo.len();
+    let (undo, journal) = (undo_len(&s), s.journal.len());
+    s.begin_undo_group();
+    for w in [101, 102, 103] {
+        s.execute("object.setBounds", &json!({"width": w})).unwrap();
+    }
+    // A live drag committed in the group (the Transparency panel's opacity field) joins it too.
+    s.begin_interaction("Opacity").unwrap();
+    s.preview("transparency.set", &json!({"opacity": 50})).unwrap();
+    s.commit_interaction().unwrap();
+    s.end_undo_group(false);
+    assert!((width(&s) - 103.0).abs() < 1e-9);
+    assert_eq!(undo_len(&s), undo + 1, "one undo step");
+    assert_eq!(s.journal.len(), journal + 4, "each edit journaled");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!((width(&s) - 100.0).abs() < 1e-9, "undo takes the whole drag back");
+    assert_eq!(undo_len(&s), undo);
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert!((width(&s) - 103.0).abs() < 1e-9);
+
+    // Escape: back where it started, with no trace in the history or the journal.
+    let (undo, journal) = (undo_len(&s), s.journal.len());
+    s.begin_undo_group();
+    s.execute("object.setBounds", &json!({"width": 150})).unwrap();
+    s.execute("object.setBounds", &json!({"width": 160})).unwrap();
+    s.end_undo_group(true);
+    assert!((width(&s) - 103.0).abs() < 1e-9);
+    assert_eq!((undo_len(&s), s.journal.len()), (undo, journal));
+    // Closed: the next edits are steps of their own again.
+    s.execute("object.setBounds", &json!({"width": 110})).unwrap();
+    s.execute("object.setBounds", &json!({"width": 120})).unwrap();
+    assert_eq!(undo_len(&s), undo + 2);
+    // A group with no edits records nothing, and cancelling it undoes nothing.
+    s.begin_undo_group();
+    s.end_undo_group(true);
+    assert!((width(&s) - 120.0).abs() < 1e-9);
+    assert_eq!(undo_len(&s), undo + 2);
+}

crates/engine/src/tests_livecorners.rs

@@ -0,0 +1,152 @@
+//! Live Corners on live rectangles: `object.setLiveShape` rounds the given corners, the
+//! Direct-Selected ones or all four, sets corner kinds, and keeps selected corners selected.
+
+use std::collections::BTreeSet;
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{AnchorRef, LiveShape, NodeKind};
+use vectorcraft_geom::Affine;
+use vectorcraft_geom::shapes::CornerKind;
+
+use super::*;
+
+/// A 100 × 60 pt live rectangle at (10, 10), selected.
+fn session() -> (Session, NodeId) {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    let id = s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 60})).unwrap()["id"].as_u64().unwrap();
+    (s, NodeId(id))
+}
+
+fn run(s: &mut Session, p: Value) {
+    s.execute("object.setLiveShape", &p).unwrap_or_else(|e| panic!("{p}: {e}"));
+}
+
+fn corners(s: &Session, id: NodeId) -> ([f64; 4], [CornerKind; 4], usize) {
+    let n = s.doc().unwrap().doc.node(id).unwrap();
+    let NodeKind::Path { live: Some(LiveShape::Rectangle { radii, kinds, .. }), path, .. } = &n.kind else { panic!("not a live rectangle") };
+    (*radii, *kinds, path.anchor_count())
+}
+
+fn selected_anchors(s: &Session, id: NodeId) -> Option<BTreeSet<AnchorRef>> {
+    s.doc().unwrap().selection.partial(id).cloned()
+}
+
+fn anchors(v: &[usize]) -> BTreeSet<AnchorRef> {
+    v.iter().map(|ai| (0, *ai)).collect()
+}
+
+#[test]
+fn a_whole_rectangle_rounds_all_corners_and_given_corners_alone() {
+    let (mut s, id) = session();
+    run(&mut s, json!({"radius": 8}));
+    assert_eq!(corners(&s, id), ([8.0; 4], [CornerKind::Round; 4], 8));
+    run(&mut s, json!({"id": id.0, "radius": 0}));
+    // One corner: only it rounds, and the path gains one anchor (one undo step).
+    let undo = s.doc().unwrap().history.undo.len();
+    run(&mut s, json!({"ids": [id.0], "corners": [1], "radius": 12}));
+    assert_eq!(corners(&s, id), ([0.0, 12.0, 0.0, 0.0], [CornerKind::Round; 4], 5));
+    assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1);
+    let b = s.doc().unwrap().doc.node(id).unwrap().geometric_bounds().unwrap();
+    assert!((b.x1 - 110.0).abs() < 1e-9 && (b.y0 - 10.0).abs() < 1e-9, "the shape keeps its bounds: {b:?}");
+    // Kinds alone, then both; the others stay as they were.
+    run(&mut s, json!({"corners": [1, 3], "kind": "chamfer"}));
+    run(&mut s, json!({"corners": [3], "radius": 5, "kind": "invertedRound"}));
+    assert_eq!(corners(&s, id), ([0.0, 12.0, 0.0, 5.0], [CornerKind::Round, CornerKind::Chamfer, CornerKind::Round, CornerKind::InvertedRound], 6));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(corners(&s, id).1[3], CornerKind::Chamfer);
+}
+
+#[test]
+fn bad_corners_and_kinds_are_errors() {
+    let (mut s, id) = session();
+    for p in
+        [json!({"corners": [4], "radius": 5}), json!({"corners": ["a"]}), json!({"corners": 1}), json!({"corners": [-1]}), json!({"kind": "wavy"})]
+    {
+        assert!(s.execute("object.setLiveShape", &p).is_err(), "{p}");
+    }
+    assert_eq!(corners(&s, id), ([0.0; 4], [CornerKind::Round; 4], 4), "nothing changed");
+}
+
+#[test]
+fn direct_selected_corners_round_alone_and_stay_selected() {
+    let (mut s, id) = session();
+    // Direct Selection picks the top-right and bottom-left corners.
+    s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 1], [0, 3]], "mode": "set"})).unwrap();
+    run(&mut s, json!({"radius": 10}));
+    assert_eq!(corners(&s, id), ([0.0, 10.0, 0.0, 10.0], [CornerKind::Round; 4], 6));
+    // Anchors: top-left, top-right's two, bottom-right, bottom-left's two.
+    assert_eq!(selected_anchors(&s, id), Some(anchors(&[1, 2, 4, 5])));
+    // The same corners again (a field in the Properties panel), now with their two anchors each.
+    run(&mut s, json!({"kind": "chamfer"}));
+    assert_eq!(corners(&s, id).1, [CornerKind::Round, CornerKind::Chamfer, CornerKind::Round, CornerKind::Chamfer]);
+    run(&mut s, json!({"radius": 0}));
+    assert_eq!(corners(&s, id).2, 4);
+    assert_eq!(selected_anchors(&s, id), Some(anchors(&[1, 3])));
+    // Undo brings back the selection with the shape.
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(selected_anchors(&s, id), Some(anchors(&[1, 2, 4, 5])));
+    // Explicit corners win over the selection, which follows its own corners.
+    run(&mut s, json!({"corners": [0], "radius": 4}));
+    assert_eq!(corners(&s, id).0, [4.0, 10.0, 0.0, 10.0]);
+    assert_eq!(selected_anchors(&s, id), Some(anchors(&[1, 2, 4, 5])), "the top-left corner comes first and last");
+}
+
+#[test]
+fn a_drag_previews_one_corner_and_commits_one_step() {
+    let (mut s, id) = session();
+    s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 2]], "mode": "set"})).unwrap();
+    let undo = s.doc().unwrap().history.undo.len();
+    s.begin_interaction("Corner Radius").unwrap();
+    for r in [5.0, 9.0, 14.0] {
+        s.preview("object.setLiveShape", &json!({"id": id.0, "radius": r, "corners": [2]})).unwrap();
+    }
+    s.commit_interaction().unwrap();
+    assert_eq!(corners(&s, id), ([0.0, 0.0, 14.0, 0.0], [CornerKind::Round; 4], 5));
+    assert_eq!(selected_anchors(&s, id), Some(anchors(&[2, 3])));
+    assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1);
+}
+
+/// How far each corner's cut reaches along x and y (top-left, top-right, bottom-right,
+/// bottom-left) of a rectangle with four cut corners: equal for a circular arc.
+fn spans(s: &Session, id: NodeId) -> Vec<(f64, f64)> {
+    let NodeKind::Path { path, .. } = &s.doc().unwrap().doc.node(id).unwrap().kind else { panic!("not a path") };
+    let a: Vec<_> = path.subpaths[0].anchors.iter().map(|a| a.p).collect();
+    assert_eq!(a.len(), 8, "four cut corners");
+    [(7, 0), (1, 2), (3, 4), (5, 6)].iter().map(|(i, j)| ((a[*j].x - a[*i].x).abs(), (a[*j].y - a[*i].y).abs())).collect()
+}
+
+fn assert_spans(s: &Session, id: NodeId, want: [f64; 4]) {
+    let got = spans(s, id);
+    let ok = got.iter().zip(want).all(|((x, y), r)| (x - r).abs() < 1e-9 && (y - r).abs() < 1e-9);
+    assert!(ok, "corners span {got:?}, want circles of radii {want:?}");
+}
+
+/// #442: on a rectangle that isn't square, every corner is the same circle, also past the limit
+/// and on a shape from a file that kept an uneven scale in its transform (before #291).
+#[test]
+fn corners_of_a_non_square_rectangle_are_alike_circles() {
+    let (mut s, id) = session();
+    run(&mut s, json!({"radius": 12}));
+    assert_spans(&s, id, [12.0; 4]);
+    // Past half the shorter side, every corner stops there.
+    run(&mut s, json!({"radius": 45}));
+    assert_spans(&s, id, [30.0; 4]);
+    // A 50 × 60 rectangle with 10 pt corners, saved stretched to 100 × 60: 20 × 10 ellipses.
+    {
+        let d = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc);
+        let NodeKind::Path { path, live: Some(live), .. } = &mut d.node_mut(id).unwrap().kind else { panic!("not live") };
+        let xf = Affine::translate((10.0, 10.0)) * Affine::scale_non_uniform(2.0, 1.0);
+        *live = LiveShape::Rectangle { w: 50.0, h: 60.0, radii: [10.0; 4], kinds: Default::default(), xf };
+        *path = live.to_path();
+    }
+    assert_eq!(spans(&s, id)[0], (20.0, 10.0));
+    // Rounding one corner makes every corner a circle: the others of the mean radius.
+    run(&mut s, json!({"corners": [1], "radius": 12}));
+    let mean = 10.0 * 2f64.sqrt();
+    assert_spans(&s, id, [mean, 12.0, mean, mean]);
+    let b = s.doc().unwrap().doc.node(id).unwrap().geometric_bounds().unwrap();
+    assert!((b.x0 - 10.0).abs() < 1e-9 && (b.x1 - 110.0).abs() < 1e-9 && (b.y1 - 70.0).abs() < 1e-9, "same bounds: {b:?}");
+    run(&mut s, json!({"radius": 8}));
+    assert_spans(&s, id, [8.0; 4]);
+}

crates/engine/src/tests_menucmds.rs

@@ -1,7 +1,7 @@
 //! Menu long-tail commands (Object/Edit/Select/Type/View/File), driven through `Session::execute`.
 
 use serde_json::{Value, json};
-use vectorcraft_color::Color;
+use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::{ColorMode, LiveShape, Node, NodeKind, TextKind};
 use vectorcraft_geom::Rect;
 
@@ -740,6 +740,99 @@ fn ruler_guides_and_lock() {
     assert!(s.execute("guide.remove", &json!({"index": 0})).is_err());
 }
 
+fn guides(s: &Session) -> Vec<(bool, f64)> {
+    s.doc().unwrap().doc.guides.iter().map(|g| (g.vertical, g.pos)).collect()
+}
+
+fn selected_guides(s: &Session) -> Vec<usize> {
+    s.doc().unwrap().selection.guides.clone()
+}
+
+/// #414: ruler guides are selected, moved, copied, nudged and deleted like art, over commands.
+#[test]
+fn ruler_guides_select_move_and_delete() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    for (vertical, pos) in [(true, 100.0), (false, 50.0), (true, 300.0)] {
+        s.execute("guide.add", &json!({"vertical": vertical, "pos": pos})).unwrap();
+    }
+    sel(&mut s, &[a]);
+    // Selecting guides deselects the art; toggle adds and removes.
+    assert_eq!(s.execute("guide.select", &json!({"indexes": [0]})).unwrap()["selected"], json!([0]));
+    assert!(selected(&s).is_empty());
+    assert_eq!(s.execute("guide.select", &json!({"indexes": [1], "toggle": true})).unwrap()["selected"], json!([0, 1]));
+    assert_eq!(s.execute("guide.list", &json!({})).unwrap()[1], json!({"index": 1, "vertical": false, "pos": 50.0, "selected": true}));
+    assert!(s.execute("guide.select", &json!({"indexes": [7]})).is_err());
+    // A move takes each selected guide along its own axis, in one undo step.
+    let n = undo_len(&s);
+    s.execute("guide.move", &json!({"dx": 10, "dy": -5})).unwrap();
+    assert_eq!(guides(&s), [(true, 110.0), (false, 45.0), (true, 300.0)]);
+    assert_eq!(undo_len(&s), n + 1);
+    // Alt: copies, which are then the selection.
+    s.execute("guide.move", &json!({"dx": 20, "copy": true})).unwrap();
+    assert_eq!(guides(&s).len(), 5);
+    assert_eq!(&guides(&s)[3..], [(true, 130.0), (false, 45.0)]);
+    assert_eq!(selected_guides(&s), [3, 4]);
+    // The arrow keys nudge them.
+    s.execute("object.nudge", &json!({"dx": 1, "dy": 0, "big": true})).unwrap();
+    assert_eq!(guides(&s)[3], (true, 140.0));
+    // Delete (edit.clear) deletes the selected guides; the others keep their places.
+    s.execute("guide.select", &json!({"indexes": [1, 3]})).unwrap();
+    assert_eq!(s.execute("guide.list", &json!({})).unwrap().as_array().unwrap().len(), 5);
+    s.execute("edit.clear", &json!({})).unwrap();
+    assert_eq!(guides(&s), [(true, 110.0), (true, 300.0), (false, 45.0)]);
+    assert!(selected_guides(&s).is_empty());
+    assert!(s.doc().unwrap().doc.node(a).is_some(), "the art stays");
+    // Removing one keeps the rest of the selection pointing at the same guides.
+    s.execute("guide.select", &json!({"indexes": [1, 2]})).unwrap();
+    assert_eq!(s.execute("guide.remove", &json!({"index": 0})).unwrap()["count"], 1);
+    assert_eq!((guides(&s), selected_guides(&s)), (vec![(true, 300.0), (false, 45.0)], vec![0, 1]));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!((guides(&s).len(), selected_guides(&s)), (3, vec![1, 2]));
+    // Out of range positions are refused.
+    assert!(s.execute("guide.move", &json!({"index": 0, "pos": 1e300})).is_err());
+    assert!(s.execute("guide.add", &json!({"vertical": true, "pos": -1e300})).is_err());
+    // Locking deselects them, and they can't be picked again until unlocked.
+    s.execute("view.guides.lock", &json!({"locked": true})).unwrap();
+    assert!(selected_guides(&s).is_empty());
+    assert!(matches!(s.execute("guide.select", &json!({"indexes": [0]})), Err(EngineError::Disabled(..))));
+    assert!(matches!(s.execute("edit.clear", &json!({})), Err(EngineError::Disabled(..))));
+}
+
+/// #414: the Selection tool picks a ruler guide over the art and drags it in one undo step; with
+/// guides hidden or locked the press goes to the art.
+#[test]
+fn selection_tool_drags_a_ruler_guide() {
+    use vectorcraft_tools::{PointerEvent, PointerKind};
+    let mut s = session();
+    let a = rect(&mut s, 100.0, 100.0, 100.0, 100.0);
+    s.execute("guide.add", &json!({"vertical": true, "pos": 150})).unwrap();
+    s.execute("select.none", &json!({})).unwrap();
+    let v = ViewInfo { smart_guides: false, ..Default::default() };
+    s.select_tool("selection", v).unwrap();
+    let drag = |s: &mut Session, v: ViewInfo, from: (f64, f64), to: (f64, f64)| {
+        s.pointer(&PointerEvent::new(PointerKind::Down, from.0, from.1), v).unwrap();
+        s.pointer(&PointerEvent::new(PointerKind::Drag, to.0, to.1), v).unwrap();
+        s.pointer(&PointerEvent::new(PointerKind::Up, to.0, to.1), v).unwrap();
+    };
+    let n = undo_len(&s);
+    drag(&mut s, v, (151.0, 120.0), (171.0, 140.0));
+    assert_eq!(guides(&s), [(true, 170.0)]);
+    assert_eq!(selected_guides(&s), [0]);
+    assert!(selected(&s).is_empty());
+    assert_eq!(bounds(&s, a).x0, 100.0, "the art stays");
+    assert_eq!(undo_len(&s), n + 1);
+    assert_eq!(s.doc().unwrap().history.undo.last().unwrap().label, "Move Guide");
+    // Hidden guides: the press takes the art.
+    let hidden = ViewInfo { guides: false, ..v };
+    drag(&mut s, hidden, (170.0, 120.0), (180.0, 120.0));
+    assert_eq!((guides(&s), bounds(&s, a).x0), (vec![(true, 170.0)], 110.0));
+    // Locked guides too.
+    s.execute("view.guides.lock", &json!({"locked": true})).unwrap();
+    drag(&mut s, v, (170.0, 120.0), (180.0, 120.0));
+    assert_eq!((guides(&s), bounds(&s, a).x0), (vec![(true, 170.0)], 120.0));
+}
+
 // ---------- File ----------
 
 #[test]
@@ -766,6 +859,122 @@ fn document_color_mode_converts_colours() {
     assert!(s.execute("file.documentColorMode", &json!({"mode": "lab"})).is_err());
 }
 
+/// Four RGB greys (#000000, #333333, #808080, #e6e6e6, as in issue #421) and a red, a 40% tint of a
+/// grey global swatch, a gradient to grey and a pattern of a grey tile → (session, the five
+/// rectangles, the tinted one, the gradient one).
+fn greys_document() -> (Session, Vec<NodeId>, NodeId, NodeId) {
+    let mut s = session();
+    let ids: Vec<NodeId> = ["#000000", "#333333", "#808080", "#e6e6e6", "#ff0000"]
+        .iter()
+        .map(|hex| {
+            let id = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+            fill(&mut s, id, hex);
+            id
+        })
+        .collect();
+    s.execute("swatch.new", &json!({"name": "Ink", "color": "#808080", "global": true})).unwrap();
+    let tint = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    s.execute("paint.setFill", &json!({"ids": [tint.0], "swatch": "Ink", "tint": 40})).unwrap();
+    let grad = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    let stops = json!([{"offset": 0, "color": "#ffffff"}, {"offset": 1, "color": "#333333"}]);
+    s.execute("paint.setFill", &json!({"ids": [grad.0], "gradient": {"kind": "linear", "stops": stops}})).unwrap();
+    let tile = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    fill(&mut s, tile, "#808080");
+    s.execute("object.pattern.make", &json!({"ids": [tile.0], "name": "Grey Tile", "edit": false})).unwrap();
+    (s, ids, tint, grad)
+}
+
+/// The colour of pattern `name`'s first tile object.
+fn pattern_fill(s: &Session, name: &str) -> Color {
+    s.doc().unwrap().doc.pattern(name).unwrap().art[0].appearance.fill_paint().color().unwrap()
+}
+
+/// K of a colour that prints on the black plate only.
+fn k_only(c: Color) -> f32 {
+    match c {
+        Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k } => k,
+        other => panic!("not K only: {other:?}"),
+    }
+}
+
+#[test]
+fn document_color_mode_separates_rgb_greys_through_the_profile() {
+    let (mut s, ids, _, _) = greys_document();
+    s.execute("file.documentColorMode", &json!({"mode": "cmyk"})).unwrap();
+    // As Illustrator converts them: four-colour greys and a rich black.
+    let Color::Cmyk { c, m, y, k } = fill_of(&s, ids[2]) else { panic!("not CMYK") };
+    assert!(c > 0.05 && m > 0.05 && y > 0.05 && k > 0.0, "a four-colour mid grey: {c} {m} {y} {k}");
+    let Color::Cmyk { c, k, .. } = fill_of(&s, ids[0]) else { panic!("not CMYK") };
+    assert!(k > 0.9 && c > 0.3, "rich black: {c} {k}");
+    // Pattern tiles are swatches too: their art converts with the rest.
+    assert!(matches!(pattern_fill(&s, "Grey Tile"), Color::Cmyk { .. }), "{:?}", pattern_fill(&s, "Grey Tile"));
+    // Gray colours stay Gray.
+    let mut g = session();
+    let a = rect(&mut g, 0.0, 0.0, 10.0, 10.0);
+    g.execute("paint.setFill", &json!({"ids": [a.0], "color": {"gray": 0.3}})).unwrap();
+    g.execute("file.documentColorMode", &json!({"mode": "cmyk"})).unwrap();
+    assert_eq!(fill_of(&g, a), Color::gray(0.3));
+}
+
+#[test]
+fn document_color_mode_can_put_rgb_greys_on_the_black_plate() {
+    let (mut profile, pids, ..) = greys_document();
+    profile.execute("file.documentColorMode", &json!({"mode": "cmyk"})).unwrap();
+    let (mut s, ids, tint, grad) = greys_document();
+    let e = s.execute("file.documentColorMode", &json!({"mode": "cmyk", "grays": "rich"})).unwrap_err().to_string();
+    assert!(e.contains("grays"), "{e}");
+    s.execute("file.documentColorMode", &json!({"mode": "cmyk", "grays": "black"})).unwrap();
+    let close = |a: f32, b: f32| (a - b).abs() < 0.005;
+    for (id, want) in ids.iter().zip([1.0, 0.8, 0.498, 0.098]) {
+        let k = k_only(fill_of(&s, *id));
+        assert!(close(k, want), "K {k}, want {want}");
+    }
+    // Other colours convert through the profile as before.
+    assert_eq!(fill_of(&s, ids[4]), fill_of(&profile, pids[4]));
+    // Swatches, their tints, gradient stops and pattern tiles follow the same rule.
+    let d = &s.doc().unwrap().doc;
+    assert!(close(k_only(d.swatch("Ink").unwrap().paint.color().unwrap()), 0.498));
+    let Paint::Solid { color, swatch, tint: t } = node(&s, tint).appearance.fill_paint() else { panic!("not solid") };
+    assert!(close(k_only(color), 0.498 * 0.4) && swatch.as_deref() == Some("Ink") && t == 0.4, "{color:?} {swatch:?} {t}");
+    let Paint::Gradient(g) = node(&s, grad).appearance.fill_paint() else { panic!("not a gradient") };
+    let ks: Vec<f32> = g.gradient.stops.iter().map(|st| k_only(st.color)).collect();
+    assert!(close(ks[0], 0.0) && close(ks[1], 0.8), "{ks:?}");
+    assert!(close(k_only(pattern_fill(&s, "Grey Tile")), 0.498));
+    // To RGB, `grays` changes nothing.
+    s.execute("file.documentColorMode", &json!({"mode": "rgb", "grays": "black"})).unwrap();
+    let rgb = s.doc().unwrap().doc.layers.clone();
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("file.documentColorMode", &json!({"mode": "rgb"})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.layers, rgb);
+}
+
+#[test]
+fn opening_in_cmyk_can_put_rgb_greys_on_the_black_plate() {
+    let mut s = session();
+    for hex in ["#000000", "#333333", "#808080", "#e6e6e6", "#ff0000"] {
+        let id = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+        fill(&mut s, id, hex);
+    }
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap()["text"].as_str().unwrap().to_string();
+    let data = vectorcraft_format::base64_encode(svg.as_bytes());
+    let mut o = Session::new();
+    o.execute("document.open", &json!({"name": "greys.svg", "dataBase64": data, "colorMode": "cmyk", "grays": "black"})).unwrap();
+    let d = &o.doc().unwrap().doc;
+    assert_eq!(d.color_mode, ColorMode::Cmyk);
+    let mut fills = vec![];
+    for l in &d.layers {
+        l.walk(&mut |n| fills.extend(n.children().is_none().then(|| n.appearance.fill_paint().color()).flatten()));
+    }
+    assert_eq!(fills.len(), 5, "{fills:?}");
+    for (c, want) in fills.iter().zip([1.0, 0.8, 0.498, 0.098]) {
+        let k = k_only(*c);
+        assert!((k - want).abs() < 0.005, "K {k}, want {want}");
+    }
+    assert!(matches!(fills[4], Color::Cmyk { m, y, .. } if m > 0.8 && y > 0.8), "red separates as usual: {:?}", fills[4]);
+    let e = Session::new().execute("document.open", &json!({"name": "greys.svg", "dataBase64": data, "grays": "k"})).unwrap_err().to_string();
+    assert!(e.contains("grays"), "{e}");
+}
+
 #[test]
 fn file_info_sets_title() {
     let mut s = session();

crates/engine/src/tests_pathtype.rs

@@ -0,0 +1,219 @@
+//! Type on a path (#429): Type on a Path Options keep its brackets, flip it, align it to the path
+//! and space it; the selection tools drag its brackets to move it along the path and across it.
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{NodeKind, PathAlign, TextKind, TextObject};
+use vectorcraft_geom::{Point, Rect, Shape};
+use vectorcraft_tools::{Mods, PointerEvent, PointerKind};
+
+use super::*;
+
+fn session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 800, "height": 600})).unwrap();
+    s
+}
+
+/// 12 pt type on a path along `d` (SVG path data), starting where the path is nearest `at`.
+fn path_type(s: &mut Session, d: &str, at: [f64; 2], text: &str) -> NodeId {
+    let pid = s.execute("path.create", &json!({ "d": d })).unwrap()["id"].as_u64().unwrap();
+    let r = s.execute("text.createInPath", &json!({"path": pid, "mode": "onPath", "text": text, "size": 12, "at": at})).unwrap();
+    let id = NodeId(r["id"].as_u64().unwrap());
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    id
+}
+
+/// Type on the 400 pt line from (100, 300) to (500, 300), from its middle on.
+fn on_line(s: &mut Session) -> NodeId {
+    path_type(s, "M100 300 L500 300", [300.0, 310.0], "Slide")
+}
+
+fn text(s: &Session, id: NodeId) -> TextObject {
+    match &s.doc().unwrap().doc.node(id).unwrap().kind {
+        NodeKind::Text(t) => (**t).clone(),
+        k => panic!("not text: {k:?}"),
+    }
+}
+
+/// The type's start and end brackets as stored.
+fn brackets(s: &Session, id: NodeId) -> (f64, Option<f64>) {
+    match text(s, id).kind {
+        TextKind::OnPath { start, end, .. } => (start, end),
+        k => panic!("not type on a path: {k:?}"),
+    }
+}
+
+/// The glyphs' ink bounds in the document.
+fn ink(s: &Session, id: NodeId) -> Rect {
+    let t = text(s, id);
+    let lay = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t);
+    lay.glyphs
+        .iter()
+        .filter(|g| !g.outline.elements().is_empty())
+        .map(|g| t.xf.transform_rect_bbox(g.outline.bounding_box()))
+        .reduce(|a, b| a.union(b))
+        .unwrap()
+}
+
+/// The glyph origins along the path, in reading order.
+fn origins(s: &Session, id: NodeId) -> Vec<Point> {
+    let t = text(s, id);
+    vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t).glyphs.iter().map(|g| t.xf * g.origin).collect()
+}
+
+fn undo_len(s: &Session) -> usize {
+    s.doc().unwrap().history.undo.len()
+}
+
+fn last_step(s: &Session) -> String {
+    s.doc().unwrap().history.undo.last().unwrap().label.clone()
+}
+
+/// Press, drag and release `tool` from `from` to `to`.
+fn drag(s: &mut Session, tool: &str, from: Point, to: Point, mods: Mods) {
+    let v = ViewInfo::default();
+    s.select_tool(tool, v).unwrap();
+    for (kind, p) in [(PointerKind::Down, from), (PointerKind::Drag, to), (PointerKind::Up, to)] {
+        s.pointer(&PointerEvent::new(kind, p.x, p.y).with_mods(mods), v).unwrap();
+    }
+    assert!(!s.in_interaction());
+}
+
+fn near(a: f64, b: f64) -> bool {
+    (a - b).abs() < 1e-3
+}
+
+#[test]
+fn options_keep_the_brackets() {
+    let mut s = session();
+    let id = on_line(&mut s);
+    assert!(near(brackets(&s, id).0, 0.5));
+    // The query (what the dialog shows) has the current options.
+    let mut q = s.execute("type.pathOptions", &json!({})).unwrap();
+    assert!(near(q["start"].as_f64().unwrap(), 0.5), "{q}");
+    q.as_object_mut().unwrap().remove("start");
+    assert_eq!(q, json!({"end": null, "flip": false, "effect": "rainbow", "alignToPath": "baseline", "spacing": 0.0}));
+    let start = brackets(&s, id).0;
+    // OK with the dialog's values (effect, flip, align, spacing) leaves the type where it is.
+    let before = origins(&s, id);
+    s.execute("type.pathOptions", &json!({"effect": "rainbow", "flip": false, "alignToPath": "baseline", "spacing": 0})).unwrap();
+    assert_eq!(brackets(&s, id), (start, None));
+    assert_eq!(origins(&s, id), before);
+    // So does a new effect.
+    s.execute("type.pathOptions", &json!({"effect": "skew"})).unwrap();
+    assert_eq!(brackets(&s, id), (start, None));
+    assert_eq!(text(&s, id).path_effect, vectorcraft_doc::PathEffect::Skew);
+    // The end bracket is set, and put back at the end of the path.
+    s.execute("type.pathOptions", &json!({"end": 0.9})).unwrap();
+    assert_eq!(brackets(&s, id), (start, Some(0.9)));
+    s.execute("type.pathOptions", &json!({"end": null})).unwrap();
+    assert_eq!(brackets(&s, id), (start, None));
+    for bad in [json!({"start": "x"}), json!({"effect": "nope"}), json!({"alignToPath": "top"})] {
+        assert!(s.execute("type.pathOptions", &bad).is_err(), "{bad}");
+    }
+}
+
+#[test]
+fn flip_turns_the_type_to_the_other_side_of_its_stretch() {
+    let mut s = session();
+    let id = on_line(&mut s);
+    let up = ink(&s, id);
+    assert!(up.y1 < 301.0 && up.x0 > 299.0, "above the path from its middle: {up:?}");
+    let n = undo_len(&s);
+    let r = s.execute("type.pathOptions", &json!({"flip": true})).unwrap();
+    assert_eq!(undo_len(&s), n + 1);
+    // The path runs the other way and the brackets swap ends: the type keeps the right half.
+    assert!(near(r["start"].as_f64().unwrap(), 0.0) && near(r["end"].as_f64().unwrap(), 0.5), "{r}");
+    let down = ink(&s, id);
+    assert!(down.y0 > 299.0 && down.x0 > 299.0, "below the path, on the same half: {down:?}");
+    let o = origins(&s, id);
+    assert!(o.first().unwrap().x > o.last().unwrap().x, "reading right to left: {o:?}");
+    // Flipped back, it is as it was.
+    s.execute("type.pathOptions", &json!({"flip": true})).unwrap();
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.5) && end.is_none(), "{start} {end:?}");
+    assert!(ink(&s, id).y1 < 301.0);
+}
+
+#[test]
+fn a_flip_round_a_closed_path_keeps_the_type_in_place() {
+    let mut s = session();
+    let id = path_type(&mut s, "M100 100 L300 100 L300 300 L100 300 Z", [200.0, 90.0], "Ring");
+    let (start, _) = brackets(&s, id);
+    assert!(near(start, 0.125), "{start}");
+    let first = origins(&s, id)[0];
+    s.execute("type.pathOptions", &json!({"flip": true})).unwrap();
+    // Once round from the same point, the other way.
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.875) && end.is_none(), "{start} {end:?}");
+    assert!(origins(&s, id)[0].distance(first) < 8.0);
+}
+
+#[test]
+fn align_to_path_and_spacing() {
+    let mut s = session();
+    let id = on_line(&mut s);
+    s.execute("type.pathOptions", &json!({"alignToPath": "ascender"})).unwrap();
+    assert_eq!(text(&s, id).path_align, PathAlign::Ascender);
+    let hang = ink(&s, id);
+    assert!(hang.y0 > 299.0, "hangs below the path: {hang:?}");
+    s.execute("type.pathOptions", &json!({"alignToPath": "center"})).unwrap();
+    let mid = ink(&s, id);
+    assert!(mid.y0 < 300.0 && mid.y1 > 300.0, "the path runs through it: {mid:?}");
+    // Spacing closes glyphs up round the outside of a curve.
+    let id = path_type(&mut s, "M100 400 A60 60 0 0 1 220 400", [100.0, 400.0], "Round the bend");
+    let spread = |s: &Session| {
+        let o = origins(s, id);
+        o.first().unwrap().distance(*o.last().unwrap())
+    };
+    let loose = spread(&s);
+    s.execute("type.pathOptions", &json!({"spacing": 6})).unwrap();
+    assert!(spread(&s) < loose - 1.0, "{} < {loose}", spread(&s));
+    assert_eq!(s.execute("type.pathOptions", &json!({})).unwrap()["spacing"], json!(6.0));
+}
+
+#[test]
+fn dragging_the_centre_bracket_slides_the_type_and_across_the_path_flips_it() {
+    let mut s = session();
+    let id = on_line(&mut s);
+    let n = undo_len(&s);
+    // The centre bracket stands midway between the start (300) and the end of the path (500).
+    drag(&mut s, "selection", Point::new(400.0, 295.0), Point::new(440.0, 295.0), Mods::default());
+    assert_eq!(undo_len(&s), n + 1, "one step");
+    assert_eq!(last_step(&s), "Move Type on a Path");
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.6) && end.is_none(), "{start} {end:?}");
+    assert!(ink(&s, id).x0 > 339.0);
+    // Direct Selection drags it too; Cmd/Ctrl held below the path only slides it.
+    drag(&mut s, "directSelection", Point::new(420.0, 295.0), Point::new(380.0, 330.0), Mods { cmd: true, ..Mods::default() });
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.5) && end.is_none(), "{start} {end:?}");
+    assert!(ink(&s, id).y1 < 301.0, "still above the path");
+    // Across the path: flipped, on the same stretch.
+    drag(&mut s, "selection", Point::new(400.0, 295.0), Point::new(400.0, 330.0), Mods::default());
+    assert_eq!(undo_len(&s), n + 3);
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.0) && end.is_some_and(|e| near(e, 0.5)), "{start} {end:?}");
+    assert!(ink(&s, id).y0 > 299.0, "below the path");
+    // The step undoes as one.
+    s.execute("edit.undo", &json!({})).unwrap();
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.5) && end.is_none(), "{start} {end:?}");
+}
+
+#[test]
+fn dragging_the_start_and_end_brackets_sets_where_the_type_runs() {
+    let mut s = session();
+    let id = on_line(&mut s);
+    // The start bracket from the middle (300) to 200.
+    drag(&mut s, "selection", Point::new(300.0, 290.0), Point::new(200.0, 290.0), Mods::default());
+    assert!(near(brackets(&s, id).0, 0.25));
+    // The end bracket from the end of the path to 400.
+    drag(&mut s, "directSelection", Point::new(500.0, 290.0), Point::new(400.0, 290.0), Mods::default());
+    let (start, end) = brackets(&s, id);
+    assert!(near(start, 0.25) && end.is_some_and(|e| near(e, 0.75)), "{start} {end:?}");
+    let v: Value = s.execute("type.pathOptions", &json!({})).unwrap();
+    assert!(near(v["end"].as_f64().unwrap(), 0.75));
+    let r = ink(&s, id);
+    assert!(r.x0 > 199.0 && r.x1 < 401.0, "between the brackets: {r:?}");
+}

crates/engine/src/tests_prefs.rs

@@ -1,6 +1,6 @@
 //! Preferences: `prefs.get` / `prefs.set` / `prefs.reset` / `prefs.list`.
 
-use serde_json::json;
+use serde_json::{Value, json};
 
 use super::*;
 use crate::cmd::prefscmds::{PREF_CATEGORIES, PREF_GROUPS, PREF_SPECS, validate};
@@ -152,3 +152,336 @@ fn gpu_preference_defaults_to_power_saving_and_validates() {
     s.execute("prefs.reset", &json!({"category": "Performance"})).unwrap();
     assert_eq!(s.prefs.gpu_preference, "powerSaving");
 }
+
+/// Selection & Anchor Display › Tolerance, Object Selection by Path Only and Command Click to
+/// Select Objects Behind, and General › Double Click To Isolate, as the Selection tool sees them
+/// (#394).
+#[test]
+fn selection_preferences_drive_the_selection_tool() {
+    use vectorcraft_tools::{Mods, PointerEvent, PointerKind};
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    let rect = |s: &mut Session, x: f64| {
+        NodeId(s.execute("shape.rectangle", &json!({"x": x, "y": 100, "width": 100, "height": 100})).unwrap()["id"].as_u64().unwrap())
+    };
+    // Two filled squares overlapping between x = 150 and 200, `front` on top.
+    let (back, front) = (rect(&mut s, 100.0), rect(&mut s, 150.0));
+    s.select_tool("selection", ViewInfo::default()).unwrap();
+    let set = |s: &mut Session, key: &str, value: Value| s.execute("prefs.set", &json!({"key": key, "value": value})).unwrap();
+    let click = |s: &mut Session, x: f64, mods: Mods| {
+        for k in [PointerKind::Down, PointerKind::Up] {
+            // Halfway between the bounding box's handles.
+            s.pointer(&PointerEvent::new(k, x, 125.0).with_mods(mods), ViewInfo::default()).unwrap();
+        }
+        s.doc().unwrap().selection.objects.clone()
+    };
+    let plain = Mods::default();
+    // Tolerance: the right edge's stroke ends at x = 250.5.
+    assert_eq!(click(&mut s, 252.5, plain), vec![front], "2 px out: within the default 3 px");
+    assert!(click(&mut s, 256.5, plain).is_empty(), "6 px out: beyond 3 px");
+    set(&mut s, "selectionTolerance", json!(8));
+    assert_eq!(click(&mut s, 256.5, plain), vec![front], "6 px out: within 8 px");
+    set(&mut s, "selectionTolerance", json!(1));
+    assert!(click(&mut s, 252.5, plain).is_empty(), "2 px out: beyond 1 px");
+    set(&mut s, "selectionTolerance", json!(3));
+    // Object Selection by Path Only: the fill no longer selects, the path does.
+    assert_eq!(click(&mut s, 225.0, plain), vec![front]);
+    set(&mut s, "objectSelectionByPathOnly", json!(true));
+    assert!(click(&mut s, 225.0, plain).is_empty(), "a click inside the fill selects nothing");
+    assert_eq!(click(&mut s, 250.0, plain), vec![front], "a click on the path selects it");
+    set(&mut s, "objectSelectionByPathOnly", json!(false));
+    // Command Click to Select Objects Behind (on by default): each Cmd/Ctrl-click goes one down,
+    // then back to the top.
+    let cmd = Mods { cmd: true, ..Mods::default() };
+    assert_eq!(click(&mut s, 175.0, plain), vec![front]);
+    assert_eq!(click(&mut s, 175.0, cmd), vec![back], "the object behind");
+    assert_eq!(click(&mut s, 175.0, cmd), vec![front], "back to the topmost");
+    set(&mut s, "ctrlClickSelectsBehind", json!(false));
+    assert_eq!(click(&mut s, 175.0, cmd), vec![front], "off: a plain click");
+    // Double Click To Isolate (on by default) isolates a group; off, it doesn't.
+    s.execute("select.all", &json!({})).unwrap();
+    s.execute("object.group", &json!({})).unwrap();
+    let double = |s: &mut Session| {
+        s.pointer(&PointerEvent::new(PointerKind::DoubleClick, 175.0, 150.0), ViewInfo::default()).unwrap();
+        s.doc().unwrap().isolation
+    };
+    set(&mut s, "doubleClickToIsolate", json!(false));
+    assert_eq!(double(&mut s), None, "off: no isolation");
+    set(&mut s, "doubleClickToIsolate", json!(true));
+    assert!(double(&mut s).is_some(), "on: the group is isolated");
+}
+
+/// General › Use Precise Cursors (#394): the Pen's pointer becomes a crosshair; the Selection
+/// tool's arrow stays.
+#[test]
+fn use_precise_cursors_makes_drawing_cursors_crosshairs() {
+    use vectorcraft_tools::{Cursor, Mods};
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    let cursor = |s: &mut Session, tool: &str| {
+        s.select_tool(tool, ViewInfo::default()).unwrap();
+        s.cursor(vectorcraft_geom::Point::new(300.0, 300.0), Mods::default(), ViewInfo::default())
+    };
+    assert_eq!(cursor(&mut s, "pen"), Cursor::Pen);
+    s.execute("prefs.set", &json!({"key": "usePreciseCursors", "value": true})).unwrap();
+    assert_eq!(cursor(&mut s, "pen"), Cursor::Crosshair);
+    assert_eq!(cursor(&mut s, "selection"), Cursor::Arrow);
+}
+
+// ---------- #394, second batch ----------
+
+fn new_doc() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    s
+}
+
+fn square(s: &mut Session, x: f64, y: f64) -> NodeId {
+    NodeId(s.execute("shape.rectangle", &json!({"x": x, "y": y, "width": 50, "height": 50})).unwrap()["id"].as_u64().unwrap())
+}
+
+fn set_pref(s: &mut Session, key: &str, value: Value) {
+    s.execute("prefs.set", &json!({"key": key, "value": value})).unwrap();
+}
+
+fn gesture(s: &mut Session, v: ViewInfo, events: &[(vectorcraft_tools::PointerKind, f64, f64)]) {
+    for (k, x, y) in events {
+        s.pointer(&vectorcraft_tools::PointerEvent::new(*k, *x, *y), v).unwrap();
+    }
+}
+
+fn top_left(s: &Session, id: NodeId) -> (f64, f64) {
+    let b = s.doc().unwrap().doc.node(id).unwrap().geometric_bounds().unwrap();
+    (b.x0, b.y0)
+}
+
+/// View › Snap to Point with Selection & Anchor Display › Snap to Point's distance (#394): with
+/// Smart Guides off, the point a selection is dragged by lands on an anchor within 2 px.
+#[test]
+fn snap_to_point_lands_a_dragged_selection_on_anchors() {
+    use vectorcraft_tools::PointerKind::{Down, Drag, Up};
+    let mut s = new_doc();
+    let a = square(&mut s, 100.0, 100.0);
+    square(&mut s, 300.0, 100.0);
+    let v = ViewInfo { smart_guides: false, ..ViewInfo::default() };
+    s.select_tool("selection", v).unwrap();
+    // Grabbed by its centre and dropped 1.5, 1 px from the other square's top-left anchor.
+    let drag = |s: &mut Session, v: ViewInfo| {
+        gesture(s, v, &[(Down, 125.0, 125.0), (Drag, 200.0, 110.0), (Drag, 301.5, 101.0), (Up, 301.5, 101.0)]);
+        let at = top_left(s, a);
+        s.execute("edit.undo", &json!({})).unwrap();
+        at
+    };
+    assert_eq!(drag(&mut s, v), (275.0, 75.0), "the centre lands on the anchor");
+    set_pref(&mut s, "snapToPointTolerance", json!(1));
+    assert_eq!(drag(&mut s, v), (276.5, 76.0), "1.8 px is beyond 1 px");
+    set_pref(&mut s, "snapToPointTolerance", json!(2));
+    assert_eq!(drag(&mut s, ViewInfo { snap_to_point: false, ..v }), (276.5, 76.0), "View › Snap to Point off");
+}
+
+/// Enable Rubber Band for Pen Tool / Curvature Tool (#394): off, no segment follows the pointer.
+#[test]
+fn rubber_band_preferences_hide_the_preview_to_the_pointer() {
+    use vectorcraft_tools::Overlay;
+    use vectorcraft_tools::PointerKind::{Down, Move, Up};
+    let v = ViewInfo::default();
+    for (tool, key) in [("pen", "penRubberBand"), ("curvature", "curvatureRubberBand")] {
+        let mut s = new_doc();
+        s.select_tool(tool, v).unwrap();
+        gesture(&mut s, v, &[(Down, 50.0, 50.0), (Up, 50.0, 50.0), (Down, 150.0, 50.0), (Up, 150.0, 50.0), (Move, 200.0, 150.0)]);
+        let bands = |s: &mut Session| s.overlays(v).iter().filter(|o| matches!(o, Overlay::Path { .. })).count();
+        assert_eq!(bands(&mut s), 1, "{tool}: the rubber band");
+        set_pref(&mut s, key, json!(false));
+        assert_eq!(bands(&mut s), 0, "{tool}: off");
+    }
+}
+
+/// Move Locked and Hidden Artwork with Artboard (#394): off, an artboard moved with its art
+/// leaves locked and hidden objects where they are; on, they move too.
+#[test]
+fn move_locked_and_hidden_artwork_with_artboard() {
+    let mut s = new_doc();
+    let (free, locked, hidden) = (square(&mut s, 10.0, 10.0), square(&mut s, 100.0, 10.0), square(&mut s, 200.0, 10.0));
+    for (id, cmd) in [(locked, "object.lock"), (hidden, "object.hide")] {
+        s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+        s.execute(cmd, &json!({})).unwrap();
+    }
+    let moved = |s: &mut Session| {
+        s.execute("artboard.move", &json!({"index": 0, "dx": 30, "dy": 0, "moveArt": true})).unwrap();
+        let xs = [free, locked, hidden].map(|id| top_left(s, id).0);
+        s.execute("edit.undo", &json!({})).unwrap();
+        xs
+    };
+    assert_eq!(moved(&mut s), [40.0, 100.0, 200.0]);
+    set_pref(&mut s, "moveLockedWithArtboard", json!(true));
+    assert_eq!(moved(&mut s), [40.0, 130.0, 230.0]);
+}
+
+/// General › Transform Pattern Tiles (#394) is what transforms do with pattern fills unless their
+/// `patterns` param says otherwise (the dialogs' Transform Patterns).
+#[test]
+fn transform_pattern_tiles_is_the_transforms_default() {
+    use vectorcraft_color::Paint;
+    let mut s = new_doc();
+    let tile = square(&mut s, 0.0, 0.0);
+    s.execute("select.set", &json!({"ids": [tile.0]})).unwrap();
+    s.execute("object.pattern.make", &json!({"name": "Dots", "width": 20, "height": 20})).unwrap();
+    s.execute("object.pattern.done", &json!({})).unwrap();
+    let big = square(&mut s, 100.0, 100.0);
+    s.execute("paint.setFill", &json!({"ids": [big.0], "swatch": "Dots"})).unwrap();
+    s.execute("select.set", &json!({"ids": [big.0]})).unwrap();
+    let tiles = |s: &Session| match s.doc().unwrap().doc.node(big).unwrap().appearance.fill_paint() {
+        Paint::Pattern { xf, .. } => xf.as_coeffs(),
+        p => panic!("not a pattern: {p:?}"),
+    };
+    s.execute("object.move", &json!({"dx": 10, "dy": 0})).unwrap();
+    assert_eq!(tiles(&s), [1.0, 0.0, 0.0, 1.0, 0.0, 0.0], "off: the tiles stay");
+    set_pref(&mut s, "transformPatternTiles", json!(true));
+    s.execute("object.move", &json!({"dx": 10, "dy": 0})).unwrap();
+    assert_eq!(tiles(&s), [1.0, 0.0, 0.0, 1.0, 10.0, 0.0], "on: they move with the art");
+    assert_eq!(s.journal.last().unwrap().1["patterns"], json!(true), "the journal keeps the choice");
+    s.execute("object.scale", &json!({"sx": 200, "origin": [0, 0], "patterns": false})).unwrap();
+    assert_eq!(tiles(&s), [1.0, 0.0, 0.0, 1.0, 10.0, 0.0], "the param wins");
+    s.execute("object.scale", &json!({"sx": 50, "origin": [0, 0]})).unwrap();
+    assert_eq!(tiles(&s), [0.5, 0.0, 0.0, 0.5, 5.0, 0.0]);
+}
+
+/// General › Select Same Tint % (#394): off, Select › Same › Fill Color takes every tint of the
+/// swatch; on, only the same tint.
+#[test]
+fn select_same_tint_percent() {
+    let mut s = new_doc();
+    s.execute("swatch.new", &json!({"name": "Ink", "color": "#cc0066", "spot": true})).unwrap();
+    // Before the others: new art takes the last fill applied.
+    square(&mut s, 300.0, 10.0);
+    let ids: Vec<NodeId> = [(10.0, 40), (100.0, 40), (200.0, 80)]
+        .into_iter()
+        .map(|(x, tint)| {
+            let id = square(&mut s, x, 10.0);
+            s.execute("paint.setFill", &json!({"ids": [id.0], "swatch": "Ink", "tint": tint})).unwrap();
+            id
+        })
+        .collect();
+    let same = |s: &mut Session| {
+        s.execute("select.set", &json!({"ids": [ids[0].0]})).unwrap();
+        s.execute("select.same.fillColor", &json!({})).unwrap();
+        s.doc().unwrap().selection.objects.len()
+    };
+    assert_eq!(same(&mut s), 3, "every tint of Ink");
+    set_pref(&mut s, "selectSameTintPercent", json!(true));
+    assert_eq!(same(&mut s), 2, "only Ink 40%");
+}
+
+fn style_at(s: &Session, id: NodeId, byte: usize) -> vectorcraft_doc::CharStyle {
+    let Some(vectorcraft_doc::NodeKind::Text(t)) = s.doc().unwrap().doc.node(id).map(|n| &n.kind) else { panic!("not text") };
+    let mut at = 0;
+    for r in &t.runs {
+        if byte < at + r.text.len() {
+            return r.style.clone();
+        }
+        at += r.text.len();
+    }
+    panic!("byte {byte} past the text")
+}
+
+/// Type › Size/Leading, Tracking and Baseline Shift (#394): the increments `type.step` and the
+/// font size shortcuts step by, on selected type objects and on the Type tool's selected text
+/// (Alt+arrows; Cmd/Ctrl too: five steps).
+#[test]
+fn type_increments_step_the_type() {
+    use vectorcraft_tools::PointerKind::{Down, Up};
+    use vectorcraft_tools::{Mods, ToolKey};
+    let mut s = new_doc();
+    let id = NodeId(s.execute("text.create", &json!({"x": 100, "y": 100, "text": "Hello world", "size": 20})).unwrap()["id"].as_u64().unwrap());
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    s.execute("type.size.increase", &json!({})).unwrap();
+    assert_eq!(style_at(&s, id, 0).size, 22.0, "Size/Leading is 2 pt");
+    set_pref(&mut s, "typeSizeIncrement", json!(3));
+    s.execute("type.size.decrease", &json!({})).unwrap();
+    assert_eq!(style_at(&s, id, 0).size, 19.0);
+    s.execute("type.step", &json!({"attribute": "leading"})).unwrap();
+    assert!((style_at(&s, id, 0).leading.unwrap() - (19.0 * 1.2 + 3.0)).abs() < 1e-9, "from Auto");
+    set_pref(&mut s, "baselineShiftIncrement", json!(1.5));
+    s.execute("type.step", &json!({"attribute": "baselineShift", "by": -2})).unwrap();
+    assert_eq!(style_at(&s, id, 10).baseline_shift, -3.0);
+    // The Type tool: Alt+→ tracks the selected text by Tracking (20/1000 em), Cmd-Alt five times.
+    let v = ViewInfo::default();
+    s.select_tool("type", v).unwrap();
+    gesture(&mut s, v, &[(Down, 102.0, 95.0), (Up, 102.0, 95.0)]);
+    assert_eq!(s.tool_options()["editing"], json!(id.0), "editing the text");
+    let alt = Mods { alt: true, ..Mods::default() };
+    let select = |s: &mut Session, a: usize, b: usize| s.set_tool_option("select", &json!({"start": a, "end": b}));
+    select(&mut s, 0, 5);
+    s.tool_key(ToolKey::Right, alt, v).unwrap();
+    assert_eq!((style_at(&s, id, 0).tracking, style_at(&s, id, 6).tracking), (20.0, 0.0));
+    s.tool_key(ToolKey::Left, Mods { cmd: true, ..alt }, v).unwrap();
+    assert_eq!(style_at(&s, id, 4).tracking, -80.0);
+    // At a caret: Alt+← kerns the character before it, Alt+↓ opens up the paragraph's leading.
+    select(&mut s, 3, 3);
+    s.tool_key(ToolKey::Left, alt, v).unwrap();
+    assert_eq!((style_at(&s, id, 2).kerning, style_at(&s, id, 3).kerning), (Some(-20.0), None));
+    let leading = style_at(&s, id, 0).leading.unwrap();
+    s.tool_key(ToolKey::Down, alt, v).unwrap();
+    assert_eq!(style_at(&s, id, 8).leading, Some(leading + 3.0));
+    // Alt+Shift+↑ raises the selected text's baseline.
+    select(&mut s, 6, 11);
+    s.tool_key(ToolKey::Up, Mods { shift: true, ..alt }, v).unwrap();
+    assert_eq!((style_at(&s, id, 0).baseline_shift, style_at(&s, id, 6).baseline_shift), (-3.0, -1.5));
+    // The font size shortcut steps the selected text while the tool edits.
+    s.execute("type.size.increase", &json!({})).unwrap();
+    assert_eq!((style_at(&s, id, 0).size, style_at(&s, id, 6).size), (19.0, 22.0));
+}
+
+/// Type › Fill New Type Objects With Placeholder Text (#394, on by default): type the Type tool
+/// places starts with placeholder text, selected, so typing replaces it; off, it starts empty.
+#[test]
+fn new_type_starts_with_placeholder_text() {
+    use vectorcraft_tools::PointerKind::{Down, Drag, Up};
+    let v = ViewInfo::default();
+    let mut s = new_doc();
+    s.select_tool("type", v).unwrap();
+    let text = |s: &Session| {
+        let st = s.doc().unwrap();
+        match &st.doc.node(st.selection.objects[0]).unwrap().kind {
+            vectorcraft_doc::NodeKind::Text(t) => t.plain_text(),
+            _ => panic!("not text"),
+        }
+    };
+    gesture(&mut s, v, &[(Down, 50.0, 50.0), (Up, 50.0, 50.0)]);
+    let placeholder = text(&s);
+    assert!(placeholder.len() > 10, "{placeholder}");
+    assert_eq!((s.tool_options()["start"].clone(), s.tool_options()["end"].clone()), (json!(0), json!(placeholder.len())), "selected");
+    s.tool_text("Hi", v).unwrap();
+    assert_eq!(text(&s), "Hi");
+    // Area type is filled to its frame.
+    gesture(&mut s, v, &[(Down, 100.0, 150.0), (Drag, 300.0, 300.0), (Up, 300.0, 300.0)]);
+    assert!(text(&s).len() > placeholder.len());
+    set_pref(&mut s, "placeholderText", json!(false));
+    gesture(&mut s, v, &[(Down, 50.0, 350.0), (Up, 50.0, 350.0)]);
+    assert_eq!(text(&s), "");
+}
+
+/// Type › Enable Missing Glyph Protection (#394, on by default): characters a new font has no
+/// glyph for keep the font that has one; off, they take the new font.
+#[test]
+fn missing_glyph_protection_keeps_glyphs_a_new_font_lacks() {
+    let (from, to, c) = ("Source Sans 3", "JetBrains Mono", '\u{180}');
+    let db = vectorcraft_text::FontDb::global();
+    let covers = |f: &str| db.face(f, "Regular").is_some_and(|face| face.covers(c));
+    if !covers(from) || covers(to) {
+        return; // Installed fonts of these names cover other characters.
+    }
+    let mut s = new_doc();
+    let id = NodeId(s.execute("text.create", &json!({"x": 10, "y": 50, "text": "a\u{180}c", "font": from})).unwrap()["id"].as_u64().unwrap());
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    let fonts = |s: &Session| [0, 1, 3].map(|b| style_at(s, id, b).font_family);
+    s.execute("text.setStyle", &json!({"font": to})).unwrap();
+    assert_eq!(fonts(&s), [to, from, to], "the character keeps its font");
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("text.setRangeStyle", &json!({"id": id.0, "start": 1, "end": 4, "font": to})).unwrap();
+    assert_eq!(fonts(&s), [from, from, to]);
+    s.execute("edit.undo", &json!({})).unwrap();
+    set_pref(&mut s, "missingGlyphProtection", json!(false));
+    s.execute("text.setStyle", &json!({"font": to})).unwrap();
+    assert_eq!(fonts(&s), [to, to, to]);
+}

crates/engine/src/tests_recovery.rs

@@ -1,6 +1,7 @@
 //! Data Recovery: `file.recovery.save/list/restore/discard`, copies removed on save, revert and
 //! close, complex documents skipped, each app's own area (another running app's copies are never
-//! offered: locks, heartbeats), and the folder store with real file locks.
+//! offered: locks, heartbeats, announcements; a paused app repairs its copies), and the folder
+//! store with real file locks.
 
 use std::sync::Arc;
 
@@ -175,7 +176,7 @@ fn heartbeats_hold_areas_where_the_store_has_no_locks() {
     store.set_now(10_000 + 359);
     assert!(offered(&mut b).is_empty());
     // A beats (as the app does every minute): fresh again.
-    cmd::recovery::heartbeat(&a);
+    cmd::recovery::heartbeat(&mut a);
     store.set_now(10_000 + 359 + 300);
     assert!(offered(&mut b).is_empty());
     assert_eq!(restored(b.execute("file.recovery.restore", &json!({})).unwrap()), 0);
@@ -203,6 +204,88 @@ fn heartbeats_hold_areas_where_the_store_has_no_locks() {
     assert_eq!(offered(&mut b), ["Untitled-1"]);
 }
 
+/// Issue #367: a tab whose timers were paused (a background tab) long enough for its heartbeat to
+/// go stale, while another tab discards the copies it takes for crash leftovers.
+#[test]
+fn a_paused_app_writes_its_copies_again_and_is_running_again() {
+    let store = Arc::new(MemoryStore::without_locks());
+    let mut a = session_in(&store);
+    a.execute("file.recovery.save", &json!({})).unwrap();
+    let a_file = format!("{}/Untitled-1-1", a.recovery.own_area().unwrap());
+    let mut b = relaunch(&store);
+    b.prefs.autosave_interval = 1;
+    assert!(b.execute("file.recovery.discard", &json!({})).unwrap()["discarded"].as_array().unwrap().is_empty());
+    // A is paused past three minutes: with heartbeats alone, B can't tell it from a crash.
+    store.set_now(1_000_000 + 186);
+    assert_eq!(b.execute("file.recovery.discard", &json!({})).unwrap()["discarded"], json!([a_file.clone()]));
+    assert!(copies(store.as_ref()).is_empty());
+    // A resumes: its heartbeat finds the copy gone and the next save writes it again, unchanged
+    // document or not.
+    store.set_now(1_000_000 + 200);
+    assert_eq!(cmd::recovery::heartbeat(&mut a), [a.doc().unwrap().uid]);
+    assert!(a.doc().unwrap().recovery.is_none());
+    let r = a.execute("file.recovery.save", &json!({})).unwrap();
+    assert_eq!(r["saved"][0]["file"], a_file.as_str(), "{r}");
+    assert_eq!(copies(store.as_ref()), ["Untitled-1-1"]);
+    assert!(cmd::recovery::heartbeat(&mut a).is_empty(), "nothing missing any more");
+    // A's heartbeat is newer than the one B wrote taking the area over: A runs again for B.
+    let l = b.execute("file.recovery.list", &json!({})).unwrap();
+    assert_eq!((l["copies"][0]["file"].as_str(), l["copies"][0]["running"].as_bool()), (Some(a_file.as_str()), Some(true)));
+    assert!(b.execute("file.recovery.discard", &json!({})).unwrap()["discarded"].as_array().unwrap().is_empty());
+    assert!(b.execute("file.recovery.discard", &json!({"file": a_file})).is_err());
+    // A recovery save alone repairs too (no heartbeat in between).
+    store.set_now(1_000_000 + 600);
+    let mut c = relaunch(&store);
+    c.prefs.autosave_interval = 1;
+    c.execute("file.recovery.discard", &json!({})).unwrap();
+    assert!(copies(store.as_ref()).is_empty());
+    assert_eq!(a.execute("file.recovery.save", &json!({})).unwrap()["saved"].as_array().unwrap().len(), 1);
+    assert_eq!(copies(store.as_ref()), ["Untitled-1-1"]);
+}
+
+/// Issue #367 where the store can tell a paused app from a gone one (the browser's Web Locks): the
+/// paused app's copies are never taken, however old its heartbeat.
+#[test]
+fn announced_areas_stay_held_while_their_app_is_paused() {
+    let store = Arc::new(MemoryStore::announcing());
+    let mut a = session_in(&store);
+    a.execute("file.recovery.save", &json!({})).unwrap();
+    let a_file = format!("{}/Untitled-1-1", a.recovery.own_area().unwrap());
+    store.set_now(1_000_000 + 3600);
+    let mut b = relaunch(&store);
+    assert!(offered(&mut b).is_empty());
+    assert!(b.execute("file.recovery.discard", &json!({})).unwrap()["discarded"].as_array().unwrap().is_empty());
+    assert_eq!(restored(b.execute("file.recovery.restore", &json!({})).unwrap()), 0);
+    assert!(b.execute("file.recovery.discard", &json!({"file": a_file})).unwrap_err().to_string().contains("running"));
+    assert_eq!(copies(store.as_ref()), ["Untitled-1-1"]);
+    // A crashes: the browser releases its lock, and its copies are offered once its heartbeat is
+    // stale too.
+    drop(a);
+    assert_eq!(offered(&mut b), ["Untitled-1"]);
+    assert_eq!(restored(b.execute("file.recovery.restore", &json!({})).unwrap()), 1);
+    // B's area is announced in turn.
+    let mut c = relaunch(&store);
+    store.set_now(1_000_000 + 7200);
+    assert!(offered(&mut c).is_empty());
+}
+
+#[test]
+fn an_app_that_leaves_has_its_copies_offered_at_once() {
+    for store in [MemoryStore::without_locks(), MemoryStore::announcing(), MemoryStore::default()] {
+        let store = Arc::new(store);
+        let mut a = session_in(&store);
+        a.execute("file.recovery.save", &json!({})).unwrap();
+        let mut b = relaunch(&store);
+        assert!(offered(&mut b).is_empty(), "A still runs");
+        // A can't go on (its page lost its graphics): its copies stay, for the next app at once.
+        cmd::recovery::leave(&mut a);
+        assert!(a.doc().unwrap().recovery.is_none());
+        assert_eq!(copies(store.as_ref()), ["Untitled-1-1"]);
+        assert_eq!(offered(&mut b), ["Untitled-1"]);
+        assert_eq!(restored(b.execute("file.recovery.restore", &json!({})).unwrap()), 1);
+    }
+}
+
 #[test]
 fn folder_areas_are_locked_by_running_apps() {
     let dir = std::env::temp_dir().join(format!("vc-recovery-locks-{}", std::process::id()));

crates/engine/src/tests_strokeux.rs

@@ -73,7 +73,7 @@ fn stroke_unit_follows_the_preference() {
     assert_eq!(s.stroke_unit(), Unit::Points);
     s.prefs.units_stroke = "millimeters".into();
     assert_eq!(s.stroke_unit(), Unit::Millimeters);
-    assert_eq!(s.stroke_unit().format(1.0), "0.353 mm");
+    assert_eq!(s.stroke_unit().format(1.0), "0.3528 mm");
 }
 
 #[test]

crates/engine/src/tests_textedit.rs

@@ -9,7 +9,9 @@ use vectorcraft_tools::{Mods, PointerEvent, PointerKind, ToolKey};
 use super::*;
 
 fn session() -> Session {
+    // Type placed by the Type tools starts empty (Fill New Type Objects With Placeholder Text off).
     let mut s = Session::new();
+    s.prefs.placeholder_text = false;
     s.execute("file.new", &json!({"width": 800, "height": 600})).unwrap();
     s
 }
@@ -310,15 +312,18 @@ fn character_panel_flow_styles_the_selected_range_while_editing() {
 fn select_all_and_cut_like_ui() {
     let mut s = session();
     let v = ViewInfo::default();
+    s.execute("shape.rectangle", &json!({"x": 300, "y": 300, "width": 10, "height": 10})).unwrap();
     let id = text(&mut s, "abc def");
     s.select_tool("type", v).unwrap();
     let t = obj(&s, id);
     let p = t.xf * Point::new(2.0, -5.0);
     click(&mut s, p.x, p.y);
-    s.set_tool_option("selectAll", &json!(true));
-    let o = s.tool_options();
-    let len = obj(&s, id).plain_text().len() as u64;
-    let r = s.execute("text.getRange", &json!({"id": o["editing"], "start": o["start"], "end": o["end"].as_u64().unwrap().min(len)})).unwrap();
+    // Select All while editing takes the text, not the art (the rectangle stays unselected).
+    assert!(s.tool_wants_text());
+    let o = s.execute("select.all", &json!({})).unwrap();
+    assert_eq!(o, json!({"editing": id.0, "start": 0, "end": 7}));
+    assert_eq!(s.doc().unwrap().selection.objects, [id]);
+    let r = s.execute("text.getRange", &json!({"id": o["editing"], "start": o["start"], "end": o["end"]})).unwrap();
     assert_eq!(r["text"], json!("abc def"));
     s.set_tool_option("copy", &r["runs"]);
     key(&mut s, ToolKey::Delete, Mods::default());
@@ -326,6 +331,10 @@ fn select_all_and_cut_like_ui() {
     s.tool_text("abc def", v).unwrap();
     s.tool_text("abc def", v).unwrap();
     assert_eq!(obj(&s, id).plain_text(), "abc defabc def");
+    // Not editing: Select All selects the art again.
+    key(&mut s, ToolKey::Escape, Mods::default());
+    assert!(!s.tool_wants_text());
+    assert_eq!(s.execute("select.all", &json!({})).unwrap(), json!({"count": 2}));
 }
 
 #[test]

crates/engine/src/tooling.rs

@@ -13,6 +13,8 @@ pub struct ViewInfo {
     pub zoom: f64,
     pub outline: bool,
     pub smart_guides: bool,
+    /// View → Show Guides: the ruler guides show (and, unlocked, can be picked).
+    pub guides: bool,
     pub snap_to_grid: bool,
     pub show_bbox: bool,
     /// View → Snap to Pixel: drawing and moving land on whole pixels (points at 72 ppi).
@@ -31,6 +33,7 @@ impl Default for ViewInfo {
             zoom: 1.0,
             outline: false,
             smart_guides: true,
+            guides: true,
             snap_to_grid: false,
             show_bbox: true,
             snap_to_pixel: false,
@@ -134,6 +137,7 @@ impl Session {
             paint: &self.paint,
             outline: view.outline,
             smart_guides: view.smart_guides,
+            guides: view.guides && !self.menu.guides_locked,
             snap_to_grid: view.snap_to_grid,
             show_bbox: view.show_bbox,
             snap_to_pixel: view.snap_to_pixel,
@@ -152,6 +156,18 @@ impl Session {
             slices_hidden: self.menu.slices_hidden,
             slices_locked: self.menu.slices_locked,
             auto_add_delete: !self.prefs.disable_auto_add_delete,
+            selection_tolerance: self.prefs.selection_tolerance,
+            path_only: self.prefs.object_selection_by_path_only,
+            double_click_isolate: self.prefs.double_click_to_isolate,
+            select_behind: self.prefs.ctrl_click_selects_behind,
+            highlight_anchors: self.prefs.highlight_anchors_on_hover,
+            snap_tolerance: self.prefs.snap_to_point_tolerance,
+            handles_multiple: self.prefs.show_handles_multiple_anchors,
+            corner_widget_max_angle: self.prefs.hide_corner_widget_above,
+            move_locked_with_artboard: self.prefs.move_locked_with_artboard,
+            pen_rubber_band: self.prefs.pen_rubber_band,
+            curvature_rubber_band: self.prefs.curvature_rubber_band,
+            placeholder_text: self.prefs.placeholder_text,
             screen: view.screen,
             plane_widget: self.prefs.perspective_widget.show.then_some(self.prefs.perspective_widget.position),
         };
@@ -265,8 +281,11 @@ impl Session {
         v
     }
 
+    /// The pointer the active tool shows at `p` (General › Use Precise Cursors makes the drawing
+    /// tools' a crosshair, [`Cursor::precise`]).
     pub fn cursor(&mut self, p: Point, mods: Mods, view: ViewInfo) -> Cursor {
-        self.with_tool_cx(view, |t, cx| t.cursor(cx, p, mods))
+        let c = self.with_tool_cx(view, |t, cx| t.cursor(cx, p, mods));
+        if self.prefs.use_precise_cursors { c.precise() } else { c }
     }
 
     pub fn tool_options(&self) -> Value {

crates/geom/src/arc.rs

@@ -0,0 +1,101 @@
+//! Arc-length parametrization of a path: the point and direction at a distance along it, and the
+//! distance along it of the point nearest another (type on a path lays its glyphs out and the
+//! selection tools drag its brackets by distance along the path).
+
+use kurbo::{ParamCurve, ParamCurveArclen, ParamCurveNearest, PathSeg, Point, Vec2};
+
+use crate::PathData;
+
+const ACCURACY: f64 = 1e-4;
+
+/// A path's segments with their lengths, measured once.
+#[derive(Clone, Debug, Default)]
+pub struct ArcPath {
+    /// Segments of some length, each with the distance to its start and its length.
+    segs: Vec<(PathSeg, f64, f64)>,
+    len: f64,
+    closed: bool,
+}
+
+impl ArcPath {
+    pub fn new(path: &PathData) -> Self {
+        let mut segs = Vec::new();
+        let mut cum = 0.0;
+        for s in path.to_bezpath().segments() {
+            let l = s.arclen(ACCURACY);
+            if l.is_finite() && l > 1e-9 {
+                segs.push((s, cum, l));
+                cum += l;
+            }
+        }
+        Self { segs, len: cum, closed: path.is_closed() }
+    }
+
+    /// The path's length.
+    pub fn len(&self) -> f64 {
+        self.len
+    }
+
+    /// No segment has any length.
+    pub fn is_empty(&self) -> bool {
+        self.segs.is_empty()
+    }
+
+    pub fn is_closed(&self) -> bool {
+        self.closed
+    }
+
+    /// Point and unit tangent at distance `s` along the path: round and round a closed path, held
+    /// at an open one's ends.
+    pub fn at(&self, s: f64) -> (Point, Vec2) {
+        let s = if self.closed && self.len > 0.0 { s.rem_euclid(self.len) } else { s.clamp(0.0, self.len) };
+        let i = self.segs.partition_point(|(_, c, _)| *c <= s).saturating_sub(1);
+        let Some(&(seg, c, l)) = self.segs.get(i) else { return (Point::ZERO, Vec2::new(1.0, 0.0)) };
+        let t = seg.inv_arclen((s - c).min(l), ACCURACY).clamp(0.0, 1.0);
+        let p = seg.eval(t);
+        let (t0, t1) = ((t - 1e-4).max(0.0), (t + 1e-4).min(1.0));
+        let d = seg.eval(t1) - seg.eval(t0);
+        let len = d.hypot();
+        (p, if len > 1e-12 { d / len } else { Vec2::new(1.0, 0.0) })
+    }
+
+    /// The distance along the path of its point nearest `p`.
+    pub fn nearest(&self, p: Point) -> Option<f64> {
+        self.segs
+            .iter()
+            .map(|(seg, c, l)| {
+                let n = seg.nearest(p, ACCURACY);
+                (n.distance_sq, c + seg.subsegment(0.0..n.t).arclen(ACCURACY).min(*l))
+            })
+            .min_by(|a, b| a.0.total_cmp(&b.0))
+            .map(|(_, s)| s)
+    }
+
+    /// [`Self::nearest`] as a fraction (0..1) of the path's length.
+    pub fn fraction_at(&self, p: Point) -> Option<f64> {
+        (self.len > 0.0).then(|| self.nearest(p)).flatten().map(|s| (s / self.len).clamp(0.0, 1.0))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::shapes;
+    use kurbo::{Rect, Shape};
+
+    #[test]
+    fn points_and_nearest_distances_along_a_path() {
+        let line = PathData::from_bezpath(&kurbo::Line::new((0.0, 0.0), (100.0, 0.0)).to_path(0.1));
+        let a = ArcPath::new(&line);
+        assert!((a.len() - 100.0).abs() < 1e-6 && !a.is_closed());
+        assert!(a.at(25.0).0.distance(Point::new(25.0, 0.0)) < 1e-6);
+        // Held at an open path's ends.
+        assert!(a.at(150.0).0.distance(Point::new(100.0, 0.0)) < 1e-6);
+        assert!((a.nearest(Point::new(40.0, 30.0)).unwrap() - 40.0).abs() < 1e-6);
+        // Round a closed one.
+        let sq = ArcPath::new(&shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)));
+        assert!(sq.is_closed() && (sq.len() - 40.0).abs() < 1e-6);
+        assert!(sq.at(45.0).0.distance(sq.at(5.0).0) < 1e-6);
+        assert!(ArcPath::new(&PathData::default()).is_empty());
+    }
+}

crates/geom/src/lib.rs

@@ -7,6 +7,7 @@
 //! Coordinates are document points (1/72 in), y pointing down.
 #![forbid(unsafe_code)]
 
+pub mod arc;
 pub mod bez;
 pub mod hit;
 pub mod path;
@@ -15,6 +16,7 @@ pub mod recognize;
 pub mod shapes;
 pub mod snap;
 
+pub use arc::ArcPath;
 pub use kurbo;
 pub use kurbo::{Affine, BezPath, CubicBez, Line, ParamCurve, PathEl, PathSeg, Point, Rect, Shape, Size, Vec2};
 pub use path::{Anchor, AnchorKind, FillRule, PathData, SubPath};

crates/geom/src/shapes.rs

@@ -3,6 +3,7 @@
 use std::f64::consts::{PI, TAU};
 
 use kurbo::{Point, Rect, Vec2};
+use serde::{Deserialize, Serialize};
 
 use crate::path::{Anchor, AnchorKind, PathData, SubPath};
 
@@ -17,25 +18,96 @@ pub fn rectangle(r: Rect) -> PathData {
 
 /// Rounded rectangle (8 anchors). The radius is clamped to half the shorter side.
 pub fn rounded_rectangle(r: Rect, radius: f64) -> PathData {
-    let r = r.abs();
-    let rad = radius.max(0.0).min(r.width() / 2.0).min(r.height() / 2.0);
-    if rad <= 1e-9 {
-        return rectangle(r);
+    rectangle_with_corners(r, [radius; 4], [CornerKind::Round; 4])
+}
+
+/// How a rectangle's corner is cut (Live Corners).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum CornerKind {
+    /// A quarter circle, bulging outwards.
+    #[default]
+    Round,
+    /// A quarter circle cut into the shape, centred on the corner.
+    InvertedRound,
+    /// A straight bevel.
+    Chamfer,
+}
+
+impl CornerKind {
+    pub const ALL: [CornerKind; 3] = [CornerKind::Round, CornerKind::InvertedRound, CornerKind::Chamfer];
+
+    /// The kind after this one (Alt-clicking a corner widget cycles through them).
+    pub fn next(self) -> Self {
+        match self {
+            CornerKind::Round => CornerKind::InvertedRound,
+            CornerKind::InvertedRound => CornerKind::Chamfer,
+            CornerKind::Chamfer => CornerKind::Round,
+        }
     }
-    let k = rad * KAPPA;
-    let (x0, y0, x1, y1) = (r.x0, r.y0, r.x1, r.y1);
-    let a = |p: (f64, f64), hin: (f64, f64), hout: (f64, f64)| Anchor { p: p.into(), h_in: hin.into(), h_out: hout.into(), kind: AnchorKind::Corner };
-    let anchors = vec![
-        a((x0 + rad, y0), (x0 + rad - k, y0), (x0 + rad, y0)),
-        a((x1 - rad, y0), (x1 - rad, y0), (x1 - rad + k, y0)),
-        a((x1, y0 + rad), (x1, y0 + rad - k), (x1, y0 + rad)),
-        a((x1, y1 - rad), (x1, y1 - rad), (x1, y1 - rad + k)),
-        a((x1 - rad, y1), (x1 - rad + k, y1), (x1 - rad, y1)),
-        a((x0 + rad, y1), (x0 + rad, y1), (x0 + rad - k, y1)),
-        a((x0, y1 - rad), (x0, y1 - rad + k), (x0, y1 - rad)),
-        a((x0, y0 + rad), (x0, y0 + rad), (x0, y0 + rad - k)),
+}
+
+/// The largest corner radius a `w` × `h` rectangle draws: half its shorter side.
+pub fn max_corner_radius(w: f64, h: f64) -> f64 {
+    w.abs().min(h.abs()) / 2.0
+}
+
+/// The radius a corner of a `w` × `h` rectangle is drawn with: `radius`, no larger than
+/// [`max_corner_radius`] (the same limit for every corner, so opposite corners match), 0 when
+/// negative or not a number.
+pub fn fitted_corner_radius(w: f64, h: f64, radius: f64) -> f64 {
+    radius.max(0.0).min(max_corner_radius(w, h))
+}
+
+/// Rectangle whose corners (top-left, top-right, bottom-right, bottom-left, y down) each have
+/// their own radius and kind, every radius clamped to half the shorter side. A corner without a
+/// radius is one anchor, the others two (where the cut meets each side). Clockwise from the
+/// top-left corner, its anchor on the top side first.
+pub fn rectangle_with_corners(r: Rect, radii: [f64; 4], kinds: [CornerKind; 4]) -> PathData {
+    PathData::single(SubPath::new(corner_anchors(r, radii, kinds).into_iter().map(|(_, a)| a).collect(), true))
+}
+
+/// The corner (index into `radii`) of each anchor of [`rectangle_with_corners`].
+pub fn rectangle_anchor_corners(r: Rect, radii: [f64; 4]) -> Vec<usize> {
+    corner_anchors(r, radii, [CornerKind::Round; 4]).into_iter().map(|(k, _)| k).collect()
+}
+
+/// The anchors of [`rectangle_with_corners`], each with its corner.
+fn corner_anchors(r: Rect, radii: [f64; 4], kinds: [CornerKind; 4]) -> Vec<(usize, Anchor)> {
+    let r = r.abs();
+    // Each corner, with the directions of the side arriving at it and of the side leaving it.
+    let corners = [
+        (Point::new(r.x0, r.y0), Vec2::new(0.0, -1.0), Vec2::new(1.0, 0.0)),
+        (Point::new(r.x1, r.y0), Vec2::new(1.0, 0.0), Vec2::new(0.0, 1.0)),
+        (Point::new(r.x1, r.y1), Vec2::new(0.0, 1.0), Vec2::new(-1.0, 0.0)),
+        (Point::new(r.x0, r.y1), Vec2::new(-1.0, 0.0), Vec2::new(0.0, -1.0)),
     ];
-    PathData::single(SubPath::new(anchors, true))
+    let mut out = Vec::with_capacity(8);
+    let mut top_left_start = None;
+    for (k, ((c, din, dout), (rad, kind))) in corners.into_iter().zip(radii.into_iter().zip(kinds)).enumerate() {
+        let rad = fitted_corner_radius(r.width(), r.height(), rad);
+        if rad <= 1e-9 {
+            out.push((k, Anchor::corner(c)));
+            continue;
+        }
+        // The cut runs from `start` on the arriving side to `end` on the leaving one.
+        let (start, end, h) = (c - din * rad, c + dout * rad, rad * KAPPA);
+        let (h_out, h_in) = match kind {
+            CornerKind::Round => (start + din * h, end - dout * h),
+            CornerKind::InvertedRound => (start + dout * h, end - din * h),
+            CornerKind::Chamfer => (start, end),
+        };
+        let start = Anchor { p: start, h_in: start, h_out, kind: AnchorKind::Corner };
+        let end = Anchor { p: end, h_in, h_out: end, kind: AnchorKind::Corner };
+        if k == 0 {
+            top_left_start = Some(start);
+        } else {
+            out.push((k, start));
+        }
+        out.push((k, end));
+    }
+    out.extend(top_left_start.map(|a| (0, a)));
+    out
 }
 
 /// Ellipse inscribed in `r` with 4 smooth anchors (left, top, right, bottom).
@@ -203,6 +275,72 @@ mod tests {
         assert_eq!(rounded_rectangle(Rect::new(0.0, 0.0, 20.0, 10.0), 0.0).anchor_count(), 4);
     }
 
+    #[test]
+    fn uniform_corners_keep_the_rounded_rectangle_layout() {
+        // The 8 anchors a rounded rectangle always had, from the top side's first one.
+        let (r, rad) = (Rect::new(10.0, 20.0, 110.0, 70.0), 7.5);
+        let (x0, y0, x1, y1, k) = (10.0, 20.0, 110.0, 70.0, rad * KAPPA);
+        let a =
+            |p: (f64, f64), hin: (f64, f64), hout: (f64, f64)| Anchor { p: p.into(), h_in: hin.into(), h_out: hout.into(), kind: AnchorKind::Corner };
+        let want = vec![
+            a((x0 + rad, y0), (x0 + rad - k, y0), (x0 + rad, y0)),
+            a((x1 - rad, y0), (x1 - rad, y0), (x1 - rad + k, y0)),
+            a((x1, y0 + rad), (x1, y0 + rad - k), (x1, y0 + rad)),
+            a((x1, y1 - rad), (x1, y1 - rad), (x1, y1 - rad + k)),
+            a((x1 - rad, y1), (x1 - rad + k, y1), (x1 - rad, y1)),
+            a((x0 + rad, y1), (x0 + rad, y1), (x0 + rad - k, y1)),
+            a((x0, y1 - rad), (x0, y1 - rad + k), (x0, y1 - rad)),
+            a((x0, y0 + rad), (x0, y0 + rad), (x0, y0 + rad - k)),
+        ];
+        assert_eq!(rounded_rectangle(r, rad).subpaths[0].anchors, want);
+        assert_eq!(rectangle_anchor_corners(r, [rad; 4]), [0, 1, 1, 2, 2, 3, 3, 0]);
+        assert_eq!(rounded_rectangle(r, 0.0), rectangle(r));
+    }
+
+    #[test]
+    fn each_corner_takes_its_own_radius_and_kind() {
+        let r = Rect::new(0.0, 0.0, 100.0, 60.0);
+        // Only the top-right corner rounded: 5 anchors, the corner's two on its sides.
+        let radii = [0.0, 10.0, 0.0, 0.0];
+        let p = rectangle_with_corners(r, radii, [CornerKind::Round; 4]);
+        let pts: Vec<Point> = p.subpaths[0].anchors.iter().map(|a| a.p).collect();
+        assert_eq!(pts, [Point::new(0.0, 0.0), Point::new(90.0, 0.0), Point::new(100.0, 10.0), Point::new(100.0, 60.0), Point::new(0.0, 60.0)]);
+        assert_eq!(rectangle_anchor_corners(r, radii), [0, 1, 1, 2, 3]);
+        let quarter = PI * 25.0;
+        assert!((p.subpaths[0].area() - (6000.0 - 100.0 + quarter)).abs() < 0.1, "a quarter circle off one corner");
+        // The top-left corner rounded: its top-side anchor first, its left-side one last.
+        assert_eq!(rectangle_anchor_corners(r, [10.0, 0.0, 0.0, 200.0]), [0, 1, 2, 3, 3, 0]);
+        // Inverted round cuts a quarter circle out; a chamfer cuts a triangle.
+        let inverted = rectangle_with_corners(r, radii, [CornerKind::InvertedRound; 4]);
+        assert!((inverted.subpaths[0].area() - (6000.0 - quarter)).abs() < 0.1);
+        let chamfer = rectangle_with_corners(r, radii, [CornerKind::Chamfer; 4]);
+        assert!((chamfer.subpaths[0].area() - (6000.0 - 50.0)).abs() < 1e-9);
+        assert!(chamfer.subpaths[0].anchors.iter().all(|a| !a.has_in() && !a.has_out()), "straight");
+        // Radii clamp to half the shorter side; negative and NaN radii are none.
+        let p = rectangle_with_corners(r, [500.0, -5.0, f64::NAN, 0.0], [CornerKind::Round; 4]);
+        assert_eq!(p.subpaths[0].anchors[0].p, Point::new(30.0, 0.0));
+        assert_eq!(p.anchor_count(), 5);
+        assert_eq!(CornerKind::ALL.map(CornerKind::next), [CornerKind::InvertedRound, CornerKind::Chamfer, CornerKind::Round]);
+    }
+
+    /// #442: on a rectangle that isn't square, every corner is a circular arc of the same radius,
+    /// and radii past the limit stop at half the shorter side, whichever side a corner is on.
+    #[test]
+    fn corners_of_a_non_square_rectangle_are_alike() {
+        let r = Rect::new(0.0, 0.0, 200.0, 80.0);
+        assert_eq!(max_corner_radius(-200.0, 80.0), 40.0);
+        assert_eq!([30.0, 60.0, -1.0, f64::NAN].map(|x| fitted_corner_radius(200.0, 80.0, x)), [30.0, 40.0, 0.0, 0.0]);
+        for (radius, drawn) in [(30.0, 30.0), (60.0, 40.0)] {
+            for kinds in [[CornerKind::Round; 4], [CornerKind::Chamfer, CornerKind::InvertedRound, CornerKind::Round, CornerKind::Chamfer]] {
+                let a: Vec<Point> = rectangle_with_corners(r, [radius; 4], kinds).subpaths[0].anchors.iter().map(|a| a.p).collect();
+                for (i, j) in [(7, 0), (1, 2), (3, 4), (5, 6)] {
+                    let (x, y) = ((a[j].x - a[i].x).abs(), (a[j].y - a[i].y).abs());
+                    assert!((x - drawn).abs() < 1e-9 && (y - drawn).abs() < 1e-9, "radius {radius}: a corner spans {x} × {y}");
+                }
+            }
+        }
+    }
+
     #[test]
     fn polygon_first_vertex_up() {
         let p = polygon(Point::new(0.0, 0.0), 10.0, 6, 0.0);

crates/mcp/src/headless.rs

@@ -271,7 +271,7 @@ impl Backend for Headless {
                 self.exec(&id, &params)
             }
             "engine.commands" => Ok(self.commands()),
-            "document.inspect" => self.exec("document.inspect", &json!({})),
+            "document.inspect" => self.exec("document.inspect", p),
             "document.node" => self.exec("document.node", p),
             "document.json" => self.exec("document.json", &json!({})),
             "ui.tool.select" => self.select_tool(p),

crates/mcp/src/resources.rs

@@ -44,7 +44,7 @@ pub static TEMPLATES: &[Template] = &[
         uri: "vectorcraft://object/{id}",
         name: "object",
         title: "One layer or object",
-        description: "The layer or object with this id, with its children, bounds and paint (document.node {summary: true})",
+        description: "The layer or object with this id, with its children, bounds and paint (document.node {summary: true}). Large containers can be sliced with run_command document.node {id, summary, depth, childLimit}: truncated levels report childCount",
         mime: "application/json",
         live: Live::Objects,
     },

crates/mcp/src/tests.rs

@@ -175,6 +175,15 @@ fn headless_end_to_end() {
     assert_eq!(rect["fill"], "#ff0000", "{rect}");
     assert_eq!(rect["stroke"], "None");
 
+    // A depth-0 inspect is the skeleton: top layers with counts, nothing below them;
+    // a bad slice is a tool error, not a full dump.
+    let r = call(&mut s, 41, "inspect_document", json!({"depth": 0}));
+    let skel: Value = serde_json::from_str(&text_of(&r)).unwrap();
+    assert!(skel["layers"][0].get("children").is_none(), "{skel}");
+    assert_eq!(skel["layers"][0]["childCount"], layer["children"].as_array().unwrap().len());
+    assert_eq!(skel["artboards"], doc["artboards"]);
+    assert_eq!(call(&mut s, 42, "inspect_document", json!({"depth": -1}))["isError"], true);
+
     // Screenshot returns image content (base64 PNG) and text.
     let shot_path = tmp("shot.png");
     let r = call(&mut s, 5, "screenshot", json!({"path": shot_path.to_str().unwrap()}));
@@ -504,3 +513,54 @@ fn oversized_screenshot_and_png_export_are_errors() {
     let r = call(&mut s, 4, "screenshot", json!({"scale": 0.01}));
     assert_eq!(r["isError"], false, "{r}");
 }
+
+/// Preferences reach agents' gestures (#394): `prefs.set` Object Selection by Path Only, then a
+/// click inside a filled square selects nothing; Command Click to Select Objects Behind, a
+/// Cmd-click selects the square underneath.
+#[test]
+fn selection_preferences_apply_to_pointer_gestures() {
+    let mut s = server();
+    let square = |s: &mut Server, id: u64, x: u64| {
+        let r = call(s, id, "draw_shape", json!({"shape": "rectangle", "x": x, "y": 100, "width": 100, "height": 100, "fill": "#ff0000"}));
+        serde_json::from_str::<Value>(&text_of(&r)).unwrap()["id"].as_u64().unwrap()
+    };
+    let (back, front) = (square(&mut s, 1, 100), square(&mut s, 2, 150));
+    let click = |s: &mut Server, id: u64, x: f64, mods: Value| {
+        let events = json!([{"kind": "down", "x": x, "y": 125}, {"kind": "up", "x": x, "y": 125}]);
+        let r = call(s, id, "pointer_gesture", json!({"tool": "selection", "events": events, "mods": mods}));
+        assert_eq!(r["isError"], false, "{r}");
+        serde_json::from_str::<Value>(&text_of(&r)).unwrap()["selection"].clone()
+    };
+    assert_eq!(click(&mut s, 3, 175.0, json!({})), json!([front]));
+    assert_eq!(click(&mut s, 4, 175.0, json!({"cmd": true})), json!([back]), "Cmd-click selects behind");
+    let r = call(&mut s, 5, "run_command", json!({"command": "prefs.set", "params": {"key": "objectSelectionByPathOnly", "value": true}}));
+    assert_eq!(r["isError"], false, "{r}");
+    assert_eq!(click(&mut s, 6, 225.0, json!({})), json!([]), "path only: the fill doesn't select");
+    assert_eq!(click(&mut s, 7, 250.0, json!({})), json!([front]), "the path does");
+}
+
+/// Type preferences reach agents (#394): type the Type tool places starts with placeholder text,
+/// selected; Alt+→ tracks it by Tracking and Cmd+Shift+. steps its size by Size/Leading.
+#[test]
+fn type_preferences_apply_to_agents() {
+    let mut s = server();
+    let events = json!([{"kind": "down", "x": 100, "y": 100}, {"kind": "up", "x": 100, "y": 100}]);
+    let r = call(&mut s, 1, "pointer_gesture", json!({"tool": "type", "events": events}));
+    assert_eq!(r["isError"], false, "{r}");
+    let id = serde_json::from_str::<Value>(&text_of(&r)).unwrap()["selection"][0].as_u64().unwrap();
+    let style = |s: &mut Server, n: u64| {
+        let r = call(s, n, "run_command", json!({"command": "text.getRange", "params": {"id": id}}));
+        let v = serde_json::from_str::<Value>(&text_of(&r)).unwrap();
+        assert!(v["text"].as_str().unwrap().len() > 10, "placeholder text: {v}");
+        let st = &v["runs"][0]["style"];
+        (st["size"].as_f64().unwrap(), st["tracking"].as_f64().unwrap())
+    };
+    let (size, tracking) = style(&mut s, 2);
+    let r = call(&mut s, 3, "run_command", json!({"command": "prefs.set", "params": {"values": {"typeSizeIncrement": 4, "trackingIncrement": 50}}}));
+    assert_eq!(r["isError"], false, "{r}");
+    let r = call(&mut s, 4, "press_key", json!({"key": "Right", "mods": {"alt": true}}));
+    assert_eq!(r["isError"], false, "{r}");
+    let r = call(&mut s, 5, "press_key", json!({"key": ".", "mods": {"cmd": true, "shift": true}}));
+    assert_eq!(r["isError"], false, "{r}");
+    assert_eq!(style(&mut s, 6), (size + 4.0, tracking + 50.0));
+}

crates/mcp/src/tests_distortkeys.rs

@@ -1,5 +1,6 @@
 //! `press_key` with the Width and Puppet Warp tools: Delete and Backspace reach the selected width
-//! point or pin, and clear the selected art when the tool has nothing selected.
+//! point or pin, and clear the selected art when the tool has nothing selected. Cmd+A while the
+//! Type tool edits selects the text, not the art.
 
 use serde_json::{Value, json};
 
@@ -64,3 +65,15 @@ fn delete_and_backspace_reach_the_puppet_warp_tool() {
         assert!(!exists(&h, id), "{key} cleared the art");
     }
 }
+
+#[test]
+fn cmd_a_while_the_type_tool_edits_selects_the_text() {
+    let mut h = session();
+    run(&mut h, "shape.rectangle", json!({"x": 300, "y": 300, "width": 20, "height": 20}));
+    let id = run(&mut h, "text.create", json!({"x": 100, "y": 100, "text": "Hello", "size": 20}))["id"].as_u64().unwrap();
+    click(&mut h, "type", 102.0, 95.0);
+    let r = ok(&mut h, "press_key", json!({"key": "A", "mods": {"cmd": true}}));
+    assert_eq!(r["command"], "select.all");
+    assert_eq!(r["result"], json!({"editing": id, "start": 0, "end": 5}));
+    assert_eq!(h.session.doc().unwrap().selection.objects, [vectorcraft_doc::NodeId(id)], "the art selection stays");
+}

crates/mcp/src/tests_fileio.rs

@@ -145,3 +145,55 @@ fn pdf_pages(pdf: &[u8]) -> usize {
         .unwrap();
     h.session.doc().unwrap().doc.artboards.len()
 }
+
+/// Issue #421 over MCP: RGB greys switched to CMYK with `grays: "black"` print on the black plate
+/// only, in the document and in the exported PDF.
+#[test]
+fn document_color_mode_puts_rgb_greys_on_the_black_plate() {
+    let svg = tmp("greys.svg");
+    std::fs::write(
+        &svg,
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="200pt" height="50pt" viewBox="0 0 200 50">
+<rect x="0" y="0" width="50" height="50" fill="#000000"/><rect x="50" y="0" width="50" height="50" fill="#333333"/>
+<rect x="100" y="0" width="50" height="50" fill="#808080"/><rect x="150" y="0" width="50" height="50" fill="#e6e6e6"/>
+</svg>"##,
+    )
+    .unwrap();
+    let want = [1.0, 0.8, 0.498, 0.098];
+    let k_only = |h: &Headless| -> Vec<f32> {
+        let mut ks = vec![];
+        for l in &h.session.doc().unwrap().doc.layers {
+            l.walk(&mut |n| {
+                if n.children().is_none()
+                    && let Some(c) = n.appearance.fill_paint().color()
+                {
+                    let v = serde_json::to_value(c).unwrap();
+                    assert!(v["model"] == "cmyk" && v["c"] == 0.0 && v["m"] == 0.0 && v["y"] == 0.0, "not K only: {v}");
+                    ks.push(v["k"].as_f64().unwrap() as f32);
+                }
+            });
+        }
+        ks
+    };
+    let close = |ks: &[f32]| ks.len() == want.len() && ks.iter().zip(want).all(|(k, w)| (k - w).abs() < 0.005);
+    let mut h = Headless::new();
+    text(&call_tool(&mut h, "open_file", &json!({"path": svg})));
+    let r = text(&call_tool(&mut h, "run_command", &json!({"command": "file.documentColorMode", "params": {"mode": "cmyk", "grays": "black"}})));
+    assert_eq!(r["changed"], 4);
+    let ks = k_only(&h);
+    assert!(close(&ks), "{ks:?}");
+    // The PDF carries the same inks (DeviceCMYK opens as CMYK).
+    let pdf = text(&call_tool(&mut h, "export", &json!({"format": "pdf"})));
+    let mut back = Headless::new();
+    back.call("engine.execute", json!({"command": "document.open", "params": {"name": "greys.pdf", "dataBase64": pdf["dataBase64"]}})).unwrap();
+    let ks = k_only(&back);
+    assert!(close(&ks), "{ks:?}");
+    // document.open takes the same option.
+    let mut o = Headless::new();
+    let r = call_tool(&mut o, "run_command", &json!({"command": "document.open", "params": {"path": svg, "colorMode": "cmyk", "grays": "black"}}));
+    text(&r);
+    let ks = k_only(&o);
+    assert!(close(&ks), "{ks:?}");
+    let bad = call_tool(&mut o, "run_command", &json!({"command": "file.documentColorMode", "params": {"mode": "rgb", "grays": "rich"}}));
+    assert!(bad.is_error, "{bad:?}");
+}

crates/mcp/src/tools.rs

@@ -100,8 +100,14 @@ pub fn tool_definitions() -> Vec<Value> {
         tool(
             "inspect_document",
             "Inspect document",
-            "Summary of the active document: artboards, layer tree (ids, names, kinds, bounds, fill/stroke), selection, undo history, current tool and default paint.",
-            empty(),
+            "Summary of the active document: artboards, layer tree (ids, names, kinds, bounds, fill/stroke), selection, undo history, current tool and default paint. On a large document pass depth: 0 for the layer skeleton (truncated levels report childCount), then locate objects with run_command document.find and read them with document.node.",
+            obj(
+                json!({
+                    "depth": {"type": "integer", "minimum": 0, "description": "Child levels of the layer tree to include (default all; 0 = top layers with counts)"},
+                    "childLimit": {"type": "integer", "minimum": 0, "description": "Children shown per node (default all; a level that shows fewer reports childCount)"}
+                }),
+                &[],
+            ),
             true,
         ),
         tool(
@@ -683,7 +689,12 @@ fn dispatch(b: &mut dyn Backend, name: &str, a: &Args) -> Result<ToolResult, Str
             let method = if name == "invoke_menu" && b.has_ui() { "ui.menu.invoke" } else { "engine.execute" };
             j(b.call(method, json!({"command": cmd, "params": params}))?)
         }
-        "inspect_document" => j(b.call("document.inspect", json!({}))?),
+        "inspect_document" => {
+            // Only the slicing options reach the command, which validates them.
+            let slice: Map<String, Value> =
+                a.iter().filter(|(k, _)| matches!(k.as_str(), "depth" | "childLimit")).map(|(k, v)| (k.clone(), v.clone())).collect();
+            j(b.call("document.inspect", Value::Object(slice))?)
+        }
         "inspect_ui" => {
             need_ui(b, name)?;
             j(b.call("ui.inspect", json!({}))?)

crates/pathops/README.md

@@ -35,6 +35,7 @@ pub struct Region { pub path: PathData, pub sources: Vec<usize> }
 pub fn regions(shapes: &[Shape]) -> Vec<Region>;            // all faces of the arrangement
 pub fn region_at(shapes: &[Shape], p: Point) -> Option<Region>;
 pub fn merge_regions(regions: &[&Region]) -> PathData;      // Shape Builder merge = union
+pub fn shape_builder(shapes: &[Shape]) -> (Vec<Region>, Vec<Shape>); // (regions, open-path pieces)
 ```
 
 Each result takes its key as follows:
@@ -58,6 +59,8 @@ pub fn interior_point(path: &PathData) -> Option<Point>;
 
 Unlike `regions`, which splits the filled areas of closed shapes, `live_paint` treats every path as an edge, open paths included. Three crossing lines enclose a triangle, a line across a rectangle splits it in two, and an area enclosed by paths becomes a face even when nothing fills it. Each face lists the inputs whose fill covers it; the list is empty for an area that is only enclosed by paths. Each edge is a piece of a path, split wherever another path meets it, and keeps the key of the front-most input it lies on.
 
+`shape_builder` gives the Shape Builder's regions. With closed paths only, they are the `regions`. Once an open path is among them, they are the `live_paint` faces, so a stroke-only line across a shape splits it and lines can enclose a region of their own. The second list holds the pieces of each path that has no closed subpath, keyed by its index, so the Shape Builder can delete them one by one. The caller closes any open path whose fill should count. Inputs with more than `SHAPE_BUILDER_MAX_SEGMENTS` segments fall back to the filled areas.
+
 ## Offset / stroke
 
 ```rust

crates/pathops/src/lib.rs

@@ -20,7 +20,7 @@ pub use edit::{
 };
 pub use offset::{Cap, Join, offset_path, outline_stroke, stroke_region};
 pub use pathfinder::{PathfinderOp, Region, Shape, merge_regions, pathfinder, region_at, regions};
-pub use planar::{interior_point, live_paint};
+pub use planar::{BuilderArrangement, SHAPE_BUILDER_MAX_SEGMENTS, cut_out, encloses_area, interior_point, live_paint, shape_builder};
 
 /// Errors from fallible operations.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, thiserror::Error)]

crates/pathops/src/planar.rs

@@ -21,7 +21,7 @@ use std::collections::HashMap;
 
 use kurbo::{Affine, BezPath, CubicBez, ParamCurve, PathSeg, Point, Shape as _};
 use linesweeper::topology::{Topology, WindingNumber};
-use vectorcraft_geom::{FillRule, PathData};
+use vectorcraft_geom::{FillRule, PathData, SubPath};
 
 use crate::boolean::{DEFAULT_PRECISION, Seg, Tidy, eps_for, is_sliver, segs_to_subpath, snap_horizontals, tidy_segments, to_seg};
 use crate::pathfinder::{Region, Shape};
@@ -102,7 +102,12 @@ struct Outlines {
 
 impl Outlines {
     fn new(inputs: &[(BezPath, usize)], eps: f64) -> Self {
-        let segs = inputs.iter().flat_map(|(bp, i)| bp.segments().map(move |s| (s.bounding_box(), s, *i))).collect();
+        // A zero-length segment (a point) is the source of no edge, even one running through it.
+        let segs = inputs
+            .iter()
+            .flat_map(|(bp, i)| bp.segments().map(move |s| (s.bounding_box(), s, *i)))
+            .filter(|(r, ..)| r.width() > 0.0 || r.height() > 0.0)
+            .collect();
         // The sweep moves points by a few `eps` at most.
         Self { segs, tol: 16.0 * eps }
     }
@@ -288,6 +293,178 @@ pub fn live_paint(shapes: &[Shape]) -> (Vec<Region>, Vec<Shape>) {
     build(shapes).unwrap_or_default()
 }
 
+/// Most segments the Shape Builder sweeps with open paths as edges: the planar map costs far more
+/// than the filled areas' arrangement, so past this only the filled areas count.
+pub const SHAPE_BUILDER_MAX_SEGMENTS: usize = 4096;
+
+/// The Shape Builder's arrangement: see [`shape_builder`].
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct BuilderArrangement {
+    pub regions: Vec<Region>,
+    /// The pieces of the paths with no closed subpath, keyed by input index.
+    pub lines: Vec<Shape>,
+    /// The pieces of the other paths' outlines, keyed by input index (the front-most where inputs
+    /// share one); only when asked for.
+    pub edges: Vec<Shape>,
+}
+
+/// Shape Builder regions of `shapes` (back → front), the pieces of their open paths and, with
+/// `edges`, the pieces of their outlines (what erasing an edge deletes).
+///
+/// Closed paths bound regions with their filled areas, as in [`regions`](crate::regions). Open
+/// paths (the caller closes the ones whose fill should count) are cutting edges: a line across a
+/// shape splits it, lines around an area enclose a region nothing fills (empty `sources`), and each
+/// path with no closed subpath comes back cut wherever another path meets it, as pieces keyed by
+/// its index in `shapes`. Outlines are cut the same way. With no open path, more than
+/// [`SHAPE_BUILDER_MAX_SEGMENTS`] segments or a map that can't be built, only the filled areas
+/// count and there are no pieces.
+pub fn shape_builder(shapes: &[Shape], edges: bool) -> BuilderArrangement {
+    let has_open = shapes.iter().flat_map(|s| &s.path.subpaths).any(|sp| !sp.closed && sp.anchors.len() >= 2);
+    let segments: usize = shapes.iter().flat_map(|s| &s.path.subpaths).map(|sp| sp.segment_count()).sum();
+    let planar = ((has_open || edges) && segments <= SHAPE_BUILDER_MAX_SEGMENTS)
+        .then(|| {
+            let keyed: Vec<Shape> = shapes.iter().enumerate().map(|(i, s)| Shape::new(s.path.clone(), s.rule, i as u64)).collect();
+            live_paint(&keyed)
+        })
+        .filter(|(faces, pieces)| !faces.is_empty() || !pieces.is_empty());
+    let Some((faces, pieces)) = planar else {
+        return BuilderArrangement { regions: crate::regions(shapes), ..Default::default() };
+    };
+    let is_line = |i: u64| shapes.get(i as usize).is_some_and(|s| !s.path.subpaths.iter().any(|sp| sp.closed));
+    let (lines, outline): (Vec<Shape>, Vec<Shape>) = pieces.into_iter().partition(|e| is_line(e.key));
+    BuilderArrangement {
+        regions: if has_open { faces } else { crate::regions(shapes) },
+        lines: if has_open { lines } else { Vec::new() },
+        edges: if edges { outline } else { Vec::new() },
+    }
+}
+
+/// Does `sp`, closed, enclose an area (rather than retrace itself)? The Shape Builder closes the
+/// open subpaths of filled paths that do.
+pub fn encloses_area(sp: &SubPath) -> bool {
+    let mut closed = sp.clone();
+    closed.closed = true;
+    let mut bp = BezPath::new();
+    closed.to_bezpath_into(&mut bp);
+    let size = bp.bounding_box().size();
+    bp.area().abs() > 1e-9 * (size.width * size.width + size.height * size.height)
+}
+
+/// `path` without `piece`, a run along one of its subpaths between two points (a Shape Builder
+/// edge): a closed subpath opens there, an open one splits in two (or loses an end), and a piece
+/// that runs all the way round takes its subpath. With `fill_closes`, open subpaths that enclose an
+/// area ([`encloses_area`]) run on round an invisible closing edge, as the Shape Builder sees a
+/// filled path: a piece may run over it, and it never comes back as a visible segment. None when
+/// the piece doesn't lie on `path` within `tol`.
+pub fn cut_out(path: &PathData, piece: &SubPath, fill_closes: bool, tol: f64) -> Option<PathData> {
+    let n = piece.segment_count();
+    if n == 0 {
+        return None;
+    }
+    // A point well inside the piece: the middle of its longest segment.
+    let arclen = |k: usize| kurbo::ParamCurveArclen::arclen(&piece.segment(k), 1e-3);
+    let mid = (0..n).map(|k| (arclen(k), k)).max_by(|x, y| x.0.total_cmp(&y.0)).map(|(_, k)| piece.segment(k).eval(0.5))?;
+    let (a, b) = (piece.anchors.first()?.p, piece.anchors.last()?.p);
+    let mut bp = BezPath::new();
+    piece.to_bezpath_into(&mut bp);
+    if bp.perimeter(1e-6) <= tol {
+        // A speck (where paths touch): there's nothing to cut.
+        return None;
+    }
+    // A piece that ends where it starts runs all the way round.
+    let whole = piece.closed || a.distance(b) <= tol;
+    // Each subpath as the piece may run along it: round its closing edge when it has one.
+    let ring = |sp: &SubPath| SubPath { anchors: sp.anchors.clone(), closed: sp.closed || (fill_closes && encloses_area(sp)) };
+    let (si, geom, um) = path
+        .subpaths
+        .iter()
+        .enumerate()
+        .filter_map(|(i, sp)| {
+            let g = ring(sp);
+            let (u, d) = nearest_u(&g, mid)?;
+            (d <= tol).then_some((i, g, u, d))
+        })
+        .min_by(|x, y| x.3.total_cmp(&y.3))
+        .map(|(i, g, u, _)| (i, g, u))?;
+    let len = geom.segment_count() as f64;
+    let real = path.subpaths.get(si)?.segment_count() as f64;
+    let at = |p: Point| nearest_u(&geom, p).filter(|(_, d)| *d <= tol).map(|(u, _)| u);
+    // The parameter spans of `geom` that stay (unrolled past the end of a ring).
+    let keep: Vec<(f64, f64)> = if whole {
+        Vec::new()
+    } else if geom.closed {
+        let (ua, ub) = (at(a)?, at(b)?);
+        let fwd = |from: f64, to: f64| (to - from).rem_euclid(len);
+        // The piece runs from one end through `mid` to the other; what stays runs on round.
+        let (start, end) = if fwd(ua, um) <= fwd(ua, ub) { (ub, ua) } else { (ua, ub) };
+        let rest = fwd(start, end);
+        if rest <= 1e-9 || len - rest <= 1e-9 {
+            Vec::new()
+        } else {
+            // Where the ring closes with an invisible edge (`real..len`), what stays stops at it.
+            let parts: &[(f64, f64)] = if real >= len { &[(0.0, 2.0 * len)] } else { &[(0.0, real), (len, len + real)] };
+            parts.iter().map(|&(lo, hi)| (start.max(lo), (start + rest).min(hi))).filter(|(x, y)| y - x > 1e-9).collect()
+        }
+    } else {
+        let (ua, ub) = (at(a)?, at(b)?);
+        let (lo, hi) = (ua.min(ub), ua.max(ub));
+        if !(lo - 1e-9..=hi + 1e-9).contains(&um) {
+            return None;
+        }
+        [(0.0, lo), (hi, len)].into_iter().filter(|(x, y)| y - x > 1e-9).collect()
+    };
+    let mut subpaths: Vec<SubPath> = path.subpaths.iter().take(si).cloned().collect();
+    subpaths.extend(keep.into_iter().filter_map(|(u0, u1)| span(&geom, u0, u1)).map(|sp| snap_ends(sp, [a, b], tol)));
+    subpaths.extend(path.subpaths.iter().skip(si + 1).cloned());
+    Some(PathData::new(subpaths))
+}
+
+/// The point of `sp` nearest `p`, as a parameter `segment + t`, with its distance.
+fn nearest_u(sp: &SubPath, p: Point) -> Option<(f64, f64)> {
+    use kurbo::ParamCurveNearest;
+    (0..sp.segment_count())
+        .map(|k| {
+            let n = sp.segment(k).nearest(p, 1e-9);
+            (k as f64 + n.t, n.distance_sq.sqrt())
+        })
+        .min_by(|x, y| x.1.total_cmp(&y.1))
+}
+
+/// `sp` with its end anchors within `tol` of one of `to` put exactly on it (where the planar map
+/// put the junction a piece ends at), handles moving with them.
+fn snap_ends(mut sp: SubPath, to: [Point; 2], tol: f64) -> SubPath {
+    let last = sp.anchors.len().saturating_sub(1);
+    for i in [0, last] {
+        if let Some(an) = sp.anchors.get_mut(i)
+            && let Some(q) = to.iter().find(|q| q.distance(an.p) <= tol)
+        {
+            let d = *q - an.p;
+            an.p = *q;
+            an.h_in += d;
+            an.h_out += d;
+        }
+    }
+    sp
+}
+
+/// The run of `sp` from parameter `u0` to `u1` (`u0 < u1`, unrolled past the end of a closed one),
+/// open.
+fn span(sp: &SubPath, u0: f64, u1: f64) -> Option<SubPath> {
+    let n = sp.segment_count();
+    if n == 0 || !(u0.is_finite() && u1.is_finite()) {
+        return None;
+    }
+    let first = u0.floor().max(0.0) as usize;
+    let last = (u1.ceil().max(0.0) as usize).min(first + 2 * n);
+    let segs: Vec<Seg> = (first..last)
+        .filter_map(|k| {
+            let (t0, t1) = ((u0 - k as f64).clamp(0.0, 1.0), (u1 - k as f64).clamp(0.0, 1.0));
+            (t1 - t0 > 1e-12).then(|| Seg { c: sp.segment(k % n).subsegment(t0..t1), line: sp.segment_is_line(k % n) })
+        })
+        .collect();
+    segs_to_subpath(&segs, false)
+}
+
 fn build(shapes: &[Shape]) -> Option<(Vec<Region>, Vec<Shape>)> {
     let mut inputs: Vec<(BezPath, usize)> = Vec::new();
     for (i, s) in shapes.iter().enumerate() {
@@ -592,7 +769,7 @@ pub fn interior_point(path: &PathData) -> Option<Point> {
 mod tests {
     use super::*;
     use proptest::prelude::*;
-    use vectorcraft_geom::{Rect, SubPath, shapes};
+    use vectorcraft_geom::{Rect, shapes};
 
     fn line(a: (f64, f64), b: (f64, f64), key: u64) -> Shape {
         Shape::new(PathData::single(SubPath::polyline(&[Point::new(a.0, a.1), Point::new(b.0, b.1)], false)), FillRule::NonZero, key)
@@ -736,6 +913,130 @@ mod tests {
         assert_eq!(edges.len(), 1);
     }
 
+    #[test]
+    fn shape_builder_lines_cut_regions() {
+        // A line across a rectangle: two regions, the line in three pieces keyed by its index.
+        let s = [rect(0.0, 0.0, 100.0, 50.0, 7), line((40.0, -20.0), (60.0, 70.0), 8)];
+        let BuilderArrangement { regions, lines, .. } = shape_builder(&s, false);
+        assert_eq!(regions.len(), 2);
+        assert!(regions.iter().all(|r| r.sources == [0]));
+        assert_eq!(lines.len(), 3);
+        assert!(lines.iter().all(|l| l.key == 1 && !l.path.is_closed()));
+        // Lines alone enclose a region nothing fills.
+        let s = [line((0.0, 0.0), (100.0, 100.0), 0), line((100.0, 0.0), (0.0, 100.0), 0), line((-10.0, 80.0), (110.0, 80.0), 0)];
+        let BuilderArrangement { regions, lines, .. } = shape_builder(&s, false);
+        assert_eq!(regions.len(), 1);
+        assert!(regions[0].sources.is_empty() && regions[0].top().is_none());
+        assert_eq!(lines.len(), 9);
+    }
+
+    #[test]
+    fn shape_builder_closed_only_or_degenerate_is_the_filled_arrangement() {
+        let s = [rect(0.0, 0.0, 100.0, 100.0, 0), rect(50.0, 0.0, 150.0, 100.0, 1)];
+        assert_eq!(shape_builder(&s, false), BuilderArrangement { regions: crate::regions(&s), ..Default::default() });
+        // A broken line can't be swept: what the filled areas give (nothing here, without a panic).
+        let s = [rect(0.0, 0.0, 100.0, 100.0, 0), line((0.0, 0.0), (f64::NAN, 1.0), 1)];
+        assert_eq!(shape_builder(&s, false), BuilderArrangement { regions: crate::regions(&s), ..Default::default() });
+        // Zero-length and doubled-back lines don't break it either.
+        let s = [
+            rect(0.0, 0.0, 100.0, 100.0, 0),
+            line((50.0, 50.0), (50.0, 50.0), 1),
+            line((0.0, 0.0), (100.0, 0.0), 2),
+            line((50.0, 0.0), (50.0, 100.0), 3),
+        ];
+        let regions = shape_builder(&s, false).regions;
+        assert_eq!(regions.len(), 2);
+        assert!((regions.iter().map(area).sum::<f64>() - 10000.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn shape_builder_stays_quick_up_to_its_cap() {
+        // A wavy ring of nearly the most segments the map takes, crossed by a few lines.
+        let n = SHAPE_BUILDER_MAX_SEGMENTS - 8;
+        let ring: Vec<Point> = (0..n)
+            .map(|k| {
+                let t = k as f64 / n as f64 * std::f64::consts::TAU;
+                let r = 100.0 + 5.0 * (t * 200.0).sin();
+                Point::new(r * t.cos(), r * t.sin())
+            })
+            .collect();
+        let mut s = vec![Shape::new(PathData::single(SubPath::polyline(&ring, true)), FillRule::NonZero, 0)];
+        for k in 0..4 {
+            let y = -60.0 + 40.0 * f64::from(k);
+            s.push(line((-150.0, y), (150.0, y + 7.0), 1));
+        }
+        let started = std::time::Instant::now();
+        let BuilderArrangement { regions, lines, .. } = shape_builder(&s, false);
+        assert!(regions.len() >= 5, "the ring cut in five bands at least (the waves make pockets)");
+        assert!(lines.len() >= 12, "{}", lines.len());
+        assert!(started.elapsed().as_secs_f64() < 5.0, "{:?}", started.elapsed());
+        // Past the cap, only the filled areas count.
+        s.push(line((0.0, 0.0), (1.0, 1.0), 2));
+        s[0].path.subpaths[0].anchors.extend((0..16).map(|k| vectorcraft_geom::Anchor::corner(Point::new(100.0, f64::from(k)))));
+        assert!(shape_builder(&s, false).lines.is_empty());
+    }
+
+    fn poly(pts: &[(f64, f64)], closed: bool) -> SubPath {
+        SubPath::polyline(&pts.iter().map(|&(x, y)| Point::new(x, y)).collect::<Vec<_>>(), closed)
+    }
+
+    fn ends(sp: &SubPath) -> (Point, Point) {
+        (sp.anchors[0].p, sp.anchors[sp.anchors.len() - 1].p)
+    }
+
+    #[test]
+    fn shape_builder_edges_are_the_outlines_cut_where_paths_meet() {
+        // Two overlapping squares: each outline in two pieces, cut where the other crosses it.
+        let s = [rect(0.0, 0.0, 100.0, 100.0, 0), rect(50.0, 50.0, 150.0, 150.0, 1)];
+        let with = shape_builder(&s, true);
+        assert_eq!(with.regions, shape_builder(&s, false).regions, "the regions don't change");
+        assert!(with.lines.is_empty() && shape_builder(&s, false).edges.is_empty());
+        assert_eq!(with.edges.len(), 4);
+        for key in [0, 1] {
+            assert_eq!(with.edges.iter().filter(|e| e.key == key && !e.path.is_closed()).count(), 2);
+        }
+        let inner = with.edges.iter().find(|e| e.key == 0 && e.path.bounds() == Some(Rect::new(50.0, 50.0, 100.0, 100.0))).expect("A inside B");
+        // Erasing it opens A there.
+        let cut = cut_out(&s[0].path, &inner.path.subpaths[0], false, 1e-3).expect("on A");
+        assert_eq!(cut.subpaths.len(), 1);
+        let sp = &cut.subpaths[0];
+        assert!(!sp.closed && sp.anchors.len() == 5, "{sp:?}");
+        let (a, b) = ends(sp);
+        assert!([a, b].contains(&Point::new(100.0, 50.0)) && [a, b].contains(&Point::new(50.0, 100.0)), "{a:?} {b:?}");
+        assert!((cut.length() - 300.0).abs() < 1e-6, "{}", cut.length());
+        // Not on B.
+        assert_eq!(cut_out(&s[1].path, &inner.path.subpaths[0], false, 1e-3), None);
+        // A lone square's edge is its whole outline: erasing it leaves nothing.
+        let lone = shape_builder(&s[..1], true);
+        assert_eq!(lone.edges.len(), 1);
+        assert!(cut_out(&s[0].path, &lone.edges[0].path.subpaths[0], false, 1e-3).unwrap().is_empty());
+    }
+
+    #[test]
+    fn cut_out_splits_open_paths_and_keeps_closing_edges_invisible() {
+        let open = PathData::single(poly(&[(0.0, 0.0), (100.0, 0.0)], false));
+        let cut = cut_out(&open, &poly(&[(60.0, 0.0), (30.0, 0.0)], false), false, 1e-3).unwrap();
+        let mut parts: Vec<(Point, Point)> = cut.subpaths.iter().map(ends).collect();
+        parts.sort_by(|a, b| a.0.x.total_cmp(&b.0.x));
+        assert_eq!(parts, vec![(Point::new(0.0, 0.0), Point::new(30.0, 0.0)), (Point::new(60.0, 0.0), Point::new(100.0, 0.0))]);
+        // An end piece only shortens it.
+        let cut = cut_out(&open, &poly(&[(70.0, 0.0), (100.0, 0.0)], false), false, 1e-3).unwrap();
+        assert_eq!(cut.subpaths.iter().map(ends).collect::<Vec<_>>(), vec![(Point::new(0.0, 0.0), Point::new(70.0, 0.0))]);
+
+        // A filled open path runs on round its invisible closing edge (100,100) → (0,0).
+        let corner = PathData::single(poly(&[(0.0, 0.0), (100.0, 0.0), (100.0, 100.0)], false));
+        let piece = poly(&[(100.0, 50.0), (100.0, 100.0), (50.0, 50.0)], false);
+        assert_eq!(cut_out(&corner, &piece, false, 1e-3), None, "without the fill it isn't on the path");
+        let cut = cut_out(&corner, &piece, true, 1e-3).unwrap();
+        assert_eq!(cut.subpaths.len(), 1);
+        assert_eq!(cut.subpaths[0].anchors.iter().map(|a| a.p).collect::<Vec<_>>(), [(0.0, 0.0), (100.0, 0.0), (100.0, 50.0)].map(Point::from));
+        // Cut elsewhere, the closing edge stays invisible: two open runs, not one through it.
+        let cut = cut_out(&corner, &poly(&[(20.0, 0.0), (60.0, 0.0)], false), true, 1e-3).unwrap();
+        assert_eq!(cut.subpaths.len(), 2);
+        assert!(cut.subpaths.iter().all(|sp| !sp.closed));
+        assert!((cut.length() - 160.0).abs() < 1e-6, "{}", cut.length());
+    }
+
     fn arb_segment() -> impl Strategy<Value = Shape> {
         let c = || (0..10i32).prop_map(|v| f64::from(v) * 10.0);
         prop_oneof![
@@ -783,6 +1084,26 @@ mod tests {
             prop_assert!((filled - regions).abs() <= 1e-9 + DEFAULT_PRECISION * outlines, "{} vs {}", filled, regions);
         }
 
+        /// Every edge and line piece cuts out of the input it is keyed by, which loses its length
+        /// and nothing else.
+        #[test]
+        fn pieces_cut_out_of_their_inputs(shapes in prop::collection::vec(arb_segment(), 1..6)) {
+            let arr = shape_builder(&shapes, true);
+            for e in arr.edges.iter().chain(&arr.lines) {
+                let (Some(s), Some(piece)) = (shapes.get(e.key as usize), e.path.subpaths.first()) else { continue };
+                let len = e.path.length();
+                let cut = cut_out(&s.path, piece, false, 0.05);
+                if len <= 0.05 {
+                    // A speck where two paths touch.
+                    prop_assert!(cut.is_none());
+                    continue;
+                }
+                prop_assert!(cut.is_some(), "{:?} not on {:?}", piece, s.path);
+                let lost = s.path.length() - cut.map_or(0.0, |c| c.length());
+                prop_assert!((lost - len).abs() <= 0.05 + 1e-3 * len, "lost {} for a piece {} long", lost, len);
+            }
+        }
+
         /// Lines anywhere (not on a grid): faces stay disjoint, and nothing panics.
         #[test]
         fn free_lines_make_disjoint_faces(pts in prop::collection::vec((-50.0..150.0f64, -50.0..150.0f64, -50.0..150.0f64, -50.0..150.0f64), 2..9)) {

crates/pdf/Cargo.toml

@@ -20,6 +20,8 @@ kurbo = { workspace = true }
 thiserror = { workspace = true }
 flate2 = { workspace = true }
 image = { workspace = true }
+# CMYK JPEGs (the image crate writes RGB and grey ones only).
+jpeg-encoder = { workspace = true }
 krilla = { workspace = true }
 hayro-syntax = "0.7.2"
 hayro-interpret = { version = "0.7.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }

crates/pdf/src/export.rs

@@ -1470,8 +1470,8 @@ impl Exporter<'_> {
     }
 
     /// Image `key` placed `size` points wide and high, resampled and compressed as the Compression
-    /// settings say ([`crate::images::recode`]); cached by key (and size when images are
-    /// resampled).
+    /// settings say ([`crate::images::recode`], [`crate::images::recode_cmyk`] for CMYK images);
+    /// cached by key (and size when images are resampled).
     fn load_image(&mut self, key: &str, size: (f64, f64)) -> Option<Image> {
         let c = self.compression;
         let sized = [c.color.downsample, c.gray.downsample, c.mono.downsample].iter().any(|d| *d != crate::Downsample::None);
@@ -1483,7 +1483,11 @@ impl Exporter<'_> {
         let doc = self.doc;
         let out = self.out.clone();
         let img = doc.images.get(key).and_then(|blob| {
-            let r = crate::images::recode(&blob.bytes, size, c, interpolate, out.pixels());
+            let r = if blob.is_cmyk() {
+                crate::images::recode_cmyk(blob, size, c, interpolate, out.cmyk_pixels())
+            } else {
+                crate::images::recode(&blob.bytes, size, c, interpolate, out.pixels())
+            };
             if let Some(w) = r.warning {
                 self.warn(w);
             }

crates/pdf/src/images.rs

@@ -6,16 +6,23 @@
 //! monochrome (greyscale that is only black and white). An image already as asked (not resampled,
 //! a JPEG kept as JPEG or another kept lossless) is embedded as it is; the others are decoded,
 //! resampled and encoded again. JPEG needs opaque pixels: images with transparency stay lossless.
+//!
+//! CMYK images ([`ImageBlob::cmyk`]) stay CMYK: a CMYK JPEG already as asked is embedded as it is
+//! when its numbers are kept; the others' ink amounts are resampled, converted when the Output
+//! settings convert CMYK colours ([`CmykPixels`]) and compressed again. CMYK JPEGs hold Adobe's
+//! inverted samples, which the PDF writer's Decode array undoes.
 
 use std::io::Cursor;
 use std::sync::Arc;
 
-use image::buffer::ConvertBuffer;
 use image::imageops::FilterType;
-use image::{DynamicImage, ExtendedColorType, ImageDecoder, ImageFormat, ImageReader, RgbaImage};
+use image::{DynamicImage, ExtendedColorType, ImageDecoder, ImageFormat, ImageReader};
 use krilla::image::{BitsPerComponent, CustomImage, Image, ImageColorspace};
 
-use crate::output::Pixels;
+use vectorcraft_doc::ImageBlob;
+use vectorcraft_doc::cmyk::jpeg_components;
+
+use crate::output::{CmykPixels, Pixels};
 use crate::{CompressionSettings, Downsample, ImageCodec, JpegQuality, MonoCodec};
 
 /// Raw 8-bit pixels: colour samples (RGB, grey or CMYK) and an optional alpha channel.
@@ -54,23 +61,16 @@ impl CustomImage for Raw {
     }
 }
 
-/// A `width` × `height` image of straight (not premultiplied) RGBA pixels, written as RGB, or as
-/// grey when every pixel is grey, with an alpha channel only when some pixel isn't opaque.
-/// `interpolate` asks viewers to smooth it when enlarged (PDF/A forbids it). `None` when `rgba`
-/// doesn't hold that many pixels.
-pub(crate) fn from_rgba(rgba: &[u8], width: u32, height: u32, interpolate: bool) -> Option<Image> {
-    from_rgba_as(rgba, width, height, interpolate, None)
-}
-
-/// [`from_rgba`], colour pixels written as CMYK when `pixels` converts to CMYK (grey ones stay
-/// grey).
-fn from_rgba_as(rgba: &[u8], width: u32, height: u32, interpolate: bool, pixels: Option<&Pixels>) -> Option<Image> {
+/// A `width` × `height` image of straight (not premultiplied) RGBA pixels, written as RGB (as
+/// CMYK when `pixels` converts to CMYK), or as grey when every pixel is grey, with an alpha
+/// channel only when some pixel isn't opaque. `interpolate` asks viewers to smooth it when
+/// enlarged (PDF/A forbids it). `None` when `rgba` doesn't hold that many pixels.
+fn from_rgba(rgba: &[u8], width: u32, height: u32, interpolate: bool, pixels: Option<&Pixels>) -> Option<Image> {
     let px = rgba.as_chunks::<4>().0;
     if px.len() as u64 != width as u64 * height as u64 || px.is_empty() {
         return None;
     }
-    let luma = px.iter().all(|p| p[0] == p[1] && p[1] == p[2]);
-    let (color, space) = if luma {
+    let (color, space) = if neutral(rgba) {
         (px.iter().map(|p| p[0]).collect(), ImageColorspace::Luma)
     } else if let Some(cmyk) = pixels.and_then(|p| p.cmyk(rgba)) {
         (cmyk, ImageColorspace::Cmyk)
@@ -81,12 +81,22 @@ fn from_rgba_as(rgba: &[u8], width: u32, height: u32, interpolate: bool, pixels:
     Image::from_custom(Raw { color: Arc::new(color), alpha, width, height, space }, interpolate).ok()
 }
 
+/// Are all of the RGBA pixels `rgba` grey?
+fn neutral(rgba: &[u8]) -> bool {
+    rgba.as_chunks::<4>().0.iter().all(|p| p[0] == p[1] && p[1] == p[2])
+}
+
+/// Opaque colour `samples` (grey, RGB, or CMYK ink amounts, as `space` says) written losslessly.
+fn lossless(samples: Vec<u8>, space: ImageColorspace, width: u32, height: u32, interpolate: bool) -> Option<Image> {
+    Image::from_custom(Raw { color: Arc::new(samples), alpha: None, width, height, space }, interpolate).ok()
+}
+
 /// [`from_rgba`] of pixels converted by `pixels` (when given).
 pub(crate) fn from_rgba_in(mut rgba: Vec<u8>, width: u32, height: u32, interpolate: bool, pixels: Option<&Pixels>) -> Option<Image> {
     if let Some(p) = pixels {
         p.rgb_in_place(&mut rgba);
     }
-    from_rgba_as(&rgba, width, height, interpolate, pixels)
+    from_rgba(&rgba, width, height, interpolate, pixels)
 }
 
 /// The kinds of images the Compression section has settings for.
@@ -118,7 +128,8 @@ struct Rule {
 }
 
 const UNCOMPRESSED: &str = "uncompressed images are not written: images are compressed with ZIP";
-const CMYK_ZIP: &str = "images converted to CMYK are compressed with ZIP, not JPEG";
+const CMYK_KEPT: &str = "a CMYK image couldn't be decoded: it is written as it is, not resampled or converted";
+const CMYK_RGB: &str = "a CMYK image couldn't be decoded in CMYK: it is written in RGB";
 
 /// JPEG quality (1–100) of a quality setting.
 fn quality(q: JpegQuality) -> u8 {
@@ -166,6 +177,48 @@ fn bilevel(img: &DynamicImage) -> bool {
     img.to_luma_alpha8().pixels().all(|p| p[0] == 0 || p[0] == 255)
 }
 
+/// The size `r` gives an image of `w` × `h` pixels placed `size` points wide and high: a side
+/// whose resolution is above the threshold goes down to the target resolution.
+fn sized(r: &Rule, (w, h): (u32, u32), size: (f64, f64)) -> (u32, u32) {
+    let ppi = |px: u32, pt: f64| px as f64 * 72.0 / pt.abs();
+    let (px, py) = (ppi(w, size.0), ppi(h, size.1));
+    let resample = r.downsample != Downsample::None && [px, py].iter().any(|p| p.is_finite() && *p > r.above);
+    let side = |n: u32, p: f64| if resample && p.is_finite() && p > r.ppi { ((n as f64 * r.ppi / p).round() as u32).clamp(1, n) } else { n };
+    (side(w, px), side(h, py))
+}
+
+/// Is an image of `dims` pixels placed `size` points already as `r` asks: not resampled, and
+/// lossless or (`jpeg`) a JPEG kept as JPEG?
+fn kept(r: &Rule, dims: (u32, u32), size: (f64, f64), jpeg: bool) -> bool {
+    sized(r, dims, size) == dims
+        && match r.codec {
+            Codec::Auto(_) => true,
+            Codec::Zip => !jpeg,
+            Codec::Jpeg(_) => jpeg,
+        }
+}
+
+/// The JPEG quality `r` compresses an image with (`jpeg`: it is a JPEG); `None`: lossless.
+fn jpeg_quality(r: &Rule, jpeg: bool) -> Option<u8> {
+    match r.codec {
+        Codec::Jpeg(q) => Some(q),
+        Codec::Auto(q) if jpeg => Some(q),
+        _ => None,
+    }
+}
+
+/// `img` resampled to `w` × `h` pixels as `r` says.
+fn resample(img: DynamicImage, r: &Rule, (w, h): (u32, u32)) -> DynamicImage {
+    if (w, h) == (img.width(), img.height()) {
+        return img;
+    }
+    match r.downsample {
+        Downsample::Average => img.thumbnail_exact(w, h),
+        Downsample::Subsample => img.resize_exact(w, h, FilterType::Nearest),
+        Downsample::Bicubic | Downsample::None => img.resize_exact(w, h, FilterType::CatmullRom),
+    }
+}
+
 /// Encoded image `bytes` placed `size` points wide and high, as the Compression settings `c` ask:
 /// resampled when its resolution is above the threshold, compressed with ZIP or JPEG, its colours
 /// converted by `convert` (colour images). `interpolate` lets viewers smooth it. An image that
@@ -175,30 +228,13 @@ pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, in
     let Ok(reader) = ImageReader::new(Cursor::new(bytes)).with_guessed_format() else { return keep };
     let jpeg = reader.format() == Some(ImageFormat::Jpeg);
     let Ok(decoder) = reader.into_decoder() else { return keep };
-    let (w, h) = decoder.dimensions();
-    // Resolution along each side as placed; above the threshold, a side goes down to the target.
-    let ppi = |px: u32, pt: f64| px as f64 * 72.0 / pt.abs();
-    let (px, py) = (ppi(w, size.0), ppi(h, size.1));
-    let sized = |r: &Rule| {
-        let resample = r.downsample != Downsample::None && [px, py].iter().any(|p| p.is_finite() && *p > r.above);
-        let side = |n: u32, p: f64| if resample && p.is_finite() && p > r.ppi { ((n as f64 * r.ppi / p).round() as u32).clamp(1, n) } else { n };
-        (side(w, px), side(h, py))
-    };
-    // Already as asked: not resampled, and lossless or a JPEG kept as JPEG.
-    let kept = |r: &Rule| {
-        sized(r) == (w, h)
-            && match r.codec {
-                Codec::Auto(_) => true,
-                Codec::Zip => !jpeg,
-                Codec::Jpeg(_) => jpeg,
-            }
-    };
+    let dims = decoder.dimensions();
     use ExtendedColorType as T;
     let grey = matches!(decoder.original_color_type(), T::L1 | T::La1 | T::L2 | T::La2 | T::L4 | T::La4 | T::L8 | T::La8 | T::L16 | T::La16);
     let (kind, pixels) = if grey {
         // Only the pixels tell monochrome images from greyscale ones: decoded unless both keep it.
         let (g, m) = (rule(c, Kind::Gray), rule(c, Kind::Mono));
-        if kept(&g) && kept(&m) && g.instead == m.instead {
+        if kept(&g, dims, size, jpeg) && kept(&m, dims, size, jpeg) && g.instead == m.instead {
             return Recoded { image: None, warning: g.instead };
         }
         let Ok(img) = DynamicImage::from_decoder(decoder) else { return keep };
@@ -208,21 +244,11 @@ pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, in
     };
     let rule = rule(c, kind);
     let convert = convert.filter(|_| kind == Kind::Color);
-    if kept(&rule) && convert.is_none() {
+    if kept(&rule, dims, size, jpeg) && convert.is_none() {
         return Recoded { image: None, warning: rule.instead };
     }
     let Some(img) = pixels.or_else(|| image::load_from_memory(bytes).ok()) else { return keep };
-    let (nw, nh) = sized(&rule);
-    let img = if (nw, nh) == (w, h) {
-        img
-    } else {
-        match rule.downsample {
-            Downsample::Average => img.thumbnail_exact(nw, nh),
-            Downsample::Subsample => img.resize_exact(nw, nh, FilterType::Nearest),
-            Downsample::Bicubic | Downsample::None => img.resize_exact(nw, nh, FilterType::CatmullRom),
-        }
-    };
-    let mut rgba = img.to_rgba8();
+    let mut rgba = resample(img, &rule, sized(&rule, dims, size)).into_rgba8();
     if kind == Kind::Mono {
         // Resampling greys the edges: back to black and white.
         for p in rgba.pixels_mut() {
@@ -230,33 +256,70 @@ pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, in
             (p[0], p[1], p[2]) = (v, v, v);
         }
     }
-    let quality = match rule.codec {
-        Codec::Jpeg(q) => Some(q),
-        Codec::Auto(q) if jpeg => Some(q),
-        _ => None,
-    };
-    // CMYK images are written losslessly (the PDF writer's CMYK JPEGs need the reader's
-    // conventions).
-    let cmyk = convert.is_some_and(|p| p.is_cmyk());
+    if let Some(p) = convert {
+        p.rgb_in_place(&mut rgba);
+    }
     let (width, height) = rgba.dimensions();
     let opaque = rgba.pixels().all(|p| p[3] == 255);
-    let image = match quality.filter(|_| opaque && !cmyk) {
-        Some(q) => {
-            if let Some(p) = convert {
-                p.rgb_in_place(&mut rgba);
-            }
-            to_jpeg(&rgba, kind != Kind::Color, q, interpolate).or_else(|| from_rgba(rgba.as_raw(), width, height, interpolate))
-        }
-        None => from_rgba_in(rgba.into_raw(), width, height, interpolate, convert),
-    };
-    let warning = rule.instead.or((cmyk && quality.is_some() && opaque).then_some(CMYK_ZIP));
-    Recoded { image, warning }
+    let jpeg = jpeg_quality(&rule, jpeg).filter(|_| opaque).and_then(|q| {
+        // Grey pixels stay grey; colour ones go to CMYK when the output converts to CMYK.
+        let grey = kind != Kind::Color || neutral(&rgba);
+        let (samples, space) = match convert.filter(|_| !grey).and_then(|p| p.cmyk(&rgba)) {
+            Some(cmyk) => (cmyk, ImageColorspace::Cmyk),
+            None if grey => (rgba.pixels().map(|p| p[0]).collect(), ImageColorspace::Luma),
+            None => (rgba.pixels().flat_map(|p| [p[0], p[1], p[2]]).collect(), ImageColorspace::Rgb),
+        };
+        to_jpeg(&samples, space, width, height, q, interpolate)
+    });
+    let image = jpeg.or_else(|| from_rgba(rgba.as_raw(), width, height, interpolate, convert));
+    Recoded { image, warning: rule.instead }
 }
 
-/// Opaque `rgba` as a JPEG image at `quality` (a greyscale JPEG with `grey`).
-fn to_jpeg(rgba: &RgbaImage, grey: bool, quality: u8, interpolate: bool) -> Option<Image> {
-    let img = if grey { DynamicImage::ImageLuma8(rgba.convert()) } else { DynamicImage::ImageRgb8(rgba.convert()) };
+/// [`recode`] of CMYK image `blob` ([`ImageBlob::cmyk`]): a JPEG already as asked is kept as it
+/// is when its numbers are (`convert` is `None`); otherwise its ink amounts are resampled,
+/// converted by `convert` and compressed again.
+pub(crate) fn recode_cmyk(blob: &ImageBlob, size: (f64, f64), c: &CompressionSettings, interpolate: bool, convert: Option<&CmykPixels>) -> Recoded {
+    let rule = rule(c, Kind::Color);
+    let jpeg = jpeg_components(&blob.bytes).is_some();
+    if jpeg && convert.is_none() {
+        let dims = ImageReader::new(Cursor::new(blob.bytes.as_slice())).with_guessed_format().ok().and_then(|r| r.into_dimensions().ok());
+        if dims.is_some_and(|d| kept(&rule, d, size, true)) {
+            return Recoded { image: None, warning: rule.instead };
+        }
+    }
+    let Some(inks) = blob.cmyk() else {
+        return Recoded { image: None, warning: Some(if jpeg { CMYK_KEPT } else { CMYK_RGB }) };
+    };
+    let dims = (inks.width, inks.height);
+    let (width, height) = sized(&rule, dims, size);
+    // The four inks resample as the four channels of an RGBA image do.
+    let inks = match image::RgbaImage::from_raw(inks.width, inks.height, inks.data) {
+        Some(img) => resample(DynamicImage::ImageRgba8(img), &rule, (width, height)).into_rgba8().into_raw(),
+        None => return Recoded { image: None, warning: Some(CMYK_RGB) },
+    };
+    let (samples, space) = match convert {
+        Some(p) => p.convert(&inks),
+        None => (inks, ImageColorspace::Cmyk),
+    };
+    let image = jpeg_quality(&rule, jpeg).and_then(|q| to_jpeg(&samples, space, width, height, q, interpolate));
+    let image = image.or_else(|| lossless(samples, space, width, height, interpolate));
+    Recoded { image, warning: rule.instead }
+}
+
+/// Opaque colour `samples` (grey, RGB, or CMYK ink amounts, as `space` says) as a JPEG at
+/// `quality`. CMYK JPEGs hold Adobe's inverted samples, which the PDF writer's Decode array
+/// undoes.
+fn to_jpeg(samples: &[u8], space: ImageColorspace, width: u32, height: u32, quality: u8, interpolate: bool) -> Option<Image> {
     let mut out = Vec::new();
-    image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality).encode_image(&img).ok()?;
+    match space {
+        ImageColorspace::Cmyk => {
+            let (w, h) = (u16::try_from(width).ok()?, u16::try_from(height).ok()?);
+            jpeg_encoder::Encoder::new(&mut out, quality).encode(samples, w, h, jpeg_encoder::ColorType::Cmyk).ok()?;
+        }
+        ImageColorspace::Rgb | ImageColorspace::Luma => {
+            let t = if space == ImageColorspace::Rgb { ExtendedColorType::Rgb8 } else { ExtendedColorType::L8 };
+            image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality).encode(samples, width, height, t).ok()?;
+        }
+    }
     Image::from_jpeg(out.into(), interpolate).ok()
 }

crates/pdf/src/import.rs

@@ -1,6 +1,6 @@
 //! PDF → Document (hayro-interpret device that builds a VectorCraft node tree).
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::sync::{Arc, Mutex};
 
 use hayro_interpret::font::Glyph;
@@ -11,7 +11,7 @@ use hayro_interpret::{
     MaskType, PathDrawMode, SoftMask, StrokeProps, interpret_page,
 };
 use hayro_syntax::object::Name;
-use kurbo::{Affine, BezPath, Rect, Shape};
+use kurbo::{Affine, BezPath, PathEl, Rect, Shape};
 use vectorcraft_color::{BlendMode, Color, Paint, Swatch};
 use vectorcraft_doc::{
     Appearance, AppearanceItem, Artboard, ColorMode, Dash, Document, FillLayer, ImageBlob, ImageObject, Knockout, LayerColor, LineCap, LineJoin,
@@ -20,8 +20,8 @@ use vectorcraft_doc::{
 use vectorcraft_geom::{FillRule, PathData};
 
 use crate::import_color::{Colors, Native};
-use crate::import_mask::{MaskSpec, contains, is_rectangle, luminance, mask_spec};
-use crate::import_scan::{Ocgs, Scan, all_on, hides_forms, scan_page};
+use crate::import_mask::{MaskSpec, contains, is_rectangle, luminance, mask_spec, white_cover};
+use crate::import_scan::{MAX_NESTING, Ocgs, Scan, all_on, hides_forms, scan_page, tag_key};
 use crate::import_shading::{clipped, extend_clip, fold_stop_opacity, mesh_shading, shading_gradient};
 use crate::import_text::{Families, Look, Placement, TextLine, Upright};
 use crate::{CropTo, ImportOptions, ImportReport, PdfError, TextAs};
@@ -32,6 +32,9 @@ const TEXT_OUTLINES: &str = "<Text Outlines>";
 const MAX_NESTED: u32 = 8;
 /// A tiling pattern read this many times with the same art is taken to always draw it.
 const PATTERN_REUSE: u32 = 16;
+/// Stands for the group of art whose group couldn't be told (see [`Builder::unsure`]): it goes
+/// to a hidden, non-printing layer of its page.
+const UNSORTED: usize = usize::MAX;
 
 /// Import a PDF (or PDF-compatible `.ai`) with default options.
 pub fn import(bytes: &[u8]) -> Result<Document, PdfError> {
@@ -46,6 +49,60 @@ enum Slot {
     Group(usize),
 }
 
+/// What each group's layer holds, in paint order: its sublayers (their groups) and, where its
+/// own group is listed, its art.
+type Nesting = HashMap<usize, Vec<usize>>;
+
+/// Group `g` paints (its first art): note where its art goes in its layer, and where that layer
+/// goes when it is new: in its parent's layer (placed the same way) or, for a top-level group, in
+/// `slots`.
+fn place_group(g: usize, ocgs: &Ocgs, slots: &mut Vec<Slot>, nesting: &mut Nesting) {
+    let placed = nesting.contains_key(&g);
+    nesting.entry(g).or_default().push(g);
+    if placed {
+        return;
+    }
+    let mut child = g;
+    // Each parent is placed before its sublayers, so the chain ends (within the nesting depth).
+    for _ in 0..=MAX_NESTING {
+        let Some(parent) = ocgs.list.get(child).and_then(|o| o.parent) else { break };
+        let placed = nesting.contains_key(&parent);
+        nesting.entry(parent).or_default().push(child);
+        if placed {
+            return;
+        }
+        child = parent;
+    }
+    slots.push(Slot::Group(child));
+}
+
+/// The layer of group `g`, in `color`: its art and sublayers. `None` for a group that isn't read.
+fn group_layer(
+    b: &mut Builder<'_>,
+    g: usize,
+    ocgs: &Ocgs,
+    nesting: &Nesting,
+    art: &mut HashMap<usize, Vec<Arc<Node>>>,
+    color: LayerColor,
+) -> Option<Node> {
+    let ocg = ocgs.list.get(g)?;
+    let mut l = Node::layer(b.id(), &ocg.name, color);
+    (l.visible, l.locked) = (ocg.on, ocg.locked);
+    let mut children = vec![];
+    for &c in nesting.get(&g).into_iter().flatten() {
+        if c == g {
+            children.extend(art.remove(&g).unwrap_or_default());
+        } else if let Some(sub) = group_layer(b, c, ocgs, nesting, art, color) {
+            children.push(Arc::new(sub));
+        }
+    }
+    if let NodeKind::Layer { children: c, printable, .. } = &mut l.kind {
+        *c = children;
+        *printable = ocg.print;
+    }
+    Some(l)
+}
+
 /// Import a PDF, returning the document plus warnings about content that was approximated or skipped.
 pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportReport, PdfError> {
     let original = crate::pages::open(bytes, opts.password.as_deref())?;
@@ -54,7 +111,7 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     let route = opts.layers && !ocgs.list.is_empty();
     // Content that is off imports as hidden layers: an update of the file turns every group on
     // (unless a form is hidden by its own group: its art couldn't be told apart).
-    let hide = route && ocgs.any_off();
+    let hide = route && ocgs.skips_any();
     let turned_on = (hide && !picked.iter().filter_map(|&n| original.pages().get(n)).any(|p| hides_forms(p, &mut ocgs)))
         .then(|| all_on(bytes, &original))
         .flatten()
@@ -92,6 +149,9 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     doc.layers.clear();
     let taken: Vec<String> = doc.swatches_iter().map(|s| s.name.clone()).chain(doc.swatch_groups.iter().map(|g| g.name.clone())).collect();
     let mut b = Builder::new(doc.peek_next_id(), Colors::new(&pdf, taken.clone()), opts.text_as, route);
+    // The art of a group that is off (drawn as `all_on` turned it on) or doesn't print mustn't
+    // show or print on its page's layer.
+    b.unsure = route && ocgs.list.iter().any(|g| (all_on && !g.on) || !g.print);
     b.taken = taken;
     b.warnings = notes;
     let cache = InterpreterCache::new();
@@ -100,6 +160,7 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     let mut placeholder = true;
     let mut slots: Vec<Slot> = vec![];
     let mut group_art: HashMap<usize, Vec<Arc<Node>>> = HashMap::new();
+    let mut nesting = Nesting::new();
     for (i, &number) in picked.iter().enumerate() {
         let Some(page) = pages.get(number) else { continue };
         // The chosen box sits at (x, 0); the page draws round it.
@@ -112,6 +173,11 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
         b.begin_page(scan);
         interpret_page(page, &mut ctx, &mut b);
         let mut parts = b.end_page();
+        // A PDF-compatible `.ai` (the editor's private data next to the PDF art).
+        let ai = crate::pages::has_private_data(page);
+        if ai {
+            drop_page_fill(&mut parts, xf.transform_rect_bbox(crate::pages::page_box(page, CropTo::Crop)));
+        }
         // A file with several artboards writes, on each page, the art of its neighbours that
         // reaches into the page's box: art lying wholly outside this page is theirs (each page
         // draws it shifted by its own artboard spacing), so keep it only where it belongs.
@@ -122,7 +188,7 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
             parts.retain(|(_, art)| !art.is_empty());
         }
         let children: Vec<Arc<Node>> = parts.iter().flat_map(|(_, v)| v.iter().cloned()).collect();
-        placeholder &= crate::pages::has_private_data(page) && only_text(&children);
+        placeholder &= ai && only_text(&children);
         let mut right = ab.x1;
         if opts.crop == CropTo::Bounding
             && let Some(art) = vectorcraft_doc::live::nodes_bounds(&children)
@@ -138,22 +204,25 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
             show_center_mark: false,
             show_cross_hairs: false,
         });
-        let page_layer = |b: &mut Builder<'_>, art: Vec<Arc<Node>>| {
-            let mut layer = Node::layer(b.id(), &format!("Page {}", number + 1), LayerColor::Preset((i % 27) as u8));
-            if let NodeKind::Layer { children: c, .. } = &mut layer.kind {
-                *c = art;
+        let page_layer = |b: &mut Builder<'_>, art: Vec<Arc<Node>>, shown: bool| {
+            let name = if shown { format!("Page {}", number + 1) } else { format!("Page {} (unsorted)", number + 1) };
+            let mut layer = Node::layer(b.id(), &name, LayerColor::Preset((i % 27) as u8));
+            layer.visible = shown;
+            if let NodeKind::Layer { children: c, printable, .. } = &mut layer.kind {
+                (*c, *printable) = (art, shown);
             }
             Slot::Page(Box::new(layer))
         };
         if parts.is_empty() {
-            slots.push(page_layer(&mut b, vec![]));
+            slots.push(page_layer(&mut b, vec![], true));
         }
         for (key, art) in parts {
             match key {
-                None => slots.push(page_layer(&mut b, art)),
+                None => slots.push(page_layer(&mut b, art, true)),
+                Some(UNSORTED) => slots.push(page_layer(&mut b, art, false)),
                 Some(g) => {
                     let into = group_art.entry(g).or_insert_with(|| {
-                        slots.push(Slot::Group(g));
+                        place_group(g, &ocgs, &mut slots, &mut nesting);
                         vec![]
                     });
                     into.extend(art);
@@ -167,16 +236,11 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     for (n, slot) in slots.into_iter().enumerate() {
         let layer = match slot {
             Slot::Page(l) => *l,
-            Slot::Group(g) => {
-                let Some(ocg) = ocgs.list.get(g) else { continue };
-                let mut l = Node::layer(b.id(), &ocg.name, LayerColor::Preset((n % 27) as u8));
-                (l.visible, l.locked) = (ocg.on, ocg.locked);
-                if let NodeKind::Layer { children, printable, .. } = &mut l.kind {
-                    *children = group_art.remove(&g).unwrap_or_default();
-                    *printable = ocg.print;
-                }
-                l
-            }
+            // Sublayers take their top-level layer's colour.
+            Slot::Group(g) => match group_layer(&mut b, g, &ocgs, &nesting, &mut group_art, LayerColor::Preset((n % 27) as u8)) {
+                Some(l) => l,
+                None => continue,
+            },
         };
         doc.layers.push(Arc::new(layer));
     }
@@ -347,6 +411,28 @@ struct FontInfo {
     face: Option<Arc<vectorcraft_text::FontFace>>,
 }
 
+/// The page a PDF-compatible `.ai` paints under its layers is the editor's page, not art: an opaque
+/// white rectangle the size of the page (`page`, document space), outside every layer and before
+/// any of them. Drop it from the page's art (`parts`, as [`Builder::end_page`] gives them).
+fn drop_page_fill(parts: &mut Vec<(Option<usize>, Vec<Arc<Node>>)>, page: Rect) {
+    let layered = parts.iter().any(|(g, _)| g.is_some());
+    let Some((None, art)) = parts.first_mut() else { return };
+    // Not a spot colour: a white ink is art.
+    let fill = art.first().is_some_and(|n| {
+        layered
+            && n.blend == BlendMode::Normal
+            && white_cover(n, page)
+            && n.appearance.fill().is_some_and(|f| matches!(f.paint, Paint::Solid { swatch: None, .. }))
+            && n.geometric_bounds().is_some_and(|b| contains(page.inflate(0.5, 0.5), b))
+    });
+    if fill {
+        art.remove(0);
+        if art.is_empty() {
+            parts.remove(0);
+        }
+    }
+}
+
 /// Is this art text and nothing else (in groups and clips), with some text?
 fn only_text(nodes: &[Arc<Node>]) -> bool {
     fn walk(nodes: &[Arc<Node>], text: &mut bool) -> bool {
@@ -435,6 +521,8 @@ struct Builder<'p> {
     text_as: TextAs,
     images: HashMap<String, ImageBlob>,
     image_keys: HashMap<u128, (String, u32, u32)>,
+    /// The images kept with their CMYK samples ([`crate::import_image`]).
+    cmyk_keys: HashSet<u128>,
     warnings: Vec<String>,
     /// Fonts by cache key → base font name (from [`scan_page`]).
     fonts: HashMap<u128, String>,
@@ -463,11 +551,16 @@ struct Builder<'p> {
     aligned: bool,
     /// Whether optional content groups become layers.
     route: bool,
+    /// Some groups are hidden or don't print: art in marked content whose group can't be told
+    /// (once the scan and the interpreter part) is [`UNSORTED`] rather than the page's.
+    unsure: bool,
     /// The marked-content sequences open: the group each marks.
     marked: Vec<Option<usize>>,
     /// A transparency group was just pushed: a form's (whose flags come next) or an image's.
     pending: bool,
     nested: u32,
+    /// The last filled path: its node and its outline (a stroke of the same outline joins it).
+    last_fill: Option<(NodeId, BezPath)>,
 }
 
 fn blend(b: hayro_interpret::BlendMode) -> BlendMode {
@@ -499,6 +592,29 @@ fn fill_rule(r: hayro_interpret::FillRule) -> FillRule {
     }
 }
 
+/// `p` with every subpath closed: how a fill reads it.
+fn closed_subpaths(p: &BezPath) -> BezPath {
+    let mut out = BezPath::new();
+    let mut open = false;
+    for el in p.elements() {
+        if open && matches!(el, PathEl::MoveTo(_)) {
+            out.push(PathEl::ClosePath);
+        }
+        out.push(*el);
+        open = !matches!(el, PathEl::ClosePath);
+    }
+    if open {
+        out.push(PathEl::ClosePath);
+    }
+    out
+}
+
+/// Do a fill of `fill` and a stroke of `stroke` paint one object's outline? Applications write the
+/// fill without closing the path (filling closes it) and the stroke closed.
+fn same_outline(fill: &BezPath, stroke: &BezPath) -> bool {
+    fill.elements() == stroke.elements() || closed_subpaths(fill).elements() == closed_subpaths(stroke).elements()
+}
+
 fn mean_scale(a: Affine) -> f64 {
     a.determinant().abs().sqrt()
 }
@@ -555,6 +671,7 @@ impl<'p> Builder<'p> {
             text_as,
             images: HashMap::new(),
             image_keys: HashMap::new(),
+            cmyk_keys: HashSet::new(),
             warnings: vec![],
             fonts: HashMap::new(),
             font_names: HashMap::new(),
@@ -573,9 +690,11 @@ impl<'p> Builder<'p> {
             group_at: 0,
             aligned: true,
             route,
+            unsure: false,
             marked: vec![],
             pending: false,
             nested: 0,
+            last_fill: None,
         }
     }
 
@@ -626,10 +745,15 @@ impl<'p> Builder<'p> {
         let children = self.close_frames();
         let groups = std::mem::take(&mut self.root_groups);
         let mut parts: Vec<(Option<usize>, Vec<Arc<Node>>)> = vec![];
+        // Thousands of groups: find each one's part by index.
+        let mut at: HashMap<Option<usize>, usize> = HashMap::new();
         for (n, g) in children.into_iter().zip(groups.into_iter().chain(std::iter::repeat(None))) {
-            match parts.iter_mut().find(|(k, _)| *k == g) {
-                Some((_, v)) => v.push(n),
-                None => parts.push((g, vec![n])),
+            let i = *at.entry(g).or_insert_with(|| {
+                parts.push((g, vec![]));
+                parts.len() - 1
+            });
+            if let Some((_, v)) = parts.get_mut(i) {
+                v.push(n);
             }
         }
         parts
@@ -1189,24 +1313,35 @@ impl<'a> Device<'a> for Builder<'_> {
                 if let NodeKind::Path { rule: r, .. } = &mut n.kind {
                     *r = fill_rule(*rule);
                 }
+                self.last_fill = Some((n.id, bp));
                 let n = wrap(self, n);
                 self.push_node(n);
             }
             PathDrawMode::Stroke(props) => {
                 let st = stroke_layer(paint, opacity, props, mean_scale(transform));
-                // Fill-then-stroke of the same path (the `B` operator) becomes one object.
+                // Fill-then-stroke of the same path (the `B` operator, or a fill and a stroke of
+                // the outline as Illustrator writes an object) becomes one object: a path with a
+                // fill and a live stroke.
                 let blend = self.blend;
+                let fill = self.last_fill.take();
                 let last = match self.mask {
                     Some(_) => self.masked.last_mut(),
                     None => self.stack.last_mut().and_then(|f| f.children.last_mut()),
                 };
                 if band.is_none()
                     && let Some(last) = last
+                    && let Some((id, outline)) = fill
+                    && last.id == id
                     && last.blend == blend
-                    && last.path_data() == Some(&pd)
                     && last.appearance.stroke().is_none()
+                    && same_outline(&outline, &bp)
                 {
-                    Arc::make_mut(last).appearance.items.push(AppearanceItem::Stroke(st));
+                    let last = Arc::make_mut(last);
+                    // The stroke's outline: closing it changes the stroke, not the fill.
+                    if let Some(p) = last.path_data_mut() {
+                        *p = pd;
+                    }
+                    last.appearance.items.push(AppearanceItem::Stroke(st));
                     return;
                 }
                 let n = Node::path(self.id(), pd, Appearance { items: vec![AppearanceItem::Stroke(st)], ..Default::default() });
@@ -1308,8 +1443,23 @@ impl<'a> Device<'a> for Builder<'_> {
         match image {
             Image::Raster(r) => {
                 let key = hayro_interpret::CacheKey::cache_key(&r);
-                // JPEG passthrough for plain DeviceRGB/DeviceGray DCT images.
                 let st = r.stream();
+                let (w, h) = (r.width(), r.height());
+                // CMYK images keep their samples (read once per image).
+                let known = self.cmyk_keys.contains(&key);
+                let cmyk = if known {
+                    None
+                } else {
+                    crate::import_image::cmyk(st, w, h).unwrap_or_else(|why| {
+                        self.warn(why);
+                        None
+                    })
+                };
+                if known || cmyk.is_some() {
+                    self.cmyk_keys.insert(key);
+                    return self.add_image(key, || cmyk.map(|blob| (blob, w, h)), transform);
+                }
+                // JPEG passthrough for plain DeviceRGB/DeviceGray DCT images.
                 let dict = st.dict();
                 let filters = st.filters();
                 let cs_ok = dict.get::<Name<'_>>(b"ColorSpace").is_some_and(|n| matches!(n.as_ref(), b"DeviceRGB" | b"DeviceGray"));
@@ -1320,7 +1470,6 @@ impl<'a> Device<'a> for Builder<'_> {
                     && !dict.contains_key(b"Mask")
                     && !dict.contains_key(b"Decode");
                 if jpeg {
-                    let (w, h) = (r.width(), r.height());
                     let bytes = st.raw_data().to_vec();
                     self.add_image(key, || Some((ImageBlob::new("image/jpeg", bytes), w, h)), transform);
                     return;
@@ -1385,13 +1534,15 @@ impl<'a> Device<'a> for Builder<'_> {
         let at = self.tag_at;
         self.tag_at += 1;
         let group = match self.scan.tags.get(at) {
-            Some((t, g)) if self.aligned && t.as_slice() == tag => *g,
+            Some((t, g)) if self.aligned && *t == tag_key(tag) => *g,
             _ => {
                 if self.route && self.aligned {
                     self.aligned = false;
-                    self.warn("some art couldn't be told apart by layer and went to its page's layer");
+                    let why = if self.scan.cut { "a page draws more than can be read for its layers: " } else { "" };
+                    let went = if self.unsure { "a hidden, non-printing layer of its page" } else { "its page's layer" };
+                    self.warn(&format!("{why}some art couldn't be told apart by layer and went to {went}"));
                 }
-                None
+                self.unsure.then_some(UNSORTED)
             }
         }
         .filter(|_| self.route);

crates/pdf/src/import_image.rs

@@ -0,0 +1,93 @@
+//! CMYK images keep their samples, as CMYK colours do: DeviceCMYK images and ICC-based ones with
+//! four components. A JPEG whose Decode array inverts its samples (Adobe's CMYK JPEGs, the
+//! convention JPEG readers and the PDF writer take a CMYK JPEG to follow) is kept as it is; any
+//! other is decoded, its Decode array applied, and stored as a CMYK TIFF
+//! ([`ImageBlob::cmyk_tiff`]). Every other image is read as RGB by the interpreter.
+
+use hayro_syntax::Filter;
+use hayro_syntax::object::stream::ImageDecodeParams;
+use hayro_syntax::object::{Array, Dict, Name, Stream};
+use vectorcraft_doc::ImageBlob;
+use vectorcraft_doc::cmyk::{Inks, MAX_CMYK_PIXELS, jpeg_components};
+
+/// A CMYK image read as RGB: why.
+pub(crate) const MASKED: &str = "CMYK images with a mask were imported in RGB";
+pub(crate) const UNREAD: &str = "CMYK images whose samples couldn't be read in CMYK were imported in RGB";
+
+/// The Decode array of a JPEG kept as it is.
+const INVERTED: [(f32, f32); 4] = [(1.0, 0.0); 4];
+
+/// `key`, or its inline-image abbreviation `short` when `d` doesn't have it.
+fn key<'k>(d: &Dict<'_>, key: &'k [u8], short: &'k [u8]) -> &'k [u8] {
+    if d.contains_key(key) { key } else { short }
+}
+
+/// Are the image's colours CMYK (DeviceCMYK, CalCMYK, or ICC-based with four components)?
+fn cmyk_space(d: &Dict<'_>) -> bool {
+    let cs = key(d, b"ColorSpace", b"CS");
+    if let Some(n) = d.get::<Name<'_>>(cs) {
+        return matches!(n.as_ref(), b"DeviceCMYK" | b"CMYK");
+    }
+    let Some(a) = d.get::<Array<'_>>(cs) else { return false };
+    let mut it = a.flex_iter();
+    match it.next::<Name<'_>>() {
+        Some(n) if n.as_ref() == b"CalCMYK" => true,
+        Some(n) if n.as_ref() == b"ICCBased" => it.next::<Stream<'_>>().and_then(|s| s.dict().get::<u8>(b"N")) == Some(4),
+        _ => false,
+    }
+}
+
+/// Each component's Decode range (`[0 1]` each when the array is missing or malformed).
+fn decode_ranges(d: &Dict<'_>) -> [(f32, f32); 4] {
+    let mut out = [(0.0, 1.0); 4];
+    let Some(a) = d.get::<Array<'_>>(key(d, b"Decode", b"D")) else { return out };
+    let v: Vec<f32> = a.iter::<f32>().collect();
+    if v.len() == 8 && v.iter().all(|x| x.is_finite()) {
+        for (o, p) in out.iter_mut().zip(v.as_chunks::<2>().0) {
+            *o = (p[0], p[1]);
+        }
+    }
+    out
+}
+
+/// The image `st` (`width` × `height` pixels) in CMYK: `Ok(None)` when it isn't a CMYK image,
+/// `Err` (a warning) when it is one that is read as RGB.
+pub(crate) fn cmyk(st: &Stream<'_>, width: u32, height: u32) -> Result<Option<ImageBlob>, &'static str> {
+    let d = st.dict();
+    if !cmyk_space(d) {
+        return Ok(None);
+    }
+    if d.contains_key(b"SMask") || d.contains_key(b"Mask") {
+        return Err(MASKED);
+    }
+    let ranges = decode_ranges(d);
+    let filters = st.filters();
+    if ranges == INVERTED && matches!(filters.as_slice(), [Filter::DctDecode]) {
+        let raw = st.raw_data();
+        if jpeg_components(&raw) == Some(4) {
+            return Ok(Some(ImageBlob::new("image/jpeg", raw.into_owned())));
+        }
+    }
+    let bpc = d.get::<u8>(key(d, b"BitsPerComponent", b"BPC")).unwrap_or(8);
+    if !matches!(bpc, 8 | 16) {
+        return Err(UNREAD);
+    }
+    let n = width as u64 * height as u64;
+    if n == 0 || n > MAX_CMYK_PIXELS {
+        return Err(UNREAD);
+    }
+    let size = usize::from(bpc / 8);
+    let params = ImageDecodeParams { is_indexed: false, bpc: Some(bpc), num_components: Some(4), target_dimension: None, width, height };
+    let Ok(decoded) = st.decoded_image(&params) else { return Err(UNREAD) };
+    let Some(raw) = decoded.data.get(..n as usize * 4 * size) else { return Err(UNREAD) };
+    let value = |s: &[u8]| match *s {
+        [hi, lo] => u16::from_be_bytes([hi, lo]) as f32 / 65535.0,
+        [v] => v as f32 / 255.0,
+        _ => 0.0,
+    };
+    let inks = raw
+        .chunks_exact(size * 4)
+        .flat_map(|px| px.chunks_exact(size).zip(ranges).map(|(s, (lo, hi))| ((lo + value(s) * (hi - lo)).clamp(0.0, 1.0) * 255.0).round() as u8))
+        .collect();
+    Inks::new(width, height, inks).and_then(|i| ImageBlob::cmyk_tiff(&i)).map(Some).ok_or(UNREAD)
+}

crates/pdf/src/import_mask.rs

@@ -42,6 +42,11 @@ fn cover(n: &Node, page: Rect) -> Option<(Color, f32)> {
     (covers && n.mask.is_none()).then_some((*color, f.opacity * n.opacity))
 }
 
+/// An opaque white rectangle covering `page`, filled only.
+pub(crate) fn white_cover(n: &Node, page: Rect) -> bool {
+    cover(n, page).is_some_and(|(c, a)| a >= 0.999 && luminance(&c) > 0.999)
+}
+
 /// Does `outer` contain `inner`?
 pub(crate) fn contains(outer: Rect, inner: Rect) -> bool {
     outer.x0 <= inner.x0 && outer.y0 <= inner.y0 && outer.x1 >= inner.x1 && outer.y1 >= inner.y1
@@ -105,7 +110,7 @@ pub(crate) fn mask_spec(
         if art.len() > 1
             && let Some(last) = art.last()
             && last.blend == BlendMode::Difference
-            && cover(last, page).is_some_and(|(c, a)| a >= 0.999 && luminance(&c) > 0.999)
+            && white_cover(last, page)
         {
             art.pop();
             invert = !invert;

crates/pdf/src/import_scan.rs

@@ -1,6 +1,6 @@
 //! What the interpreter doesn't tell the import, read from the file itself: the optional content
-//! groups (layers) with their states, which group each marked-content sequence belongs to, the
-//! isolate and knockout flags of transparency groups, and the names of the fonts.
+//! groups (layers) with their states and nesting, which group each marked-content sequence belongs
+//! to, the isolate and knockout flags of transparency groups, and the names of the fonts.
 //!
 //! hayro-interpret reports a marked-content sequence by its tag alone and a transparency group
 //! without its flags, and skips the content of groups that are off. So each page's content is
@@ -16,15 +16,23 @@ use hayro_interpret::CacheKey;
 use hayro_syntax::Pdf;
 use hayro_syntax::content::TypedIter;
 use hayro_syntax::content::ops::TypedInstruction;
-use hayro_syntax::object::{Array, Dict, FromBytes, Name, Object, ObjectIdentifier, dict_or_stream};
+use hayro_syntax::object::{Array, Dict, FromBytes, MaybeRef, Name, Object, ObjectIdentifier, dict_or_stream};
 use hayro_syntax::page::{Page, Resources};
 
 /// The interpreter's limit on nested form XObjects.
 const MAX_DEPTH: u32 = 50;
-/// The most content operators walked per page: past it the rest of the page isn't told apart.
-const MAX_OPS: usize = 2_000_000;
+/// The most content operators walked per page (a guard against forms drawn within each other
+/// many times over): the art past it can't be told apart by group. A drawing of a million paths
+/// takes a few million; the walk reads about 15 million a second, twice as fast as the
+/// interpreter draws them.
+const MAX_OPS: usize = 64_000_000;
+/// The most marked-content sequences noted per page (24 bytes each): past it the rest of the
+/// page isn't told apart either.
+const MAX_TAGS: usize = 4_000_000;
 /// The most groups read.
 const MAX_GROUPS: usize = 10_000;
+/// The deepest layers nest in the configuration's `/Order`.
+pub(crate) const MAX_NESTING: usize = 32;
 
 /// An optional content group: a layer.
 #[derive(Clone, Debug, PartialEq)]
@@ -35,6 +43,8 @@ pub(crate) struct Ocg {
     /// Printed (its print usage isn't off).
     pub print: bool,
     pub locked: bool,
+    /// The group it is listed under in the layer order (a sublayer of it).
+    pub parent: Option<usize>,
 }
 
 /// The file's optional content groups.
@@ -44,6 +54,10 @@ pub(crate) struct Ocgs {
     index: HashMap<ObjectIdentifier, usize>,
     /// The groups that are off (as the interpreter decides it).
     off: HashSet<ObjectIdentifier>,
+    /// The groups whose view state applies when the file opens (an `/AS` entry for viewing).
+    view_auto: HashSet<ObjectIdentifier>,
+    /// The groups placed in the layer order.
+    placed: HashSet<usize>,
 }
 
 impl Ocgs {
@@ -68,35 +82,88 @@ impl Ocgs {
             o.off.remove(&id);
         }
         o.off.extend(refs(&config, b"OFF"));
+        let auto = config.get::<Array<'_>>(b"AS").map(|a| a.iter::<Dict<'_>>().take(MAX_GROUPS).collect::<Vec<_>>()).unwrap_or_default();
+        for d in auto.iter().filter(|d| d.get::<Name<'_>>(b"Event").is_some_and(|e| e.as_ref() == b"View")) {
+            o.view_auto.extend(refs(d, b"OCGs"));
+        }
         let locked: HashSet<_> = refs(&config, b"Locked").into_iter().collect();
         for id in all {
             if let Some(d) = xref.get::<Dict<'_>>(id) {
                 o.add(id, &d, locked.contains(&id));
             }
         }
+        if let Some(order) = config.get::<Array<'_>>(b"Order") {
+            o.nest(&order, None, 0, xref, &mut 0);
+        }
         o
     }
 
+    /// Read the layer order `order` (listed under group `parent`): a group followed by an array
+    /// lists that array's groups as its sublayers; an array starting with a label lists its
+    /// groups under the label, which isn't a group (they go under `parent`). A group listed twice
+    /// stays where it is first listed. `seen`: the entries read so far.
+    fn nest(&mut self, order: &Array<'_>, parent: Option<usize>, depth: usize, xref: &hayro_syntax::xref::XRef, seen: &mut usize) {
+        let mut prev = None;
+        for item in order.raw_iter() {
+            *seen += 1;
+            if *seen > 4 * MAX_GROUPS {
+                return;
+            }
+            let sub = match item {
+                MaybeRef::Ref(r) => {
+                    let id = ObjectIdentifier::from(r);
+                    let sub = xref.get::<Array<'_>>(id);
+                    if sub.is_none() {
+                        prev = self.place(id, parent);
+                    }
+                    sub
+                }
+                MaybeRef::NotRef(o) => o.into_array(),
+            };
+            if let Some(sub) = sub
+                && depth < MAX_NESTING
+            {
+                let label = matches!(sub.raw_iter().next(), Some(MaybeRef::NotRef(Object::String(_))));
+                let under = prev.take().filter(|_| !label).or(parent);
+                self.nest(&sub, under, depth + 1, xref, seen);
+            }
+        }
+    }
+
+    /// Put group `id` under `parent` in the layer order → its index, unless it isn't a group or
+    /// is already placed. Each group is placed after its parent, so the nesting has no cycles.
+    fn place(&mut self, id: ObjectIdentifier, parent: Option<usize>) -> Option<usize> {
+        let i = *self.index.get(&id)?;
+        let placed = self.placed.insert(i);
+        let g = self.list.get_mut(i).filter(|_| placed)?;
+        g.parent = parent;
+        Some(i)
+    }
+
     /// Note group `id` (its dictionary `d`) → its index.
     fn add(&mut self, id: ObjectIdentifier, d: &Dict<'_>, locked: bool) -> usize {
         if let Some(i) = self.index.get(&id) {
             return *i;
         }
         let name = d.get::<hayro_syntax::object::String<'_>>(b"Name").map(|s| text_string(s.as_bytes())).unwrap_or_default();
-        let print = d
-            .get::<Dict<'_>>(b"Usage")
-            .and_then(|u| u.get::<Dict<'_>>(b"Print"))
-            .and_then(|p| p.get::<Name<'_>>(b"PrintState"))
-            .is_none_or(|s| s.as_ref() != b"OFF");
-        let on = !self.off.contains(&id);
-        self.list.push(Ocg { name: if name.is_empty() { format!("Layer {}", self.list.len() + 1) } else { name }, on, print, locked });
+        let print = usage(d, b"Print", b"PrintState") != Some(false);
+        // A view state applies when the configuration says so on opening; an off one hides the
+        // group all the same (it says how the group is meant to be seen).
+        let view = usage(d, b"View", b"ViewState");
+        let on = match view {
+            Some(v) if self.view_auto.contains(&id) => v,
+            Some(false) => false,
+            _ => !self.off.contains(&id),
+        };
+        let name = if name.is_empty() { format!("Layer {}", self.list.len() + 1) } else { name };
+        self.list.push(Ocg { name, on, print, locked, parent: None });
         self.index.insert(id, self.list.len() - 1);
         self.list.len() - 1
     }
 
-    /// Is any group off?
-    pub fn any_off(&self) -> bool {
-        self.list.iter().any(|g| !g.on)
+    /// Does the interpreter leave out the art of some group (off in the default configuration)?
+    pub fn skips_any(&self) -> bool {
+        self.index.keys().any(|id| self.off.contains(id))
     }
 
     /// The group content marked with `/OC` (`d`: the group or membership dictionary, `id` its
@@ -119,6 +186,16 @@ impl Ocgs {
     }
 }
 
+/// The state (`ON` → true, `OFF` → false) group `d`'s usage `category` gives in `key`.
+fn usage(d: &Dict<'_>, category: &[u8], key: &[u8]) -> Option<bool> {
+    let state = d.get::<Dict<'_>>(b"Usage")?.get::<Dict<'_>>(category)?.get::<Name<'_>>(key)?;
+    match state.as_ref() {
+        b"ON" => Some(true),
+        b"OFF" => Some(false),
+        _ => None,
+    }
+}
+
 /// A PDF text string: UTF-16 (with its byte order mark), UTF-8 (with one) or PDFDocEncoding
 /// (read as Latin-1, which it matches for letters).
 pub(crate) fn text_string(b: &[u8]) -> String {
@@ -135,10 +212,35 @@ pub(crate) fn text_string(b: &[u8]) -> String {
 /// One page as the interpreter walks it.
 #[derive(Default)]
 pub(crate) struct Scan {
-    /// Each marked-content sequence: its tag and the group (index into [`Ocgs::list`]) it marks.
-    pub tags: Vec<(Vec<u8>, Option<usize>)>,
+    /// Each marked-content sequence: its tag ([`tag_key`]) and the group (index into
+    /// [`Ocgs::list`]) it marks.
+    pub tags: Vec<(u64, Option<usize>)>,
     /// Each form transparency group: isolated, knockout.
     pub groups: Vec<(bool, bool)>,
+    /// The walk stopped at [`MAX_OPS`] or [`MAX_TAGS`]: the rest of the page isn't told apart.
+    pub cut: bool,
+}
+
+/// A marked-content tag as [`Scan::tags`] keeps it: its FNV-1a hash (the tags are only compared,
+/// and a page can have millions).
+pub(crate) fn tag_key(tag: &[u8]) -> u64 {
+    tag.iter().fold(0xcbf2_9ce4_8422_2325, |h, &b| (h ^ u64::from(b)).wrapping_mul(0x0100_0000_01b3))
+}
+
+/// [`MAX_OPS`], lowered by tests that need a page past it.
+#[cfg(not(test))]
+fn max_ops() -> usize {
+    MAX_OPS
+}
+
+#[cfg(test)]
+thread_local! {
+    pub(crate) static TEST_MAX_OPS: std::cell::Cell<usize> = const { std::cell::Cell::new(MAX_OPS) };
+}
+
+#[cfg(test)]
+fn max_ops() -> usize {
+    TEST_MAX_OPS.with(std::cell::Cell::get)
 }
 
 struct Walker<'w, 'p> {
@@ -149,6 +251,7 @@ struct Walker<'w, 'p> {
     fonts: &'w mut HashMap<u128, String>,
     visible: Vec<bool>,
     ops: usize,
+    max_ops: usize,
     out: Scan,
     /// A form XObject hidden by its own optional content was met.
     hidden_form: bool,
@@ -202,7 +305,8 @@ impl Walker<'_, '_> {
         self.note_fonts(res);
         while let Some(op) = iter.next() {
             self.ops += 1;
-            if self.ops > MAX_OPS {
+            if self.ops > self.max_ops || self.out.tags.len() >= MAX_TAGS {
+                self.out.cut = true;
                 return;
             }
             match op {
@@ -225,11 +329,11 @@ impl Walker<'_, '_> {
                             None
                         }
                     };
-                    self.out.tags.push((bdc.0.to_vec(), group));
+                    self.out.tags.push((tag_key(bdc.0.as_ref()), group));
                 }
                 TypedInstruction::BeginMarkedContent(bmc) => {
                     self.begin(true);
-                    self.out.tags.push((bmc.0.to_vec(), None));
+                    self.out.tags.push((tag_key(bmc.0.as_ref()), None));
                 }
                 TypedInstruction::EndMarkedContent(_) => {
                     self.visible.pop();
@@ -276,7 +380,7 @@ pub(crate) fn scan_page(page: &Page<'_>, ocgs: &mut Ocgs, all_on: bool, fonts: &
 
 fn walk_page<'w, 'p>(page: &Page<'p>, ocgs: &'w mut Ocgs, all_on: bool, fonts: &'w mut HashMap<u128, String>) -> Walker<'w, 'p> {
     let off = if all_on { HashSet::new() } else { ocgs.off.clone() };
-    let mut w = Walker { ocgs, off, xref: page.xref(), fonts, visible: vec![], ops: 0, out: Scan::default(), hidden_form: false };
+    let mut w = Walker { ocgs, off, xref: page.xref(), fonts, visible: vec![], ops: 0, max_ops: max_ops(), out: Scan::default(), hidden_form: false };
     w.walk(page.typed_operations(), page.resources(), 0);
     w
 }

crates/pdf/src/import_text.rs

@@ -269,7 +269,7 @@ impl TextLine {
         t.xf = Affine::translate(self.at.origin.to_vec2()) * Affine::rotate(angle);
         let db = vectorcraft_text::FontDb::global();
         if let Some(path) = path {
-            t.kind = TextKind::OnPath { path: vectorcraft_geom::PathData::from_bezpath(&path), start: 0.0 };
+            t.kind = TextKind::OnPath { path: vectorcraft_geom::PathData::from_bezpath(&path), start: 0.0, end: None };
             t.xf = Affine::IDENTITY;
             t.cached_bounds = Some(vectorcraft_text::layout(db, &t).bounds);
             return Some((t, self.opacity));

crates/pdf/src/lib.rs

@@ -47,6 +47,7 @@ mod forms;
 mod images;
 mod import;
 mod import_color;
+mod import_image;
 mod import_mask;
 mod import_scan;
 mod import_shading;
@@ -210,6 +211,8 @@ mod tests_charstroke;
 #[cfg(test)]
 mod tests_cmykblend;
 #[cfg(test)]
+mod tests_cmykimages;
+#[cfg(test)]
 mod tests_compression;
 #[cfg(test)]
 mod tests_dashalign;

crates/pdf/src/output.rs

@@ -6,7 +6,8 @@
 //!   model when their profile differs from the destination; `preserveNumbers` converts only the
 //!   colours of the other model (and Lab ones), keeping the numbers of those already in it.
 //!   Grey stays grey. Images (and freeform gradients' images) are converted the same way, pixel
-//!   by pixel; printer's marks are not. The destination is a profile name; empty, the document's
+//!   by pixel (CMYK images too: they keep their numbers unless converted, see [`CmykPixels`]);
+//!   printer's marks are not. The destination is a profile name; empty, the document's
 //!   profile for its colour mode.
 //! - Profiles ([`ProfileInclusion`]): with `all`, with `destination`, and with `taggedSource` on a
 //!   document that was assigned profiles, colours are written in ICC-based colour spaces: CMYK
@@ -23,8 +24,9 @@
 
 use std::sync::{Arc, OnceLock};
 
+use krilla::image::ImageColorspace;
 use vectorcraft_color::Color;
-use vectorcraft_color::cms::{self, Cms, Intent, Model, ProfileKind, ProofLut};
+use vectorcraft_color::cms::{self, Cms, CmykLut, Intent, Model, ProfileKind, ProofLut};
 use vectorcraft_doc::{ColorMode, Document};
 
 use crate::patch::{Patch, Xref};
@@ -58,6 +60,8 @@ pub(crate) struct ColorOut {
     pub srgb_note: Option<String>,
     /// The image transform, built when the first image needs it.
     pixels: OnceLock<Option<Pixels>>,
+    /// The CMYK image transform, built when the first CMYK image needs it.
+    cmyk_pixels: OnceLock<Option<CmykPixels>>,
     intent: Intent,
     /// The output intent and Trapped entries to write.
     catalog: Option<Catalog>,
@@ -97,6 +101,7 @@ impl Default for ColorOut {
             cmyk_profile,
             srgb_note: None,
             pixels: OnceLock::new(),
+            cmyk_pixels: OnceLock::new(),
             intent,
             catalog: None,
             standard: Standard::None,
@@ -276,6 +281,30 @@ impl ColorOut {
             .as_ref()
     }
 
+    /// How CMYK images' ink amounts are converted; `None` when they keep their numbers (no
+    /// conversion, or to a CMYK destination that keeps them).
+    pub(crate) fn cmyk_pixels(&self) -> Option<&CmykPixels> {
+        self.cmyk_pixels
+            .get_or_init(|| {
+                let d = self.dest.as_ref().filter(|d| !(d.keep && d.model == Model::Cmyk))?;
+                let cmyk = d.model == Model::Cmyk;
+                // Each ink combination as a CMYK colour is written.
+                let lut = CmykLut::build(|[c, m, y, k]| {
+                    let out = self.color(&Color::Cmyk { c, m, y, k }, self.intent, false, true);
+                    if cmyk {
+                        return d.cms.to_cmyk(&out, self.intent);
+                    }
+                    let [r, g, b] = match out {
+                        Color::Rgb { r, g, b } => [r, g, b],
+                        other => d.cms.srgb_to_rgb(d.cms.display_rgb(&other)),
+                    };
+                    [r, g, b, 0.0]
+                });
+                Some(CmykPixels { lut, cmyk })
+            })
+            .as_ref()
+    }
+
     /// `pdf` with the output intent and Trapped entries, and a PDF/X file's identification
     /// ([`crate::pdfx`]) → (the file, warnings).
     pub(crate) fn write_catalog(&self, pdf: Vec<u8>) -> Result<(Vec<u8>, Vec<String>), PdfError> {
@@ -424,10 +453,6 @@ pub(crate) enum Pixels {
 }
 
 impl Pixels {
-    pub(crate) fn is_cmyk(&self) -> bool {
-        matches!(self, Self::Cmyk(_))
-    }
-
     /// Convert the RGB samples of straight RGBA pixels `rgba` in place (RGB destinations).
     pub(crate) fn rgb_in_place(&self, rgba: &mut [u8]) {
         if let Self::Rgb(lut) = self {
@@ -455,3 +480,30 @@ impl Pixels {
         )
     }
 }
+
+/// How CMYK images' ink amounts are converted to the destination: a lookup table to its RGB
+/// values, or to its CMYK ones (another profile).
+pub(crate) struct CmykPixels {
+    lut: CmykLut,
+    /// The destination is CMYK.
+    cmyk: bool,
+}
+
+impl CmykPixels {
+    /// Ink amounts `inks` (four bytes a pixel) converted → (the samples, their colour space).
+    pub(crate) fn convert(&self, inks: &[u8]) -> (Vec<u8>, ImageColorspace) {
+        let n = if self.cmyk { 4 } else { 3 };
+        let mut out = Vec::with_capacity(inks.len() / 4 * n);
+        // Runs of one colour convert once.
+        let mut last: Option<([u8; 4], [u8; 4])> = None;
+        for p in inks.as_chunks::<4>().0 {
+            let v = match last {
+                Some((k, v)) if k == *p => v,
+                _ => self.lut.apply8(*p),
+            };
+            last = Some((*p, v));
+            out.extend_from_slice(v.get(..n).unwrap_or_default());
+        }
+        (out, if self.cmyk { ImageColorspace::Cmyk } else { ImageColorspace::Rgb })
+    }
+}

crates/pdf/src/tests_cmykimages.rs

@@ -0,0 +1,292 @@
+//! CMYK images keep their CMYK samples from import to export (issue #320): a CMYK JPEG passes
+//! through unchanged, other CMYK images keep their ink amounts, and only the Output settings
+//! convert them.
+
+use std::sync::Arc;
+
+use hayro_syntax::Pdf;
+use hayro_syntax::object::{Array, Name, Object, Stream};
+use serde_json::json;
+use vectorcraft_color::cms::{self, DEVICE_CMYK, GENERIC_CMYK, SRGB};
+use vectorcraft_doc::cmyk::Inks;
+use vectorcraft_doc::{ColorMode, Document, ImageBlob, ImageObject, Node, NodeKind};
+use vectorcraft_geom::Affine;
+
+use crate::*;
+
+/// `inks` (four bytes a pixel) as a CMYK JPEG: Adobe's inverted samples, with its marker.
+fn cmyk_jpeg(inks: &[u8], w: u16, h: u16) -> Vec<u8> {
+    let mut out = Vec::new();
+    jpeg_encoder::Encoder::new(&mut out, 100).encode(inks, w, h, jpeg_encoder::ColorType::Cmyk).unwrap();
+    out
+}
+
+fn flat(inks: [u8; 4], n: usize) -> Vec<u8> {
+    inks.repeat(n)
+}
+
+fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
+    let mut s = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+    s.extend_from_slice(data);
+    s.extend_from_slice(b"\nendstream");
+    s
+}
+
+/// A 300 × 100 pt page with a CMYK rectangle and image XObjects `images` (dictionary entries
+/// after the type, stream data), 50 pt wide each: objects 5…, then the `extra` objects.
+fn pdf_with_images(images: &[(String, Vec<u8>)], extra: &[Vec<u8>]) -> Vec<u8> {
+    let xobjects: String = (0..images.len()).map(|i| format!("/Im{i} {} 0 R ", 5 + i)).collect();
+    let mut content = String::from("0 1 0.6 0.2 k 0 80 300 20 re f\n");
+    for i in 0..images.len() {
+        content.push_str(&format!("q 50 0 0 50 {} 10 cm /Im{i} Do Q\n", 10 + 60 * i));
+    }
+    let mut objs = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 100] /Resources << /XObject << {xobjects}>> >> /Contents 4 0 R >>").into_bytes(),
+        stream("", content.as_bytes()),
+    ];
+    for (dict, data) in images {
+        objs.push(stream(&format!("/Type /XObject /Subtype /Image {dict}"), data));
+    }
+    objs.extend_from_slice(extra);
+    let mut out = b"%PDF-1.4\n".to_vec();
+    let mut at = vec![];
+    for (i, o) in objs.iter().enumerate() {
+        at.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for a in at {
+        out.extend_from_slice(format!("{a:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// An image dictionary's entries: `w` × `h` CMYK pixels, with `more`.
+fn cmyk_dict(w: u32, h: u32, more: &str) -> String {
+    format!("/Width {w} /Height {h} /ColorSpace /DeviceCMYK /BitsPerComponent 8 {more}")
+}
+
+const INVERTED: &str = "/Decode [1 0 1 0 1 0 1 0]";
+
+/// An image XObject of a written PDF: its colour space and the components of its ICC profile,
+/// its Decode array, its filter and its stream data.
+#[derive(Debug)]
+struct Written {
+    space: String,
+    icc_n: Option<u8>,
+    decode: Vec<f32>,
+    filter: Option<String>,
+    data: Vec<u8>,
+    width: u32,
+}
+
+fn written(pdf: &[u8]) -> Vec<Written> {
+    let file = Pdf::new(Arc::new(pdf.to_vec())).unwrap();
+    let mut out = vec![];
+    for o in file.objects() {
+        let Object::Stream(s) = o else { continue };
+        let d = s.dict();
+        if d.get::<Name<'_>>(b"Subtype").is_none_or(|n| n.as_ref() != b"Image") {
+            continue;
+        }
+        let (space, icc_n) = match (d.get::<Name<'_>>(b"ColorSpace"), d.get::<Array<'_>>(b"ColorSpace")) {
+            (Some(n), _) => (n.as_str().to_string(), None),
+            (_, Some(a)) => {
+                let mut it = a.flex_iter();
+                let name = it.next::<Name<'_>>().unwrap().as_str().to_string();
+                (name, it.next::<Stream<'_>>().and_then(|s| s.dict().get::<u8>(b"N")))
+            }
+            _ => (String::new(), None),
+        };
+        out.push(Written {
+            space,
+            icc_n,
+            decode: d.get::<Array<'_>>(b"Decode").map(|a| a.iter::<f32>().collect()).unwrap_or_default(),
+            filter: d.get::<Name<'_>>(b"Filter").map(|n| n.as_str().to_string()),
+            data: s.raw_data().to_vec(),
+            width: d.get::<u32>(b"Width").unwrap_or(0),
+        });
+    }
+    out
+}
+
+/// The blob each image of `d` shows, in paint order.
+fn blobs(d: &Document) -> Vec<&ImageBlob> {
+    let NodeKind::Layer { children, .. } = &d.layers[0].kind else { panic!() };
+    children
+        .iter()
+        .filter_map(|n| match &n.kind {
+            NodeKind::Image(im) => d.images.get(&im.key),
+            _ => None,
+        })
+        .collect()
+}
+
+/// Options with settings `s` (at their standard's version).
+fn opts(s: serde_json::Value) -> PdfOptions {
+    let settings: PdfSettings = serde_json::from_value(s).unwrap();
+    let compatibility = if settings.standard == Standard::None { settings.compatibility } else { settings.standard.version() };
+    PdfOptions { settings: PdfSettings { compatibility, ..settings }, created: Some(1_700_000_000), ..Default::default() }
+}
+
+fn close(a: &[u8], b: &[u8], tolerance: u8) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|(x, y)| x.abs_diff(*y) <= tolerance)
+}
+
+#[test]
+fn a_cmyk_jpeg_passes_through_open_and_every_pdf_export() {
+    // The issue's file: a DeviceCMYK JPEG (Adobe's inverted samples, Decode [1 0 …]) beside a
+    // DeviceCMYK fill.
+    let jpg = cmyk_jpeg(&flat([0, 102, 255, 0], 32 * 16), 32, 16);
+    let source = pdf_with_images(&[(cmyk_dict(32, 16, &format!("/Filter /DCTDecode {INVERTED}")), jpg.clone())], &[]);
+    let r = import_with_report(&source, &ImportOptions::default()).unwrap();
+    assert_eq!(r.document.color_mode, ColorMode::Cmyk);
+    let b = blobs(&r.document);
+    assert_eq!(b.len(), 1);
+    assert_eq!((b[0].mime.as_str(), b[0].bytes.as_slice()), ("image/jpeg", jpg.as_slice()), "the JPEG as it is");
+    assert!(b[0].cmyk().unwrap().data.as_chunks::<4>().0.iter().all(|p| close(p, &[0, 102, 255, 0], 2)));
+    assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+
+    for (settings, space, icc_n) in [
+        (json!({}), "DeviceCMYK", None),
+        (json!({"output": {"conversion": "preserveNumbers"}}), "DeviceCMYK", None),
+        (json!({"standard": "pdfX1a"}), "DeviceCMYK", None),
+        (json!({"standard": "pdfX3"}), "ICCBased", Some(4)),
+        (json!({"standard": "pdfX4"}), "ICCBased", Some(4)),
+        (json!({"output": {"profiles": "all"}}), "ICCBased", Some(4)),
+    ] {
+        let out = export_with_report(&r.document, &opts(settings.clone())).unwrap();
+        let w = written(&out.bytes);
+        assert_eq!(w.len(), 1, "{settings}: {w:?}");
+        assert_eq!((w[0].space.as_str(), w[0].icc_n), (space, icc_n), "{settings}");
+        assert_eq!(w[0].filter.as_deref(), Some("DCTDecode"), "{settings}");
+        assert_eq!(w[0].decode, [1.0, 0.0, 1.0, 0.0, 1.0, 0.0, 1.0, 0.0], "{settings}");
+        assert!(w[0].data == jpg, "{settings}: the JPEG data unchanged");
+        assert!(out.warnings.iter().all(|w| !w.contains("image")), "{settings}: {:?}", out.warnings);
+        // And open again: the same JPEG.
+        let back = import(&out.bytes).unwrap();
+        assert_eq!(blobs(&back)[0].bytes.as_slice(), jpg.as_slice(), "{settings}");
+    }
+}
+
+#[test]
+fn other_cmyk_images_keep_their_ink_amounts() {
+    let inks: Vec<u8> = [[0, 0, 0, 0], [255, 0, 0, 0], [10, 20, 30, 40], [0, 102, 255, 0]].concat();
+    let z = |data: &[u8]| crate::output::deflate(data).unwrap();
+    let inverted: Vec<u8> = inks.iter().map(|v| 255 - v).collect();
+    let wide: Vec<u8> = inks.iter().flat_map(|v| (*v as u16 * 257).to_be_bytes()).collect();
+    let images = [
+        (cmyk_dict(2, 2, "/Filter /FlateDecode"), z(&inks)),
+        (cmyk_dict(2, 2, &format!("/Filter /FlateDecode {INVERTED}")), z(&inverted)),
+        (cmyk_dict(2, 2, "/Filter /FlateDecode").replace("/BitsPerComponent 8", "/BitsPerComponent 16"), z(&wide)),
+        // A CMYK JPEG holding the ink amounts themselves (no Decode array): not Adobe's convention.
+        (cmyk_dict(2, 2, "/Filter /DCTDecode"), cmyk_jpeg(&inverted, 2, 2)),
+        // ICC-based with four components (object 10: after the page's 4 objects and 5 images).
+        (cmyk_dict(2, 2, "/Filter /FlateDecode").replace("/DeviceCMYK", "[/ICCBased 10 0 R]"), z(&inks)),
+    ];
+    let source = pdf_with_images(&images, &[stream("/N 4", b"")]);
+    let r = import_with_report(&source, &ImportOptions::default()).unwrap();
+    let b = blobs(&r.document);
+    assert_eq!(b.len(), 5, "{:?}", r.warnings);
+    for (i, blob) in b.iter().enumerate() {
+        assert_eq!(blob.mime, "image/tiff", "image {i}");
+        let got = blob.cmyk().unwrap();
+        assert_eq!((got.width, got.height), (2, 2));
+        let tolerance = if i == 3 { 3 } else { 0 };
+        assert!(close(&got.data, &inks, tolerance), "image {i}: {:?}", got.data);
+    }
+    // Written as CMYK, losslessly: they open with the same ink amounts.
+    let out = export_with_report(&r.document, &opts(json!({}))).unwrap();
+    let w = written(&out.bytes);
+    assert!(!w.is_empty() && w.iter().all(|w| w.space == "DeviceCMYK" && w.decode.is_empty()), "{w:?}");
+    let back = import(&out.bytes).unwrap();
+    for blob in blobs(&back) {
+        assert!(close(&blob.cmyk().unwrap().data, &inks, 3));
+    }
+}
+
+#[test]
+fn cmyk_images_with_a_mask_or_odd_samples_open_in_rgb_with_a_warning() {
+    let inks = flat([0, 102, 255, 0], 4);
+    let mask = stream("/Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8", &[255, 128, 255, 128]);
+    let source = pdf_with_images(&[(cmyk_dict(2, 2, "/SMask 6 0 R /Filter /FlateDecode"), crate::output::deflate(&inks).unwrap())], &[mask]);
+    let r = import_with_report(&source, &ImportOptions::default()).unwrap();
+    assert_eq!(blobs(&r.document)[0].mime, "image/png");
+    assert!(r.warnings.iter().any(|w| w == crate::import_image::MASKED), "{:?}", r.warnings);
+    let four_bits = cmyk_dict(2, 2, "").replace("/BitsPerComponent 8", "/BitsPerComponent 4");
+    let r = import_with_report(&pdf_with_images(&[(four_bits, vec![0x0F; 8])], &[]), &ImportOptions::default()).unwrap();
+    assert_eq!(blobs(&r.document)[0].mime, "image/png");
+    assert!(r.warnings.iter().any(|w| w == crate::import_image::UNREAD), "{:?}", r.warnings);
+}
+
+/// A document with CMYK image `blob` of `w` × `h` pixels placed 40 pt wide.
+fn image_doc(blob: ImageBlob, w: u32, h: u32) -> Document {
+    let mut d = Document::new_with_mode(100.0, 100.0, ColorMode::Cmyk);
+    d.images.insert("img".into(), blob);
+    let image = ImageObject { key: "img".into(), width: w, height: h, xf: Affine::scale(40.0 / w as f64), link: None, placement: Default::default() };
+    let n = Node::new(d.alloc_id(), NodeKind::Image(image));
+    let l = d.layers[0].id;
+    d.insert(Some(l), 0, n).unwrap();
+    d
+}
+
+#[test]
+fn the_output_settings_convert_cmyk_images_and_compression_recompresses_them_in_cmyk() {
+    let ink = [0u8, 102, 255, 0];
+    let tiff = ImageBlob::cmyk_tiff(&Inks::new(4, 4, flat(ink, 16)).unwrap()).unwrap();
+    let d = image_doc(tiff, 4, 4);
+    let first = |s: serde_json::Value| {
+        let out = export_with_report(&d, &opts(s.clone())).unwrap();
+        let w = written(&out.bytes);
+        assert_eq!(w.len(), 1, "{s}");
+        let back = import(&out.bytes).unwrap();
+        let blob = blobs(&back)[0].clone();
+        (w.into_iter().next().unwrap(), blob, out.warnings)
+    };
+    // Kept: its numbers.
+    for s in [json!({}), json!({"output": {"conversion": "preserveNumbers", "destination": DEVICE_CMYK}})] {
+        let (w, blob, warnings) = first(s.clone());
+        assert_eq!(w.space, "DeviceCMYK", "{s}");
+        assert_eq!(blob.cmyk().unwrap().data, flat(ink, 16), "{s}");
+        assert!(warnings.is_empty(), "{s}: {warnings:?}");
+    }
+    // To another CMYK profile: other numbers, still CMYK.
+    let (w, blob, _) = first(json!({"output": {"conversion": "destination", "destination": DEVICE_CMYK}}));
+    assert_eq!(w.space, "DeviceCMYK");
+    let converted = blob.cmyk().unwrap().data;
+    assert_ne!(converted, flat(ink, 16));
+    let source = cms::active();
+    let dest = cms::Cms::new(&cms::ColorSettings { cmyk: DEVICE_CMYK.into(), ..source.settings().clone() }).unwrap();
+    let want = dest.lab_to_cmyk(source.cmyk_to_lab(ink.map(|v| v as f32 / 255.0)), source.settings().intent).map(|v| (v * 255.0).round() as u8);
+    assert!(close(&converted[..4], &want, 3), "{converted:?} vs {want:?}");
+    // To RGB: the colour shown on screen.
+    let (w, blob, _) = first(json!({"output": {"conversion": "destination", "destination": SRGB}}));
+    assert_eq!(w.space, "DeviceRGB");
+    let shown = source.cmyk_to_srgb(ink.map(|v| v as f32 / 255.0), false).map(|v| (v * 255.0).round() as u8);
+    let px = image::load_from_memory(&blob.bytes).unwrap().to_rgb8().get_pixel(0, 0).0;
+    assert!(close(&px, &shown, 3), "{px:?} vs {shown:?}");
+    // JPEG compression: a CMYK JPEG (Adobe's inverted samples, undone by the Decode array).
+    let (w, blob, warnings) = first(json!({"compression": {"color": {"compression": "jpeg", "quality": "maximum"}}}));
+    assert_eq!((w.space.as_str(), w.filter.as_deref()), ("DeviceCMYK", Some("DCTDecode")));
+    assert_eq!(w.decode, [1.0, 0.0, 1.0, 0.0, 1.0, 0.0, 1.0, 0.0]);
+    assert!(warnings.is_empty(), "{warnings:?}");
+    assert!(blob.cmyk().unwrap().data.as_chunks::<4>().0.iter().all(|p| close(p, &ink, 3)));
+    // Resampled: fewer pixels, the same inks.
+    let jpg = ImageBlob::new("image/jpeg", cmyk_jpeg(&flat(ink, 64 * 64), 64, 64));
+    let d = image_doc(jpg, 64, 64);
+    let s = json!({"compression": {"color": {"downsample": "bicubic", "ppi": 72.0, "abovePpi": 100.0}}});
+    let out = export_with_report(&d, &opts(s)).unwrap();
+    let w = written(&out.bytes);
+    assert_eq!((w[0].space.as_str(), w[0].width), ("DeviceCMYK", 40), "{w:?}");
+    assert!(blobs(&import(&out.bytes).unwrap())[0].cmyk().unwrap().data.as_chunks::<4>().0.iter().all(|p| close(p, &ink, 3)));
+    // And PDF/X-1a keeps the numbers of a CMYK image (no conversion through RGB).
+    let (w, blob, _) = first(json!({"standard": "pdfX1a", "output": {"destination": GENERIC_CMYK}}));
+    assert_eq!(w.space, "DeviceCMYK");
+    assert_eq!(blob.cmyk().unwrap().data, flat(ink, 16));
+}

crates/pdf/src/tests_import_fidelity.rs

@@ -1,11 +1,11 @@
 //! Import fidelity: soft masks → opacity masks, isolated and knockout groups, tiling patterns →
 //! pattern swatches, text → point type, mesh shadings → gradient meshes, gradient stop opacity
-//! and shading Extend flags.
+//! and shading Extend flags; strokes stay live strokes.
 
 use std::sync::Arc;
 
 use vectorcraft_color::{BlendMode, Color, Gradient, GradientKind, GradientPaint, GradientStop, Paint};
-use vectorcraft_doc::{Appearance, AppearanceItem, Document, Knockout, Node, NodeId, NodeKind, OpacityMask};
+use vectorcraft_doc::{Appearance, AppearanceItem, Document, Knockout, LineCap, LineJoin, Node, NodeId, NodeKind, OpacityMask};
 use vectorcraft_geom::{Rect, shapes};
 use vectorcraft_testkit::pdf::{PdfPage, first_extra, pdf_with};
 
@@ -390,3 +390,57 @@ fn glyphs_turned_along_a_curve_become_type_on_a_path() {
     assert_eq!(straight.len(), 1);
     assert!(matches!(straight[0].kind, vectorcraft_doc::TextKind::Point), "{:?}", straight[0].kind);
 }
+
+/// The leaves (objects that aren't groups or clipping paths) of a document.
+fn objects(d: &Document) -> Vec<Node> {
+    all(d).into_iter().filter(|n| !n.is_container() && !matches!(n.kind, NodeKind::Path { clipping: true, .. })).collect()
+}
+
+#[test]
+fn an_object_written_as_a_fill_and_a_closed_stroke_stays_one_path_with_a_live_stroke() {
+    // As Illustrator writes an object: the fill of the outline left open, then the stroke of it
+    // closed, each in its own transform. Two subpaths: one ending on its start, one not.
+    let outline = "0 0 m -20 1 l -30 -12 l -30 30 l 0 0 l 5 5 m 10 5 l 10 10 l";
+    let content = format!(
+        "0.2 0.2 0.2 rg q 1 0 0 1 50 50 cm {outline} f Q 1 1 1 RG 1.5 w 1 J 1 j 4 M [3 2] 1 d q 1 0 0 1 50 50 cm {} S Q",
+        outline.replace(" 5 5 m", " h 5 5 m") + " h"
+    );
+    let d = open(&one_page(&content, "", &[]));
+    let objs = objects(&d);
+    assert_eq!(objs.len(), 1, "one object, not a fill and a separate stroke: {objs:#?}");
+    let n = &objs[0];
+    assert_eq!(fill_color(n), Some(Color::rgb(0.2, 0.2, 0.2)));
+    let st = n.appearance.stroke().expect("a live stroke");
+    assert_eq!(st.paint.color(), Some(Color::WHITE));
+    assert!((st.width - 1.5).abs() < 1e-6);
+    assert_eq!((st.cap, st.join), (LineCap::Round, LineJoin::Round));
+    assert!((st.miter_limit - 4.0).abs() < 1e-6);
+    let dash = st.dash.as_ref().expect("dashed");
+    assert_eq!((dash.pattern.as_slice(), dash.offset), (&[3.0, 2.0][..], 1.0));
+    // The stroke's outline: both subpaths closed, as they were stroked.
+    let p = n.path_data().unwrap();
+    assert_eq!(p.subpaths.len(), 2);
+    assert!(p.is_closed());
+}
+
+#[test]
+fn different_outlines_filled_and_stroked_stay_apart() {
+    let d = open(&one_page("1 0 0 rg 10 10 m 40 10 l 40 40 l f 0 0 1 RG 10 10 m 40 10 l 40 40 l 10 40 l h S 0 g 50 50 m 60 60 l S", "", &[]));
+    let objs = objects(&d);
+    assert_eq!(objs.len(), 3);
+    assert!(objs[0].appearance.stroke().is_none() && objs[1].appearance.fill().is_none());
+}
+
+#[test]
+fn a_stroke_under_a_stretched_transform_stays_a_stroke() {
+    // Stretched twice as wide: the stroke keeps its average width (√2 × 2 pt) rather than
+    // becoming a filled outline.
+    let d = open(&one_page("0 0 1 RG 2 w q 2 0 0 1 0 0 cm 10 10 m 40 10 l 40 40 l S Q", "", &[]));
+    let objs = objects(&d);
+    assert_eq!(objs.len(), 1);
+    assert!(objs[0].appearance.fill().is_none());
+    let st = objs[0].appearance.stroke().expect("a stroke");
+    assert!((st.width - 2.0 * 2f64.sqrt()).abs() < 1e-6, "{}", st.width);
+    let b = objs[0].geometric_bounds().unwrap();
+    assert!((b.x0 - 20.0).abs() < 1e-6 && (b.x1 - 80.0).abs() < 1e-6, "{b:?}");
+}

crates/pdf/src/tests_import_layers.rs

@@ -1,5 +1,6 @@
-//! Optional content groups become layers: name, visibility, print state and lock; art that is
-//! off comes in as a hidden layer.
+//! Optional content groups become layers: name, visibility (the default configuration's or the
+//! view state's), print state, lock and nesting; art that is off comes in as a hidden layer, and
+//! art past what is read of a huge page never shows or prints a hidden layer.
 
 use vectorcraft_color::Color;
 use vectorcraft_doc::{Document, Node, NodeKind};
@@ -134,3 +135,220 @@ fn an_encrypted_file_keeps_its_hidden_layers() {
     assert!(d.layers[0].visible && !d.layers[1].visible);
     assert_eq!(colors(&d.layers[1]), [Color::rgb(0.0, 0.0, 1.0)]);
 }
+
+/// A page drawing `before`, white and red squares in "Shapes", then `after`; `ai`: with an
+/// editor's private data (a PDF-compatible `.ai`).
+fn page_fill(before: &str, after: &str, ai: bool) -> Document {
+    let (objs, catalog, ids) = groups(1, "");
+    let page = PdfPage {
+        resources: format!(
+            "/Properties << /MC0 {} 0 R >> /ExtGState << /GS0 << /ca 0.5 >> >> /ColorSpace << /W [/Separation /White /DeviceCMYK << /FunctionType 2 /Domain [0 1] /C0 [0 0 0 0] /C1 [0 0 0 0] /N 1 >>] >>",
+            ids[0]
+        ),
+        entries: if ai { "/PieceInfo << /Illustrator << /Private << /AIPrivateData1 7 /NumBlock 1 >> >> >>".into() } else { String::new() },
+        ..PdfPage::new(200.0, 100.0, &format!("{before} /OC /MC0 BDC 1 1 1 rg 20 20 60 60 re f 1 0 0 rg 120 20 60 60 re f EMC {after}"))
+    };
+    import(&pdf_with_catalog(&[page], &[&objs[0], &objs[1]], &catalog, None)).unwrap()
+}
+
+fn path_count(d: &Document) -> usize {
+    let mut n = 0;
+    d.walk(|c| n += usize::from(matches!(c.kind, NodeKind::Path { .. })));
+    n
+}
+
+#[test]
+fn an_ai_files_white_page_outside_its_layers_is_not_art() {
+    // RGB, grey and CMYK white, the rectangle drawn either way round.
+    for fill in ["1 1 1 rg 0 0 200 100 re f", "1 g 0 100 200 -100 re f", "0 0 0 0 k 0 0 200 100 re f"] {
+        let d = page_fill(fill, "", true);
+        assert_eq!(names(&d), ["Shapes"], "{fill}");
+        assert_eq!(path_count(&d), 2, "{fill}");
+        assert_eq!(colors(&d.layers[0]), [Color::rgb(1.0, 1.0, 1.0), Color::rgb(1.0, 0.0, 0.0)], "{fill}");
+    }
+}
+
+#[test]
+fn a_page_fill_that_is_art_stays() {
+    // A plain PDF's white background is art, as are an .ai's fills that aren't a plain white
+    // page under its layers: grey, smaller or larger than the page, stroked, translucent or a
+    // white ink.
+    let page = "1 1 1 rg 0 0 200 100 re f";
+    let kept = [
+        (page, false),
+        ("0.9 g 0 0 200 100 re f", true),
+        ("1 g 10 10 180 80 re f", true),
+        ("1 g -20 -20 240 140 re f", true),
+        ("1 g 0 G 0 0 200 100 re B", true),
+        ("/GS0 gs 1 g 0 0 200 100 re f", true),
+        ("/W cs 1 scn 0 0 200 100 re f", true),
+    ];
+    for (fill, ai) in kept {
+        let d = page_fill(fill, "", ai);
+        assert_eq!(names(&d), ["Page 1", "Shapes"], "{fill}");
+        assert_eq!(path_count(&d), 3, "{fill}");
+    }
+    // Painted over the layers.
+    let d = page_fill("", page, true);
+    assert_eq!(names(&d), ["Shapes", "Page 1"]);
+    assert_eq!(path_count(&d), 3);
+}
+
+/// A page drawing a red, a blue and a green square in groups `defs` (as `/MC0`–`/MC2`), the
+/// catalog listing them with default configuration `config`, plus `more` objects; in `config` and
+/// `more`, `{0}`–`{2}` stand for the groups.
+fn three_groups(defs: [&str; 3], more: &[&str], config: &str) -> Vec<u8> {
+    let refs = [0, 1, 2].map(|i| format!("{} 0 R", first_extra(1) + i));
+    let fill = |s: &str| (0..3).fold(s.to_string(), |s, i| s.replace(&format!("{{{i}}}"), &refs[i]));
+    let content = "/OC /MC0 BDC 1 0 0 rg 10 10 20 20 re f EMC /OC /MC1 BDC 0 0 1 rg 40 40 20 20 re f EMC /OC /MC2 BDC 0 1 0 rg 70 70 20 20 re f EMC";
+    let page = PdfPage { resources: fill("/Properties << /MC0 {0} /MC1 {1} /MC2 {2} >>"), ..PdfPage::new(100.0, 100.0, content) };
+    let catalog = format!("/OCProperties << /OCGs [{}] /D << {} >> >> ", refs.join(" "), fill(config));
+    let more: Vec<String> = more.iter().map(|m| fill(m)).collect();
+    let objs: Vec<&str> = defs.iter().copied().chain(more.iter().map(String::as_str)).collect();
+    pdf_with_catalog(&[page], &objs, &catalog, None)
+}
+
+fn ocg(name: &str, usage: &str) -> String {
+    format!("<< /Type /OCG /Name ({name}) {usage} >>")
+}
+
+fn visibility(layers: &[std::sync::Arc<Node>]) -> Vec<bool> {
+    layers.iter().map(|l| l.visible).collect()
+}
+
+#[test]
+fn a_view_state_that_is_off_hides_the_layer_with_its_art() {
+    let off = ocg("Off", "/Usage << /View << /ViewState /OFF >> >>");
+    // With an /AS entry for viewing, the view state wins over the default configuration.
+    let on = ocg("On", "/Usage << /View << /ViewState /ON >> >>");
+    let bytes = three_groups([&ocg("Plain", ""), &off, &on], &[], "/OFF [{2}] /AS [<< /Event /View /Category [/View] /OCGs [{1} {2}] >>]");
+    let d = import(&bytes).unwrap();
+    assert_eq!(names(&d), ["Plain", "Off", "On"]);
+    assert_eq!(visibility(&d.layers), [true, false, true]);
+    assert_eq!(colors(&d.layers[1]), [Color::rgb(0.0, 0.0, 1.0)]);
+    assert_eq!(colors(&d.layers[2]), [Color::rgb(0.0, 1.0, 0.0)], "the art the default configuration hides is read");
+    // Without one, a view state that is off still hides the layer.
+    let d = import(&three_groups([&ocg("Plain", ""), &off, &ocg("Other", "")], &[], "")).unwrap();
+    assert_eq!(visibility(&d.layers), [true, false, true]);
+    assert_eq!(colors(&d.layers[1]), [Color::rgb(0.0, 0.0, 1.0)]);
+}
+
+#[test]
+fn nested_groups_become_sublayers_and_hidden_ones_keep_their_art() {
+    // The order as an object of its own (as Illustrator writes it): "Top" holds "Sub", which is
+    // off; a label's groups stay at the level of the label.
+    let order = first_extra(1) + 3;
+    let bytes = three_groups(
+        [&ocg("Top", ""), &ocg("Sub", ""), &ocg("Other", "")],
+        &["[{0} [{1}] [(Label) {2}]]"],
+        &format!("/OFF [{{1}}] /Order {order} 0 R"),
+    );
+    let d = import(&bytes).unwrap();
+    assert_eq!(names(&d), ["Top", "Other"]);
+    assert_eq!(visibility(&d.layers), [true, true]);
+    let top = d.layers[0].children().unwrap();
+    assert_eq!(top.len(), 2, "its art, then its sublayer");
+    assert_eq!(top[0].appearance.fill().and_then(|f| f.paint.color()), Some(Color::rgb(1.0, 0.0, 0.0)));
+    let sub = &top[1];
+    assert!(matches!(sub.kind, NodeKind::Layer { .. }) && sub.name.as_deref() == Some("Sub"));
+    assert!(!sub.visible, "the sublayer that is off is hidden");
+    assert_eq!(colors(sub), [Color::rgb(0.0, 0.0, 1.0)], "with its art");
+    assert_eq!(d.layer_color(sub.id), d.layer_color(d.layers[0].id), "a sublayer takes its layer's colour");
+    assert_eq!(colors(&d.layers[1]), [Color::rgb(0.0, 1.0, 0.0)]);
+}
+
+#[test]
+fn a_sublayer_that_paints_first_brings_its_parent_layer() {
+    // "Sub" paints first; "Top", its parent, paints its own art last.
+    let bytes = three_groups([&ocg("Sub", ""), &ocg("Other", ""), &ocg("Top", "")], &[], "/Order [{2} [{0}] {1}]");
+    let d = import(&bytes).unwrap();
+    assert_eq!(names(&d), ["Top", "Other"]);
+    let top = d.layers[0].children().unwrap();
+    assert_eq!(top.len(), 2);
+    assert_eq!(top[0].name.as_deref(), Some("Sub"));
+    assert_eq!(colors(&top[0]), [Color::rgb(1.0, 0.0, 0.0)]);
+    assert_eq!(top[1].appearance.fill().and_then(|f| f.paint.color()), Some(Color::rgb(0.0, 1.0, 0.0)));
+}
+
+#[test]
+fn hostile_layer_orders_stay_bounded() {
+    // A group listed twice, under itself, and an order nested far deeper than layers go.
+    let deep = format!("{}{{2}}{}", "[".repeat(100), "]".repeat(100));
+    let order = format!("[{{0}} [{{0}} {{1}}] {{1}} [{{0}}] {deep}]");
+    let d = import(&three_groups([&ocg("A", ""), &ocg("B", ""), &ocg("C", "")], &[], &format!("/Order {order}"))).unwrap();
+    assert_eq!(names(&d), ["A", "C"], "C, listed too deep, stays a top-level layer");
+    assert_eq!(d.layers[0].children().unwrap()[1].name.as_deref(), Some("B"));
+    let mut count = 0;
+    d.walk(|n| count += usize::from(matches!(n.kind, NodeKind::Layer { .. })));
+    assert_eq!(count, 3, "each group is one layer");
+}
+
+#[test]
+fn thousands_of_layers_hidden_ones_included_all_come_in() {
+    const N: usize = 3000;
+    let first = first_extra(1);
+    let objs: Vec<String> = (0..N).map(|i| ocg(&format!("L{i}"), "")).collect();
+    let refs: Vec<String> = (0..N).map(|i| format!("{} 0 R", first + i)).collect();
+    let props: String = refs.iter().enumerate().map(|(i, r)| format!("/M{i} {r} ")).collect();
+    let content: String = (0..N).map(|i| format!("/OC /M{i} BDC {} {} 1 1 re f EMC ", i % 100, i / 100)).collect();
+    let off: Vec<&str> = refs.iter().step_by(2).map(String::as_str).collect();
+    let catalog = format!("/OCProperties << /OCGs [{}] /D << /OFF [{}] >> >> ", refs.join(" "), off.join(" "));
+    let page = PdfPage { resources: format!("/Properties << {props}>>"), ..PdfPage::new(100.0, 100.0, &content) };
+    let objs: Vec<&str> = objs.iter().map(String::as_str).collect();
+    let d = import(&pdf_with_catalog(&[page], &objs, &catalog, None)).unwrap();
+    assert_eq!(d.layers.len(), N);
+    assert!(d.layers.iter().enumerate().all(|(i, l)| l.visible == (i % 2 == 1) && l.children().is_some_and(|c| c.len() == 1)));
+}
+
+/// Import `bytes` with the scan's operator limit lowered to `n`.
+fn import_with_max_ops(bytes: &[u8], n: usize) -> ImportReport {
+    let old = crate::import_scan::TEST_MAX_OPS.replace(n);
+    let r = import_with_report(bytes, &ImportOptions::default());
+    crate::import_scan::TEST_MAX_OPS.set(old);
+    r.unwrap()
+}
+
+#[test]
+fn art_past_the_scan_limit_never_shows_a_hidden_layer() {
+    // "Shapes" draws 100 operators before its square, then "Hidden" (off, not printed) its own.
+    let (objs, catalog, ids) = groups(1, "/OFF [{B}]");
+    let filler = "q Q ".repeat(50);
+    let page = PdfPage {
+        resources: format!("/Properties << /MC0 {} 0 R /MC1 {} 0 R >>", ids[0], ids[1]),
+        ..PdfPage::new(
+            100.0,
+            100.0,
+            &format!("/OC /MC0 BDC {filler}1 0 0 rg 10 10 30 30 re f EMC /OC /MC1 BDC 0 0 1 rg 50 50 30 30 re f EMC 0 1 0 rg 0 0 5 5 re f"),
+        )
+    };
+    let bytes = pdf_with_catalog(&[page], &[&objs[0], &objs[1]], &catalog, None);
+    // Within the limit, every group is told apart.
+    assert_eq!(names(&import(&bytes).unwrap()), ["Shapes", "Hidden", "Page 1"]);
+    let r = import_with_max_ops(&bytes, 60);
+    let d = &r.document;
+    assert_eq!(names(d), ["Shapes", "Page 1 (unsorted)", "Page 1"], "{:?}", r.warnings);
+    // The art drawn past the limit in a group already open stays in it.
+    assert!(d.layers[0].visible);
+    assert_eq!(colors(&d.layers[0]), [Color::rgb(1.0, 0.0, 0.0)]);
+    // The hidden group's art, past it, can't be told apart: it neither shows nor prints.
+    let unsorted = &d.layers[1];
+    assert!(!unsorted.visible && !printable(unsorted));
+    assert_eq!(colors(unsorted), [Color::rgb(0.0, 0.0, 1.0)]);
+    // Art outside any group is the page's, as before.
+    assert!(d.layers[2].visible && printable(&d.layers[2]));
+    assert_eq!(colors(&d.layers[2]), [Color::rgb(0.0, 1.0, 0.0)]);
+    assert!(r.warnings.iter().any(|w| w.contains("more than can be read") && w.contains("hidden, non-printing")), "{:?}", r.warnings);
+}
+
+#[test]
+fn art_past_the_scan_limit_of_shown_layers_stays_shown() {
+    // Every group shows and prints: what can't be told apart goes to the page's layer, shown.
+    let bytes = three_groups([&ocg("A", ""), &ocg("B", ""), &ocg("C", "")], &[], "");
+    let r = import_with_max_ops(&bytes, 4);
+    let d = &r.document;
+    assert_eq!(names(d), ["A", "Page 1"], "{:?}", r.warnings);
+    assert_eq!(colors(&d.layers[0]), [Color::rgb(1.0, 0.0, 0.0)]);
+    assert!(d.layers[1].visible && printable(&d.layers[1]));
+    assert_eq!(colors(&d.layers[1]), [Color::rgb(0.0, 0.0, 1.0), Color::rgb(0.0, 1.0, 0.0)]);
+    assert!(r.warnings.iter().any(|w| w.contains("went to its page's layer")), "{:?}", r.warnings);
+}

crates/pdf/src/tests_live_text.rs

@@ -3,11 +3,13 @@
 use krilla::geom::{Point as KPoint, Transform};
 use krilla::page::PageSettings;
 use krilla::text::{Font, TextDirection};
+use kurbo::Shape;
 use vectorcraft_doc::{Document, NodeKind, TextObject};
 
 use crate::*;
 
 const SOURCE_SANS: &[u8] = include_bytes!("../../../assets/fonts/SourceSans3-Regular.ttf");
+const SOURCE_SERIF: &[u8] = include_bytes!("../../../assets/fonts/SourceSerif4-Regular.ttf");
 
 /// A 300 × 200 pt page with `lines` of (x, y from the top, size, text) in Source Sans 3, and the
 /// same rotated 90° when `rotated`.
@@ -157,21 +159,73 @@ fn a_glyph_whose_unicode_names_another_letter_stays_outlined() {
     assert!(r.warnings.iter().any(|w| w.contains("differ from the installed font")), "{:?}", r.warnings);
 }
 
-/// Source Sans 3 renamed `SourceSans9-Regular` (a font no machine has installed).
-fn uninstalled_font() -> Vec<u8> {
-    let mut bytes = SOURCE_SANS.to_vec();
-    let utf16: Vec<u8> = "SourceSans3-Regular".encode_utf16().flat_map(u16::to_be_bytes).collect();
-    let renamed16: Vec<u8> = "SourceSans9-Regular".encode_utf16().flat_map(u16::to_be_bytes).collect();
-    for (from, to) in [(b"SourceSans3-Regular".to_vec(), b"SourceSans9-Regular".to_vec()), (utf16, renamed16)] {
-        let mut i = 0;
-        while let Some(at) = bytes[i..].windows(from.len()).position(|w| w == from.as_slice()) {
-            bytes[i + at..i + at + from.len()].copy_from_slice(&to);
-            i += at + from.len();
+/// `font` with each of `names` (`from`, `to`, the same length) replaced, in ASCII and UTF-16.
+fn renamed(font: &[u8], names: &[(&str, &str)]) -> Vec<u8> {
+    let mut bytes = font.to_vec();
+    let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    for &(from, to) in names {
+        assert_eq!(from.len(), to.len());
+        for (from, to) in [(from.as_bytes().to_vec(), to.as_bytes().to_vec()), (utf16(from), utf16(to))] {
+            let mut i = 0;
+            while let Some(at) = bytes[i..].windows(from.len()).position(|w| w == from.as_slice()) {
+                bytes[i + at..i + at + from.len()].copy_from_slice(&to);
+                i += at + from.len();
+            }
         }
     }
     bytes
 }
 
+/// Source Sans 3 renamed `SourceSans9-Regular` (a font no machine has installed).
+fn uninstalled_font() -> Vec<u8> {
+    renamed(SOURCE_SANS, &[("SourceSans3-Regular", "SourceSans9-Regular")])
+}
+
+/// Source Serif 4 renamed `SourceSerif9-Regular`, family Source Serif 9: a serif font that isn't
+/// installed (the fallback font, Source Sans 3, is a sans).
+fn uninstalled_serif() -> Vec<u8> {
+    renamed(SOURCE_SERIF, &[("SourceSerif4", "SourceSerif9"), ("Source Serif 4", "Source Serif 9")])
+}
+
+/// A page with `text` in `font` (24 pt, at 20, 50).
+fn one_line_pdf(font: Vec<u8>, text: &str) -> Vec<u8> {
+    let mut pdf = krilla::Document::new();
+    let mut page = pdf.start_page_with(PageSettings::from_wh(300.0, 200.0).unwrap());
+    let mut s = page.surface();
+    s.draw_text(KPoint::from_xy(20.0, 50.0), Font::new(font.into(), 0).unwrap(), 24.0, text, false, TextDirection::Auto);
+    s.finish();
+    page.finish();
+    pdf.finish().unwrap()
+}
+
+/// The outlines text imported as (`textAs: outlines`), as one path.
+fn outlines(d: &Document) -> kurbo::BezPath {
+    let mut all = kurbo::BezPath::new();
+    d.walk(|n| {
+        if let NodeKind::Path { path, .. } = &n.kind {
+            all.extend(path.to_bezpath().iter());
+        }
+    });
+    all
+}
+
+#[test]
+fn outlined_text_in_a_missing_font_keeps_the_embedded_glyphs() {
+    let outlined = |bytes: &[u8]| {
+        let r = import_with_report(bytes, &ImportOptions { text_as: TextAs::Outlines, ..Default::default() }).unwrap();
+        assert!(texts(&r.document).is_empty());
+        outlines(&r.document)
+    };
+    let missing = outlined(&one_line_pdf(uninstalled_serif(), "Serif Hamburg"));
+    let installed = outlined(&one_line_pdf(SOURCE_SERIF.to_vec(), "Serif Hamburg"));
+    let fallback = outlined(&one_line_pdf(SOURCE_SANS.to_vec(), "Serif Hamburg"));
+    let (m, i, f) = (missing.bounding_box(), installed.bounding_box(), fallback.bounding_box());
+    assert!(m.width() > 50.0, "{m:?}");
+    let near = |a: kurbo::Rect, b: kurbo::Rect| (a.x0 - b.x0).abs() + (a.x1 - b.x1).abs() + (a.y0 - b.y0).abs() + (a.y1 - b.y1).abs() < 0.01;
+    assert!(near(m, i), "the file's own serif glyphs: {m:?} vs {i:?}");
+    assert!(!near(m, f), "not the fallback font's: {m:?} vs {f:?}");
+}
+
 #[test]
 fn text_in_a_missing_font_stays_live_type() {
     for stroke_only in [false, true] {

crates/pdf/src/tests_output.rs

@@ -218,11 +218,12 @@ fn images_are_converted_too() {
     assert!(String::from_utf8_lossy(&plain.bytes).contains("/ColorSpace/DeviceRGB"));
     let r = pdf(&d, json!({"output": {"conversion": "preserveNumbers", "destination": GENERIC_CMYK}}));
     assert!(String::from_utf8_lossy(&r.bytes).contains("/ColorSpace/DeviceCMYK"), "a CMYK image");
-    // CMYK images aren't written as JPEG.
+    // Converted to CMYK and compressed with JPEG: a CMYK JPEG.
     let jpeg =
         pdf(&d, json!({"compression": {"color": {"compression": "jpeg"}}, "output": {"conversion": "destination", "destination": GENERIC_CMYK}}));
-    assert!(!String::from_utf8_lossy(&jpeg.bytes).contains("/DCTDecode"));
-    assert!(jpeg.warnings.iter().any(|w| w.contains("ZIP")), "{:?}", jpeg.warnings);
+    let t = String::from_utf8_lossy(&jpeg.bytes);
+    assert!(t.contains("/DCTDecode") && t.contains("/ColorSpace/DeviceCMYK"), "{t}");
+    assert!(jpeg.warnings.is_empty(), "{:?}", jpeg.warnings);
     // An RGB destination other than sRGB changes the pixels (unless their numbers are kept).
     assert_eq!(first_pixel(&plain.bytes), [200, 40, 30]);
     let p3 = |conversion: &str| first_pixel(&pdf(&d, json!({"output": {"conversion": conversion, "destination": cms::DISPLAY_P3}})).bytes);

crates/pdf/src/tests_realtext.rs

@@ -96,7 +96,7 @@ fn real_text_lands_within_half_a_point_of_the_outlines() {
         TextRun { text: " ok".into(), style: CharStyle { rotation: 20.0, ..style(20.0) } },
     ];
     let mut on_path = TextObject::point(Point::ZERO, "along the arc", style(18.0));
-    on_path.kind = TextKind::OnPath { path: arc(), start: 0.0 };
+    on_path.kind = TextKind::OnPath { path: arc(), start: 0.0, end: None };
     on_path.xf = Affine::IDENTITY;
     for t in [plain, turned, mixed, on_path] {
         let what = t.plain_text();