Part of #516: the in-window menus' Select All, Cut, Copy and Paste act on a focused field

The clipboard keys already went to a focused text field, but on Windows,
Linux and the web the press that opens a menu takes the keyboard from the
field, so Edit > Copy (and Cut, Paste, Select > All) acted on the art.
The menu bar now keeps the field that had the keyboard, and its
selection, while the menus are open; those four commands go to it as the
events their keys send, the frame after the click that chose them, and
give it the keyboard back. Everything else, and those commands with no
field, run as before. The macOS menu bar shares the same helpers.

Tests: Copy, Cut and Paste events in the W field and the Color panel's
hex field edit the text, never the art; Select > All, Edit > Copy and
Edit > Paste clicked in the in-window menus act on the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/packaging-lint.yml

@@ -54,4 +54,13 @@ jobs:
           desktop-file-validate packaging/linux/ai.storyteller.vectorcraft.desktop
           sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.vectorcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
           appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.vectorcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.vectorcraft.yml')); assert m['id'] == 'ai.storyteller.vectorcraft' and m['command'] == 'vectorcraft'"
+          python3 - <<'EOF'
+          import yaml
+          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.yml"))
+          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml"))
+          for m in (src, bundle):
+              assert m["id"] == "ai.storyteller.vectorcraft" and m["command"] == "vectorcraft", m["id"]
+          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
+              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
+          print("Flatpak manifests ok")
+          EOF

.github/workflows/release.yml

@@ -1,9 +1,11 @@
 # Release pipeline: every push to `release` builds signed installers for every platform and
 # creates or updates the draft GitHub Release "VectorCraft v<version>". See docs/releasing.md.
 #
-# All jobs run in the `release` environment (restricted to the `release` branch), which holds
-# the signing secrets. Every secret is optional: missing ones produce unsigned artifacts and a
-# warning, never a failed build.
+# Jobs that sign (macOS, Windows) and the job that creates the release run in the `release`
+# environment (restricted to the `release` branch), which holds the signing secrets. Every secret
+# is optional: missing ones produce unsigned artifacts and a warning, never a failed build. The
+# other jobs sign nothing and get no environment, so a `workflow_dispatch` on any branch is a dry
+# run: they build and upload artifacts, the signed jobs are refused, and no release is drafted.
 name: Release
 
 on:
@@ -35,7 +37,7 @@ jobs:
   version:
     name: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     outputs:
       version: ${{ steps.v.outputs.version }}
       date: ${{ steps.v.outputs.date }}
@@ -175,7 +177,7 @@ jobs:
     # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
     # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
     runs-on: ${{ matrix.runner }}
-    environment: release
+    # No `environment: release`: Linux packages are not signed (checksums in SHA256SUMS.txt).
     strategy:
       fail-fast: false
       matrix:
@@ -200,7 +202,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml
+            desktop-file-utils appstream python3-yaml zsync
           curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
             "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
           sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
@@ -225,6 +227,12 @@ jobs:
           for appimage in dist/release/*.AppImage; do
             chmod +x "$appimage"
             APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
+            # Update information is embedded, and the .zsync for delta updates sits beside it.
+            # No APPIMAGE_EXTRACT_AND_RUN here: with it the runtime passes --appimage-* flags on
+            # to the app instead of answering them itself.
+            "$appimage" --appimage-updateinformation \
+              | grep -F "gh-releases-zsync|${GITHUB_REPOSITORY%%/*}|${GITHUB_REPOSITORY#*/}|latest|vectorcraft-*-linux-${{ matrix.arch }}.AppImage.zsync"
+            test -s "$appimage.zsync"
           done
       - uses: actions/upload-artifact@v4
         with:
@@ -232,13 +240,52 @@ jobs:
           path: dist/release/*
           if-no-files-found: error
 
+  flatpak:
+    name: Flatpak ${{ matrix.arch }}
+    needs: [version, linux]
+    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
+    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
+    runs-on: ${{ matrix.runner }}
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-24.04 }
+          - { arch: aarch64, runner: ubuntu-24.04-arm }
+    env:
+      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      - name: Install flatpak-builder
+        run: |
+          sudo apt-get update
+          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
+          # `appstreamcli compose`, which renders the scalable icon and fails without it.
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
+          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build the Flatpak bundle
+        run: packaging/linux/flatpak-bundle.sh "dist/linux/vectorcraft-$VECTORCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-flatpak-${{ matrix.arch }}
+          path: dist/release/*.flatpak
+          if-no-files-found: error
+
   freebsd:
     name: FreeBSD x86_64
     needs: version
-    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM (same image as freebsd.yml).
+    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM (same image and packages as
+    # freebsd.yml).
     runs-on: ubuntu-latest
     timeout-minutes: 150
-    environment: release
+    # No `environment: release`: this job signs nothing, so it gets no release secrets.
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -262,6 +309,7 @@ jobs:
         with:
           release: "14.3"
           usesh: true
+          cpu: 4
           mem: 12288
           # Passed through by name; never templated into the script.
           envs: "VECTORCRAFT_VERSION VECTORCRAFT_BUILD_DATE VECTORCRAFT_BUILD_SHA"
@@ -276,6 +324,8 @@ jobs:
             export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
             export CARGO_TARGET_DIR=/var/tmp/vectorcraft-target CARGO_BUILD_JOBS=4
             bash packaging/freebsd/package.sh
+            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz \
+              | grep -E '/bin/vectorcraft$|/bin/vectorcraft-cli$|/share/applications/ai\.storyteller\.vectorcraft\.desktop$'
       - uses: actions/upload-artifact@v4
         with:
           name: release-freebsd
@@ -286,7 +336,7 @@ jobs:
     name: Web (wasm)
     needs: version
     runs-on: ubuntu-latest
-    environment: release
+    # No `environment: release`: no secrets here.
     env:
       VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
       VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -327,7 +377,9 @@ jobs:
 
   release:
     name: Draft GitHub Release
-    needs: [version, macos, windows, linux, freebsd, web]
+    # Needs the signed jobs, so a branch dry run (where the environment refuses them) never
+    # drafts a release.
+    needs: [version, macos, windows, linux, flatpak, freebsd, web]
     runs-on: ubuntu-latest
     environment: release
     permissions:

AGENTS.md

@@ -6,13 +6,19 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,7 +59,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.
 
 ## Contributor credits (About window)

ASSETS.md

@@ -37,6 +37,9 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/app-icon/vectorcraft.icns` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.ico` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
 | `assets/app-icon/vectorcraft.svg` | Project owner (ArtCraft team) | Original artwork drawn in ArtCraft for VectorCraft, vectorised and rendered by `packaging/icons.sh` | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | App icon (engraved dragon) |
+| `packaging/macos/dmg/background.svg` | Xus Badia (contributed in #493) | Original artwork for VectorCraft's DMG window; links the app icon `assets/app-icon/vectorcraft-small.svg` | MIT OR Apache-2.0 (licensed by the contributor under the project licence) | DMG background source. Text in Inter and JetBrains Mono (OFL-1.1, `assets/fonts`), not embedded; paper grain generated by an SVG `feTurbulence` filter |
+| `packaging/macos/dmg/background.tiff` | Xus Badia (contributed in #493) | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | 1x + 2x DMG background; includes the app icon (see its rows), text rendered from OFL-1.1 fonts and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
+| `packaging/macos/dmg/DS_Store` | Xus Badia (layout, #493) | Written by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0 | Finder view settings for the DMG (window, icon size and positions, background alias); no machine data |
 | `assets/fonts/Inter-Medium.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-Regular.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |
 | `assets/fonts/Inter-SemiBold.ttf` | Rasmus Andersson / The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) | Open-source typeface, not product iconography or artwork |

CLAUDE.md

@@ -6,13 +6,19 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 
 ## Start every session here
 1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
-2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: `plan/illustrator/*.md`.
+2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.
 
 `plan/` is gitignored (local only).
 
 ## Non-negotiables
-- **Clean-room.** Never read, disassemble or copy anything inside the Illustrator bundle (names/listings only). Never copy Adobe icons, artwork, presets or wording beyond feature names. Behaviour comes from public docs and black-box observation of the running app with synthetic documents only (screenshots by window id, stored under `plan/illustrator/screenshots/`, never committed). Never copy GPL/AGPL code (Inkscape, lib2geom…).
+- **Clean-room: never use Adobe software (absolute rule, from the project owner).** Adobe's Terms of Use forbid reverse engineering, including observing a program's inputs and outputs to recreate it. So:
+  - Never launch, run, script, automate (COM, AppleScript, ExtendScript, UI automation), screenshot or measure Illustrator or any other Adobe application, and never compare our output against one. Don't make test files with them, not even "synthetic" ones.
+  - Never read, disassemble or copy anything inside an Adobe install (binaries, plug-ins, presets, procsets, resources, help files, fonts, ICC profiles).
+  - Never copy Adobe-authored code or text into this repo, tests included: no PostScript procsets or prologs (AGM, CoolType, the Illustrator prologs), no sample files. Write test inputs from scratch from the public specifications (PostScript Language Reference, PDF / ISO 32000, TIFF, EPSF/DCS).
+  - Behaviour comes only from public documentation (helpx, published specs, public forum posts), cited by URL, and from files users send us that they own (used locally, never committed). Never copy Adobe icons, artwork, presets or wording beyond feature names.
+  - If a task seems to need any of this, stop and say so instead. `cargo xtask cleanroom` (run by `cargo xtask ci`) fails on Adobe copyright notices and on fixtures made with Adobe applications.
+  - Never copy GPL/AGPL code (Inkscape, lib2geom…).
 - **Assets: no Adobe iconography or images — ever (absolute rule, from the project owner).**
   - Never add, copy, trace, redraw-from, embed or ship any icon, image, artwork, cursor, preset, swatch/brush/symbol/pattern/style library, ICC profile or screenshot from Adobe products or from any other source whose licence doesn't allow it.
   - Every image, icon, font or other asset must be one of:
@@ -44,7 +50,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Running and looking at the app
 - `cargo run --release -p vectorcraft -- --control 7979 [file.svg|file.vectorcraft]` (sibling apps' agents use the same default port: if the log says it failed to bind, pick another port — otherwise your requests reach a different app).
 - Drive it: JSON lines on `127.0.0.1:7979`, e.g. `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}` then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`.
-- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with `plan/illustrator/02-ui-ux.md` / `10-observed-ui.md`. `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
+- **For UI work, look at the result** (take `ui.screenshot`, read the PNG) and compare with the public documentation (`plan/illustrator/02-ui-ux.md` notes). `ui.screenshot` needs a presented frame: if it errors (screen locked), check the art with `ui.render` / `vectorcraft-cli run … --export x.png`, and cover panels with a headless egui frame test (see `panels/transparency.rs` tests).
 - **Performance:** `vectorcraft-cli perf` checks the budgets (render/pan/zoom, hit test, save/open, SVG, Pathfinder) on a synthetic 50k-path document; `vectorcraft-cli bench FILE` times one file. Run them before and after renderer, format or geometry changes, on an idle machine (the report warns when the load average makes timings noise).
 - MCP: `vectorcraft-cli mcp` (see `docs/mcp.md`).
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
@@ -53,5 +59,5 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 ## Roadmap
 `ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
 - When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
-- Grade by behaviour against `plan/illustrator/`, not by whether a menu item exists. Scores are self-assessed, so err low.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.

Cargo.lock

@@ -2283,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "9a7b000cca0783af26837fe2ebd9ddf1c42279463c085b97622ee1d2f444b89e"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -2294,7 +2294,6 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
  "png 0.18.1",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
@@ -2777,7 +2776,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4297,7 +4296,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "arboard",
  "block2 0.6.2",
@@ -4321,7 +4320,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-brush"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde",
@@ -4333,7 +4332,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cad"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4349,7 +4348,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cli"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "serde_json",
  "vectorcraft-color",
@@ -4365,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-color"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "kurbo 0.13.1",
  "moxcms",
@@ -4377,7 +4376,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-doc"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "jpeg-encoder",
@@ -4394,7 +4393,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-effects"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde_json",
@@ -4408,7 +4407,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-engine"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "flate2",
  "image",
@@ -4440,7 +4439,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-eps"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "flate2",
  "image",
@@ -4458,7 +4457,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-format"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4472,7 +4471,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-geom"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "kurbo 0.13.1",
  "proptest",
@@ -4484,7 +4483,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-mcp"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "log",
@@ -4503,7 +4502,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-metafile"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4517,7 +4516,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pathops"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "kurbo 0.13.1",
  "linesweeper",
@@ -4529,7 +4528,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pdf"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "aes",
  "flate2",
@@ -4558,7 +4557,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-plugins"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4572,7 +4571,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-render"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "flate2",
  "gif",
@@ -4597,7 +4596,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-svg"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "flate2",
  "image",
@@ -4621,7 +4620,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-testkit"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4638,7 +4637,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-text"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "harfrust 0.13.3",
  "kurbo 0.13.1",
@@ -4656,7 +4655,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-tools"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4671,7 +4670,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-trace"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4684,7 +4683,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "egui",
  "egui_extras",
@@ -4713,7 +4712,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-web"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "eframe",
  "egui",
@@ -5816,7 +5815,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.6.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

README.md

@@ -54,6 +54,7 @@
   <a href="#why-vectorcraft">Why VectorCraft</a> ·
   <a href="#quick-start">Quick start</a> ·
   <a href="#status">Status</a> ·
+  <a href="#downloads">Downloads</a> ·
   <a href="#the-crafting-apps">The Crafting Apps</a> ·
   <a href="#license-and-credits">License</a>
 </p>
@@ -162,9 +163,11 @@ Japanese fonts come from [storytold/craft-fonts](https://github.com/storytold/cr
 build input (releases always use it): `CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo run --release -p vectorcraft` (an absolute path).
 Without it, Japanese text uses the installed system fonts. See [`docs/development.md`](docs/development.md#fonts-craft-fonts-optional-build-input).
 
-On laptops with two graphics processors, VectorCraft uses the power-saving (integrated) one by default.
-To use the discrete one, choose **Preferences › Performance › Graphics Processor › High Performance**
-and restart, or start the app with `WGPU_POWER_PREF=high` (see [`docs/development.md`](docs/development.md#desktop-graphics-processor)).
+On machines with two graphics processors, VectorCraft renders on the power-saving (integrated) one by default on
+Windows and macOS, and on the one the desktop runs on under Linux. To choose, use **Preferences › Performance ›
+Graphics Processor** and restart. If a graphics processor can't show the window, VectorCraft starts again on the
+next one. To pick one when starting the app, set `WGPU_POWER_PREF=high` (or `low`), or `WGPU_ADAPTER_NAME` to part of
+its name, such as `WGPU_ADAPTER_NAME=nvidia` (see [`docs/development.md`](docs/development.md#desktop-graphics-processor)).
 
 On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
 respond to it yet (#491). Start the app under XWayland instead: `WAYLAND_DISPLAY= vectorcraft` (see
@@ -191,7 +194,7 @@ milestones, and honest time-to-parity estimates.
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
-speaks English, Japanese, Traditional and Simplified Chinese and Spanish (and Czech and Brazilian Portuguese in the menus).
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish and Italian (and Czech and Brazilian Portuguese in the menus).
 The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 
@@ -216,6 +219,51 @@ Agent and contributor rules (clean-room, the asset policy, no panics in shipped
 explains how VectorCraft avoids crashing, and [`docs/releasing.md`](docs/releasing.md) how releases are built,
 signed and published. Every bundled asset is listed with its licence in [`ASSETS.md`](ASSETS.md).
 
+## Downloads
+
+**New to VectorCraft?** Download it from the [VectorCraft page on getartcraft.com](https://getartcraft.com/apps/vectorcraft). That's the easiest way to install it.
+
+**Want a specific build or format?** On GitHub, the [latest release](https://github.com/storytold/vectorcraft/releases/latest) has every build listed below, and [all releases](https://github.com/storytold/vectorcraft/releases) has earlier versions and their notes. `<ver>` in the file names is the version number, and `SHA256SUMS.txt` lists a checksum for every file.
+
+### Windows
+
+| Build | Installer | Portable |
+|---|---|---|
+| x64 (64-bit Intel/AMD) | `vectorcraft-<ver>-windows-x64.msi` | `vectorcraft-<ver>-windows-x64-portable.zip` |
+| arm64 (Snapdragon and other ARM PCs) | `vectorcraft-<ver>-windows-arm64.msi` | `vectorcraft-<ver>-windows-arm64-portable.zip` |
+| x86 (32-bit) | `vectorcraft-<ver>-windows-x86.msi` | `vectorcraft-<ver>-windows-x86-portable.zip` |
+
+Installers and executables are code-signed.
+
+### macOS
+
+| Build | File | Notes |
+|---|---|---|
+| App, universal (Apple silicon + Intel) | `vectorcraft-<ver>-macos-universal.dmg` | Signed and notarized |
+| Command-line tool, universal | `vectorcraft-cli-<ver>-macos-universal.zip` | Signed and notarized |
+
+### Linux
+
+| Format | x86_64 | aarch64 (ARM64) | Notes |
+|---|---|---|---|
+| AppImage | `vectorcraft-<ver>-linux-x86_64.AppImage` | `vectorcraft-<ver>-linux-aarch64.AppImage` | Runs anywhere; updates itself with [AppImageUpdate](https://github.com/AppImageCommunity/AppImageUpdate) (`.zsync` files) |
+| Flatpak | `vectorcraft-<ver>-linux-x86_64.flatpak` | `vectorcraft-<ver>-linux-aarch64.flatpak` | Sandboxed; `flatpak install --user <file>` |
+| Debian/Ubuntu | `vectorcraft-<ver>-linux-x86_64.deb` | `vectorcraft-<ver>-linux-aarch64.deb` | |
+| Fedora/RHEL/openSUSE | `vectorcraft-<ver>-linux-x86_64.rpm` | `vectorcraft-<ver>-linux-aarch64.rpm` | |
+| Tarball | `vectorcraft-<ver>-linux-x86_64.tar.gz` | `vectorcraft-<ver>-linux-aarch64.tar.gz` | Unpack anywhere |
+
+### FreeBSD
+
+| Build | File |
+|---|---|
+| x86_64 | `vectorcraft-<ver>-freebsd-x86_64.tar.gz` |
+
+### Web (WebAssembly)
+
+| Build | File | Notes |
+|---|---|---|
+| Static site | `vectorcraft-web-<ver>.zip` | Runs in a modern browser; host it on any static server |
+
 ## The Crafting Apps
 
 VectorCraft is one of the **Crafting Apps**: free, open-source creative tools from the

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS files from Illustrator 2026, Inkscape/cairo, matplotlib, CorelDRAW, Affinity, LibreOffice and Ghostscript opening as vectors, and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485); see [Honest assessment](#honest-assessment-2026-10-05))._
+_Last updated: 2026-10-09 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG window (#493), panels, panel groups and the Tools panel undocking into flLine truncated
 
 ## Where we are
 
@@ -42,7 +42,7 @@ since 2026-10-01.
 | **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
 | **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
 | **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
-| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); hybrid-graphics laptops render on the power-saving GPU by default (#306); web drops land in the document they were dropped on (#359); desktop drops carry no pointer position (winit 0.30), so a dropped document opens as a tab of its own and a picture or text is placed in the middle of the view, while the web places anything dropped on the canvas and opens what is dropped off it, as Illustrator does (#472); a web page that loses its WebGPU device or WebGL context restarts its graphics with the same documents (#369); on Linux/Wayland the clipboard reads the compositor's own (data-control) and copied image files paste, but files can't be dropped on the window under Wayland until eframe moves to winit 0.31 (#398; the Wayland side is verified by compilation only); on KDE Plasma 6.3+ under Wayland, pens and pen displays reach the app only under XWayland (`WAYLAND_DISPLAY=`) or with KWin's `KWIN_WAYLAND_EMULATE_TABLET=1`, since winit 0.30 has no Wayland tablet input (#491, not verified on hardware); Windows/Linux packaging and accessibility are pending; an experimental, unsupported Windows 7 x64 OpenGL build exists (community-contributed, not verified by maintainers) |
+| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); on macOS the menus are in the system menu bar, laid out as a Mac app's, with the in-window menus as a fallback (`--in-window-menus`; verified on Windows and by cross-compilation, not yet by hand on a Mac); hybrid-graphics laptops render on the power-saving GPU by default on Windows and macOS (#306), and Linux on the GPU the desktop runs on, since a Wayland compositor may refuse frames from the other one; a window that fails on its GPU while starting up starts again on the next one instead of crashing (#502; the dual-GPU Wayland case is verified by unit tests and cross-compilation, not on such hardware); web drops land in the document they were dropped on (#359); desktop drops carry no pointer position (winit 0.30), so a dropped document opens as a tab of its own and a picture or text is placed in the middle of the view, while the web places anything dropped on the canvas and opens what is dropped off it, as Illustrator does (#472); a web page that loses its WebGPU device or WebGL context restarts its graphics with the same documents (#369); on Linux/Wayland the clipboard reads the compositor's own (data-control) and copied image files paste, but files can't be dropped on the window under Wayland until eframe moves to winit 0.31 (#398; the Wayland side is verified by compilation only); on Linux the Paste menu checks the system clipboard on a background thread, so a clipboard owner that never answers no longer freezes the window, while Windows and macOS keep their quick in-line check (#510; the X11 hang verified by the contributor, here by headless tests); on KDE Plasma 6.3+ under Wayland, pens and pen displays reach the app only under XWayland (`WAYLAND_DISPLAY=`) or with KWin's `KWIN_WAYLAND_EMULATE_TABLET=1`, since winit 0.30 has no Wayland tablet input (#491, not verified on hardware); Windows/Linux packaging and accessibility are pending; an experimental, unsupported Windows 7 x64 OpenGL build exists (community-contributed, not verified by maintainers) |
 | **Agent automation** | beyond Illustrator | Every command, gesture and dialog is drivable over MCP, the CLI and the control channel |
 | **Scrubby numeric fields** | beyond Illustrator | As in Photoshop, dragging a numeric field's label (`W:`, `Opacity:`, the Character panel's icons) left or right steps its value live; one undo step per drag, Escape cancels (#400) |
 
@@ -97,20 +97,23 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **UI:** Illustrator 2026 layout restyled to measured values:
   - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
   - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
+  - The contextual task bar's handle drags it anywhere on the canvas (kept whole on it as the window resizes); unpinned it keeps that offset as it follows the selection, and its More Options menu hides it, pins its position across selection changes (`window.taskBar.pin`), resets it under the selection (`window.taskBar.reset`) and shows the Properties panel. As in Illustrator the position isn't kept across launches. Not done: the bar's tool-specific variants (only the selection tools show it).
   - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
+  - Panels undock (#495): a dock tab, a panel icon or a popped-out panel's title dragged out of the dock floats that panel inside the window, and the strip right of the dock's tabs floats the whole tabbed group. A floating group moves by its title bar, a tab dragged out of it floats on its own, and dropped on another group's title bar or tabs it stacks with that group; dropped on the dock, which lights up under the pointer, its panels go back where they live (the tabbed group or the icon column), as its × and the panel menus' Float Panel / Dock Panel do (`window.panel.float`, `window.panel.dock`). The Tools panel floats by its title bar and docks again on the window's left edge. Floating panels and the Tools panel's position are kept with the preferences and in user workspaces, and clamped into a smaller window. Not done: panels in separate OS windows, docking a panel into a dock group it doesn't belong to, reordering tabs by dragging, collapsing a floating group to icons, resizing floating panels.
   - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
-  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese and Spanish ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish and Italian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
   - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool.
-  - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats.
+  - The macOS menu bar is built from the in-window menus (one model, `native_menu`) and laid out as a Mac app's: the VectorCraft menu holds About, Settings ▸ (each Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays Hide Edges), Hide Others, Show All and Quit; Window gains Minimize ⌃⌘M, Zoom and Bring All to Front, and Help the system's search field. Its key equivalents go back to egui as key presses, so user shortcuts, focused text fields and the Type tool's input method behave as in the window, and nothing fires twice; enabled, check marks and labels update in place. `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps the menus in the window; `ui.inspect` reports `nativeMenuBar`.
+  - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats. The DMG opens on a designed Finder window, VectorCraft.app beside the `Applications` link over a background with the app icon (#493).
   - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
   - Save / Don't Save / Cancel before closing or quitting with unsaved documents (tabs, Close, Close All, Quit, window close).
   - Four brightness themes, persistent preferences.
-  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 35 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Construction and Spacing Guides, performance, devices…).
+  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. Then General › Show The Home Screen When No Documents Are Open (off, closing the last document leaves an empty window; the Home button still opens the screen). Then Units › Numbers Without Units Are Points (on by default: a number typed with no unit into a field in picas is read in points, a typed unit still wins; dimmed unless a unit is Picas). Then User Interface › Auto-Collapse Iconic Panels (off by default: on, a click away from a panel popped out of the icon column puts it away). They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 32 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Construction and Spacing Guides, performance, devices…).
   - Dialogs move by dragging their heading (the band down from the top edge, as a title bar), stay on screen and keep where they were moved for the session; the form dialogs' choices are dropdowns (Offset Path's Joins, Average's and Shear's and Reflect's axis), and Offset Path lists Offset, Joins, Miter Limit and previews (#423).
   - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…). Number fields in panels, the Control bar and dialogs (preferences too) step with Up/Down, or with the mouse wheel over the focused field (#485: a notch a step; the panel under it then stays put, and an unfocused field leaves the wheel to scrolling) (Shift: ten, Ctrl/Cmd: a tenth of their unit), applied at once.
   - Scrubby labels (#400, beyond Illustrator, as in Photoshop): dragging a numeric field's label left or right (the ↔ cursor shows over it) steps the value one unit every 2 points (Shift: ten, Ctrl/Cmd: a tenth; counts stay whole), in the field's unit and within its limits, applied live as the art follows; the whole drag is one undo step and Escape puts the value back. A click on the label focuses the field; the text box itself never scrubs, and a field with no label doesn't. Text labels before a field (Transform, Properties, Control bar, Stroke, Transparency, form rows in dialogs) and the Character and Paragraph panels' icons act as labels. Preferences › General › Scrub Numeric Fields by Dragging (on by default) turns it off.
   - Tab shows and hides the panels (in the Type tool it types a tab) without moving the keyboard focus onto a field, so the next shortcut or letter still works; in dialogs and panel fields it moves between fields.
-  - Cmd/Ctrl+A follows the keyboard: in a panel, dialog or search field it selects the field's text, while the Type tool edits it selects all of that text (also `select.all` over MCP), and only otherwise every object. On macOS the menu bar's Select All, Cut, Copy and Paste (keys or clicks) act on a focused field too. Not yet: Select All across threaded frames (one frame's text is selected).
+  - Cmd/Ctrl+A follows the keyboard: in a panel, dialog or search field it selects the field's text, while the Type tool edits it selects all of that text (also `select.all` over MCP), and only otherwise every object. On macOS the menu bar's Select All, Cut, Copy and Paste (keys or clicks) act on a focused field too, and elsewhere the in-window menus' do: the field that had the keyboard when the menu opened gets them, with its selection, and the keyboard back (#516). Not yet: Select All across threaded frames (one frame's text is selected).
   - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content. As on a native menu bar, once one menu is open, moving the pointer onto another title opens that one.
 - **Tools:**
   - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso. A Shift-drag marquee toggles what it reaches: objects with the Selection tool, anchors with Direct and Group Selection (#483); the Lasso adds with Shift and subtracts with Alt. Dragging a path segment with Direct Selection bends it when it's curved (its anchors stay) and moves its two anchors when it's straight, one undo step; the fill, Shift or Alt still pick the whole path (Alt-drag copies it).
@@ -120,7 +123,8 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - **Cutting:** Eraser, Scissors, Knife, Mirror & Cut, Line Cut and Rectangle Cut (real geometry, compound paths keep their holes).
   - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres; Alt-click opens the tool's dialog, and a drag with Alt down at the release, from the press or pressed mid-drag, transforms a copy), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
   - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout; with Direct Selection, select corner anchors to show and round just those corners (#381). Each corner keeps its own radius and kind (Round, Inverted Round, Chamfer): Alt-click a widget to cycle the kind, double-click it for the Corners dialog, and the Properties and Transform radius fields set the selected corners (`object.setLiveShape {corners, radius, kind}`). Corners stay circular when the rectangle is scaled unevenly or along its own sides when rotated (the radius keeps its size, or scales by the mean scale with Scale Corners on); only a shear distorts them. On a rectangle that isn't square every corner is the same circle: a radius past half the shorter side stops there for all of them, the widgets sit on the corners as drawn and turn the edited corners red at that limit, CSS export writes the drawn radii, and rectangles saved stretched by older versions get circular corners when their corners are next set (#442).
-  - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles; drawing then goes on.
+  - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. A press on the first anchor of the path being drawn closes it whatever the drag then does: the drag shapes the closing curve (symmetric handles, Alt breaks them) and the release closes the path wherever it ends (#501). Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles, dragging a segment reshapes it; drawing then goes on. Cmd (Ctrl) held drags with the selection tool chosen last, Direct Selection until one is (handles, anchors and segments of the path being drawn or another), and the Pen then goes on drawing its path while that stays selected; the pointer shows that tool's while Cmd is held. The same holds for agents (`pointer_gesture` with `mods.cmd`), as the borrowing now lives in the engine (#494).
+  - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path).
   - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
   - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446), Measure, Type, Hand, Zoom, Rotate View.
   - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
@@ -134,7 +138,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
 - **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
-- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese and Spanish (neutral international Spanish, for every `es-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish also translates status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech and Spanish ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline; Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale) and Italian (every `it-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish and Italian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish and Italian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline; Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
 - **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
@@ -151,11 +155,11 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
 - **Files (M4):**
   - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
-  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs Illustrator's AGM/CoolType prologs (resource categories, `resourceforall`, `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters, `cshow`, metadata skipped with `flushfile`), so Illustrator 30 EPS files open as vectors. It also runs what other generators write (Discord feedback, #466, #469): Illustrator 2026's procsets (`gcheck`, `rootfont`, `currentcolorrendering`: every Illustrator 2026 EPS fell back to its preview before), cairo/Inkscape (`status`/`flushfile`, images with a mask, `ImageType 3`, reusable streams), matplotlib's Type 3 fonts, Illustrator 8 EPS (stock art's usual format: executable strings such as its gradients' `ed`, `load` by integer keys, #474), Ghostscript's `//name` immediate names, `pdfmark`, `token`, `execform` and user paths. Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
-  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
+  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
-- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so the desktop app asks for the power-saving GPU by default (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306). Preferences › Performance › Graphics Processor (`gpuPreference`) or `WGPU_POWER_PREF` picks the discrete one; Help › About and `ui.inspect` name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
+- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so any GPU that can show the window will do. Preferences › Performance › Graphics Processor (`gpuPreference`) is Automatic by default: the power-saving GPU on Windows and macOS (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306), and the GPU the desktop runs on under Linux, where KWin on an NVIDIA GPU refused frames from a Ryzen's integrated GPU and 0.5.0 crashed at startup (#502). Power Saving and High Performance pick a kind of GPU; `WGPU_POWER_PREF`, `WGPU_ADAPTER_NAME` and `WGPU_BACKEND` override them. The app picks among the adapters that can present to the window (native backends before OpenGL, hardware before software), and if the window fails on one while starting up it starts again without it instead of crashing; Help › About, `ui.inspect` and the log name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).
 
 ## Milestones and estimates
@@ -211,11 +215,11 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard presets/rearrange polish (Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
 | View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
 | Guides, grids, smart guides, snapping, rulers | 3 | 82% | global/video rulers, smart-guide preference depth, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451) | 3–5 |
-| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files (Illustrator 2026 and Inkscape files open as vectors; CorelDRAW, Affinity, LibreOffice, matplotlib and Ghostscript output checked with synthetic programs only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
+| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
-| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 35 Preferences options stored but not yet acted on (#394: Construction and Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 32 Preferences options stored but not yet acted on (#394: Construction and Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
 | Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done | 5–8 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
@@ -235,7 +239,7 @@ lossless SVG/PDF export of live effects with SVG filters, a documented JSON form
 command, gesture and dialog drivable by agents (MCP, CLI, control channel).
 
 ## Out of scope (by design or by law)
-- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Art off the page that a PDF does draw opens on the pasteboard.
+- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 - **Adobe cloud services** (Libraries sync, Adobe Fonts, Firefly/generative): these are pluggable provider APIs, not built in.
 - **Adobe's bundled assets** (swatch/brush/symbol libraries, presets, icons): ours are original.
 

apps/vectorcraft-cli/src/perf.rs

@@ -70,6 +70,49 @@ fn load_average() -> Option<f64> {
     text.split_whitespace().map(|t| t.trim_matches(|c| c == '{' || c == '}')).find_map(|t| t.parse().ok())
 }
 
+/// Milliseconds per pointer move of a Direct Selection drag of a handle, then of a segment, of a
+/// 5,000-anchor wave of smooth anchors added on top of the synthetic `n`-path document.
+fn edit_drags(n: usize) -> Result<(f64, f64), String> {
+    use vectorcraft_engine::tools::{Mods, PointerEvent, PointerKind};
+    use vectorcraft_geom::{Anchor, PathData, SubPath, Vec2};
+    let mut doc = synthetic(n)?;
+    let l = doc.layers.first().map(|l| l.id);
+    let id = doc.alloc_id();
+    // Anchors 2 pt apart, up and down by 20 pt, their handles 0.6 pt long.
+    let anchor = |i: usize| {
+        let p = Point::new(i as f64 * 2.0, if i.is_multiple_of(2) { 500.0 } else { 520.0 });
+        Anchor::smooth(p, p + Vec2::new(0.6, 0.0))
+    };
+    let path = PathData::single(SubPath::new((0..5000).map(anchor).collect(), false));
+    doc.insert(l, usize::MAX, Node::path(id, path, Appearance::default_art())).map_err(|e| e.to_string())?;
+    let mut s = vectorcraft_engine::Session::new();
+    s.add_document(doc, None);
+    let view = vectorcraft_engine::ViewInfo { zoom: 8.0, ..Default::default() };
+    let err = |e: vectorcraft_engine::EngineError| e.to_string();
+    let mut drag = |down: Point| -> Result<f64, String> {
+        let ev = |kind, y: f64| PointerEvent { kind, pos: down + Vec2::new(0.0, y), mods: Mods::default(), pressure: 1.0 };
+        s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 400]]})).map_err(err)?;
+        s.select_tool("directSelection", view).map_err(err)?;
+        let undo = s.doc().map_err(err)?.history.undo.len();
+        s.pointer(&ev(PointerKind::Down, 0.0), view).map_err(err)?;
+        let mut y = 0.0;
+        let ms = median_ms(9, || {
+            y += 3.0;
+            // A failed move shows as the missing undo step below.
+            let _ = s.pointer(&ev(PointerKind::Drag, y), view);
+        });
+        s.pointer(&ev(PointerKind::Up, y), view).map_err(err)?;
+        if s.doc().map_err(err)?.history.undo.len() != undo + 1 {
+            return Err(format!("the drag from {down:?} made no undo step"));
+        }
+        Ok(ms)
+    };
+    // Anchor 400 is at (800, 500): its outgoing handle's end, then its segment to anchor 401.
+    let handle = drag(Point::new(800.6, 500.0))?;
+    let segment = drag(Point::new(801.0, 510.0))?;
+    Ok((handle, segment))
+}
+
 pub fn run(args: &[String]) -> Result<(), String> {
     let mut n = 50_000usize;
     let mut it = args.iter();
@@ -145,6 +188,15 @@ pub fn run(args: &[String]) -> Result<(), String> {
         }
     });
     rows.push(("Pathfinder Unite, 1,000 paths", unite, 150.0));
+
+    // Path editing: one pointer move of a Direct Selection drag (the tool event and the preview it
+    // applies), on a 5,000-anchor path among the synthetic paths.
+    let (handle, segment) = edit_drags(n).unwrap_or_else(|e| {
+        failed = Some(e);
+        (0.0, 0.0)
+    });
+    rows.push(("handle drag, 5,000-anchor path (per move)", handle, 8.0));
+    rows.push(("segment drag, 5,000-anchor path (per move)", segment, 8.0));
     if let Some(e) = failed {
         return Err(e);
     }

apps/vectorcraft/Cargo.toml

@@ -37,9 +37,11 @@ winit = { version = "0.30", default-features = false }
 clipboard-win = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
-muda = { version = "0.21", default-features = false }
+# The macOS menu bar (src/mac_menu.rs): Tauri's menu crate, AppKit menus behind a safe API (no GTK
+# with default features off). Pinned exactly: review the diff before bumping.
+muda = { version = "=0.21.1", default-features = false }
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
 # Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
 objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
 block2 = "0.6"

apps/vectorcraft/src/gpu.rs

@@ -0,0 +1,470 @@
+//! Which graphics adapter the window renders with (#306, #502), and what happens when it can't
+//! show the window.
+//!
+//! The canvas is rasterized on the CPU; the GPU only composites it and draws the UI, so any
+//! adapter that can present to the window will do. [`adapter_order`] ranks the adapters: those that
+//! can't present to the window's surface never, then the one `WGPU_ADAPTER_NAME` names, hardware
+//! before software, the native backends (Vulkan, Metal, DX12) before OpenGL, and the power
+//! preference ([`power_preference`]) among the rest. eframe is handed [`selector`], which takes
+//! the first of that order.
+//!
+//! An adapter can report that it presents to the window and still fail once it does: on a hybrid
+//! Linux desktop under Wayland, the compositor runs on one GPU and may refuse the frame buffers
+//! another GPU allocates, which kills the window's Wayland connection; egui-wgpu then panics while
+//! configuring the surface (#502). Nothing in the process can show a window after that, so when
+//! the graphics fail while the window is starting up, [`finish`] starts the app again without
+//! that adapter, as the next one in the order would be tried. Each restart leaves out one more
+//! adapter, so it ends when none is left.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, OnceLock};
+
+use eframe::egui_wgpu::NativeAdapterSelectorMethod;
+use eframe::wgpu::{self, Backend, DeviceType, PowerPreference};
+
+/// The adapters a restart leaves out, those the window failed on, as comma-separated
+/// `backend:vendor:device` keys (`Vulkan:1002:164e`). Set by the app itself when it starts again.
+pub const SKIP_ENV: &str = "VECTORCRAFT_GPU_SKIP";
+
+/// wgpu's variable for choosing an adapter by (part of) its name, any case.
+const NAME_ENV: &str = "WGPU_ADAPTER_NAME";
+
+/// Where to read how to choose another adapter, for the error that ends the app.
+const HELP: &str =
+    "to choose a graphics adapter, see https://github.com/storytold/vectorcraft/blob/main/docs/development.md#desktop-graphics-processor";
+
+/// Frames the UI ran before the failure, below which it was still starting up. The failure in
+/// #502 came on the first or second frame; later, the adapter has proved itself, and a lost
+/// window is something else (such as the compositor restarting).
+const STARTUP_FRAMES: u64 = 10;
+
+/// The preference used when Preferences say Automatic. Windows and macOS show frames from any GPU
+/// (the integrated one avoids the flicker of #306). Elsewhere, the system's own order: Mesa's
+/// device-select layer puts the GPU the desktop runs on first (the integrated one on hybrid
+/// laptops), and a Wayland compositor may not show frames from another GPU (#502).
+pub const AUTOMATIC: PowerPreference = if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None };
+
+/// The power preference that orders the adapters: the `WGPU_POWER_PREF` environment variable
+/// (`low`, `high`, `none`) when set, otherwise Preferences › Performance › Graphics Processor
+/// (`gpuPreference`). Automatic, and any value this version doesn't know (0.5.0's default
+/// `powerSaving`, a newer or damaged preference file), is [`AUTOMATIC`].
+pub fn power_preference(pref: Option<&str>, env: Option<PowerPreference>) -> PowerPreference {
+    match (env, pref) {
+        (Some(p), _) => p,
+        (None, Some("highPerformance")) => PowerPreference::HighPerformance,
+        (None, Some("lowPower")) => PowerPreference::LowPower,
+        (None, _) => AUTOMATIC,
+    }
+}
+
+/// One adapter, as [`adapter_order`] sees it.
+#[derive(Clone, Debug)]
+pub struct Candidate {
+    /// Identifies the adapter across a restart: `backend:vendor:device` ([`key`]).
+    pub key: String,
+    pub name: String,
+    pub backend: Backend,
+    pub device_type: DeviceType,
+    /// Reports that it can present to the window's surface.
+    pub presents: bool,
+}
+
+impl Candidate {
+    fn new(adapter: &wgpu::Adapter, surface: Option<&wgpu::Surface<'_>>) -> Self {
+        let info = adapter.get_info();
+        Self {
+            key: key(info.backend, info.vendor, info.device),
+            presents: surface.is_none_or(|s| adapter.is_surface_supported(s)),
+            name: info.name,
+            backend: info.backend,
+            device_type: info.device_type,
+        }
+    }
+}
+
+/// `backend:vendor:device`, e.g. `Vulkan:1002:164e` (PCI ids, as `MESA_VK_DEVICE_SELECT` takes them).
+fn key(backend: Backend, vendor: u32, device: u32) -> String {
+    format!("{backend:?}:{vendor:04x}:{device:04x}")
+}
+
+/// The order to try `candidates` in (their indices): only those that present to the window and
+/// aren't in `skip`; the one whose name contains `named` (any case) first; hardware before
+/// software; native backends before OpenGL; then by `power`, keeping the system's order among
+/// equals (all of it for [`PowerPreference::None`]).
+pub fn adapter_order(candidates: &[Candidate], power: PowerPreference, named: Option<&str>, skip: &[String]) -> Vec<usize> {
+    let named = named.map(str::to_lowercase).filter(|n| !n.is_empty());
+    let mut order: Vec<(usize, &Candidate)> = candidates.iter().enumerate().filter(|(_, c)| c.presents && !skip.contains(&c.key)).collect();
+    // Stable, so equals keep the system's order.
+    order.sort_by_key(|(_, c)| {
+        let unnamed = named.as_ref().is_some_and(|n| !c.name.to_lowercase().contains(n));
+        (unnamed, c.device_type == DeviceType::Cpu, c.backend == Backend::Gl, power_rank(c.device_type, power))
+    });
+    order.into_iter().map(|(i, _)| i).collect()
+}
+
+/// wgpu's own ranking for a power preference: the preferred kind of GPU, the other kind, unknown,
+/// virtual, software.
+fn power_rank(t: DeviceType, power: PowerPreference) -> u8 {
+    match (power, t) {
+        (PowerPreference::None, _) => 0,
+        (PowerPreference::LowPower, DeviceType::IntegratedGpu) | (PowerPreference::HighPerformance, DeviceType::DiscreteGpu) => 0,
+        (_, DeviceType::IntegratedGpu | DeviceType::DiscreteGpu) => 1,
+        (_, DeviceType::Other) => 2,
+        (_, DeviceType::VirtualGpu) => 3,
+        (_, DeviceType::Cpu) => 4,
+    }
+}
+
+/// The adapters [`SKIP_ENV`] lists.
+pub fn skipped() -> Vec<String> {
+    std::env::var(SKIP_ENV).map(|v| parse_skip(&v)).unwrap_or_default()
+}
+
+fn parse_skip(v: &str) -> Vec<String> {
+    v.split(',').map(str::trim).filter(|k| !k.is_empty()).map(String::from).collect()
+}
+
+/// What the window's start-up leaves for [`finish`].
+#[derive(Default)]
+pub struct Startup {
+    /// The key of the adapter [`selector`] picked.
+    adapter: OnceLock<String>,
+    /// The UI's context, which counts the frames run.
+    ui: OnceLock<egui::Context>,
+}
+
+impl Startup {
+    /// The app was created on `ctx`.
+    pub fn created(&self, ctx: &egui::Context) {
+        // Set once; the window is created once.
+        let _ = self.ui.set(ctx.clone());
+    }
+}
+
+/// eframe's adapter choice: the first of [`adapter_order`] for `power`, `WGPU_ADAPTER_NAME` and the
+/// adapters a restart left out. Every adapter and the choice are logged, for bug reports.
+pub fn selector(power: PowerPreference, startup: Arc<Startup>) -> NativeAdapterSelectorMethod {
+    let named = std::env::var(NAME_ENV).ok();
+    let skip = skipped();
+    Arc::new(move |adapters, surface| {
+        let candidates: Vec<Candidate> = adapters.iter().map(|a| Candidate::new(a, surface)).collect();
+        let order = adapter_order(&candidates, power, named.as_deref(), &skip);
+        let listed: Vec<String> = candidates
+            .iter()
+            .map(|c| {
+                let note = if !c.presents {
+                    ", can't show the window"
+                } else if skip.contains(&c.key) {
+                    ", failed before"
+                } else {
+                    ""
+                };
+                format!("{} ({:?}, {:?}, {}{note})", c.name.trim(), c.backend, c.device_type, c.key)
+            })
+            .collect();
+        log::info!("graphics adapters: {}", listed.join("; "));
+        let first = order.first().and_then(|&i| adapters.get(i).zip(candidates.get(i)));
+        let Some((adapter, chosen)) = first else {
+            return Err(format!("no graphics adapter can show the window (power preference {power:?}, {} adapters)", adapters.len()));
+        };
+        // Set once; eframe picks the adapter once.
+        let _ = startup.adapter.set(chosen.key.clone());
+        Ok(adapter.clone())
+    })
+}
+
+/// The last panic came from the graphics stack (see [`watch_panics`]).
+static GRAPHICS_PANIC: AtomicBool = AtomicBool::new(false);
+
+/// Note whether each panic comes from the graphics stack, so [`finish`] can tell a failing adapter
+/// from a bug. The default hook still prints it.
+pub fn watch_panics() {
+    let default = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        GRAPHICS_PANIC.store(info.location().is_some_and(|l| in_graphics_stack(l.file())), Ordering::Relaxed);
+        default(info);
+    }));
+}
+
+/// A source file of wgpu (`wgpu-core-30.0.1/src/…`, `wgpu-hal-…`), egui-wgpu or naga.
+fn in_graphics_stack(file: &str) -> bool {
+    file.split(['/', '\\']).any(|dir| ["wgpu-", "egui-wgpu-", "naga-"].iter().any(|p| dir.starts_with(p)))
+}
+
+/// The adapter to start again without: the one picked, when the graphics failed while the window
+/// was starting up and it wasn't already left out.
+fn restart_without<'a>(graphics_failed: bool, frames: u64, picked: Option<&'a str>, skip: &[String]) -> Option<&'a str> {
+    picked.filter(|p| graphics_failed && frames < STARTUP_FRAMES && !skip.iter().any(|s| s == p))
+}
+
+/// After the window's run: `Ok` when it closed normally or the app started again (see the module
+/// docs), otherwise why it failed. `outcome` is eframe's result, or the message of a panic that
+/// ended it.
+pub fn finish(outcome: Result<eframe::Result, String>, startup: &Startup) -> Result<(), String> {
+    let (why, graphics_failed) = match outcome {
+        Ok(Ok(())) => return Ok(()),
+        Ok(Err(e @ eframe::Error::Wgpu(_))) => (e.to_string(), true),
+        Ok(Err(e)) => (e.to_string(), false),
+        Err(panic) => (panic, GRAPHICS_PANIC.load(Ordering::Relaxed)),
+    };
+    let frames = startup.ui.get().map_or(0, egui::Context::cumulative_frame_nr);
+    let mut skip = skipped();
+    let Some(failed) = restart_without(graphics_failed, frames, startup.adapter.get().map(String::as_str), &skip) else {
+        return Err(if graphics_failed { format!("{why} ({HELP})") } else { why });
+    };
+    log::error!("the window failed on graphics adapter {failed} ({why}): starting again without it");
+    skip.push(failed.to_string());
+    restart(&skip.join(",")).map_err(|e| format!("{why}; starting again failed: {e}"))
+}
+
+/// Start the app again with the same arguments, leaving out the adapters in `skip`. On Unix the
+/// new app replaces this process (same process id, so an AppImage keeps its files mounted), and
+/// this returns only on failure; on Windows it starts beside this one, which then exits.
+fn restart(skip: &str) -> std::io::Result<()> {
+    log::logger().flush();
+    let mut c = std::process::Command::new(std::env::current_exe()?);
+    c.args(std::env::args_os().skip(1)).env(SKIP_ENV, skip);
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt as _;
+        Err(c.exec())
+    }
+    #[cfg(not(unix))]
+    c.spawn().map(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn gpu(name: &str, backend: Backend, device_type: DeviceType) -> Candidate {
+        Candidate { key: format!("{backend:?}:{name}"), name: name.into(), backend, device_type, presents: true }
+    }
+
+    fn names(c: &[Candidate], order: &[usize]) -> Vec<String> {
+        order.iter().map(|&i| c[i].name.clone()).collect()
+    }
+
+    /// The machine of #502 as Vulkan lists it with Mesa's device-select layer: the GPU KDE's
+    /// compositor runs on (NVIDIA) first, then the Ryzen's integrated GPU, Mesa's software
+    /// renderer, and OpenGL.
+    fn issue_502() -> Vec<Candidate> {
+        vec![
+            gpu("NVIDIA GeForce RTX 5070", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("llvmpipe (LLVM 20.1.8, 256 bits)", Backend::Vulkan, DeviceType::Cpu),
+            gpu("NVIDIA GeForce RTX 5070/PCIe/SSE2", Backend::Gl, DeviceType::Other),
+        ]
+    }
+
+    #[test]
+    fn automatic_keeps_the_systems_order_on_linux_and_saves_power_elsewhere() {
+        let c = issue_502();
+        let order = adapter_order(&c, power_preference(None, None), None, &[]);
+        let first = &c[order[0]].name;
+        if cfg!(any(windows, target_os = "macos")) {
+            assert_eq!(first, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        } else {
+            // #502: the integrated GPU couldn't show frames to a compositor on the NVIDIA GPU.
+            assert_eq!(first, "NVIDIA GeForce RTX 5070");
+        }
+    }
+
+    #[test]
+    fn each_preference_orders_the_adapters_then_falls_back_to_opengl_and_software() {
+        let c = issue_502();
+        let order = |power| names(&c, &adapter_order(&c, power, None, &[]));
+        assert_eq!(
+            order(PowerPreference::None),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::LowPower),
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+        assert_eq!(
+            order(PowerPreference::HighPerformance),
+            [
+                "NVIDIA GeForce RTX 5070",
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    /// A restart leaves out the adapter the window failed on, so Power Saving on the machine of
+    /// #502 ends up on the NVIDIA GPU, and once every adapter failed there is nothing to try.
+    #[test]
+    fn a_restart_tries_the_next_adapter() {
+        let c = issue_502();
+        let mut skip = vec![];
+        let mut tried = vec![];
+        while let Some(&i) = adapter_order(&c, PowerPreference::LowPower, None, &skip).first() {
+            tried.push(c[i].name.clone());
+            skip.push(c[i].key.clone());
+        }
+        assert_eq!(
+            tried,
+            [
+                "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)",
+                "NVIDIA GeForce RTX 5070",
+                "NVIDIA GeForce RTX 5070/PCIe/SSE2",
+                "llvmpipe (LLVM 20.1.8, 256 bits)"
+            ]
+        );
+    }
+
+    #[test]
+    fn adapters_that_cannot_present_to_the_window_are_never_tried() {
+        let mut c = issue_502();
+        c[0].presents = false;
+        c[3].presents = false;
+        for power in [PowerPreference::None, PowerPreference::LowPower, PowerPreference::HighPerformance] {
+            let order = adapter_order(&c, power, None, &[]);
+            assert!(!order.contains(&0) && !order.contains(&3), "{power:?}: {order:?}");
+            assert_eq!(order.len(), 2);
+        }
+        for p in &mut c {
+            p.presents = false;
+        }
+        assert!(adapter_order(&c, PowerPreference::None, None, &[]).is_empty());
+        assert!(adapter_order(&[], PowerPreference::HighPerformance, None, &[]).is_empty());
+    }
+
+    #[test]
+    fn wgpu_adapter_name_picks_an_adapter_first_and_the_rest_stay_as_fallbacks() {
+        let c = issue_502();
+        let order = adapter_order(&c, PowerPreference::HighPerformance, Some("radv"), &[]);
+        assert_eq!(c[order[0]].name, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
+        assert_eq!(order.len(), 4);
+        // Any case; every match comes before the rest, natively first.
+        let order = adapter_order(&c, PowerPreference::LowPower, Some("GeForce"), &[]);
+        assert_eq!(names(&c, &order[..2]), ["NVIDIA GeForce RTX 5070", "NVIDIA GeForce RTX 5070/PCIe/SSE2"]);
+        // An empty name or one nothing matches changes nothing.
+        for named in ["", "no such gpu"] {
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, Some(named), &[]), adapter_order(&c, PowerPreference::LowPower, None, &[]));
+        }
+        // A named adapter that failed is left out like any other.
+        let skip = vec![c[1].key.clone()];
+        assert_eq!(adapter_order(&c, PowerPreference::None, Some("radv"), &skip)[0], 0);
+    }
+
+    /// A Windows machine lists every GPU twice (Vulkan and DX12): power saving still takes the
+    /// integrated GPU first, as wgpu's own choice did (#306).
+    #[test]
+    fn hybrid_laptop_on_windows_renders_on_the_integrated_gpu_with_power_saving() {
+        let c = vec![
+            gpu("Intel(R) Arc(TM) A370M", Backend::Vulkan, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
+            gpu("Intel(R) Arc(TM) A370M", Backend::Dx12, DeviceType::DiscreteGpu),
+            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
+            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
+        ];
+        let order = adapter_order(&c, PowerPreference::LowPower, None, &[]);
+        assert_eq!(order, [1, 3, 0, 2, 4]);
+        assert_eq!(adapter_order(&c, PowerPreference::HighPerformance, None, &[]), [0, 2, 1, 3, 4]);
+    }
+
+    #[test]
+    fn power_preference_follows_the_environment_then_the_preference() {
+        assert_eq!(power_preference(None, None), AUTOMATIC);
+        assert_eq!(power_preference(Some("automatic"), None), AUTOMATIC);
+        assert_eq!(power_preference(Some("lowPower"), None), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("highPerformance"), None), PowerPreference::HighPerformance);
+        // 0.5.0's default, and values this version doesn't know (a newer or damaged file).
+        for old in ["powerSaving", "turbo", ""] {
+            assert_eq!(power_preference(Some(old), None), AUTOMATIC, "{old}");
+        }
+        // WGPU_POWER_PREF wins over the preference, either way.
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::HighPerformance)), PowerPreference::HighPerformance);
+        assert_eq!(power_preference(Some("highPerformance"), Some(PowerPreference::LowPower)), PowerPreference::LowPower);
+        assert_eq!(power_preference(Some("lowPower"), Some(PowerPreference::None)), PowerPreference::None);
+        assert_eq!(AUTOMATIC, if cfg!(any(windows, target_os = "macos")) { PowerPreference::LowPower } else { PowerPreference::None });
+    }
+
+    /// The preference the engine saves is the one the app reads back before the window opens.
+    #[test]
+    fn the_saved_engine_preference_is_found() {
+        let mut prefs = vectorcraft_engine::Prefs::default();
+        let saved = prefs.to_json();
+        assert_eq!(saved.get("gpuPreference").and_then(serde_json::Value::as_str), Some("automatic"));
+        for (value, power) in [("lowPower", PowerPreference::LowPower), ("highPerformance", PowerPreference::HighPerformance)] {
+            prefs.gpu_preference = value.into();
+            let saved = prefs.to_json();
+            assert_eq!(power_preference(saved.get("gpuPreference").and_then(serde_json::Value::as_str), None), power);
+        }
+        // Every choice Preferences offer means something here.
+        for (value, _) in vectorcraft_engine::cmd::prefscmds::GPU_PREFERENCES {
+            assert!(["automatic", "lowPower", "highPerformance"].contains(value), "{value}");
+        }
+    }
+
+    #[test]
+    fn skipped_adapters_parse_from_a_comma_separated_list() {
+        assert_eq!(parse_skip("Vulkan:1002:164e, Gl:10de:2f04,,"), ["Vulkan:1002:164e", "Gl:10de:2f04"]);
+        assert!(parse_skip("").is_empty());
+        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e), "Vulkan:1002:164e");
+        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04), "Gl:10de:2f04");
+    }
+
+    #[test]
+    fn panics_in_wgpu_egui_wgpu_and_naga_are_graphics_failures() {
+        for file in [
+            "/home/u/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/egui-wgpu-0.36.2/src/winit.rs",
+            r"C:\Users\u\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\wgpu-core-30.0.1\src\device\mod.rs",
+            "/rustc/deps/wgpu-hal-30.0.1/src/vulkan/adapter.rs",
+            "naga-30.0.0/src/back/spv/writer.rs",
+        ] {
+            assert!(in_graphics_stack(file), "{file}");
+        }
+        for file in [
+            "apps/vectorcraft/src/main.rs",
+            "/home/wgpu/vectorcraft/crates/ui-egui/src/lib.rs",
+            "egui-0.36.2/src/context.rs",
+            "winit-0.30.12/src/x.rs",
+        ] {
+            assert!(!in_graphics_stack(file), "{file}");
+        }
+    }
+
+    #[test]
+    fn only_a_graphics_failure_while_starting_up_restarts_without_the_adapter() {
+        let amd = Some("Vulkan:1002:164e");
+        assert_eq!(restart_without(true, 0, amd, &[]), amd);
+        assert_eq!(restart_without(true, STARTUP_FRAMES - 1, amd, &[]), amd);
+        // After start-up the adapter has shown frames; a lost window is something else.
+        assert_eq!(restart_without(true, STARTUP_FRAMES, amd, &[]), None);
+        // A bug outside the graphics, or no adapter picked: nothing another adapter would change.
+        assert_eq!(restart_without(false, 0, amd, &[]), None);
+        assert_eq!(restart_without(true, 0, None, &[]), None);
+        // Never the same adapter twice, so restarts end.
+        assert_eq!(restart_without(true, 0, amd, &["Vulkan:1002:164e".into()]), None);
+    }
+
+    #[test]
+    fn a_normal_exit_or_another_failure_does_not_restart() {
+        let startup = Startup::default();
+        assert_eq!(finish(Ok(Ok(())), &startup), Ok(()));
+        // No adapter was picked (none can show the window): the error is returned, nothing restarts.
+        let none =
+            eframe::Error::Wgpu(eframe::egui_wgpu::WgpuError::CustomNativeAdapterSelectionError("no graphics adapter can show the window".into()));
+        assert_eq!(
+            finish(Ok(Err(none)), &startup),
+            Err(format!("WGPU error: Adapter selection failed: no graphics adapter can show the window ({HELP})"))
+        );
+        let _ = startup.adapter.set("Vulkan:1002:164e".into());
+        GRAPHICS_PANIC.store(false, Ordering::Relaxed);
+        assert_eq!(finish(Err("a bug".into()), &startup), Err("a bug".into()));
+    }
+}

apps/vectorcraft/src/mac_menu.rs

@@ -0,0 +1,367 @@
+//! The macOS menu bar, through muda (Tauri's menu crate: AppKit menus behind a safe API, no GTK
+//! with default features off). The menus, their Mac layout and how their keys reach VectorCraft
+//! are in `vectorcraft_ui_egui::native_menu`; this file only builds and updates the `NSMenu`s.
+//!
+//! - Item ids are the items' places (`vc12`, depth first): one command can run from several items
+//!   (each language of VectorCraft › Language is `app.language` with its own code).
+//! - A structure change (a recent file added, the language or a shortcut changed) rebuilds the
+//!   menu; labels, enabled and checked are updated in place.
+//! - A chosen item is a click or a key equivalent: AppKit's current event says which. A key
+//!   equivalent goes back to egui as the key press that was made (the event's modifiers, not the
+//!   item's: AppKit may match ⌘R to a ⇧⌘R item), so VectorCraft's key rules still apply.
+//! - Hide and Hide Others are items of ours calling `NSApplication`: AppKit's own always take ⌘H
+//!   (View › Hide Edges) and ⌥⌘H.
+
+use std::sync::mpsc::{Receiver, channel};
+
+use egui::{Key, KeyboardShortcut};
+use muda::accelerator::{Accelerator, Code, Modifiers};
+use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use objc2::MainThreadMarker;
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType};
+use vectorcraft_ui_egui::VectorcraftApp;
+use vectorcraft_ui_egui::native_menu::{self, Backend, Event, MenuBar, MenuRole, Node, Standard};
+
+enum Handle {
+    Plain(MenuItem),
+    Check(CheckMenuItem),
+}
+
+/// One native item, in the order of [`MenuBar::items`].
+struct Entry {
+    handle: Handle,
+    item: native_menu::Item,
+    /// Its shortcut, when it is a key equivalent.
+    chord: Option<KeyboardShortcut>,
+}
+
+/// How an item was chosen, read from AppKit's current event while it calls the handler.
+struct Chosen {
+    id: String,
+    /// A key press (not a mouse click), and the modifiers held: ⌘, ⌃, ⌥, ⇧.
+    key: bool,
+    mods: [bool; 4],
+}
+
+pub struct MacMenu {
+    menu: Option<Menu>,
+    entries: Vec<Entry>,
+    rx: Receiver<Chosen>,
+    structure: u64,
+}
+
+impl MacMenu {
+    fn new(ctx: &egui::Context) -> MacMenu {
+        let (tx, rx) = channel();
+        let repaint = ctx.clone();
+        MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
+            // AppKit calls this on the main thread, from the event that chose the item: a key
+            // equivalent is a key-down, a click a mouse-up (or ↩ inside the open menu).
+            let event = MainThreadMarker::new().and_then(|mtm| NSApplication::sharedApplication(mtm).currentEvent());
+            let key = event.as_ref().is_some_and(|ev| ev.r#type() == NSEventType::KeyDown);
+            let flags = event.as_ref().map_or(NSEventModifierFlags::empty(), |ev| ev.modifierFlags());
+            let mods = [NSEventModifierFlags::Command, NSEventModifierFlags::Control, NSEventModifierFlags::Option, NSEventModifierFlags::Shift]
+                .map(|m| flags.contains(m));
+            // The receiver only goes away with the app.
+            let _ = tx.send(Chosen { id: e.id.0, key, mods });
+            // Wake egui, so the item runs now rather than on the next mouse move.
+            repaint.request_repaint();
+        }));
+        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0 }
+    }
+
+    /// Build the menus of `bar` and make them the app's, in place of the ones before.
+    fn build(&mut self, bar: &MenuBar) -> muda::Result<()> {
+        let mut entries = Vec::new();
+        let menu = Menu::new();
+        let mut special = Vec::new();
+        for m in &bar.menus {
+            let sub = Submenu::new(escape(&m.title), true);
+            append(&sub, &m.children, &mut entries)?;
+            menu.append(&sub)?;
+            if matches!(m.role, MenuRole::Window | MenuRole::Help) {
+                special.push((m.role, sub));
+            }
+        }
+        if let Some(old) = self.menu.take() {
+            old.remove_for_nsapp();
+        }
+        menu.init_for_nsapp();
+        // Only once the menu is the app's: muda looks the submenus up in the installed main menu.
+        for (role, sub) in special {
+            match role {
+                MenuRole::Window => sub.set_as_windows_menu_for_nsapp(),
+                _ => sub.set_as_help_menu_for_nsapp(),
+            }
+        }
+        self.menu = Some(menu);
+        self.entries = entries;
+        self.structure = native_menu::structure_key(bar);
+        Ok(())
+    }
+}
+
+fn append(sub: &Submenu, nodes: &[Node], entries: &mut Vec<Entry>) -> muda::Result<()> {
+    for n in nodes {
+        match n {
+            Node::Separator => sub.append(&PredefinedMenuItem::separator())?,
+            Node::Header(label) => sub.append(&MenuItem::new(escape(label), false, None))?,
+            Node::Submenu { label, children } => {
+                let s = Submenu::new(escape(label), !children.is_empty());
+                append(&s, children, entries)?;
+                sub.append(&s)?;
+            }
+            Node::Standard(item) => {
+                let text = Some(vectorcraft_ui_egui::i18n::t(item.label()));
+                let p = match item {
+                    Standard::Services => PredefinedMenuItem::services(text),
+                    Standard::ShowAll => PredefinedMenuItem::show_all(text),
+                    Standard::Zoom => PredefinedMenuItem::maximize(text),
+                    Standard::BringAllToFront => PredefinedMenuItem::bring_all_to_front(text),
+                };
+                sub.append(&p)?;
+            }
+            Node::Item(it) => {
+                let id = format!("vc{}", entries.len());
+                let chord = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok);
+                let accel = chord.as_ref().and_then(accelerator);
+                let handle = match it.checked {
+                    Some(c) => {
+                        let h = CheckMenuItem::with_id(id, escape(&it.label), it.enabled, c, accel);
+                        sub.append(&h)?;
+                        Handle::Check(h)
+                    }
+                    None => {
+                        let h = MenuItem::with_id(id, escape(&it.label), it.enabled, accel);
+                        sub.append(&h)?;
+                        Handle::Plain(h)
+                    }
+                };
+                entries.push(Entry { handle, item: it.clone(), chord });
+            }
+        }
+    }
+    Ok(())
+}
+
+impl Backend for MacMenu {
+    fn sync(&mut self, bar: &MenuBar) {
+        let items = bar.items();
+        if self.menu.is_none() || native_menu::structure_key(bar) != self.structure || items.len() != self.entries.len() {
+            if let Err(e) = self.build(bar) {
+                // The menus as they were stay up (a failed build changed nothing).
+                log::warn!("couldn't rebuild the macOS menu bar: {e}");
+            }
+            return;
+        }
+        for (e, it) in self.entries.iter_mut().zip(items) {
+            if e.item.label != it.label {
+                let text = escape(&it.label);
+                match &e.handle {
+                    Handle::Plain(h) => h.set_text(text),
+                    Handle::Check(h) => h.set_text(text),
+                }
+            }
+            if e.item.enabled != it.enabled {
+                match &e.handle {
+                    Handle::Plain(h) => h.set_enabled(it.enabled),
+                    Handle::Check(h) => h.set_enabled(it.enabled),
+                }
+            }
+            // Compare with AppKit's own state: muda toggles a check item when it's clicked.
+            if let (Handle::Check(h), Some(c)) = (&e.handle, it.checked)
+                && h.is_checked() != c
+            {
+                h.set_checked(c);
+            }
+            if e.item != *it {
+                e.item = it.clone();
+            }
+        }
+    }
+
+    fn drain(&mut self) -> Vec<Event> {
+        let mut out = Vec::new();
+        while let Ok(chosen) = self.rx.try_recv() {
+            // Ids that aren't ours are AppKit's own items (Services, Zoom…), already handled.
+            let Some(e) = chosen.id.strip_prefix("vc").and_then(|n| n.parse::<usize>().ok()).and_then(|i| self.entries.get(i)) else { continue };
+            if let Some(command @ (native_menu::HIDE | native_menu::HIDE_OTHERS)) = e.item.command {
+                if let Some(mtm) = MainThreadMarker::new() {
+                    let app = NSApplication::sharedApplication(mtm);
+                    if command == native_menu::HIDE { app.hide(None) } else { app.hideOtherApplications(None) }
+                }
+                continue;
+            }
+            // A key-down chose it: its key equivalent, unless it was ↩ or Space inside the open
+            // menu (no ⌘ or ⌃ while the item's shortcut has one). The key is the item's (AppKit
+            // matched on it); the modifiers are the ones held.
+            let [cmd, ctrl, alt, shift] = chosen.mods;
+            let key = e
+                .chord
+                .filter(|c| {
+                    chosen.key && e.item.command != Some(native_menu::MINIMIZE) && (cmd || ctrl || !(c.modifiers.command || c.modifiers.ctrl))
+                })
+                .map(|c| KeyboardShortcut::new(egui::Modifiers { alt, ctrl, shift, mac_cmd: cmd, command: cmd }, c.logical_key));
+            out.push(match key {
+                Some(k) => Event::Key(k),
+                None => Event::Click(e.item.clone()),
+            });
+        }
+        out
+    }
+}
+
+/// Install the menu bar (in eframe's creator closure, so winit's default menu doesn't stay up).
+/// `None` keeps the menus in the window: AppKit refused them (logged), never a crash.
+pub fn install(ctx: &egui::Context, app: &VectorcraftApp) -> Option<native_menu::NativeMenu> {
+    vectorcraft_ui_egui::i18n::set_current(app.ui_language());
+    let bar = native_menu::layout(app).bar;
+    let built = vectorcraft_engine::guard::catch_panic(|| {
+        let mut menu = MacMenu::new(ctx);
+        menu.build(&bar).map(|()| menu)
+    });
+    match built {
+        Ok(Ok(menu)) => Some(native_menu::NativeMenu::new(Box::new(menu))),
+        Ok(Err(e)) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+        Err(e) => {
+            log::warn!("couldn't install the macOS menu bar ({e}); the menus stay in the window");
+            None
+        }
+    }
+}
+
+/// `&` marks a mnemonic in muda labels: "Fill & Stroke" keeps its ampersand.
+fn escape(s: &str) -> String {
+    s.replace('&', "&&")
+}
+
+/// A key equivalent for AppKit. `Cmd` is ⌘ (`META`) and `Ctrl` is ⌃: never folded together.
+fn accelerator(c: &KeyboardShortcut) -> Option<Accelerator> {
+    let m = c.modifiers;
+    let mut mods = Modifiers::empty();
+    for (on, flag) in [(m.command || m.mac_cmd, Modifiers::META), (m.ctrl, Modifiers::CONTROL), (m.alt, Modifiers::ALT), (m.shift, Modifiers::SHIFT)]
+    {
+        if on {
+            mods |= flag;
+        }
+    }
+    Some(Accelerator::new(mods, code(c.logical_key)?))
+}
+
+/// The key code AppKit matches for an egui key.
+fn code(key: Key) -> Option<Code> {
+    Some(match key {
+        Key::A => Code::KeyA,
+        Key::B => Code::KeyB,
+        Key::C => Code::KeyC,
+        Key::D => Code::KeyD,
+        Key::E => Code::KeyE,
+        Key::F => Code::KeyF,
+        Key::G => Code::KeyG,
+        Key::H => Code::KeyH,
+        Key::I => Code::KeyI,
+        Key::J => Code::KeyJ,
+        Key::K => Code::KeyK,
+        Key::L => Code::KeyL,
+        Key::M => Code::KeyM,
+        Key::N => Code::KeyN,
+        Key::O => Code::KeyO,
+        Key::P => Code::KeyP,
+        Key::Q => Code::KeyQ,
+        Key::R => Code::KeyR,
+        Key::S => Code::KeyS,
+        Key::T => Code::KeyT,
+        Key::U => Code::KeyU,
+        Key::V => Code::KeyV,
+        Key::W => Code::KeyW,
+        Key::X => Code::KeyX,
+        Key::Y => Code::KeyY,
+        Key::Z => Code::KeyZ,
+        Key::Num0 => Code::Digit0,
+        Key::Num1 => Code::Digit1,
+        Key::Num2 => Code::Digit2,
+        Key::Num3 => Code::Digit3,
+        Key::Num4 => Code::Digit4,
+        Key::Num5 => Code::Digit5,
+        Key::Num6 => Code::Digit6,
+        Key::Num7 => Code::Digit7,
+        Key::Num8 => Code::Digit8,
+        Key::Num9 => Code::Digit9,
+        Key::F1 => Code::F1,
+        Key::F2 => Code::F2,
+        Key::F3 => Code::F3,
+        Key::F4 => Code::F4,
+        Key::F5 => Code::F5,
+        Key::F6 => Code::F6,
+        Key::F7 => Code::F7,
+        Key::F8 => Code::F8,
+        Key::F9 => Code::F9,
+        Key::F10 => Code::F10,
+        Key::F11 => Code::F11,
+        Key::F12 => Code::F12,
+        Key::F13 => Code::F13,
+        Key::F14 => Code::F14,
+        Key::F15 => Code::F15,
+        Key::F16 => Code::F16,
+        Key::F17 => Code::F17,
+        Key::F18 => Code::F18,
+        Key::F19 => Code::F19,
+        Key::F20 => Code::F20,
+        Key::F21 => Code::F21,
+        Key::F22 => Code::F22,
+        Key::F23 => Code::F23,
+        Key::F24 => Code::F24,
+        Key::OpenBracket => Code::BracketLeft,
+        Key::CloseBracket => Code::BracketRight,
+        Key::Backslash => Code::Backslash,
+        Key::Slash => Code::Slash,
+        // `+` is Shift+`=` on the keyboards AppKit matches by key: Zoom In shows ⌘=.
+        Key::Equals | Key::Plus => Code::Equal,
+        Key::Minus => Code::Minus,
+        Key::Quote => Code::Quote,
+        Key::Semicolon => Code::Semicolon,
+        Key::Comma => Code::Comma,
+        Key::Period => Code::Period,
+        Key::Backtick => Code::Backquote,
+        Key::Backspace => Code::Backspace,
+        Key::Delete => Code::Delete,
+        Key::Enter => Code::Enter,
+        Key::Tab => Code::Tab,
+        Key::Space => Code::Space,
+        Key::Escape => Code::Escape,
+        Key::ArrowLeft => Code::ArrowLeft,
+        Key::ArrowRight => Code::ArrowRight,
+        Key::ArrowUp => Code::ArrowUp,
+        Key::ArrowDown => Code::ArrowDown,
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every shortcut the Mac menu shows as a key equivalent has one AppKit can match.
+    #[test]
+    fn every_menu_shortcut_maps_to_a_key_equivalent() {
+        let app = VectorcraftApp::new(vectorcraft_engine::Session::new(), Default::default());
+        let bar = native_menu::layout(&app).bar;
+        let mut native = 0;
+        for it in bar.items() {
+            let Some(c) = it.shortcut.and_then(vectorcraft_ui_egui::shortcuts::parse).filter(native_menu::native_ok) else { continue };
+            assert!(accelerator(&c).is_some(), "{:?} ({:?}) has no key equivalent", it.shortcut, it.command);
+            native += 1;
+        }
+        assert!(native > 70, "{native} key equivalents");
+    }
+
+    #[test]
+    fn control_and_command_stay_distinct() {
+        let parse = |s| vectorcraft_ui_egui::shortcuts::parse(s).and_then(|c| accelerator(&c));
+        assert_ne!(parse("Cmd+M"), parse("Ctrl+Cmd+M"));
+        assert!(parse("Cmd+M").is_some());
+    }
+}

apps/vectorcraft/src/main.rs

@@ -1,6 +1,9 @@
 //! VectorCraft desktop app.
 //!
-//! Usage: `vectorcraft [--control <port>] [files…]`
+//! Usage: `vectorcraft [--control <port>] [--in-window-menus] [files…]`
+//!
+//! `--in-window-menus` (or `VECTORCRAFT_IN_WINDOW_MENUS=1`) keeps the menus inside the window on
+//! macOS instead of the macOS menu bar (`mac_menu`).
 //!
 //! `--control <port>` (or `VECTORCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"ui.inspect","params":{}}` → `{"id":1,"ok":true,"result":…}`.
@@ -16,9 +19,11 @@ compile_error!("the win7 target requires --no-default-features --features window
 
 mod clipboard;
 mod control_server;
+#[cfg(feature = "wgpu")]
+mod gpu;
 mod logging;
 #[cfg(target_os = "macos")]
-mod native_menu;
+mod mac_menu;
 #[cfg(target_os = "macos")]
 mod open_documents;
 mod printing;
@@ -27,7 +32,7 @@ mod window;
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
 use vectorcraft_ui_egui::graphics::GraphicsLoss;
-use vectorcraft_ui_egui::{FilePick, Services, VectorcraftApp};
+use vectorcraft_ui_egui::{ClipboardProbeFactory, FilePick, Services, VectorcraftApp};
 
 struct App {
     app: VectorcraftApp,
@@ -35,8 +40,6 @@ struct App {
     graphics_loss: GraphicsLoss,
     /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
     graphics_lost: bool,
-    #[cfg(target_os = "macos")]
-    menu: Option<native_menu::NativeMenu>,
 }
 
 impl eframe::App for App {
@@ -57,15 +60,7 @@ impl eframe::App for App {
             return;
         }
         #[cfg(target_os = "macos")]
-        {
-            if self.menu.is_none() && std::env::var_os("VECTORCRAFT_NO_NATIVE_MENU").is_none() {
-                self.menu = Some(native_menu::NativeMenu::install(&mut self.app));
-            }
-            if let Some(m) = &mut self.menu {
-                m.poll(&mut self.app, ctx);
-            }
-            open_files(&mut self.app, open_documents::take());
-        }
+        open_files(&mut self.app, open_documents::take());
         self.app.logic(ctx);
         window::track(ctx, &mut self.app.ui.window);
         if self.app.ui.status == "quit" {
@@ -254,6 +249,10 @@ fn services() -> Services {
         write_shared: Some(std::sync::Arc::new(write_file)),
         // Every format Copy offers and Paste reads (menu-bar Paste never sees egui's Paste event).
         system_clipboard: Some(clipboard::system_clipboard()),
+        // Linux checks whether Paste has something to take on a background thread: an X11 clipboard
+        // owner that never answers holds a read for up to 4 s. Windows only asks which formats the
+        // clipboard holds and macOS asks the pasteboard server, so they check in line.
+        clipboard_probe: cfg!(target_os = "linux").then(|| Box::new(clipboard::system_clipboard) as ClipboardProbeFactory),
         // Help → Discord / website / GitHub, the Discord button, About and Home links.
         open_url: Some(Box::new(|url: &str| {
             let _ = webbrowser::open(url);
@@ -297,23 +296,6 @@ fn app_icon() -> egui::IconData {
     eframe::icon_data::from_png_bytes(png).unwrap_or_default()
 }
 
-/// The power preference wgpu picks the window's graphics adapter with (#306): the
-/// `WGPU_POWER_PREF` environment variable (`low`, `high`, `none`) when set, otherwise Preferences ›
-/// Performance › Graphics Processor (`gpuPreference`). Power saving unless the preference asks for
-/// high performance: the canvas is rasterized on the CPU and the GPU only composites it, which the
-/// integrated GPU of a hybrid-graphics laptop does easily, while presenting frames rendered on the
-/// discrete GPU through the integrated one made the window flicker on some laptops. With a single
-/// GPU both preferences pick it.
-#[cfg(feature = "wgpu")]
-fn power_preference(pref: Option<&str>, env: Option<eframe::wgpu::PowerPreference>) -> eframe::wgpu::PowerPreference {
-    use eframe::wgpu::PowerPreference;
-    match (env, pref) {
-        (Some(p), _) => p,
-        (None, Some("highPerformance")) => PowerPreference::HighPerformance,
-        (None, _) => PowerPreference::LowPower,
-    }
-}
-
 /// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
 #[cfg(feature = "wgpu")]
 fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
@@ -324,19 +306,21 @@ fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
 /// macOS keeps its traffic lights over the integrated title strip.
 const CUSTOM_TITLEBAR: bool = !cfg!(target_os = "macos");
 
-fn main() -> eframe::Result {
+fn main() -> std::process::ExitCode {
     // First, so every start-up warning is recorded (`logging`).
     let logger = logging::install();
     vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
     let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
     let mut files = Vec::new();
+    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
     let mut args = std::env::args().skip(1);
     while let Some(a) = args.next() {
         match a.as_str() {
             "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
+            "--in-window-menus" => in_window_menus = true,
             "--version" => {
                 println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
-                return Ok(());
+                return std::process::ExitCode::SUCCESS;
             }
             _ => files.push(a),
         }
@@ -360,7 +344,9 @@ fn main() -> eframe::Result {
     #[cfg(feature = "wgpu")]
     let gpu_pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("gpuPreference")).and_then(serde_json::Value::as_str);
     #[cfg(feature = "wgpu")]
-    let power = power_preference(gpu_pref, eframe::wgpu::PowerPreference::from_env());
+    let power = gpu::power_preference(gpu_pref, eframe::wgpu::PowerPreference::from_env());
+    #[cfg(feature = "wgpu")]
+    let startup = std::sync::Arc::new(gpu::Startup::default());
     let options = eframe::NativeOptions {
         viewport: egui::ViewportBuilder::default()
             .with_title("VectorCraft")
@@ -383,86 +369,96 @@ fn main() -> eframe::Result {
         // One frame queued, not two: the canvas is rasterized on the CPU and the GPU only
         // composites it, so the window answers the pointer a frame sooner (#444).
         options.wgpu_options.surface = eframe::egui_wgpu::SurfaceConfig::LOW_LATENCY;
+        // Only adapters that can show the window, in the order `gpu` gives (#306, #502).
         if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
-            create.power_preference = power;
+            create.native_adapter_selector = Some(gpu::selector(power, startup.clone()));
         }
         options
     };
+    #[cfg(feature = "wgpu")]
+    gpu::watch_panics();
     // Files opened from Finder and the Dock arrive as events, not arguments.
     #[cfg(target_os = "macos")]
     open_documents::install();
-    eframe::run_native(
-        "VectorCraft",
-        options,
-        Box::new(move |cc| {
-            let mut app = VectorcraftApp::new(Session::new(), services());
-            load_prefs(&mut app, saved);
-            // Fit the window to its monitor, or put it back where it was (still hidden).
-            if let Some(w) = cc.winit_window() {
-                app.ui.window = Some(window::restore(w, saved_window));
-            }
-            // User Defined swatch and graphic style libraries live next to the preferences.
-            let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
-            app.session.swatch_libraries.set_user_dir(swatches);
-            let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
-            app.session.style_libraries.set_user_dir(styles);
-            // Data Recovery copies live next to the preferences too (none for runs without
-            // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
-            if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
-                let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
-                app.session.recovery.set_default_folder(recovery);
-            }
-            let graphics_loss = GraphicsLoss::default();
-            #[cfg(feature = "wgpu")]
-            if let Some(rs) = &cc.wgpu_render_state {
-                let summary = adapter_summary(&rs.adapter.get_info());
-                log::info!("rendering with {summary} (power preference {power:?})");
-                app.graphics_adapter = Some(summary);
-                let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
-                rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
-            }
-            #[cfg(feature = "windows7")]
-            {
-                app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
-            }
-            app.integrated_titlebar = cfg!(target_os = "macos");
-            app.custom_titlebar = CUSTOM_TITLEBAR;
-            if let Some(port) = control_port {
-                let rx = control_server::start(port, cc.egui_ctx.clone());
-                app = app.with_control(rx);
-            }
-            #[cfg(target_os = "macos")]
-            open_documents::set_ui(&cc.egui_ctx);
-            open_files(&mut app, files);
-            Ok(Box::new(App {
-                app,
-                graphics_loss,
-                graphics_lost: false,
+    #[cfg(feature = "wgpu")]
+    let created = startup.clone();
+    // A panic that ends the window (egui-wgpu's own, #502) is caught here: never a crash.
+    let outcome = vectorcraft_engine::guard::catch_panic(|| {
+        eframe::run_native(
+            "VectorCraft",
+            options,
+            Box::new(move |cc| {
+                let mut app = VectorcraftApp::new(Session::new(), services());
+                load_prefs(&mut app, saved);
+                // Fit the window to its monitor, or put it back where it was (still hidden).
+                if let Some(w) = cc.winit_window() {
+                    app.ui.window = Some(window::restore(w, saved_window));
+                }
+                // User Defined swatch and graphic style libraries live next to the preferences.
+                let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
+                app.session.swatch_libraries.set_user_dir(swatches);
+                let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
+                app.session.style_libraries.set_user_dir(styles);
+                // Data Recovery copies live next to the preferences too (none for runs without
+                // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
+                if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
+                    let recovery = prefs_path().and_then(|p| Some(p.parent()?.join("Data Recovery").to_string_lossy().to_string()));
+                    app.session.recovery.set_default_folder(recovery);
+                }
+                let graphics_loss = GraphicsLoss::default();
+                #[cfg(feature = "wgpu")]
+                if let Some(rs) = &cc.wgpu_render_state {
+                    let summary = adapter_summary(&rs.adapter.get_info());
+                    log::info!("rendering with {summary} (power preference {power:?})");
+                    created.created(&cc.egui_ctx);
+                    if !gpu::skipped().is_empty() {
+                        app.status(format!("The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}"));
+                    }
+                    app.graphics_adapter = Some(summary);
+                    let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
+                    rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
+                }
+                #[cfg(feature = "windows7")]
+                {
+                    app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
+                }
+                app.integrated_titlebar = cfg!(target_os = "macos");
+                app.custom_titlebar = CUSTOM_TITLEBAR;
+                if let Some(port) = control_port {
+                    let rx = control_server::start(port, cc.egui_ctx.clone());
+                    app = app.with_control(rx);
+                }
                 #[cfg(target_os = "macos")]
-                menu: None,
-            }))
-        }),
-    )
+                {
+                    open_documents::set_ui(&cc.egui_ctx);
+                    // The macOS menu bar, installed now so winit's default menu doesn't stay up.
+                    if !in_window_menus {
+                        app.services.native_menu = mac_menu::install(&cc.egui_ctx, &app);
+                    }
+                }
+                #[cfg(not(target_os = "macos"))]
+                let _ = in_window_menus;
+                open_files(&mut app, files);
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false }))
+            }),
+        )
+    });
+    #[cfg(feature = "wgpu")]
+    let outcome = gpu::finish(outcome, &startup);
+    #[cfg(not(feature = "wgpu"))]
+    let outcome = outcome.and_then(|r| r.map_err(|e| e.to_string()));
+    match outcome {
+        Ok(()) => std::process::ExitCode::SUCCESS,
+        Err(e) => {
+            log::error!("VectorCraft stopped: {e}");
+            std::process::ExitCode::FAILURE
+        }
+    }
 }
 
 #[cfg(all(test, feature = "wgpu"))]
 mod tests {
     use super::*;
-    use eframe::wgpu::PowerPreference;
-
-    #[test]
-    fn power_saving_unless_the_preference_or_the_environment_says_otherwise() {
-        assert_eq!(power_preference(None, None), PowerPreference::LowPower);
-        assert_eq!(power_preference(Some("powerSaving"), None), PowerPreference::LowPower);
-        assert_eq!(power_preference(Some("highPerformance"), None), PowerPreference::HighPerformance);
-        // A value this version doesn't know (a newer or damaged preference file) is the default.
-        assert_eq!(power_preference(Some("turbo"), None), PowerPreference::LowPower);
-        assert_eq!(power_preference(Some(""), None), PowerPreference::LowPower);
-        // WGPU_POWER_PREF wins over the preference, either way.
-        assert_eq!(power_preference(Some("powerSaving"), Some(PowerPreference::HighPerformance)), PowerPreference::HighPerformance);
-        assert_eq!(power_preference(Some("highPerformance"), Some(PowerPreference::LowPower)), PowerPreference::LowPower);
-        assert_eq!(power_preference(None, Some(PowerPreference::None)), PowerPreference::None);
-    }
 
     /// The file extensions the macOS bundle declares: its document types and its own exported type.
     fn plist_extensions(plist: &str) -> Vec<&str> {
@@ -492,16 +488,4 @@ mod tests {
         assert!(types > 1 && plist.matches("<key>LSHandlerRank</key>").count() == types, "every document type has a rank");
         assert_eq!(plist.matches("<string>Owner</string>").count(), 2, "only VectorCraft documents and templates are owned");
     }
-
-    /// The preference the engine saves is the one the app reads back before the window opens.
-    #[test]
-    fn the_saved_engine_preference_is_found() {
-        let mut prefs = vectorcraft_engine::Prefs::default();
-        let saved = prefs.to_json();
-        assert_eq!(saved.get("gpuPreference").and_then(serde_json::Value::as_str), Some("powerSaving"));
-        prefs.gpu_preference = "highPerformance".into();
-        let saved = prefs.to_json();
-        let pref = saved.get("gpuPreference").and_then(serde_json::Value::as_str);
-        assert_eq!(power_preference(pref, None), PowerPreference::HighPerformance);
-    }
 }

apps/vectorcraft/src/native_menu.rs

@@ -1,183 +0,0 @@
-//! macOS: VectorCraft's menu tree as the native system menu bar (like Illustrator on the Mac).
-//! Items dispatch through the same command path as the in-window menus; enablement, check marks
-//! and dynamic labels ("Undo Move") are refreshed a few times per second, and the menu is rebuilt
-//! when saved views or recent files come and go.
-
-use std::collections::HashMap;
-use std::str::FromStr;
-
-use muda::accelerator::Accelerator;
-use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
-use serde_json::Value;
-use vectorcraft_ui_egui::VectorcraftApp;
-use vectorcraft_ui_egui::i18n::{self, Lang, t};
-use vectorcraft_ui_egui::menus::{self, Item};
-
-enum Handle {
-    Plain(MenuItem),
-    Check(CheckMenuItem),
-}
-
-pub struct NativeMenu {
-    _menu: Menu,
-    items: HashMap<String, (String, Value, Handle, String)>,
-    last_refresh: f64,
-    /// Shortcut-override / workspace-list generation the menu was built for.
-    generation: u64,
-    /// Saved views and recent files listed (empty slots are left out, so a change rebuilds).
-    slots: usize,
-    /// Plug-in registry revision the Plug-ins submenus were built for.
-    plugins: u64,
-    /// The language the labels were built in (a change rebuilds the menu).
-    language: Lang,
-}
-
-/// Accelerator for a shortcut like "Cmd+Shift+]" (modifier-less shortcuts stay in the app so they
-/// don't steal keys from text fields; a focused field still gets Cmd+A/X/C/V, see [`NativeMenu::poll`]).
-fn accel(sc: &str) -> Option<Accelerator> {
-    if !(sc.contains("Cmd") || sc.contains("Ctrl") || sc.contains("Alt") || sc.starts_with('F')) {
-        return None;
-    }
-    Accelerator::from_str(&sc.replace("Cmd", "CMD").replace("Alt", "ALT").replace("Shift", "SHIFT").replace("Ctrl", "CTRL")).ok()
-}
-
-impl NativeMenu {
-    pub fn install(app: &mut VectorcraftApp) -> Self {
-        // Accelerators come from `shortcut_of`, which honours the user's overrides.
-        vectorcraft_ui_egui::shortcut_editor::sync(&app.ui);
-        let generation = vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed);
-        let menu = Menu::new();
-        let mut items = HashMap::new();
-        let mut counter = 0usize;
-        for (title, entries) in menus::menu_tree() {
-            let sub = Submenu::new(t(title), true);
-            build(app, &sub, &entries, &mut items, &mut counter);
-            let _ = menu.append(&sub);
-        }
-        menu.init_for_nsapp();
-        app.native_menu = true;
-        app.native_shortcuts = items
-            .values()
-            .filter(|(_, p, _, c)| (p.is_null() || p.as_object().is_some_and(|o| o.is_empty())) && menus::shortcut_of(c).and_then(accel).is_some())
-            .map(|(_, _, _, c)| c.clone())
-            .collect();
-        Self {
-            _menu: menu,
-            items,
-            last_refresh: 0.0,
-            generation,
-            slots: menus::listed_slots(app),
-            plugins: menus::plugin_revision(),
-            language: i18n::current(),
-        }
-    }
-
-    /// Dispatch chosen items (a focused text field takes Select All and the clipboard) and refresh
-    /// state.
-    pub fn poll(&mut self, app: &mut VectorcraftApp, ctx: &egui::Context) {
-        while let Ok(ev) = MenuEvent::receiver().try_recv() {
-            if let Some((cmd, params, _, _)) = self.items.get(ev.id.as_ref()) {
-                let p = if params.is_null() { serde_json::json!({}) } else { params.clone() };
-                menus::invoke_from_system_menu(app, ctx, cmd, p);
-            }
-        }
-        let now = vectorcraft_ui_egui::now_ms();
-        if now - self.last_refresh < 250.0 {
-            return;
-        }
-        self.last_refresh = now;
-        // Shortcuts edited, workspaces added, saved views, recent files, plug-ins or the UI language
-        // changed: rebuild so accelerators, lists and labels are current.
-        if vectorcraft_ui_egui::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed) != self.generation
-            || menus::listed_slots(app) != self.slots
-            || menus::plugin_revision() != self.plugins
-            || i18n::current() != self.language
-        {
-            *self = NativeMenu::install(app);
-            return;
-        }
-        for (run, rp, h, cmd) in self.items.values() {
-            let null = Value::Null;
-            let params = if run == cmd { rp } else { &null };
-            let en = menus::enabled(app, cmd);
-            match h {
-                Handle::Plain(i) => {
-                    i.set_enabled(en);
-                    if matches!(
-                        cmd.as_str(),
-                        "edit.undo"
-                            | "edit.redo"
-                            | "view.outline"
-                            | "view.rulers"
-                            | "view.guides"
-                            | "view.grid"
-                            | "view.edges"
-                            | "view.artboards"
-                            | "view.boundingBox"
-                            | "view.transparencyGrid"
-                            | "window.workspace.reset"
-                    ) || cmd.starts_with("file.openRecent")
-                        || cmd.starts_with("type.recentFont")
-                        || cmd.starts_with("view.goto")
-                        || matches!(
-                            cmd.as_str(),
-                            "view.cornerWidget" | "view.textThreads" | "view.gradientAnnotator" | "effect.last" | "type.hiddenCharacters"
-                        )
-                    {
-                        i.set_text(menus::display_label(app, cmd, ""));
-                    }
-                }
-                Handle::Check(c) => {
-                    c.set_enabled(en);
-                    c.set_checked(menus::checked(app, cmd, params).unwrap_or(false));
-                }
-            }
-        }
-    }
-}
-
-fn build(
-    app: &VectorcraftApp,
-    parent: &Submenu,
-    entries: &[Item],
-    items: &mut HashMap<String, (String, Value, Handle, String)>,
-    counter: &mut usize,
-) {
-    for e in entries {
-        match e {
-            Item::Sep => {
-                let _ = parent.append(&PredefinedMenuItem::separator());
-            }
-            Item::Header(h) => {
-                let _ = parent.append(&MenuItem::new(t(h), false, None));
-            }
-            Item::Todo(label, sc) => {
-                let _ = parent.append(&MenuItem::new(t(label), false, accel(sc)));
-            }
-            Item::Sub(label, children) => {
-                let sub = Submenu::new(t(label), true);
-                build(app, &sub, children, items, counter);
-                let _ = parent.append(&sub);
-            }
-            // Unused saved-view and recent-file slots are left out, as in the in-window menus.
-            Item::Cmd(_, cmd, _) if menus::hidden_slot(app, cmd) => {}
-            Item::Cmd(label, cmd, params) => {
-                *counter += 1;
-                let id = format!("dc{counter}");
-                let sc = if params.is_null() { menus::shortcut_of(cmd).and_then(accel) } else { None };
-                let handle = if menus::checked(app, cmd, params).is_some() {
-                    let c = CheckMenuItem::with_id(id.clone(), menus::display_label(app, cmd, label), true, false, sc);
-                    let _ = parent.append(&c);
-                    Handle::Check(c)
-                } else {
-                    let i = MenuItem::with_id(id.clone(), menus::display_label(app, cmd, label), true, sc);
-                    let _ = parent.append(&i);
-                    Handle::Plain(i)
-                };
-                let (run, run_params) = menus::click_target(label, cmd, params);
-                let _ = &run_params;
-                items.insert(id, (run, run_params, handle, cmd.to_string()));
-            }
-        }
-    }
-}

contributors/people.toml

@@ -21,3 +21,7 @@
 real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false
+
+[people.callmeBalloch]
+real_name = "Riccardo Balloch"
+sync_github_name = false

crates/engine/src/cmd/draw2.rs

@@ -701,13 +701,16 @@ fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
             return Err(EngineError::Other("no such segment".into()));
         }
         let n = sp.anchors.len();
-        // Moving both inner control points by v moves B(t) by 3t(1-t)·v.
+        // Moving both inner control points by v moves B(t) by 3t(1-t)·v. A smooth anchor stays
+        // smooth: its other handle turns with the moved one.
         let v = dv / (3.0 * t * (1.0 - t));
         let (i0, i1) = (seg % n, (seg + 1) % n);
-        let a = sp.anchors[i0];
-        sp.anchors[i0] = Anchor::with_handles(a.p, a.h_in, a.h_out + v);
-        let b = sp.anchors[i1];
-        sp.anchors[i1] = Anchor::with_handles(b.p, b.h_in + v, b.h_out);
+        if let Some(a) = sp.anchors.get_mut(i0) {
+            a.set_handle(true, a.h_out + v, false);
+        }
+        if let Some(b) = sp.anchors.get_mut(i1) {
+            b.set_handle(false, b.h_in + v, false);
+        }
         Ok(())
     })?;
     ok()

crates/engine/src/cmd/fileio/mod.rs

@@ -78,7 +78,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Open Document",
             [],
             None,
-            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
+            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, lines wrapped in a frame as area type where they lay out the same, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
             always,
             load::open
         ),

crates/engine/src/cmd/prefscmds.rs

@@ -82,8 +82,11 @@ pub const UNITS: &[(&str, &str)] = &[
     ("feet", "Feet"),
 ];
 const LINE_STYLE: &[(&str, &str)] = &[("lines", "Lines"), ("dots", "Dots")];
-/// Performance › Graphics Processor (`gpuPreference`), read by the desktop app at startup.
-pub const GPU_PREFERENCES: &[(&str, &str)] = &[("powerSaving", "Power Saving (integrated)"), ("highPerformance", "High Performance (discrete)")];
+/// Performance › Graphics Processor (`gpuPreference`), read by the desktop app at startup. The
+/// values are WebGPU's power preferences plus `automatic`; 0.5.0's default, `powerSaving`, reads as
+/// `automatic` (#502).
+pub const GPU_PREFERENCES: &[(&str, &str)] =
+    &[("automatic", "Automatic"), ("lowPower", "Power Saving (integrated)"), ("highPerformance", "High Performance (discrete)")];
 const BLACK: &[(&str, &str)] = &[("accurate", "Display All Blacks Accurately"), ("rich", "Display All Blacks as Rich Black")];
 const BLACK_OUT: &[(&str, &str)] = &[("accurate", "Output All Blacks Accurately"), ("rich", "Output All Blacks as Rich Black")];
 

crates/engine/src/lib.rs

@@ -397,6 +397,8 @@ pub struct Prefs {
     pub units_stroke: String,
     pub units_type: String,
     pub units_asian_type: String,
+    /// Numbers Without Units Are Points: a number typed with no unit into a length field in picas
+    /// is read in points (on by default; the reference app dims it unless a unit is Picas).
     pub numbers_without_units_are_points: bool,
     pub identify_objects_by: String,
     // Guides & Grid
@@ -444,10 +446,13 @@ pub struct Prefs {
     pub gpu_performance: bool,
     pub animated_zoom: bool,
     /// Which graphics processor the desktop app asks for at startup (it takes effect after a
-    /// restart): `powerSaving` (the integrated GPU on hybrid-graphics laptops) or `highPerformance`
-    /// (the discrete one). The canvas is rasterized on the CPU and only composited on the GPU, so
-    /// the integrated GPU is plenty; presenting from the discrete GPU through the integrated one
-    /// made some hybrid laptops flicker (#306). Single-GPU machines are unaffected.
+    /// restart): `automatic`, `lowPower` (the integrated GPU on hybrid-graphics machines) or
+    /// `highPerformance` (the discrete one). The canvas is rasterized on the CPU and only
+    /// composited on the GPU, so the integrated GPU is plenty; presenting from the discrete GPU
+    /// through the integrated one made some hybrid laptops flicker (#306). Automatic is power
+    /// saving on Windows and macOS and the system's default GPU elsewhere, the one the desktop
+    /// runs on: a Wayland compositor may not show frames from another GPU (#502). Single-GPU
+    /// machines are unaffected.
     pub gpu_preference: String,
     pub history_states: u32,
     pub real_time_drawing: bool,
@@ -651,7 +656,7 @@ impl Default for Prefs {
             interface_language: s("auto"),
             gpu_performance: true,
             animated_zoom: true,
-            gpu_preference: s("powerSaving"),
+            gpu_preference: s("automatic"),
             history_states: 500,
             real_time_drawing: true,
             render_threads: -1,
@@ -716,6 +721,12 @@ pub struct Session {
     /// Executed commands (for actions and debugging).
     pub journal: Vec<(String, Value)>,
     pub(crate) tool: Box<dyn Tool>,
+    /// While Cmd lends `tool` (a selection tool) for a drag: the tool it was lent to, which comes
+    /// back as it was at the release ([`Session::pointer`]).
+    pub(crate) lender: Option<Box<dyn Tool>>,
+    /// The selection tool chosen last (Selection, Direct Selection or Group Selection): the one Cmd
+    /// lends the other tools. None until one is chosen.
+    pub(crate) last_selection_tool: Option<&'static str>,
     pub(crate) last_view: ViewInfo,
     depth: u32,
     /// Set when the active tool panicked (see [`guard`]); reported by the next tool event.
@@ -795,6 +806,8 @@ impl Session {
             clipboard: Clipboard::default(),
             journal: vec![],
             tool: vectorcraft_tools::create("selection"),
+            lender: None,
+            last_selection_tool: None,
             last_view: ViewInfo::default(),
             depth: 0,
             tool_panic: None,
@@ -853,6 +866,8 @@ impl Session {
             return;
         }
         let view = self.last_view;
+        // The switch goes on whatever the lent tool's last actions did, as for the deactivation.
+        let _ = self.give_back_tool(view);
         let acts = self.with_tool_cx(view, |t, cx| t.deactivate(cx));
         let _ = self.apply_actions(acts);
         // A batch leaves its interaction open in the document it leaves, to keep or roll back with

crates/engine/src/tests_draw2.rs

@@ -57,6 +57,20 @@ fn click(s: &mut Session, tool: &str, x: f64, y: f64) -> Vec<UiRequest> {
     drag(s, tool, &[(x, y)], Mods::default())
 }
 
+/// A gesture of the active tool, `m` held throughout: press at the first point, drag through the
+/// others, release at the last. The undo steps it made.
+fn gesture(s: &mut Session, pts: &[(f64, f64)], m: Mods) -> usize {
+    let v = view();
+    let undo = undo_steps(s);
+    s.pointer(&PointerEvent::new(PointerKind::Down, pts[0].0, pts[0].1).with_mods(m), v).unwrap();
+    for &(x, y) in &pts[1..] {
+        s.pointer(&PointerEvent::new(PointerKind::Drag, x, y).with_mods(m), v).unwrap();
+    }
+    let l = pts[pts.len() - 1];
+    s.pointer(&PointerEvent::new(PointerKind::Up, l.0, l.1).with_mods(m), v).unwrap();
+    undo_steps(s) - undo
+}
+
 /// A wavy stroke sampled every 2 pt.
 fn wave(x0: f64, x1: f64, y: f64) -> Vec<(f64, f64)> {
     let n = ((x1 - x0) / 2.0) as usize;
@@ -622,16 +636,6 @@ fn pen_with_alt_moves_one_handle_and_converts_anchors() {
     let anchors = json!([{"x": 100, "y": 200}, {"x": 200, "y": 100, "in": [150, 100], "out": [250, 100]}, {"x": 300, "y": 200}]);
     let id = NodeId(s.execute("path.create", &json!({"anchors": anchors})).unwrap()["id"].as_u64().unwrap());
     s.select_tool("pen", v).unwrap();
-    let gesture = |s: &mut Session, pts: &[(f64, f64)], m: Mods| {
-        let undo = undo_steps(s);
-        s.pointer(&PointerEvent::new(PointerKind::Down, pts[0].0, pts[0].1).with_mods(m), v).unwrap();
-        for &(x, y) in &pts[1..] {
-            s.pointer(&PointerEvent::new(PointerKind::Drag, x, y).with_mods(m), v).unwrap();
-        }
-        let l = pts[pts.len() - 1];
-        s.pointer(&PointerEvent::new(PointerKind::Up, l.0, l.1).with_mods(m), v).unwrap();
-        undo_steps(s) - undo
-    };
     // Alt-drag the out handle: it moves alone, the in handle stays.
     assert_eq!(gesture(&mut s, &[(250.0, 100.0), (260.0, 130.0), (275.0, 165.0)], alt), 1);
     assert!(!s.in_interaction());
@@ -659,3 +663,130 @@ fn pen_with_alt_moves_one_handle_and_converts_anchors() {
     assert_eq!(path(&s, new).subpaths[0].anchors.len(), 3);
     assert_eq!(paths(&s).len(), 2);
 }
+
+/// The anchor's handles point opposite ways.
+fn smooth(a: vectorcraft_geom::Anchor) -> bool {
+    let (i, o) = (a.h_in - a.p, a.h_out - a.p);
+    (i.x * o.y - i.y * o.x).abs() < 1e-6 && i.x * o.x + i.y * o.y < 0.0
+}
+
+#[test]
+fn pen_with_cmd_borrows_direct_selection_and_goes_on_drawing() {
+    // #494: Cmd (Ctrl) held with the Pen drags with the selection tool used last (Direct Selection
+    // until one is chosen): handles, segments and anchors of the path being drawn; released, the
+    // Pen goes on drawing that path. Through pointer events, so agents reach it too.
+    let (none, cmd) = (Mods::default(), Mods { cmd: true, ..Mods::default() });
+    let v = view();
+    let mut s = session();
+    s.select_tool("pen", v).unwrap();
+    gesture(&mut s, &[(100.0, 300.0)], none);
+    gesture(&mut s, &[(200.0, 300.0), (250.0, 300.0)], none);
+    let id = s.doc().unwrap().selection.objects[0];
+    assert_eq!(s.cursor(Point::new(250.0, 300.0), none, v), vectorcraft_tools::Cursor::Pen);
+    assert_eq!(s.cursor(Point::new(250.0, 300.0), cmd, v), vectorcraft_tools::Cursor::ArrowHollow, "Direct Selection's");
+    // The new anchor's outgoing handle: it moves, its incoming one turning with it.
+    s.pointer(&PointerEvent::new(PointerKind::Down, 250.0, 300.0).with_mods(cmd), v).unwrap();
+    assert_eq!(s.tool_id(), "directSelection");
+    s.pointer(&PointerEvent::new(PointerKind::Drag, 250.0, 260.0).with_mods(cmd), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 250.0, 260.0).with_mods(cmd), v).unwrap();
+    assert_eq!(s.tool_id(), "pen");
+    let a = path(&s, id).subpaths[0].anchors[1];
+    assert!(a.h_out == Point::new(250.0, 260.0) && smooth(a), "{a:?}");
+    // The segment between the two anchors bends, the smooth anchor staying smooth.
+    let before = path(&s, id).subpaths[0].anchors[1].h_in;
+    gesture(&mut s, &[(120.0, 300.0), (120.0, 270.0)], cmd);
+    let a = path(&s, id).subpaths[0].anchors[1];
+    assert!(a.h_in != before && smooth(a), "{a:?}");
+    assert_eq!(s.tool_id(), "pen");
+    // A plain click goes on drawing the same path.
+    gesture(&mut s, &[(300.0, 350.0)], none);
+    assert_eq!((paths(&s).len(), path(&s, id).subpaths[0].anchors.len()), (1, 3));
+    // A Cmd-click away from the art deselects: the path is done, the next click starts another.
+    gesture(&mut s, &[(600.0, 100.0)], cmd);
+    gesture(&mut s, &[(400.0, 500.0)], none);
+    assert_eq!(paths(&s).len(), 2);
+    assert_eq!(path(&s, id).subpaths[0].anchors.len(), 3);
+    // With the Selection tool chosen last, Cmd lends it.
+    s.select_tool("selection", v).unwrap();
+    s.select_tool("pen", v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Down, 600.0, 100.0).with_mods(cmd), v).unwrap();
+    assert_eq!(s.tool_id(), "selection");
+    s.pointer(&PointerEvent::new(PointerKind::Up, 600.0, 100.0).with_mods(cmd), v).unwrap();
+    assert_eq!(s.tool_id(), "pen");
+    // Choosing a tool mid-gesture keeps it: the Pen doesn't come back over it.
+    s.pointer(&PointerEvent::new(PointerKind::Down, 600.0, 100.0).with_mods(cmd), v).unwrap();
+    s.select_tool("rectangle", v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 600.0, 100.0), v).unwrap();
+    assert_eq!(s.tool_id(), "rectangle");
+}
+
+#[test]
+fn reshaping_a_segment_keeps_smooth_anchors_smooth() {
+    // #494: the anchors at the ends of a dragged segment keep their kind: a smooth one's other
+    // handle turns with the moved one (at its length), a corner's stays.
+    let mut s = session();
+    let anchors = json!([{"x": 100, "y": 300}, {"x": 200, "y": 300, "in": [160, 300], "out": [240, 300]}, {"x": 300, "y": 300}]);
+    let id = NodeId(s.execute("path.create", &json!({"anchors": anchors})).unwrap()["id"].as_u64().unwrap());
+    s.execute("path.reshapeSegment", &json!({"id": id.0, "segment": 0, "t": 0.5, "dx": 0, "dy": -30})).unwrap();
+    let sp = &path(&s, id).subpaths[0];
+    let a = sp.anchors[1];
+    assert!(near(a.h_in, Point::new(160.0, 260.0)) && smooth(a), "{a:?}");
+    assert!((a.h_out.distance(a.p) - 40.0).abs() < 1e-9, "its length kept");
+    assert!(near(sp.anchors[0].h_out, Point::new(100.0, 260.0)) && !sp.anchors[0].has_in(), "the corner end: {:?}", sp.anchors[0]);
+}
+
+#[test]
+fn pen_drag_from_the_first_anchor_closes_the_path() {
+    // #501: closing a path by dragging out of its first anchor flickered between a close and a new
+    // path, and released at the wrong moment left the shape open. The press decides: the drag
+    // shapes the closing curve, symmetric, and the release closes the path wherever it ends.
+    let none = Mods::default();
+    let v = view();
+    let mut s = session();
+    s.select_tool("pen", v).unwrap();
+    for (x, y) in [(100.0, 300.0), (200.0, 300.0), (200.0, 400.0)] {
+        gesture(&mut s, &[(x, y)], none);
+    }
+    let id = s.doc().unwrap().selection.objects[0];
+    let pts: Vec<(f64, f64)> = (0..=12).map(|i| (100.0 + 5.0 * f64::from(i), 300.0 - 4.0 * f64::from(i))).collect();
+    s.pointer(&PointerEvent::new(PointerKind::Down, 100.0, 300.0), v).unwrap();
+    for &(x, y) in &pts[1..] {
+        s.pointer(&PointerEvent::new(PointerKind::Drag, x, y), v).unwrap();
+        let p = path(&s, id);
+        assert!(p.subpaths[0].closed && paths(&s).len() == 1, "closed throughout the drag, at ({x}, {y})");
+    }
+    s.pointer(&PointerEvent::new(PointerKind::Up, 160.0, 252.0), v).unwrap();
+    assert!(!s.in_interaction());
+    let sp = &path(&s, id).subpaths[0];
+    assert!(sp.closed && sp.anchors.len() == 3, "{sp:?}");
+    let a = sp.anchors[0];
+    assert_eq!((a.h_in, a.h_out), (Point::new(40.0, 348.0), Point::new(160.0, 252.0)), "symmetric");
+    assert_eq!(paths(&s).len(), 1);
+    // The next click starts a new path.
+    gesture(&mut s, &[(500.0, 500.0)], none);
+    assert_eq!(paths(&s).len(), 2);
+}
+
+#[test]
+fn pen_with_alt_converts_the_anchors_of_the_path_being_drawn() {
+    // #504: while drawing, Alt-click on a smooth anchor of the path makes it a corner and Alt-drag
+    // on a corner one pulls out smooth handles; the next click goes on drawing the path.
+    let (none, alt) = (Mods::default(), Mods { alt: true, ..Mods::default() });
+    let v = view();
+    let mut s = session();
+    s.select_tool("pen", v).unwrap();
+    gesture(&mut s, &[(100.0, 300.0)], none);
+    gesture(&mut s, &[(200.0, 300.0), (240.0, 300.0)], none);
+    gesture(&mut s, &[(300.0, 400.0)], none);
+    gesture(&mut s, &[(400.0, 300.0)], none);
+    let id = s.doc().unwrap().selection.objects[0];
+    assert!(smooth(path(&s, id).subpaths[0].anchors[1]));
+    assert_eq!(gesture(&mut s, &[(200.0, 300.0)], alt), 1);
+    let a = path(&s, id).subpaths[0].anchors[1];
+    assert!(!a.has_in() && !a.has_out(), "a corner: {a:?}");
+    assert_eq!(gesture(&mut s, &[(300.0, 400.0), (320.0, 400.0), (340.0, 400.0)], alt), 1);
+    let a = path(&s, id).subpaths[0].anchors[2];
+    assert!(smooth(a) && a.h_out == Point::new(340.0, 400.0), "smooth: {a:?}");
+    gesture(&mut s, &[(500.0, 400.0)], none);
+    assert_eq!((paths(&s).len(), path(&s, id).subpaths[0].anchors.len()), (1, 5));
+}

crates/engine/src/tests_prefs.rs

@@ -123,34 +123,37 @@ fn prefs_serde_round_trip_and_tolerates_missing_fields() {
     assert_eq!(partial.corner_radius, 12.0);
 }
 
-/// Performance › Graphics Processor (#306): power saving by default, set by value or label, kept
-/// through a save/load round trip, and a bad value is an error that changes nothing.
+/// Performance › Graphics Processor (#306, #502): automatic by default, set by value or label,
+/// kept through a save/load round trip, and a bad value (0.5.0's `powerSaving` among them) is an
+/// error that changes nothing.
 #[test]
-fn gpu_preference_defaults_to_power_saving_and_validates() {
+fn gpu_preference_defaults_to_automatic_and_validates() {
     let mut s = Session::new();
-    assert_eq!(s.prefs.gpu_preference, "powerSaving");
-    assert_eq!(s.execute("prefs.get", &json!({"key": "gpuPreference"})).unwrap(), json!("powerSaving"));
+    assert_eq!(s.prefs.gpu_preference, "automatic");
+    assert_eq!(s.execute("prefs.get", &json!({"key": "gpuPreference"})).unwrap(), json!("automatic"));
     s.execute("prefs.set", &json!({"key": "gpuPreference", "value": "highPerformance"})).unwrap();
     assert_eq!(s.prefs.gpu_preference, "highPerformance");
     s.execute("prefs.set", &json!({"key": "gpuPreference", "value": "Power Saving (integrated)"})).unwrap();
-    assert_eq!(s.prefs.gpu_preference, "powerSaving");
-    for bad in [json!("turbo"), json!(""), json!(1), json!(null), json!(["highPerformance"])] {
+    assert_eq!(s.prefs.gpu_preference, "lowPower");
+    s.execute("prefs.set", &json!({"key": "gpuPreference", "value": "automatic"})).unwrap();
+    assert_eq!(s.prefs.gpu_preference, "automatic");
+    for bad in [json!("powerSaving"), json!("turbo"), json!(""), json!(1), json!(null), json!(["highPerformance"])] {
         assert!(s.execute("prefs.set", &json!({"key": "gpuPreference", "value": bad})).is_err(), "{bad}");
-        assert_eq!(s.prefs.gpu_preference, "powerSaving");
+        assert_eq!(s.prefs.gpu_preference, "automatic");
     }
-    let p = Prefs { gpu_preference: "highPerformance".into(), ..Default::default() };
+    let p = Prefs { gpu_preference: "lowPower".into(), ..Default::default() };
     let back: Prefs = serde_json::from_value(p.to_json()).unwrap();
-    assert_eq!(back.gpu_preference, "highPerformance");
+    assert_eq!(back.gpu_preference, "lowPower");
     // Preference files written before the preference existed get the default.
     let old: Prefs = serde_json::from_value(json!({"gpuPerformance": true})).unwrap();
-    assert_eq!(old.gpu_preference, "powerSaving");
+    assert_eq!(old.gpu_preference, "automatic");
     let l = s.execute("prefs.list", &json!({})).unwrap();
     let row = l.as_array().unwrap().iter().find(|e| e["key"] == "gpuPreference").unwrap().clone();
     assert_eq!(row["category"], "Performance");
-    assert_eq!(row["options"], json!(["powerSaving", "highPerformance"]));
+    assert_eq!(row["options"], json!(["automatic", "lowPower", "highPerformance"]));
     s.execute("prefs.set", &json!({"key": "gpuPreference", "value": "highPerformance"})).unwrap();
     s.execute("prefs.reset", &json!({"category": "Performance"})).unwrap();
-    assert_eq!(s.prefs.gpu_preference, "powerSaving");
+    assert_eq!(s.prefs.gpu_preference, "automatic");
 }
 
 /// Selection & Anchor Display › Tolerance, Object Selection by Path Only and Command Click to

crates/engine/src/tooling.rs

@@ -82,6 +82,7 @@ impl Session {
     /// Switch to tool `id` without choosing it afresh (back from a temporary tool: a hidden
     /// perspective grid stays hidden), finishing any pending tool work first.
     pub fn switch_tool(&mut self, id: &str, view: ViewInfo) -> Result<()> {
+        self.give_back_tool(view)?;
         if self.tool.id() == id {
             return Ok(());
         }
@@ -89,9 +90,47 @@ impl Session {
         self.apply_actions(acts)?;
         self.keep_tool_settings();
         self.tool = self.make_tool(id);
+        if vectorcraft_tools::catalog::is_selection_tool(id) {
+            self.last_selection_tool = Some(self.tool.id());
+        }
         Ok(())
     }
 
+    /// The selection tool Cmd lends tool `id` for a drag: the one chosen last; until one is,
+    /// Direct Selection to the tools that edit anchors (the Pen) and Selection to the others.
+    /// None for the selection tools themselves and the view tools.
+    fn lent_tool(&self, id: &str) -> Option<&'static str> {
+        use vectorcraft_tools::catalog::{edits_anchors, is_selection_tool};
+        if is_selection_tool(id) || matches!(id, "hand" | "zoom" | "rotateView") {
+            return None;
+        }
+        Some(self.last_selection_tool.unwrap_or(if edits_anchors(id) { "directSelection" } else { "selection" }))
+    }
+
+    /// A press with Cmd held (Ctrl elsewhere) and any other tool than a selection tool: the
+    /// selection tool [`Self::lent_tool`] takes the gesture, pressing without Cmd (a plain click,
+    /// not Select Behind). The tool lent to stays as it was, unaware, until the release.
+    fn lend_selection_tool(&mut self, ev: &PointerEvent) -> PointerEvent {
+        if ev.kind != PointerKind::Down || !ev.mods.cmd || self.lender.is_some() {
+            return *ev;
+        }
+        let Some(id) = self.lent_tool(self.tool.id()) else { return *ev };
+        let lent = self.make_tool(id);
+        self.lender = Some(std::mem::replace(&mut self.tool, lent));
+        PointerEvent { mods: Mods { cmd: false, ..ev.mods }, ..*ev }
+    }
+
+    /// The lent selection tool's gesture is over: the tool it was lent to is back as it was (the
+    /// Pen goes on drawing its path).
+    pub(crate) fn give_back_tool(&mut self, view: ViewInfo) -> Result<()> {
+        let Some(lender) = self.lender.take() else { return Ok(()) };
+        let acts = self.with_tool_cx(view, |t, cx| t.deactivate(cx));
+        let r = self.apply_actions(acts);
+        self.keep_tool_settings();
+        self.tool = lender;
+        r.map(drop)
+    }
+
     /// A fresh `id` tool with the options it keeps ([`settings`]): its last values, from this
     /// session or a saved one.
     pub(crate) fn make_tool(&self, id: &str) -> Box<dyn Tool> {
@@ -212,13 +251,19 @@ impl Session {
         if let Some(r) = self.plane_widget_pointer(ev, view) {
             return r;
         }
+        let ev = &self.lend_selection_tool(ev);
         let acts = self.with_tool_cx(view, |t, cx| t.pointer(cx, ev));
-        self.take_tool_panic()?;
-        // A gesture may change options (Alt-drag sizes a Liquify brush): keep them.
+        let r = self.take_tool_panic().and_then(|()| {
+            // A gesture may change options (Alt-drag sizes a Liquify brush): keep them.
+            if ev.kind == PointerKind::Up {
+                self.keep_tool_settings();
+            }
+            self.apply_actions(acts)
+        });
         if ev.kind == PointerKind::Up {
-            self.keep_tool_settings();
+            self.give_back_tool(view)?;
         }
-        self.apply_actions(acts)
+        r
     }
 
     /// A guide dragged out of a ruler, whatever the tool: a vertical one out of the left ruler, a
@@ -325,9 +370,20 @@ impl Session {
     }
 
     /// The pointer the active tool shows at `p` (General › Use Precise Cursors makes the drawing
-    /// tools' a crosshair, [`Cursor::precise`]).
+    /// tools' a crosshair, [`Cursor::precise`]). With Cmd held, the pointer of the selection tool a
+    /// press would borrow ([`Self::lend_selection_tool`]).
     pub fn cursor(&mut self, p: Point, mods: Mods, view: ViewInfo) -> Cursor {
-        let c = self.with_tool_cx(view, |t, cx| t.cursor(cx, p, mods));
+        let lent = if mods.cmd && self.lender.is_none() { self.lent_tool(self.tool.id()) } else { None };
+        let c = match lent {
+            Some(id) => {
+                let lent = self.make_tool(id);
+                let own = std::mem::replace(&mut self.tool, lent);
+                let c = self.with_tool_cx(view, |t, cx| t.cursor(cx, p, Mods { cmd: false, ..mods }));
+                self.tool = own;
+                c
+            }
+            None => self.with_tool_cx(view, |t, cx| t.cursor(cx, p, mods)),
+        };
         if self.prefs.use_precise_cursors { c.precise() } else { c }
     }
 

crates/engine/tests/import_fuzz.rs

@@ -488,6 +488,10 @@ fn arb_rich_op() -> impl Strategy<Value = String> {
             "/Sh0 sh",
             "/Sh1 sh",
             "BT /F1 12 Tf 10 10 Td (Hi there) Tj [(a) -900 (b)] TJ ET",
+            // Lines wrapped in a frame, digits set apart by gaps, glyph outlines stroked (#508).
+            "BT /F1 10 Tf 10 80 Td (Wrapped line ) Tj 0 -12 Td (and its next ) Tj 0 -12 Td (end.) Tj ET",
+            "BT /F1 10 Tf 10 40 Td (3) Tj 20 0 Td (5331) Tj 40 0 Td (0106) Tj ET",
+            "0.5 w 10 10 m 14 18 l 18 10 l h S",
             "7 Tr",
             "q 10 10 50 50 re W n",
             "Q",
@@ -874,7 +878,8 @@ proptest! {
     }
 
     /// Hostile PostScript programs: operators in any order with any operands, opened and placed;
-    /// as Illustrator's too, its groups (`u` … `U`) unbalanced, deep and among clips.
+    /// as files in the legacy Illustrator format too (the creator line is what turns on its
+    /// documented `u` … `U` groups), the groups unbalanced, deep and among clips.
     #[test]
     fn eps_hostile_programs_never_panic(tokens in prop::collection::vec(arb_ps_token(), 0..60), illustrator in any::<bool>()) {
         let head = if illustrator { "%%Creator: Adobe Illustrator(R) 8.0\n%%EndComments\n/u {} def /U {} def" } else { "%%EndComments" };
@@ -948,7 +953,13 @@ fn arb_ps_token() -> impl Strategy<Value = String> {
             "/T3 << /FontType 3 /FontMatrix [0.1 0 0 0.1 0 0] /FontBBox [0 0 9 9] /Encoding [/a /b] /BuildChar { pop pop 9 0 setcharwidth 0 0 5 5 rectfill } >> definefont setfont",
             "/T4 << /FontType 3 /FontMatrix [1 0 0 1 0 0] /BuildGlyph { pop pop (x) show } /Encoding [/a] >> definefont setfont",
             "glyphshow", "xshow", "xyshow", "awidthshow", "kshow", "/a", "[1 2 3]",
-            // Executable strings and integer keys (Illustrator 8's procsets).
+            // Several data sources reading one file in turn, and sources of uneven lengths.
+            "/f currentfile /ASCIIHexDecode filter def", "{f 3 string readstring pop}", "{f 0 string readstring pop}", "true 3 colorimage",
+            "3 2 8 [3 0 0 2 0 0] {f 5 string readstring pop} {(ab)} {f 1 string readstring pop} true 3 colorimage",
+            "<< /ImageType 1 /Width 3 /Height 2 /BitsPerComponent 4 /Decode [0 1 0 1 0 1 0 1] /ImageMatrix [3 0 0 2 0 0] /MultipleDataSources true /DataSource [(a) (bc) {f 2 string readstring pop} (d)] >>",
+            // Local VM restored: dictionary changes undone, saves restored twice.
+            "/a 1 def save /a 2 def", "restore", "save dup restore", "1 dict save exch /k 1 put", "cachestatus", "/n 0 def save /n n 1 add store",
+            // Executable strings and keys other than names (PLRM 3rd ed., `cvx`, `load`).
             "(>>) cvx", "(1 2 add) cvx exec", "(x) cvx dup exec", "0 load", "1 { } def", "(mark) cvx cvlit"
         ])
         .prop_map(str::to_string),

crates/eps/src/import/data.rs

@@ -635,33 +635,51 @@ impl Interp<'_> {
 
     /// The bytes a data procedure gives, called until it gives an empty string or `n` bytes.
     fn gather(&mut self, p: &Obj, n: usize) -> Res<Vec<u8>> {
-        let mut out = vec![];
-        while out.len() < n {
-            self.call(p.clone())?;
-            let s = self.pop_str()?;
-            let s = s.borrow();
-            if s.is_empty() {
-                break;
-            }
-            self.alloc(s.len())?;
-            out.extend_from_slice(&s);
-        }
-        out.truncate(n);
-        Ok(out)
+        Ok(self.read_sources(&[Source::Proc(p.clone())], n, n)?.pop().unwrap_or_default())
     }
 
     /// `n` bytes of image data from `src` (zeros past its end).
     fn source_bytes(&mut self, src: &Source, n: usize) -> Res<Vec<u8>> {
-        let mut v = match src {
-            Source::File(f) => self.read(f, n)?,
-            Source::Str(s) if !s.is_empty() => s.iter().copied().cycle().take(n).collect(),
-            Source::Str(_) => vec![],
-            Source::Proc(p) => self.gather(p, n)?,
-        };
+        let mut v = self.read_sources(std::slice::from_ref(src), n, n)?.pop().unwrap_or_default();
         v.resize(n, 0);
         Ok(v)
     }
 
+    /// Up to `n` bytes from each of `sources`, read in turn as an image reads several data sources
+    /// (PLRM 3rd ed., §4.10 "Images" and `image`/`colorimage` in chapter 8: the sources are read
+    /// in turn, the same amount from each): each procedure called once a round (its string,
+    /// whatever its length), each file and string giving `step` bytes a round, until each has
+    /// given `n` bytes or ended. Procedures that read one file get their own rows that way.
+    fn read_sources(&mut self, sources: &[Source], n: usize, step: usize) -> Res<Vec<Vec<u8>>> {
+        let mut out: Vec<Vec<u8>> = vec![vec![]; sources.len()];
+        let mut ended = vec![false; sources.len()];
+        while out.iter().zip(&ended).any(|(o, e)| o.len() < n && !e) {
+            for ((src, o), e) in sources.iter().zip(out.iter_mut()).zip(ended.iter_mut()) {
+                if *e || o.len() >= n {
+                    continue;
+                }
+                let want = step.min(n - o.len());
+                let chunk = match src {
+                    Source::File(f) => self.read(f, want)?,
+                    // A string gives its bytes over and over.
+                    Source::Str(s) => {
+                        let at = o.len() % s.len().max(1);
+                        s.get(at..).unwrap_or_default().iter().chain(s.iter().cycle()).take(want).copied().collect()
+                    }
+                    Source::Proc(p) => {
+                        self.call(p.clone())?;
+                        let s = self.pop_str()?.to_vec();
+                        self.alloc(s.len())?;
+                        s
+                    }
+                };
+                *e = chunk.is_empty();
+                o.extend_from_slice(chunk.get(..chunk.len().min(n - o.len())).unwrap_or_default());
+            }
+        }
+        Ok(out)
+    }
+
     /// `eexec`: an encrypted font program follows. It is skipped (type is drawn in the app's
     /// fonts, by name): the font dictionary it would complete is defined as it is.
     fn eexec(&mut self) -> Res {
@@ -849,16 +867,12 @@ impl Interp<'_> {
         let multi = s.sources.len() > 1;
         let row_bits = if multi { s.w * bpc } else { s.w * n * bpc };
         let row = row_bits.div_ceil(8);
-        let planes: Vec<Vec<u8>> = if multi {
-            let mut v = vec![];
-            for src in &s.sources {
-                v.push(self.source_bytes(src, row * s.h)?);
-            }
-            v
-        } else {
-            let src = s.sources.first().ok_or(PsError::Ps("undefined", "DataSource".into()))?;
-            vec![self.source_bytes(src, row * s.h)?]
-        };
+        // Several sources are read in turn, a row at a time each (zeros past their ends).
+        let sources = if multi { &s.sources[..] } else { s.sources.get(..1).ok_or(PsError::Ps("undefined", "DataSource".into()))? };
+        let mut planes = self.read_sources(sources, row * s.h, if multi { row } else { row * s.h })?;
+        for p in &mut planes {
+            p.resize(row * s.h, 0);
+        }
         let max = ((1u32 << bpc.min(16)) - 1) as f64;
         let sample = |plane: &[u8], y: usize, i: usize| -> u32 {
             let bit = y * row * 8 + i * bpc;

crates/eps/src/import/interp.rs

@@ -49,6 +49,12 @@ pub(crate) struct Interp<'a> {
     /// Bytes asked for so far (see [`MAX_MEMORY`]).
     allocated: usize,
     seed: u32,
+    /// The `save`s not restored yet, oldest first.
+    saves: Vec<SaveMark>,
+    /// What dictionary entries were before they changed since the oldest `save` (dictionary,
+    /// key, old value): `restore` puts them back, as restoring local VM does (PLRM 3rd ed.,
+    /// §3.7.3 "Save and Restore": composite objects get the values they had at the `save`).
+    journal: Vec<(DictRef, Key, Option<Obj>)>,
     /// Where the error that is unwinding was raised (see [`Fault`]).
     pub fault: Option<Fault>,
     /// The width a Type 3 glyph procedure gave (`setcachedevice`, `setcharwidth`).
@@ -56,8 +62,8 @@ pub(crate) struct Interp<'a> {
     pub g: GState,
     pub saved: Vec<GState>,
     pub out: Out,
-    /// The program is an Illustrator file's: its `u` … `U` (written at the top level, whatever
-    /// its prolog defines them as) are groups.
+    /// The program is in the legacy Illustrator format: its group operators `u` … `U` (at the top
+    /// level, whatever its prolog defines them as) are groups (see the module docs of `import`).
     pub illustrator: bool,
 }
 
@@ -72,6 +78,13 @@ pub(crate) struct Fault {
 /// Most procedure names a [`Fault`] keeps.
 const FAULT_PROCS: usize = 3;
 
+/// Where a `save` was made: the graphics states saved and the journal's length then.
+#[derive(Clone, Copy, Debug)]
+struct SaveMark {
+    gstates: usize,
+    journal: usize,
+}
+
 fn new_dict() -> DictRef {
     Rc::new(RefCell::new(Dict::new()))
 }
@@ -143,6 +156,8 @@ impl<'a> Interp<'a> {
             ops: 0,
             allocated: 0,
             seed: 1,
+            saves: vec![],
+            journal: vec![],
             fault: None,
             glyph_width: None,
             g,
@@ -157,7 +172,7 @@ impl<'a> Interp<'a> {
         loop {
             let Some(o) = self.lex.next()? else { return Ok(()) };
             let o = self.scanned(o, self.lex.immediate)?;
-            // An Illustrator group begins before its `u` runs (`Some(true)`) and ends after its `U`
+            // A group begins before its `u` runs (`Some(true)`) and ends after its `U`
             // has (`Some(false)`).
             let group = match &o {
                 Obj::Exec(name) if self.illustrator => match &**name {
@@ -190,6 +205,7 @@ impl<'a> Interp<'a> {
         }
         self.dicts.clear();
         self.stack.clear();
+        self.journal.clear();
     }
 
     // ---------- the operand stack ----------
@@ -879,7 +895,7 @@ impl<'a> Interp<'a> {
                     }
                     Obj::Dict(d) => {
                         let key = k.key().ok_or(PsError::Ps("typecheck", String::new()))?;
-                        insert(&d, key, v)?;
+                        self.insert(&d, key, Some(v))?;
                         true
                     }
                     _ => return ps_err("typecheck", ""),
@@ -968,7 +984,7 @@ impl<'a> Interp<'a> {
                 let v = self.pop()?;
                 let k = self.pop()?.key().ok_or(PsError::Ps("typecheck", String::new()))?;
                 let d = self.dicts.last().cloned().ok_or(PsError::Ps("dictstackunderflow", String::new()))?;
-                insert(&d, k, v)?;
+                self.insert(&d, k, Some(v))?;
             }
             Load => {
                 let k = self.pop()?;
@@ -981,7 +997,7 @@ impl<'a> Interp<'a> {
                 let k = self.pop()?.key().ok_or(PsError::Ps("typecheck", String::new()))?;
                 let d = self.dicts.iter().rev().find(|d| d.borrow().contains_key(&k)).or(self.dicts.last()).cloned();
                 let d = d.ok_or(PsError::Ps("dictstackunderflow", String::new()))?;
-                insert(&d, k, v)?;
+                self.insert(&d, k, Some(v))?;
             }
             Known => {
                 let k = self.pop()?.key().ok_or(PsError::Ps("typecheck", String::new()))?;
@@ -1001,7 +1017,8 @@ impl<'a> Interp<'a> {
             }
             Undef => {
                 let k = self.pop()?.key().ok_or(PsError::Ps("typecheck", String::new()))?;
-                self.pop_dict()?.borrow_mut().remove(&k);
+                let d = self.pop_dict()?;
+                self.insert(&d, k, None)?;
             }
             CurrentDict => {
                 let d = self.dicts.last().cloned().ok_or(PsError::Ps("dictstackunderflow", String::new()))?;
@@ -1034,11 +1051,24 @@ impl<'a> Interp<'a> {
             }
             Save => {
                 self.gsave()?;
-                self.push(Obj::Save(self.saved.len()))?;
+                self.push(Obj::Save(self.saves.len()))?;
+                self.saves.push(SaveMark { gstates: self.saved.len(), journal: self.journal.len() });
             }
             Restore => {
-                let Obj::Save(level) = self.pop()? else { return ps_err("typecheck", "") };
-                while self.saved.len() >= level && !self.saved.is_empty() {
+                let Obj::Save(i) = self.pop()? else { return ps_err("typecheck", "") };
+                // A save restored already (or through an outer one) is no longer valid: §3.7.3,
+                // `invalidrestore`.
+                let mark = self.saves.get(i).copied().ok_or(PsError::Ps("invalidrestore", String::new()))?;
+                self.saves.truncate(i);
+                // The dictionaries as they were at the save, newest change undone first.
+                for (d, k, old) in self.journal.drain(mark.journal..).rev() {
+                    let mut d = d.borrow_mut();
+                    match old {
+                        Some(v) => d.insert(k, v),
+                        None => d.remove(&k),
+                    };
+                }
+                while self.saved.len() >= mark.gstates && !self.saved.is_empty() {
                     self.grestore();
                 }
             }
@@ -1083,9 +1113,12 @@ impl<'a> Interp<'a> {
                     self.push(Obj::Int(1 << 20))?;
                 }
             }
+            // An empty font cache of a device's sizes, in `cachestatus`'s order (PLRM 3rd ed.,
+            // chapter 8): bytes used and most, fonts used and most, glyphs used and most, and the
+            // most bytes one cached glyph may take (positive on a real device: programs divide by it).
             CacheStatus => {
-                for _ in 0..7 {
-                    self.push(Obj::Int(0))?;
+                for v in [0, 1 << 20, 0, 1000, 0, 10_000, 25_000] {
+                    self.push(Obj::Int(v))?;
                 }
             }
             StartJob => {
@@ -1143,7 +1176,9 @@ impl<'a> Interp<'a> {
             }
             Obj::Dict(d) => {
                 let from = self.pop_dict()?.borrow().clone();
-                d.borrow_mut().extend(from);
+                for (k, v) in from {
+                    self.insert(&d, k, Some(v))?;
+                }
                 self.push(Obj::Dict(d))?;
             }
             _ => return ps_err("typecheck", "copy"),
@@ -1219,6 +1254,26 @@ impl<'a> Interp<'a> {
         }
     }
 
+    /// Put `v` under `k` in `d` (`None`: remove it), within [`MAX_ALLOC`] entries; while a `save`
+    /// is open the old value is kept for `restore`.
+    fn insert(&mut self, d: &DictRef, k: Key, v: Option<Obj>) -> Res {
+        let old = {
+            let mut dm = d.borrow_mut();
+            if v.is_some() && dm.len() >= MAX_ALLOC && !dm.contains_key(&k) {
+                return Err(PsError::Limit("a dictionary grew too large"));
+            }
+            match v {
+                Some(v) => dm.insert(k.clone(), v),
+                None => dm.remove(&k),
+            }
+        };
+        if !self.saves.is_empty() {
+            self.alloc(2 * std::mem::size_of::<Obj>())?;
+            self.journal.push((d.clone(), k, old));
+        }
+        Ok(())
+    }
+
     // ---------- resources ----------
 
     /// The resources of `category`.
@@ -1293,16 +1348,6 @@ impl<'a> Interp<'a> {
     }
 }
 
-/// Put `v` under `k` in `d`, within [`MAX_ALLOC`] entries.
-fn insert(d: &DictRef, k: Key, v: Obj) -> Res {
-    let mut d = d.borrow_mut();
-    if d.len() >= MAX_ALLOC && !d.contains_key(&k) {
-        return Err(PsError::Limit("a dictionary grew too large"));
-    }
-    d.insert(k, v);
-    Ok(())
-}
-
 /// An array or string index.
 fn index(k: &Obj) -> Res<usize> {
     match *k {

crates/eps/src/import/mod.rs

@@ -11,9 +11,11 @@
 //! - `text`: fonts by name and type as point type; Type 3 fonts' glyphs drawn by their procedures.
 //! - `preview`: the previews a file carries, for when its PostScript can't be read.
 //!
-//! Clipped art comes in as clipping groups. In an Illustrator file (Illustrator 3–8, written with
-//! the prolog that defines its operators), the groups it writes (`u` … `U`, nested) come in as
-//! groups.
+//! Clipped art comes in as clipping groups. In a file in the legacy Illustrator format (versions
+//! 3–8, with the prolog that defines its operators), the group operators `u` … `U` (nested) come in
+//! as groups. The format's published specification documents its header comments (`%AI…`,
+//! `%%Creator`) and these operators: Adobe Illustrator File Format Specification, version 7.0
+//! (1998), listed by PRONOM at https://www.nationalarchives.gov.uk/PRONOM/fmt/423.
 //!
 //! The page is the file's `%%BoundingBox` (`%%HiResBoundingBox` when it has one), the first page
 //! of a PostScript file without one. A file whose program can't be read (an operator the
@@ -39,6 +41,8 @@ mod tests_fontnames;
 mod tests_generators;
 #[cfg(test)]
 mod tests_illustrator;
+#[cfg(test)]
+mod tests_images;
 
 use std::sync::Arc;
 
@@ -73,7 +77,8 @@ struct Dsc {
     /// `llx lly urx ury` in PostScript's default space.
     bbox: Option<[f64; 4]>,
     pages: Option<u32>,
-    /// Written by Illustrator (or in its format): `%AI…` comments, or Illustrator the creator.
+    /// In the legacy Illustrator format: its header has `%AI…` comments or names the app as the
+    /// creator (see the module docs for the specification).
     illustrator: bool,
 }
 

crates/eps/src/import/tests_generators.rs

@@ -42,7 +42,7 @@ fn a85_flate(data: &[u8]) -> String {
 }
 
 /// Pixel `(x, y)` (straight RGBA) of the first image in `d`.
-fn pixel(d: &Document, x: u32, y: u32) -> [u8; 4] {
+pub(super) fn pixel(d: &Document, x: u32, y: u32) -> [u8; 4] {
     let im = all(d)
         .into_iter()
         .find_map(|n| match &n.kind {
@@ -592,105 +592,52 @@ showpage"##;
     assert!(near(bounds(&meshes[1]), Rect::new(150.0, 90.0, 190.0, 140.0)), "{:?}", bounds(&meshes[1]));
 }
 
-/// Illustrator's EPS (CS and later, through 2026): procsets that define helpers with
-/// `bdf`/`ndf`/`ddf`, probe the level and version (`{version cvr} stopped`), switch VM with
-/// `currentglobal`/`setglobal`, save and restore the whole graphics state through
-/// `currentcolorrendering`, `rootfont`, the colour transfers, half-tone and flatness, set up
-/// categories and keep fonts by VM (`gcheck`), while the art is drawn with procedures of their own.
+/// A procset written as the PostScript Language Reference (3rd ed.) describes the Level 2 and 3
+/// facilities programs probe before drawing: a resource category made from `Generic` and
+/// resources defined and found in it (§3.9), local and global VM (`currentglobal`, `setglobal`,
+/// `gcheck`, §3.7.2), `internaldict` (§8.2), a halftone dictionary (§7.4), the font cache
+/// (`cachestatus`), `rootfont` and the colour rendering dictionary (§7.1), each guarded or
+/// probed through `stopped` (§3.10), saving the state they change and drawing with procedures of
+/// their own.
 #[test]
-fn illustrator_procsets_read_as_vectors() {
+fn level_2_and_3_probes_read_as_vectors() {
     let program = r##"%%BeginProlog
-%%BeginResource: procset Adobe_AGM_Utils 1.0 0
-systemdict /setpacking known { currentpacking true setpacking } if
-userdict /Adobe_AGM_Utils 75 dict dup begin put
-/bdf { bind def } bind def
-/nd { null def } bdf
-/xdf { exch def } bdf
-/ddf { put } bdf
-/xddf { 3 -1 roll put } bdf
-/ndf { exch dup where { pop pop pop } { xdf } ifelse } def
-/gx { get exec } bdf
-/ps_level /languagelevel where { pop systemdict /languagelevel gx } { 1 } ifelse def
-/level2 ps_level 2 ge def
-/level3 ps_level 3 ge def
-/ps_version { version cvr } stopped { -1 } if def
-/set_gvm { currentglobal exch setglobal } bdf
-/reset_gvm { setglobal } bdf
-/makereadonlyarray { /packedarray where { pop packedarray } { array astore readonly } ifelse } bdf
-/GSTATE 22 dict def
-/get_gstate {
-  GSTATE begin
-  /clr_spc currentcolorspace def
-  mark currentcolor counttomark array astore /clr_comps xdf pop
-  /fnt rootfont def
-  /lw currentlinewidth def /lc currentlinecap def /lj currentlinejoin def /ml currentmiterlimit def
-  currentdash /dsh_o xdf /dsh_a xdf
-  /sa currentstrokeadjust def
-  /crd currentcolorrendering def
-  /op currentoverprint def
-  /bg currentblackgeneration cvlit def
-  /ucr currentundercolorremoval cvlit def
-  currentcolortransfer cvlit /gy_x xdf cvlit /b_x xdf cvlit /g_x xdf cvlit /r_x xdf
-  /ht currenthalftone def
-  /flt currentflat def
-  end
-} def
-/set_gstate {
-  GSTATE begin
-  clr_spc setcolorspace clr_comps aload pop setcolor
-  fnt setfont lw setlinewidth lc setlinecap lj setlinejoin ml setmiterlimit dsh_a dsh_o setdash
-  sa setstrokeadjust crd setcolorrendering op setoverprint
-  bg cvx setblackgeneration ucr cvx setundercolorremoval
-  r_x cvx g_x cvx b_x cvx gy_x cvx setcolortransfer
-  ht /HalftoneType get dup 9 eq exch 100 eq or { ht sethalftone } if
-  flt setflat
-  end
-} def
-/ct_tst { 1183615869 internaldict pop } stopped pop
-currentdict readonly pop
+/ExampleKit 40 dict def ExampleKit begin
+/defp { bind def } bind def
+% A category of our own, implemented by a copy of Generic's dictionary (§3.9.2).
+/Generic /Category findresource dup length dict copy /ExampleShapes exch /Category defineresource pop
+/Card << /W 80 /H 50 >> /ExampleShapes defineresource pop
+% VM: a dictionary made in global VM, then the VM mode put back.
+/wasglobal currentglobal def true setglobal /Shared 4 dict def wasglobal setglobal
+/vm Shared gcheck { (global) } { (local) } ifelse def
+% Probes that fail on some interpreters, inside stopped.
+/hasinternal { 1183615869 internaldict } stopped { false } { pop true } ifelse def
+/screen << /HalftoneType 1 /Frequency 85 /Angle 15 /SpotFunction { 180 mul cos exch 180 mul cos add 2 div } >> def
+/oldscreen currenthalftone def
+/rendering currentcolorrendering def
+/cache [ cachestatus ] def
+/frame { /h exch def /w exch def moveto w 0 rlineto 0 h rlineto w neg 0 rlineto closepath } defp
 end
-systemdict /setpacking known { setpacking } if
-%%EndResource
-%%BeginResource: procset Adobe_AGM_Core 2.0 0
-userdict /Adobe_AGM_Core 200 dict dup begin put
-/AGMCORE_str256 256 string def
-/AGMCORE_deviceDPI 72 0 matrix defaultmatrix dtransform dup mul exch dup mul add sqrt def
-/AGMCORE_distilling /product where { pop systemdict /setdistillerparams known product (Adobe PostScript Parser) ne and } { false } ifelse def
-/AGMCORE_producing_seps currentpagedevice /Separations 2 copy known { get } { pop pop false } ifelse def
-/AGMCORE_page_size currentpagedevice /PageSize get def
-/Generic /Category findresource dup length dict copy /Category defineresource pop
-/AGMCORE_mo { moveto } def /AGMCORE_li { lineto } def /AGMCORE_cv { curveto } def /AGMCORE_cp { closepath } def
-/AGMCORE_rgb { setrgbcolor } def /AGMCORE_cmyk { setcmykcolor } def
-/doc_setup { Adobe_AGM_Utils begin get_gstate end } def
-/page_setup { Adobe_AGM_Utils begin set_gstate end } def
-end
-%%EndResource
-%%BeginResource: procset Adobe_CoolType_Core 2.31 0
-userdict /CT_Core 20 dict dup begin put
-/GVMFonts 10 dict def /LVMFonts 10 dict def
-/VMDictPut { dup gcheck { GVMFonts } { LVMFonts } ifelse 3 1 roll put } bind def
-/copyfont { currentglobal exch dup gcheck setglobal dup length dict copy exch setglobal } bind def
-end
-%%EndResource
 %%EndProlog
 %%BeginSetup
-Adobe_AGM_Core /doc_setup get exec
-CT_Core begin /Body /Helvetica findfont copyfont VMDictPut end
+ExampleKit begin
+screen sethalftone
+/Helvetica 12 selectfont
+/face rootfont /FontName get def
 %%EndSetup
 %%Page: 1 1
-%%BeginPageSetup
-Adobe_AGM_Core /page_setup get exec
-%%EndPageSetup
-Adobe_AGM_Core begin
-/mo { AGMCORE_mo } def /li { AGMCORE_li } def /cv { AGMCORE_cv } def /cp { AGMCORE_cp } def
-0 0.94 0.94 0.12 AGMCORE_cmyk
-10 140 mo 90 140 li 90 90 li 10 90 li cp fill
-0.2 0.4 0.8 AGMCORE_rgb
-100 20 mo 150 80 180 0 190 60 cv 2 setlinewidth stroke
-0 setgray CT_Core /LVMFonts get /Body get 12 scalefont setfont 10 30 moveto (Art) show
+gsave
+0 0.94 0.94 0.12 setcmykcolor
+10 90 /Card /ExampleShapes findresource dup /W get exch /H get frame fill
+0.2 0.4 0.8 setrgbcolor 2 setlinewidth 100 20 moveto 150 80 180 0 190 60 curveto stroke
+grestore
+% Each probe answered as the reference says: draw only when it did.
+vm length 5 eq hasinternal and rendering type /dicttype eq and cache length 7 eq and face /Helvetica eq and
+{ 0 setgray 10 30 moveto (Art) show } if
+oldscreen sethalftone
 end
 showpage"##;
-    let r = open("Adobe Illustrator(R) 30.0", program);
+    let r = open("Example Generator 1.0", program);
     let d = &r.document;
     let rect = all(d).into_iter().find(|n| fill(n).and_then(Paint::color) == Some(Color::cmyk(0.0, 0.94, 0.94, 0.12))).unwrap();
     assert!(near(bounds(&rect), Rect::new(10.0, 10.0, 90.0, 60.0)), "{:?}", bounds(&rect));
@@ -950,44 +897,65 @@ fn hostile_patterns_glyphs_and_shadings_end() {
     assert_eq!(objects(&r.document).len(), 1);
 }
 
-/// Illustrator 8 EPS (what stock art often comes as, #474): its gradient procset builds shading
-/// dictionaries with `bd` … `ed`, where `ed` is an executable string (`(>>) cvx`, or a Level 1
-/// dictionary builder), and its `discard` runs procedures it `load`s by integer keys.
+/// Executable strings and keys other than names (#474): `cvx` makes a string executable, and
+/// running it runs its text (PLRM 3rd ed. §3.3.1, `cvx`, `exec`); `load` takes any key (§8.2).
+/// A program closes its shading dictionaries with an executable string (`>>` at Level 2 and up,
+/// else a dictionary built with `counttomark`), and runs procedures it keeps under integer keys
+/// through `stopped`.
 #[test]
-fn illustrator_8_gradients_and_executable_strings() {
+fn executable_strings_and_integer_keys() {
     let program = r##"%%BeginProlog
-userdict /AGM_Gradient 20 dict dup begin put
-/AGM_Gradient_private 201 dict def
-/initialize {
-  AGM_Gradient begin AGM_Gradient_private begin
-  /bd systemdict /mark get def
-  /ed /languagelevel where { pop languagelevel 2 ge } { false } ifelse
-    { (>>) } { (counttomark 2 idiv dup dict begin {def} repeat pop currentdict end) } ifelse cvx def
-  /ed1 (counttomark 2 idiv dup dict begin {def} repeat pop currentdict end) cvx def
-  end end
-} def
-userdict /discardDict 4 dict dup begin put
-0 { 0 1 0 setrgbcolor } def
-2 { 0 0 1 setrgbcolor } def
+/ShadeKit 12 dict def ShadeKit begin
+% A Level 1 way to make a dictionary of the pairs above a mark.
+/pairs (counttomark 2 idiv dict begin { counttomark 0 eq { exit } if def } loop pop currentdict end) cvx def
+/close /languagelevel where { pop languagelevel 2 ge } { false } ifelse { (>>) } { (pairs) } ifelse cvx def
+/open /mark load def
+/actions 3 dict def actions begin 0 { 0 1 0 setrgbcolor } def 1 { 1 0 0 setrgbcolor } def end
+/act { actions 1 index known { actions begin load end stopped pop } { pop } ifelse } bind def
 end
-/gt38? false def
-/discard { discardDict begin /endString exch def gt38? { 2 add } if load stopped pop end } bind def
 %%EndProlog
-initialize
-AGM_Gradient begin AGM_Gradient_private begin
-bd /ShadingType 3 /ColorSpace /DeviceRGB
-  /Function bd /FunctionType 2 /Domain [0 1] /C0 [1 1 0] /C1 [0 0.5 0] /N 1 ed
-  /Extend [true true] /Coords [50 50 0 50 50 40] ed
+ShadeKit begin
+open /ShadingType 3 /ColorSpace /DeviceRGB
+  /Function open /FunctionType 2 /Domain [0 1] /C0 [1 1 0] /C1 [0 0.5 0] /N 1 close
+  /Extend [true true] /Coords [50 50 0 50 50 40] close
 gsave 10 10 80 80 rectclip shfill grestore
-bd /Width 3 ed1 /Width get 3 eq { 0 (%AI5_EndPalette) discard 10 10 20 20 rectfill } if
-end end
+mark /Width 3 pairs /Width get 3 eq { 0 act 10 10 20 20 rectfill } if
+2 act
+end
 (x) cvx xcheck (x) cvx cvlit xcheck not and { 50 50 10 10 rectfill } if
 showpage"##;
-    let r = open("Adobe Illustrator(R) 8.0", program);
+    let r = open("Example Generator 1.0", program);
     let d = &r.document;
     let Some(Paint::Gradient(g)) = all(d).into_iter().find_map(|n| fill(&n).cloned()) else { panic!("no gradient") };
     assert_eq!(g.gradient.kind, vectorcraft_color::GradientKind::Radial);
-    // `discard` ran the procedure under key 0 (green), not the one under 2.
+    // `act` ran the procedure under key 0 (green); there is none under key 2.
     assert!(all(d).iter().any(|n| fill(n).and_then(Paint::color) == Some(Color::rgb(0.0, 1.0, 0.0))));
     assert_eq!(objects(d).len(), 3);
 }
+
+/// `restore` puts local VM back as it was at the `save` (PLRM 3rd ed., §3.7.3 "Save and
+/// Restore"): dictionaries get back the entries they had, whatever changed them. A program that
+/// keeps a count of the saves it has open in a dictionary, and refuses to go past a depth, reads
+/// to its end only if each `restore` puts the count back (part of #505: files with many images,
+/// each drawn between `save` and `restore`).
+#[test]
+fn restore_puts_dictionaries_back() {
+    let r = read(
+        "/Depth 2 dict def Depth /open 0 put \
+         /enter { save Depth /open get 1 add dup 8 gt { rangecheck } if Depth exch /open exch put } def \
+         1 1 100 { pop enter 0 0 1 1 rectfill restore } for Depth /open get 0 eq { 10 10 5 5 rectfill } if",
+    );
+    clean(&r);
+    assert_eq!(objects(&r.document).len(), 101);
+    // `def`, `store`, `put`, `undef` and dictionary `copy` are undone, newest first.
+    super::tests::check(
+        "/a 1 def /d 2 dict def d /k 1 put save /a 2 def /b 3 def d /k 2 put d /k undef 1 dict dup /z 9 put d copy pop \
+         /a 4 store restore a 1 eq /b where not and d /k get 1 eq and d /z known not and",
+    );
+    // A save restored (itself, or through an outer one) is no longer valid: `invalidrestore`.
+    super::tests::check("save dup restore { restore } stopped");
+    super::tests::check("save save exch restore { restore } stopped");
+    // `cachestatus` gives a device's cache sizes; its last, the most bytes one cached glyph may
+    // take, is positive (chapter 8), and programs divide by it.
+    super::tests::check("cachestatus 7 1 roll 6 { pop } repeat 0 gt");
+}

crates/eps/src/import/tests_illustrator.rs

@@ -20,6 +20,9 @@ fn ai(header: &str, ugroup: &str, body: &str) -> Vec<u8> {
     .into_bytes()
 }
 
+/// A legacy Illustrator format header: the reader takes `u` … `U` as groups only in files whose
+/// header says they are in that format (`%AI…` comments or the creator, which the format's
+/// published specification documents; see the `import` module docs).
 const AI8: &str = "%%Creator: Adobe Illustrator(R) 8.0\n%AI5_FileFormat 4.0\n";
 
 /// A triangle filled at `x`.

crates/eps/src/import/tests_images.rs

@@ -0,0 +1,130 @@
+//! Image data read as the PostScript Language Reference (3rd ed.) defines it: several data sources
+//! read in turn (§4.10 "Images", `image` and `colorimage` in chapter 8), rows padded to a whole
+//! byte at every bit depth and odd widths (§4.10), and Flate predictors undone row by row (§3.13,
+//! `FlateDecode` parameters) (#498).
+
+use super::tests::read;
+use super::tests_generators::pixel;
+
+/// Each pixel of the first image, row by row.
+fn pixels(r: &crate::Imported, w: u32, h: u32) -> Vec<[u8; 4]> {
+    assert!(!r.preview && r.warnings.is_empty(), "{:?}", r.warnings);
+    (0..h).flat_map(|y| (0..w).map(move |x| (x, y))).map(|(x, y)| pixel(&r.document, x, y)).collect()
+}
+
+/// A CMYK image whose four data sources are procedures reading one file, a row of one ink each:
+/// the image operator calls them in turn, so each gets its own rows. Read one after the other,
+/// the cyan source took the first four rows of all four inks and the image came out in
+/// horizontal bands (#498).
+#[test]
+fn procedures_reading_one_file_are_read_in_turn() {
+    // 3 × 2 pixels; rows: C M Y K of row 0, then of row 1.
+    let rows = ["ff0000", "00ff00", "000000", "000000", "000000", "000000", "ffff00", "0000ff"];
+    let r = read(&format!(
+        "/DeviceCMYK setcolorspace 30 20 scale /f currentfile /ASCIIHexDecode filter def \
+         << /ImageType 1 /Width 3 /Height 2 /BitsPerComponent 8 /Decode [0 1 0 1 0 1 0 1] /ImageMatrix [3 0 0 -2 0 2] \
+         /MultipleDataSources true /DataSource [ {{f 3 string readstring pop}} {{f 3 string readstring pop}} \
+         {{f 3 string readstring pop}} {{f 3 string readstring pop}} ] >> image\n{}>",
+        rows.concat()
+    ));
+    let cyan = [0, 174, 239, 255];
+    let magenta = [236, 0, 140, 255];
+    let yellow = [255, 242, 0, 255];
+    let black = [35, 31, 32, 255];
+    let white = [255, 255, 255, 255];
+    let px = pixels(&r, 3, 2);
+    let near = |a: [u8; 4], b: [u8; 4]| a.iter().zip(b).all(|(x, y)| x.abs_diff(y) <= 40);
+    let want = [cyan, magenta, white, yellow, yellow, black];
+    assert!(px.iter().zip(want).all(|(a, b)| near(*a, b)), "{px:?}");
+
+    // The operand form: `{r} {g} {b} true 3 colorimage`, procedures reading one file.
+    let r = read(
+        "30 20 scale /f currentfile /ASCIIHexDecode filter def \
+         3 2 8 [3 0 0 -2 0 2] {f 3 string readstring pop} {f 3 string readstring pop} {f 3 string readstring pop} true 3 colorimage\n\
+         ff0000 00ff00 0000ff 102030 405060 708090>",
+    );
+    assert_eq!(pixels(&r, 3, 2), [[255, 0, 0, 255], [0, 255, 0, 255], [0, 0, 255, 255], [16, 64, 112, 255], [32, 80, 128, 255], [48, 96, 144, 255]]);
+}
+
+/// Separate strings and files as the sources: each is read for its own plane, whatever the row.
+#[test]
+fn separate_sources_keep_their_planes() {
+    let r = read("30 20 scale 3 2 8 [3 0 0 -2 0 2] <ff0000102030> <00ff00405060> <0000ff708090> true 3 colorimage");
+    assert_eq!(pixels(&r, 3, 2), [[255, 0, 0, 255], [0, 255, 0, 255], [0, 0, 255, 255], [16, 64, 112, 255], [32, 80, 128, 255], [48, 96, 144, 255]]);
+}
+
+/// Rows of an odd width at 1, 2, 4, 12 and 16 bits a sample start at a byte (their last byte
+/// padded), in one source and in several.
+#[test]
+fn rows_of_every_depth_start_at_a_byte() {
+    // 3 pixels a row, two rows: 0, max, mid / max, 0, 0 (grey), each row padded.
+    let cases = [
+        (1, "a0 80"),                  // 101(00000) 100(00000)
+        (2, "cc c0"),                  // 11 00 11 (00), 11 00 00 (00)
+        (4, "f0 80 f0 00"),            // f 0 8 (0), f 0 0 (0)
+        (12, "fff0008000 fff0000000"), // fff 000 800 (0), fff 000 000 (0)
+        (16, "ffff00008000 ffff00000000"),
+    ];
+    for (bpc, data) in cases {
+        let data = data.replace(' ', "");
+        let r = read(&format!("30 20 scale 3 2 {bpc} [3 0 0 -2 0 2] <{data}> image"));
+        let px: Vec<u8> = pixels(&r, 3, 2).iter().map(|p| p[0]).collect();
+        let want: &[u8] = match bpc {
+            1 => &[255, 0, 255, 255, 0, 0],
+            2 => &[255, 0, 255, 255, 0, 0],
+            4 => &[255, 0, 136, 255, 0, 0],
+            12 => &[255, 0, 128, 255, 0, 0],
+            _ => &[255, 0, 128, 255, 0, 0],
+        };
+        assert_eq!(px, want, "{bpc} bits");
+    }
+    // Several 4-bit sources, odd width: each plane's rows padded on their own.
+    let r = read("30 20 scale 3 2 4 [3 0 0 -2 0 2] <f0f000f0> <0f00f000> <00f00ff0> true 3 colorimage");
+    let (on, off) = (255, 0);
+    let want = [[on, off, off], [off, on, off], [on, off, on], [off, on, off], [off, off, on], [on, off, on]];
+    assert_eq!(pixels(&r, 3, 2), want.map(|[r, g, b]| [r, g, b, 255]));
+}
+
+/// A PNG-predicted Flate image of an odd width: every row filter (None, Sub, Up, Average, Paeth)
+/// undone on its own row.
+#[test]
+fn predicted_rows_of_an_odd_width() {
+    // 3 RGB pixels a row, five rows; each row predicted with its own filter.
+    let raw: Vec<[u8; 9]> = (0..5u8).map(|y| std::array::from_fn(|i| (i as u8).wrapping_mul(29).wrapping_add(y.wrapping_mul(53)))).collect();
+    let mut encoded = vec![];
+    let mut prev = [0u8; 9];
+    for (kind, row) in raw.iter().enumerate() {
+        encoded.push(kind as u8);
+        for i in 0..9 {
+            let a = if i >= 3 { row[i - 3] } else { 0 };
+            let b = prev[i];
+            let c = if i >= 3 { prev[i - 3] } else { 0 };
+            let pred = match kind {
+                1 => a,
+                2 => b,
+                3 => ((u16::from(a) + u16::from(b)) / 2) as u8,
+                4 => {
+                    let p = i16::from(a) + i16::from(b) - i16::from(c);
+                    let (pa, pb, pc) = ((p - i16::from(a)).abs(), (p - i16::from(b)).abs(), (p - i16::from(c)).abs());
+                    if pa <= pb && pa <= pc {
+                        a
+                    } else if pb <= pc {
+                        b
+                    } else {
+                        c
+                    }
+                }
+                _ => 0,
+            };
+            encoded.push(row[i].wrapping_sub(pred));
+        }
+        prev = *row;
+    }
+    let r = read(&format!(
+        "/DeviceRGB setcolorspace 30 50 scale << /ImageType 1 /Width 3 /Height 5 /BitsPerComponent 8 /Decode [0 1 0 1 0 1] /ImageMatrix [3 0 0 -5 0 5] \
+         /DataSource currentfile /ASCII85Decode filter << /Predictor 15 /Colors 3 /Columns 3 >> /FlateDecode filter >> image\n{}",
+        crate::ps::ascii85(&crate::ps::deflate(&encoded))
+    ));
+    let want: Vec<[u8; 4]> = raw.iter().flat_map(|row| (0..3).map(move |x| [row[3 * x], row[3 * x + 1], row[3 * x + 2], 255])).collect();
+    assert_eq!(pixels(&r, 3, 5), want);
+}

crates/mcp/src/lib.rs

@@ -49,6 +49,8 @@ mod tests_links;
 #[cfg(test)]
 mod tests_liquify;
 #[cfg(test)]
+mod tests_pen;
+#[cfg(test)]
 mod tests_persp;
 #[cfg(test)]
 mod tests_place;

crates/mcp/src/tests_pen.rs

@@ -0,0 +1,66 @@
+//! The Pen over MCP, headless: `pointer_gesture` with the modifiers held as on the desktop.
+
+use serde_json::{Value, json};
+
+use crate::{Backend, Headless, call_tool};
+
+fn text(r: &crate::ToolResult) -> Value {
+    assert!(!r.is_error, "{r:?}");
+    serde_json::from_str(r.content[0]["text"].as_str().unwrap()).unwrap()
+}
+
+/// A press at the first point, drags through the others, the release at the last.
+fn gesture(pts: &[(f64, f64)]) -> Value {
+    let (first, last) = (pts[0], pts[pts.len() - 1]);
+    let mut events = vec![json!({"kind": "down", "x": first.0, "y": first.1})];
+    events.extend(pts[1..].iter().map(|(x, y)| json!({"kind": "drag", "x": x, "y": y})));
+    events.push(json!({"kind": "up", "x": last.0, "y": last.1}));
+    json!({ "events": events })
+}
+
+/// The anchors of each path, in paint order.
+fn paths(h: &Headless) -> Vec<Vec<vectorcraft_geom::Anchor>> {
+    let mut v = vec![];
+    h.session.doc().unwrap().doc.walk(|n| {
+        if let Some(p) = n.path_data() {
+            v.push(p.subpaths.iter().flat_map(|s| s.anchors.clone()).collect());
+        }
+    });
+    v
+}
+
+/// #494: Cmd held at the press borrows Direct Selection from the Pen; the path goes on afterwards.
+#[test]
+fn cmd_with_the_pen_edits_the_path_being_drawn() {
+    let mut h = Headless::new();
+    h.call("engine.execute", json!({"command": "file.new", "params": {"width": 800, "height": 600}})).unwrap();
+    text(&call_tool(&mut h, "select_tool", &json!({"tool": "pen"})));
+    text(&call_tool(&mut h, "pointer_gesture", &gesture(&[(100.0, 300.0)])));
+    text(&call_tool(&mut h, "pointer_gesture", &gesture(&[(200.0, 300.0), (250.0, 300.0)])));
+    let mut drag = gesture(&[(250.0, 300.0), (250.0, 280.0), (250.0, 263.0)]);
+    drag["mods"] = json!({"cmd": true});
+    let r = text(&call_tool(&mut h, "pointer_gesture", &drag));
+    assert_eq!(r["tool"], "pen", "{r}");
+    assert_eq!(paths(&h)[0][1].h_out, vectorcraft_geom::Point::new(250.0, 263.0));
+    text(&call_tool(&mut h, "pointer_gesture", &gesture(&[(300.0, 350.0)])));
+    assert_eq!(paths(&h).iter().map(Vec::len).collect::<Vec<_>>(), [3], "the same path, three anchors");
+}
+
+/// #501: a drag out of the first anchor closes the path, shaping the closing curve.
+#[test]
+fn a_drag_from_the_first_anchor_closes_the_path() {
+    let mut h = Headless::new();
+    h.call("engine.execute", json!({"command": "file.new", "params": {"width": 800, "height": 600}})).unwrap();
+    text(&call_tool(&mut h, "select_tool", &json!({"tool": "pen"})));
+    for p in [(100.0, 300.0), (200.0, 300.0), (200.0, 400.0)] {
+        text(&call_tool(&mut h, "pointer_gesture", &gesture(&[p])));
+    }
+    let close: Vec<(f64, f64)> = (0..=12).map(|i| (100.0 + 5.0 * f64::from(i), 300.0 - 4.0 * f64::from(i))).collect();
+    text(&call_tool(&mut h, "pointer_gesture", &gesture(&close)));
+    let d = &h.session.doc().unwrap().doc;
+    let mut closed = vec![];
+    d.walk(|n| closed.extend(n.path_data().map(|p| p.is_closed())));
+    assert_eq!(closed, [true], "one path, closed");
+    let first = paths(&h)[0][0];
+    assert_eq!((first.h_in, first.h_out), (vectorcraft_geom::Point::new(40.0, 348.0), vectorcraft_geom::Point::new(160.0, 252.0)));
+}

crates/pdf/src/import.rs

@@ -23,7 +23,7 @@ use crate::import_color::{Colors, Native};
 use crate::import_mask::{MaskSpec, contains, is_rectangle, luminance, mask_spec, white_cover};
 use crate::import_scan::{MAX_NESTING, Ocgs, Scan, all_on, hides_forms, scan_page, tag_key};
 use crate::import_shading::{clipped, extend_clip, fold_stop_opacity, mesh_shading, shading_gradient};
-use crate::import_text::{Families, Look, Placement, TextLine, Upright};
+use crate::import_text::{Families, LineFacts, Look, Placement, TextLine, Upright};
 use crate::{CropTo, ImportOptions, ImportReport, PdfError, TextAs};
 
 /// The name of the paths text imports as.
@@ -76,6 +76,33 @@ fn place_group(g: usize, ocgs: &Ocgs, slots: &mut Vec<Slot>, nesting: &mut Nesti
     slots.push(Slot::Group(child));
 }
 
+/// The top-level group that group `g` is listed under (`g` itself when it isn't a sublayer).
+fn top_group(g: usize, ocgs: &Ocgs) -> usize {
+    let mut top = g;
+    for _ in 0..=MAX_NESTING {
+        match ocgs.list.get(top).and_then(|o| o.parent) {
+            Some(parent) => top = parent,
+            None => break,
+        }
+    }
+    top
+}
+
+/// Merge the top-level groups a page marks (`page`, in the order it first marks each, its empty
+/// ones too) into the stacking order of the pages before (`order`, bottom first; `known`: its
+/// groups). A group new to it goes right below the first group the page marks after it that it
+/// has: a layer whose art starts on a later page keeps its place among the others (#508).
+fn merge_order(order: &mut Vec<usize>, known: &mut HashSet<usize>, page: &[usize]) {
+    let mut above = None;
+    for &g in page.iter().rev() {
+        if known.insert(g) {
+            let at = above.and_then(|a| order.iter().position(|&x| x == a)).unwrap_or(order.len());
+            order.insert(at, g);
+        }
+        above = Some(g);
+    }
+}
+
 /// The layer of group `g`, in `color`: its art and sublayers. `None` for a group that isn't read.
 fn group_layer(
     b: &mut Builder<'_>,
@@ -166,6 +193,8 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     let mut slots: Vec<Slot> = vec![];
     let mut group_art: HashMap<usize, Vec<Arc<Node>>> = HashMap::new();
     let mut nesting = Nesting::new();
+    // The top-level groups in the order the pages mark them, bottom first.
+    let (mut order, mut known) = (vec![], HashSet::new());
     for (i, &number) in picked.iter().enumerate() {
         let Some(page) = pages.get(number) else { continue };
         // The chosen box sits at (x, 0); the page draws round it.
@@ -175,6 +204,11 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
         let mut ctx = Context::new(xf, ab, &cache, pdf.xref(), settings.clone());
         b.page = ab;
         let scan = scan_page(page, &mut ocgs, all_on, &mut b.fonts);
+        if route {
+            let mut seen = HashSet::new();
+            let marked: Vec<usize> = scan.tags.iter().filter_map(|(_, g)| g.map(|g| top_group(g, &ocgs))).filter(|g| seen.insert(*g)).collect();
+            merge_order(&mut order, &mut known, &marked);
+        }
         b.begin_page(scan);
         interpret_page(page, &mut ctx, &mut b);
         let mut parts = b.end_page();
@@ -239,8 +273,25 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
     if placeholder {
         return Err(PdfError::PlaceholderOnly);
     }
+    // A group the pages mark but draw nothing in is an empty layer, as the editor had it.
+    for &g in &order {
+        if !nesting.contains_key(&g) {
+            slots.push(Slot::Group(g));
+        }
+    }
+    // The groups' layers stack as the pages mark them (the art outside them stays where it was
+    // drawn): a group that first paints on a later page doesn't go on top of the others.
+    let rank: HashMap<usize, usize> = order.iter().enumerate().map(|(i, &g)| (g, i)).collect();
+    let at: Vec<usize> = slots.iter().enumerate().filter(|(_, s)| matches!(s, Slot::Group(_))).map(|(i, _)| i).collect();
+    let mut stacked: Vec<usize> = slots.iter().filter_map(|s| if let Slot::Group(g) = s { Some(*g) } else { None }).collect();
+    stacked.sort_by_key(|g| rank.get(g).copied().unwrap_or(usize::MAX));
+    for (i, g) in at.into_iter().zip(stacked) {
+        if let Some(s) = slots.get_mut(i) {
+            *s = Slot::Group(g);
+        }
+    }
     for (n, slot) in slots.into_iter().enumerate() {
-        let layer = match slot {
+        let mut layer = match slot {
             Slot::Page(l) => *l,
             // Sublayers take their top-level layer's colour.
             Slot::Group(g) => match group_layer(&mut b, g, &ocgs, &nesting, &mut group_art, LayerColor::Preset((n % 27) as u8)) {
@@ -248,6 +299,9 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
                 None => continue,
             },
         };
+        if let Some(art) = layer.children_mut() {
+            crate::import_lines::rebuild(art, &b.lines);
+        }
         doc.layers.push(Arc::new(layer));
     }
     for (k, blob) in b.images.drain() {
@@ -567,6 +621,8 @@ struct Builder<'p> {
     nested: u32,
     /// The last filled path: its node and its outline (a stroke of the same outline joins it).
     last_fill: Option<(NodeId, BezPath)>,
+    /// What each line of type made tells beyond its text object ([`crate::import_lines`]).
+    lines: HashMap<NodeId, LineFacts>,
 }
 
 fn blend(b: hayro_interpret::BlendMode) -> BlendMode {
@@ -701,6 +757,7 @@ impl<'p> Builder<'p> {
             pending: false,
             nested: 0,
             last_fill: None,
+            lines: HashMap::new(),
         }
     }
 
@@ -786,10 +843,11 @@ impl<'p> Builder<'p> {
         let current = self.current_group();
         let Some(f) = self.stack.last_mut() else { return };
         f.children.push(n);
+        // A frame's art goes where its first art was drawn (a clip can end in a later group).
         if root {
             self.root_groups.push(group.or(current));
         } else if f.group.is_none() {
-            f.group = group;
+            f.group = group.or(current);
         }
     }
 
@@ -955,9 +1013,10 @@ impl<'p> Builder<'p> {
     }
 
     fn flush_text(&mut self) {
-        let Some((t, opacity)) = self.text.take().and_then(TextLine::finish) else { return };
+        let Some((t, opacity, facts)) = self.text.take().and_then(TextLine::finish) else { return };
         let mut n = Node::new(self.id(), NodeKind::Text(Box::new(t)));
         n.opacity = opacity;
+        self.lines.insert(n.id, facts);
         self.push_node(n);
     }
 
@@ -1227,6 +1286,14 @@ impl<'p> Builder<'p> {
             place(&mut line);
             self.text = Some(line);
         }
+        // Its ink: a stroke the file draws as outlines of the glyphs is told by it.
+        let mut ink = o.outline();
+        if let Some(line) = &mut self.text
+            && !ink.elements().is_empty()
+        {
+            ink.apply_affine(m);
+            line.ink.push(ink.bounding_box());
+        }
         true
     }
 }
@@ -1570,8 +1637,10 @@ impl<'a> Device<'a> for Builder<'_> {
         if self.nested > 0 {
             return;
         }
-        if self.marked.pop().flatten().is_some() {
+        // The runs gathered within a layer's sequence are its art: finish them before it ends.
+        if self.marked.last().copied().flatten().is_some() {
             self.flush();
         }
+        self.marked.pop();
     }
 }

crates/pdf/src/import_lines.rs

@@ -0,0 +1,254 @@
+//! What a file's lines of type were, beyond what each line says on its own (#508). An editor
+//! writes what PDF text can't say as more art next to the text, and the type it wrapped in a
+//! frame as lines:
+//! - a stroke added to a type object (above or below its characters) comes as the outline of each
+//!   glyph stroked, one path per glyph, right after the type (or right before it): it is the
+//!   type's stroke again, so the type stays one object;
+//! - area type comes as a line of point type per line, each wrapped line ending in a space. Lines
+//!   in a row sharing a left edge, font, size and leading (and paragraph spacing) are one area
+//!   type object again, aligned left or justified, where laying its text out in the frame breaks
+//!   it where the file does: else, as where its font isn't installed, they stay lines.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use kurbo::{Point, Rect, Shape};
+use vectorcraft_color::BlendMode;
+use vectorcraft_doc::{AppearanceItem, Justify, Node, NodeId, NodeKind, TextKind, TextObject, TextRun};
+use vectorcraft_geom::shapes;
+
+use crate::import_text::LineFacts;
+
+/// Rebuild the type among `nodes` (and in their groups) from what its lines tell (`lines`).
+pub(crate) fn rebuild(nodes: &mut Vec<Arc<Node>>, lines: &HashMap<NodeId, LineFacts>) {
+    if lines.is_empty() {
+        return;
+    }
+    for n in nodes.iter_mut() {
+        if n.children().is_some_and(|c| !c.is_empty())
+            && let Some(children) = Arc::make_mut(n).children_mut()
+        {
+            rebuild(children, lines);
+        }
+    }
+    join_strokes(nodes, lines);
+    join_paragraphs(nodes, lines);
+}
+
+/// The stroke paths `nodes` draw when they are the outlines of the glyphs whose ink boxes are
+/// `ink`, stroked one by one alike (no fill, mask or blending, fully opaque).
+fn outline_stroke(nodes: &[Arc<Node>], ink: &[Rect]) -> Option<AppearanceItem> {
+    let first = nodes.first()?;
+    let [stroke @ AppearanceItem::Stroke(_)] = first.appearance.items.as_slice() else { return None };
+    let on_glyph = |n: &Node, r: &Rect| {
+        let tol = 0.01 * (r.width() + r.height()) + 0.01;
+        let NodeKind::Path { path, clipping: false, guide: false, live: None, .. } = &n.kind else { return false };
+        let b = path.to_bezpath().bounding_box();
+        n.appearance == first.appearance
+            && n.mask.is_none()
+            && n.opacity >= 0.999
+            && n.blend == BlendMode::Normal
+            && [(b.x0, r.x0), (b.y0, r.y0), (b.x1, r.x1), (b.y1, r.y1)].iter().all(|(a, b)| (a - b).abs() <= tol)
+    };
+    (nodes.len() == ink.len() && nodes.iter().zip(ink).all(|(n, r)| on_glyph(n, r))).then(|| stroke.clone())
+}
+
+/// Each type object among `nodes` whose glyphs' outlines are stroked by the paths right after it
+/// (or right before it) takes that stroke above (or below) its characters, and the paths go.
+fn join_strokes(nodes: &mut Vec<Arc<Node>>, lines: &HashMap<NodeId, LineFacts>) {
+    let mut i = 0;
+    while i < nodes.len() {
+        let ink = nodes
+            .get(i)
+            .filter(|n| matches!(n.kind, NodeKind::Text(_)) && n.appearance.items.is_empty())
+            .and_then(|n| lines.get(&n.id))
+            .map_or(&[][..], |f| f.ink.as_slice());
+        let k = ink.len();
+        if k > 0 {
+            if let Some(stroke) = nodes.get(i + 1..i + 1 + k).and_then(|after| outline_stroke(after, ink)) {
+                nodes.drain(i + 1..i + 1 + k);
+                if let Some(t) = nodes.get_mut(i) {
+                    Arc::make_mut(t).appearance.items.push(stroke);
+                }
+            } else if let Some(stroke) = i.checked_sub(k).and_then(|from| nodes.get(from..i)).and_then(|before| outline_stroke(before, ink)) {
+                nodes.drain(i - k..i);
+                i -= k;
+                if let Some(t) = nodes.get_mut(i) {
+                    let ap = &mut Arc::make_mut(t).appearance;
+                    ap.items.insert(0, stroke);
+                    ap.set_contents_at(1);
+                }
+            }
+        }
+        i += 1;
+    }
+}
+
+/// `n` as a line that can be part of area type: horizontal point type, with what its line told.
+fn line<'a>(n: &'a Node, lines: &'a HashMap<NodeId, LineFacts>) -> Option<(&'a TextObject, &'a LineFacts)> {
+    let NodeKind::Text(t) = &n.kind else { return None };
+    let point = matches!(t.kind, TextKind::Point) && !t.vertical && n.mask.is_none() && !t.runs.is_empty();
+    point.then_some(())?;
+    Some((t, lines.get(&n.id)?))
+}
+
+/// Lines of type in a row that may be one area type object.
+struct Block {
+    /// The step from a wrapped line's baseline to the next.
+    leading: f64,
+    /// The extra step after a line ending a paragraph.
+    space: f64,
+    /// Each line's baseline below the first (text space).
+    ys: Vec<f64>,
+}
+
+/// The lines from `nodes`' first on that share its left edge, angle, font and size, its look
+/// (opacity, blending, appearance) and steps down by one leading after a wrapped line and by
+/// another (the leading and paragraph spacing) after a line ending a paragraph: how many, and
+/// the block they make unless none of them was wrapped (0 and `None`: the first isn't a line).
+fn block(nodes: &[Arc<Node>], lines: &HashMap<NodeId, LineFacts>) -> (usize, Option<Block>) {
+    let Some((head, (t0, f0))) = nodes.first().and_then(|n| Some((n, line(n, lines)?))) else { return (0, None) };
+    let st = t0.first_style();
+    let size = st.size;
+    let inv = t0.xf.inverse();
+    let lin = |t: &TextObject| {
+        let [a, b, c, d, ..] = t.xf.as_coeffs();
+        [a, b, c, d]
+    };
+    let (mut ys, mut wraps) = (vec![0.0], f0.wraps);
+    let (mut leading, mut para): (Option<f64>, Option<f64>) = (None, None);
+    for n in nodes.iter().skip(1) {
+        let Some((t, f)) = line(n, lines) else { break };
+        let s = t.first_style();
+        let alike = n.opacity == head.opacity
+            && n.blend == head.blend
+            && n.appearance == head.appearance
+            && s.font_family == st.font_family
+            && s.font_style == st.font_style
+            && (s.size - size).abs() <= size * 0.01
+            && t.para == t0.para
+            && lin(t).iter().zip(lin(t0)).all(|(a, b)| (a - b).abs() < 1e-6);
+        let at = inv * (t.xf * Point::ZERO);
+        let step = at.y - ys.last().copied().unwrap_or_default();
+        if !alike || at.x.abs() > size * 0.02 || !(step > size * 0.5 && step < size * 4.0) {
+            break;
+        }
+        let slot = if wraps { &mut leading } else { &mut para };
+        match *slot {
+            Some(s) if (s - step).abs() > size * 0.01 => break,
+            Some(_) => {}
+            None => *slot = Some(step),
+        }
+        ys.push(at.y);
+        wraps = f.wraps;
+    }
+    let count = ys.len();
+    let Some(leading) = leading else { return (count, None) };
+    let space = para.map_or(0.0, |p| p - leading);
+    (count, (space > -size * 0.01).then_some(Block { leading, space: space.max(0.0), ys }))
+}
+
+/// Lines `nodes` of block `b` as one area type object, aligned left or justified, when laying it
+/// out breaks its lines where the file does.
+fn area_type(nodes: &[Arc<Node>], lines: &HashMap<NodeId, LineFacts>, b: &Block) -> Option<TextObject> {
+    let texts: Vec<(&TextObject, &LineFacts)> = nodes.iter().map(|n| line(n, lines)).collect::<Option<_>>()?;
+    let (first, _) = texts.first()?;
+    let size = first.first_style().size;
+    // Each line's tracking (a line with spaces tracked apart was set by hand).
+    let trackings: Vec<f64> = texts
+        .iter()
+        .map(|(t, _)| {
+            let mut all = t.runs.iter().map(|r| r.style.tracking);
+            let one = all.next()?;
+            all.all(|x| x == one).then_some(one)
+        })
+        .collect::<Option<_>>()?;
+    let median = |mut v: Vec<f64>| {
+        v.sort_by(f64::total_cmp);
+        v.get(v.len() / 2).copied()
+    };
+    let wrapped: Vec<f64> = texts.iter().filter(|(_, f)| f.wraps).map(|(_, f)| f.length).collect();
+    let longest = |v: &[f64]| v.iter().copied().fold(0.0, f64::max);
+    let mut tries = vec![];
+    // Wrapped lines all as long: justified (a paragraph's last line aligned left), tracked as the
+    // lines that end paragraphs are (the others are spaced out).
+    let full = longest(&wrapped);
+    if wrapped.len() >= 2 && wrapped.iter().all(|l| (full - l).abs() <= size * 0.02) {
+        let ends: Vec<f64> = texts.iter().zip(&trackings).filter(|((_, f), _)| !f.wraps).map(|(_, t)| *t).collect();
+        let tracking = median(ends).or_else(|| trackings.iter().copied().reduce(f64::min))?;
+        tries.push((Justify::JustifyLeft, full, tracking));
+    }
+    let all: Vec<f64> = texts.iter().map(|(_, f)| f.length).collect();
+    tries.push((Justify::Left, longest(&all) + size * 0.02, median(trackings)?));
+    tries.into_iter().find_map(|(justify, width, tracking)| laid_out(&texts, b, justify, width, tracking))
+}
+
+/// The area type of lines `texts` (block `b`): `width` wide, aligned `justify`, its characters
+/// tracked `tracking`; `None` when it doesn't lay out as the lines did.
+fn laid_out(texts: &[(&TextObject, &LineFacts)], b: &Block, justify: Justify, width: f64, tracking: f64) -> Option<TextObject> {
+    let (first, _) = texts.first()?;
+    let size = first.first_style().size;
+    // Leading as set, unless it is Auto's (120% of the size).
+    let explicit =
+        (b.leading - size * 1.2).abs() > size * 1e-3 || texts.iter().any(|(t, _)| t.runs.iter().any(|r| (r.style.size - size).abs() > 1e-9));
+    let mut runs: Vec<TextRun> = vec![];
+    for (k, (t, f)) in texts.iter().enumerate() {
+        for r in &t.runs {
+            let mut style = r.style.clone();
+            style.tracking = tracking;
+            style.leading = explicit.then_some((b.leading * 1000.0).round() / 1000.0);
+            match runs.last_mut() {
+                Some(last) if last.style == style => last.text.push_str(&r.text),
+                _ => runs.push(TextRun { text: r.text.clone(), style }),
+            }
+        }
+        // A wrapped line's space, or the end of a paragraph.
+        if k + 1 < texts.len()
+            && let Some(last) = runs.last_mut()
+        {
+            last.text.push(if f.wraps { ' ' } else { '\n' });
+        }
+    }
+    let mut t = (*first).clone();
+    t.runs = runs;
+    t.para.justify = justify;
+    t.para.space_before = b.space;
+    let last = b.ys.last().copied()?;
+    let db = vectorcraft_text::FontDb::global();
+    // The frame's top puts the first baseline where the file has it.
+    t.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, width, last + b.leading.max(size) + size)) };
+    let top = -vectorcraft_text::layout(db, &t).lines.first()?.baseline;
+    t.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, top, width, last + b.leading.max(size))) };
+    let laid = vectorcraft_text::layout(db, &t);
+    let plain = t.plain_text();
+    let same = !laid.overflow
+        && laid.lines.len() == texts.len()
+        && laid.lines.iter().zip(texts).zip(&b.ys).all(|((l, (line, f)), y)| {
+            let text = plain.get(l.start..l.end).unwrap_or_default();
+            text.trim() == line.plain_text().trim()
+                && (l.baseline - y).abs() <= size * 0.05
+                && (justify != Justify::JustifyLeft || !f.wraps || (l.x1 - f.length).abs() <= size * 0.05)
+        });
+    t.cached_bounds = Some(laid.bounds);
+    same.then_some(t)
+}
+
+/// Lines of point type in a row among `nodes` that were wrapped in a frame become one area type
+/// object again (see [`area_type`]).
+fn join_paragraphs(nodes: &mut Vec<Arc<Node>>, lines: &HashMap<NodeId, LineFacts>) {
+    let mut i = 0;
+    while i < nodes.len() {
+        let (count, b) = nodes.get(i..).map_or((0, None), |rest| block(rest, lines));
+        let area = b.filter(|_| count > 1).and_then(|b| area_type(nodes.get(i..i + count)?, lines, &b));
+        if let Some(area) = area
+            && let Some(head) = nodes.get_mut(i)
+        {
+            Arc::make_mut(head).kind = NodeKind::Text(Box::new(area));
+            nodes.drain(i + 1..i + count);
+            i += 1;
+        } else {
+            // Lines that don't make area type: none of them starts it either.
+            i += count.max(1);
+        }
+    }
+}

crates/pdf/src/import_text.rs

@@ -9,9 +9,10 @@
 
 use std::collections::HashMap;
 
-use kurbo::{Affine, BezPath, Point, Vec2};
+use kurbo::{Affine, BezPath, Point, Rect, Vec2};
 use vectorcraft_color::Paint;
 use vectorcraft_doc::{CharStyle, ParaDirection, TextKind, TextObject, TextRun};
+use vectorcraft_text::TextLayout;
 
 /// One glyph's placement: its baseline origin, advance direction, size and horizontal scale.
 #[derive(Clone, Copy, Debug)]
@@ -103,6 +104,8 @@ pub(crate) struct TextLine {
     next: Point,
     /// The last glyph's origin.
     last: Point,
+    /// Where the last glyph that isn't a space ends.
+    visible: Point,
     /// The last glyph's baseline direction.
     last_dir: Vec2,
     /// Each glyph's baseline origin, then where the last one ends.
@@ -112,6 +115,24 @@ pub(crate) struct TextLine {
     upright: Option<Upright>,
     /// The glyphs make a column (vertical type), each below the last.
     column: bool,
+    /// Each glyph's ink box as drawn (document space), in drawing order; glyphs without ink are
+    /// left out.
+    pub ink: Vec<Rect>,
+    /// The spaces read from gaps between glyphs: their byte offset in the text, and the gap from
+    /// the end of the glyph before to the start of the next (points).
+    gaps: Vec<(usize, f64)>,
+}
+
+/// What a finished line of type tells beyond its text object (see [`crate::import_lines`]).
+#[derive(Clone, Debug, Default)]
+pub(crate) struct LineFacts {
+    /// [`TextLine::ink`].
+    pub ink: Vec<Rect>,
+    /// Horizontal point type: it ended in a space (as a line an editor wrapped in a frame does).
+    pub wraps: bool,
+    /// Horizontal point type: how long the file set it, from its first glyph's origin to the end
+    /// of its last glyph that isn't a space (points, along the baseline).
+    pub length: f64,
 }
 
 /// The most a glyph on a curve turns from the one before it (about 20°).
@@ -119,7 +140,20 @@ const CURVE_TURN_COS: f64 = 0.94;
 
 impl TextLine {
     pub fn new(at: Placement, opacity: f32) -> Self {
-        Self { at, opacity, next: at.origin, last: at.origin, last_dir: at.dir, baseline: vec![], runs: vec![], upright: None, column: false }
+        Self {
+            at,
+            opacity,
+            next: at.origin,
+            last: at.origin,
+            visible: at.origin,
+            last_dir: at.dir,
+            baseline: vec![],
+            runs: vec![],
+            upright: None,
+            column: false,
+            ink: vec![],
+            gaps: vec![],
+        }
     }
 
     /// Add glyph `text` set vertically (`upright`) if it continues this column (or makes this
@@ -171,6 +205,7 @@ impl TextLine {
         if self.column || self.upright.is_some() {
             return false;
         }
+        let bytes: usize = self.runs.iter().map(|(_, t)| t.len()).sum();
         if let Some((last, run)) = self.runs.last_mut() {
             let size = self.at.size.max(at.size);
             let gap = (at.origin - self.next).dot(self.last_dir);
@@ -192,6 +227,9 @@ impl TextLine {
             // A gap wider than a fifth of an em reads as a space.
             if gap > size * 0.2 && !run.ends_with(' ') && !text.starts_with(' ') {
                 run.push(' ');
+                if on_line {
+                    self.gaps.push((bytes, gap));
+                }
             }
             if last.takes(look) {
                 run.push_str(text);
@@ -202,6 +240,9 @@ impl TextLine {
             self.runs.push((look.clone(), text.to_string()));
         }
         self.next = at.origin + at.dir * advance;
+        if !text.trim().is_empty() {
+            self.visible = self.next;
+        }
         self.last = at.origin;
         self.last_dir = at.dir;
         self.baseline.push(at.origin);
@@ -247,10 +288,12 @@ impl TextLine {
         true
     }
 
-    /// The point type object and its opacity.
-    pub fn finish(mut self) -> Option<(TextObject, f32)> {
+    /// The point type object, its opacity and what else the line tells.
+    pub fn finish(mut self) -> Option<(TextObject, f32, LineFacts)> {
+        let mut facts = LineFacts { ink: std::mem::take(&mut self.ink), ..LineFacts::default() };
         // Turned along a curve: type on a path through the glyphs.
         let path = if self.curved() { self.baseline_path() } else { None };
+        facts.wraps = path.is_none() && self.upright.is_none() && self.runs.last().is_some_and(|(_, t)| t.ends_with(' '));
         if let Some((_, last)) = self.runs.last_mut() {
             last.truncate(last.trim_end().len());
         }
@@ -272,7 +315,7 @@ impl TextLine {
             t.kind = TextKind::OnPath { path: vectorcraft_geom::PathData::from_bezpath(&path), start: 0.0, end: None };
             t.xf = Affine::IDENTITY;
             t.cached_bounds = Some(vectorcraft_text::layout(db, &t).bounds);
-            return Some((t, self.opacity));
+            return Some((t, self.opacity, facts));
         }
         let (start, along) = match self.upright {
             // Vertical point type (a column, or a single upright glyph) is anchored at the top
@@ -286,26 +329,87 @@ impl TextLine {
         };
         // Tracking that makes the line as long as in the file: the PDF placed each glyph, the
         // layout sets them by their advances. Spread over the gaps between characters (tracking
-        // follows each character, the last one's past the end of the line).
-        let length = (self.next - start).dot(along);
+        // follows each character, the last one's past the end of the line). A horizontal line is
+        // measured to its last glyph that isn't a space: the spaces after it were dropped.
+        let length = (if t.vertical { self.next } else { self.visible } - start).dot(along);
+        if !t.vertical {
+            facts.length = length;
+        }
         let laid = vectorcraft_text::layout(db, &t);
         let natural: f64 = laid.glyphs.iter().map(|g| g.advance).sum();
         let chars: usize = t.runs.iter().map(|r| r.text.chars().count()).sum();
         let size = self.at.size;
         let mut bounds = laid.bounds;
         if chars > 1 && length.is_finite() && (length - natural).abs() > size * 0.01 {
-            let tracking = ((length - natural) / (chars - 1) as f64 / size * 1000.0).clamp(-1000.0, 1000.0).round();
-            for r in &mut t.runs {
-                r.style.tracking = tracking;
-            }
+            // The spaces read from gaps keep their own place only in text left in the file's order.
+            let total: usize = t.runs.iter().map(|r| r.text.len()).sum();
+            let gaps: Vec<(usize, f64)> =
+                if t.para.direction.is_none() { self.gaps.into_iter().filter(|(b, _)| *b < total).collect() } else { vec![] };
+            let (tracking, spaces) = spacing(&laid, &gaps, length - natural, chars, size);
+            t.runs = tracked(std::mem::take(&mut t.runs), tracking, &spaces);
             // Tracked: laid out again for its bounds.
             bounds = vectorcraft_text::layout(db, &t).bounds;
         }
         t.cached_bounds = Some(bounds);
-        Some((t, self.opacity))
+        Some((t, self.opacity, facts))
     }
 }
 
+/// The tracking (thousandths of an em) that sets a line of `chars` characters, laid out untracked
+/// as `laid`, `extra` points longer, as the file set it: the same after every character, except
+/// the spaces read from gaps (`gaps`: byte offset, gap in points) where that would put the glyphs
+/// after them more than a tenth of an em off (a barcode's digits, set in groups apart). Those take
+/// their own tracking, given with their byte offsets.
+fn spacing(laid: &TextLayout, gaps: &[(usize, f64)], extra: f64, chars: usize, size: f64) -> (f64, Vec<(usize, f64)>) {
+    let pairs = chars.saturating_sub(1).max(1) as f64;
+    // The space and the character before it take `need` (the gap less the space) between them;
+    // tracking gives them twice its share.
+    let space = |b: usize| laid.glyphs.iter().find(|g| g.byte == b).map(|g| g.advance);
+    let needs: Vec<(usize, f64)> = gaps.iter().filter_map(|&(b, gap)| Some((b, gap - space(b)?))).collect();
+    let mut own: Vec<(usize, f64)> = vec![];
+    let mut tracking = extra / pairs;
+    // Each space taken apart changes the others' share: until no more are.
+    loop {
+        let more: Vec<(usize, f64)> =
+            needs.iter().filter(|(b, need)| !own.iter().any(|(o, _)| o == b) && (need - 2.0 * tracking).abs() > size * 0.1).copied().collect();
+        if more.is_empty() {
+            break;
+        }
+        own.extend(more);
+        let rest = pairs - 2.0 * own.len() as f64;
+        tracking = if rest >= 1.0 { (extra - own.iter().map(|(_, need)| need).sum::<f64>()) / rest } else { 0.0 };
+    }
+    own.sort_by_key(|(b, _)| *b);
+    let em = |pts: f64| (pts / size * 1000.0).clamp(-1000.0, 1000.0).round();
+    (em(tracking), own.into_iter().map(|(b, need)| (b, em(need - tracking))).collect())
+}
+
+/// `runs` with tracking `tracking`, and each space at a byte offset of `spaces` (in order) a run
+/// of its own with the tracking given with it.
+fn tracked(runs: Vec<TextRun>, tracking: f64, spaces: &[(usize, f64)]) -> Vec<TextRun> {
+    let mut out = Vec::with_capacity(runs.len() + 2 * spaces.len());
+    let mut off = 0;
+    for r in runs {
+        let style = CharStyle { tracking, ..r.style };
+        let end = off + r.text.len();
+        let mut from = 0;
+        for &(b, own) in spaces.iter().filter(|(b, _)| (off..end).contains(b)) {
+            let at = b - off;
+            let (Some(before), Some(space)) = (r.text.get(from..at), r.text.get(at..at + 1)) else { continue };
+            if !before.is_empty() {
+                out.push(TextRun { text: before.to_string(), style: style.clone() });
+            }
+            out.push(TextRun { text: space.to_string(), style: CharStyle { tracking: own, ..style.clone() } });
+            from = at + 1;
+        }
+        if let Some(rest) = r.text.get(from..).filter(|t| !t.is_empty()) {
+            out.push(TextRun { text: rest.to_string(), style });
+        }
+        off = end;
+    }
+    out
+}
+
 fn round(v: f64) -> f64 {
     (v * 1000.0).round() / 1000.0
 }

crates/pdf/src/lib.rs

@@ -48,6 +48,7 @@ mod images;
 mod import;
 mod import_color;
 mod import_image;
+mod import_lines;
 mod import_mask;
 mod import_scan;
 mod import_shading;
@@ -231,6 +232,8 @@ mod tests_import_fidelity;
 #[cfg(test)]
 mod tests_import_layers;
 #[cfg(test)]
+mod tests_import_lines;
+#[cfg(test)]
 mod tests_import_options;
 #[cfg(test)]
 mod tests_layers;

crates/pdf/src/tests_import_fidelity.rs

@@ -242,11 +242,13 @@ fn text_becomes_point_type() {
     // The baseline origin, in y-down page space.
     let o = t[0].xf * kurbo::Point::ORIGIN;
     assert!((o.x - 10.0).abs() < 0.01 && (o.y - 70.0).abs() < 0.01, "{o:?}");
-    // A gap of an em between words reads as a space; another font on the line is another run.
+    // A gap of an em between words reads as a space, tracked on its own to keep the gap's width
+    // (#508); another font on the line is another run.
     assert_eq!(text(&t[1]), "Next line in bold");
     let runs: Vec<(&str, &str)> = t[1].runs.iter().map(|r| (r.text.as_str(), r.style.font_style.as_str())).collect();
-    assert_eq!(runs, [("Next line", "Regular"), (" in bold", "Bold")]);
-    assert_eq!(t[1].runs[1].style.fill.color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    assert_eq!(runs, [("Next", "Regular"), (" ", "Regular"), ("line", "Regular"), (" in bold", "Bold")]);
+    assert!(t[1].runs[1].style.tracking > t[1].runs[0].style.tracking + 100.0, "{:?}", t[1].runs);
+    assert_eq!(t[1].runs[3].style.fill.color(), Some(Color::rgb(0.0, 0.0, 1.0)));
     assert!(!r.warnings.iter().any(|w| w.contains("outlines")), "{:?}", r.warnings);
     // As outlines: paths, no type.
     let r = open_with(&bytes, |o| o.text_as = TextAs::Outlines);

crates/pdf/src/tests_import_lines.rs

@@ -0,0 +1,203 @@
+//! What a file's lines of type were (#508): the layer art ending a group's marked content belongs
+//! to, layers ordered as the pages mark them, a stroke written as stroked glyph outlines, spaces
+//! read from wide gaps, and lines wrapped in a frame rebuilt as area type.
+
+use kurbo::{BezPath, PathEl, Point, Shape};
+use serde_json::json;
+use vectorcraft_color::{Color, Paint};
+use vectorcraft_doc::{AppearanceItem, CharStyle, Document, Justify, Node, NodeKind, TextKind, TextObject};
+use vectorcraft_geom::{Affine, Rect, shapes};
+use vectorcraft_testkit::pdf::{PdfPage, first_extra, pdf_with_catalog};
+
+use crate::*;
+
+const HELVETICA: &str = "/Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >>";
+
+/// Groups "A" and "B" (A painted first) for a file of `pages` pages, and the catalog entries.
+fn groups(pages: usize) -> ([String; 2], String, String) {
+    let (a, b) = (first_extra(pages), first_extra(pages) + 1);
+    let objs = ["<< /Type /OCG /Name (A) >>".to_string(), "<< /Type /OCG /Name (B) >>".to_string()];
+    let catalog = format!("/OCProperties << /OCGs [{a} 0 R {b} 0 R] /D << /Order [{b} 0 R {a} 0 R] >> >> ");
+    let resources = format!("/Properties << /MC0 {a} 0 R /MC1 {b} 0 R >> {HELVETICA}");
+    (objs, catalog, resources)
+}
+
+/// A file of 100 × 100 pt pages drawing `contents`, with groups A (`/MC0`) and B (`/MC1`).
+fn layered(contents: &[&str]) -> Document {
+    let (objs, catalog, resources) = groups(contents.len());
+    let pages: Vec<PdfPage> = contents.iter().map(|c| PdfPage { resources: resources.clone(), ..PdfPage::new(100.0, 100.0, c) }).collect();
+    import(&pdf_with_catalog(&pages, &[&objs[0], &objs[1]], &catalog, None)).unwrap()
+}
+
+/// The layers' names, bottom first, and the kinds of their art.
+fn layers(d: &Document) -> Vec<(String, Vec<&'static str>)> {
+    let kind = |n: &std::sync::Arc<Node>| match n.kind {
+        NodeKind::Text(_) => "text",
+        NodeKind::Group { .. } => "group",
+        _ => "path",
+    };
+    d.layers.iter().map(|l| (l.name.clone().unwrap_or_default(), l.children().map_or(vec![], |c| c.iter().map(kind).collect()))).collect()
+}
+
+fn texts(d: &Document) -> Vec<TextObject> {
+    let mut v = vec![];
+    d.walk(|n| {
+        if let NodeKind::Text(t) = &n.kind {
+            v.push((**t).clone());
+        }
+    });
+    v
+}
+
+fn named(layers: &[(&str, &[&'static str])]) -> Vec<(String, Vec<&'static str>)> {
+    layers.iter().map(|(n, k)| (n.to_string(), k.to_vec())).collect()
+}
+
+#[test]
+fn type_ending_a_layers_marked_content_stays_in_its_layer() {
+    // The line is still being gathered when the group's sequence ends.
+    let d = layered(&["/OC /MC0 BDC 0 0 1 rg 0 0 10 10 re f BT /F1 12 Tf 10 50 Td (Lead) Tj ET EMC /OC /MC1 BDC EMC"]);
+    assert_eq!(layers(&d), named(&[("A", &["path", "text"]), ("B", &[])]));
+}
+
+#[test]
+fn a_clip_ending_in_a_later_group_stays_with_its_art() {
+    // The clip opens in A, its art is drawn in A, and it closes after B's (empty) sequence.
+    let d = layered(&["/OC /MC0 BDC q 0 0 50 50 re W n 1 0 0 rg 40 40 20 20 re f EMC /OC /MC1 BDC EMC Q"]);
+    assert_eq!(layers(&d), named(&[("A", &["group"]), ("B", &[])]));
+}
+
+#[test]
+fn layers_stack_as_the_pages_mark_them_when_one_first_paints_on_a_later_page() {
+    // A, the bottom layer, is empty on page 1 and has art on page 2 only.
+    let d = layered(&["/OC /MC0 BDC EMC /OC /MC1 BDC 1 0 0 rg 0 0 10 10 re f EMC", "/OC /MC0 BDC 0 0 1 rg 0 0 10 10 re f EMC /OC /MC1 BDC EMC"]);
+    assert_eq!(layers(&d), named(&[("A", &["path"]), ("B", &["path"])]));
+    // A group marked with no art on any page is an empty layer in its place.
+    let d = layered(&["/OC /MC0 BDC EMC /OC /MC1 BDC 1 0 0 rg 0 0 10 10 re f EMC"]);
+    assert_eq!(layers(&d), named(&[("A", &[]), ("B", &["path"])]));
+}
+
+/// A 100 × 100 pt page drawing `content` in Helvetica.
+fn page(content: &str) -> Vec<u8> {
+    vectorcraft_testkit::pdf::pdf(&[PdfPage { resources: HELVETICA.into(), ..PdfPage::new(100.0, 100.0, content) }], None)
+}
+
+/// The outline of glyph `c` drawn at 24 pt from (x, 50), in PDF operators (y up), stroked.
+fn outline(c: char, x: f64) -> String {
+    let opts = ImportOptions { text_as: TextAs::Outlines, ..Default::default() };
+    let d = import_with_report(&page(&format!("BT /F1 24 Tf {x} 50 Td ({c}) Tj ET")), &opts).unwrap().document;
+    let mut p: Option<BezPath> = None;
+    d.walk(|n| {
+        if let NodeKind::Path { path, .. } = &n.kind {
+            p = Some(path.to_bezpath());
+        }
+    });
+    let pt = |q: Point| format!("{:.3} {:.3}", q.x, 100.0 - q.y);
+    let ops: String = p
+        .unwrap()
+        .elements()
+        .iter()
+        .map(|e| match e {
+            PathEl::MoveTo(a) => format!("{} m ", pt(*a)),
+            PathEl::LineTo(a) => format!("{} l ", pt(*a)),
+            PathEl::QuadTo(a, b) => format!("{} {} {} c ", pt(*a), pt(*b), pt(*b)),
+            PathEl::CurveTo(a, b, c) => format!("{} {} {} c ", pt(*a), pt(*b), pt(*c)),
+            PathEl::ClosePath => "h ".into(),
+        })
+        .collect();
+    ops + "S "
+}
+
+#[test]
+fn a_stroke_written_as_stroked_glyph_outlines_is_the_types_stroke() {
+    // "Hi": the H is 722 units wide in Helvetica.
+    let strokes = format!("0 0 1 RG 0.5 w {}{}", outline('H', 10.0), outline('i', 10.0 + 0.722 * 24.0));
+    let text = "BT 1 0 0 rg /F1 24 Tf 10 50 Td (Hi) Tj ET ";
+    for (content, below) in [(format!("{text}{strokes}"), false), (format!("{strokes}{text}"), true)] {
+        let d = import(&page(&content)).unwrap();
+        let art = d.layers[0].children().unwrap();
+        assert_eq!(art.len(), 1, "one object: {art:?}");
+        let NodeKind::Text(t) = &art[0].kind else { panic!("{:?}", art[0].kind) };
+        assert_eq!(t.plain_text(), "Hi");
+        assert_eq!(t.first_style().fill.color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+        let ap = &art[0].appearance;
+        let [AppearanceItem::Stroke(st)] = ap.items.as_slice() else { panic!("{ap:?}") };
+        assert_eq!(st.paint.color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+        assert!((st.width - 0.5).abs() < 1e-6);
+        assert_eq!(ap.contents_at(), usize::from(below), "a stroke drawn first paints below the characters");
+    }
+    // A stroke that isn't on the glyphs stays a path.
+    let d = import(&page(&format!("{text}0 0 1 RG 0.5 w {}", outline('H', 40.0)))).unwrap();
+    assert_eq!(d.layers[0].children().unwrap().len(), 2);
+}
+
+/// A 300 × 200 pt page with `lines` of (x, y from the top, size, text) in Source Sans 3.
+fn source_sans(lines: &[(f32, f32, f32, &str)]) -> Vec<u8> {
+    crate::tests_live_text::text_pdf(lines, false)
+}
+
+#[test]
+fn spaces_read_from_wide_gaps_keep_the_glyphs_after_them_in_place() {
+    // A barcode's digits in three groups, set apart by more than a space.
+    let (x1, x2) = (29.0, 69.0);
+    let bytes = source_sans(&[(20.0, 50.0, 10.0, "3"), (x1, 50.0, 10.0, "533121"), (x2, 50.0, 10.0, "010629")]);
+    let t = texts(&import(&bytes).unwrap());
+    assert_eq!(t.len(), 1);
+    assert_eq!(t[0].plain_text(), "3 533121 010629");
+    let laid = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), &t[0]);
+    let at = |byte: usize| (t[0].xf * laid.glyphs.iter().find(|g| g.byte == byte).unwrap().origin).x;
+    assert!((at(2) - f64::from(x1)).abs() < 0.05, "the second group starts where the file has it: {} vs {x1}", at(2));
+    assert!((at(9) - f64::from(x2)).abs() < 0.05, "the third group starts where the file has it: {} vs {x2}", at(9));
+}
+
+/// A document of area type `text` (Source Sans 3, 10 pt) `width` wide at (20, 30).
+fn area_doc(text: &str, justify: Justify, width: f64, space_before: f64) -> Document {
+    let style = CharStyle { size: 10.0, fill: Paint::solid(Color::BLACK), ..Default::default() };
+    let mut t = TextObject::point(Point::ORIGIN, text, style);
+    t.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, width, 200.0)) };
+    t.xf = Affine::translate((20.0, 30.0));
+    t.para.justify = justify;
+    t.para.space_before = space_before;
+    let mut d = Document::new(300.0, 300.0);
+    let l = d.layers[0].id;
+    let n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(t)));
+    d.insert(Some(l), 0, n).unwrap();
+    d
+}
+
+/// `d` exported (real text) and imported again.
+fn round_trip(d: &Document) -> Document {
+    let settings: PdfSettings = serde_json::from_value(json!({"compression": {"compressText": false}, "advanced": {"outlineText": false}})).unwrap();
+    let bytes = export_with_report(d, &PdfOptions { settings, ..Default::default() }).unwrap().bytes;
+    import(&bytes).unwrap()
+}
+
+const PROSE: &str = "Stop losing your sinkers on the cast: the clip holds the lead until a snag pulls it free, \
+                     so the fish swims on without the weight.\nIt works on every running rig and leaves the line clear.";
+
+#[test]
+fn lines_wrapped_in_a_frame_come_back_as_area_type() {
+    for (justify, space) in [(Justify::Left, 0.0), (Justify::JustifyLeft, 4.0)] {
+        let d = round_trip(&area_doc(PROSE, justify, 120.0, space));
+        let t = texts(&d);
+        assert_eq!(t.len(), 1, "{justify:?}: one object, not a line each: {:?}", t.iter().map(TextObject::plain_text).collect::<Vec<_>>());
+        assert_eq!(t[0].plain_text(), PROSE);
+        assert_eq!(t[0].para.justify, justify);
+        assert!((t[0].para.space_before - space).abs() < 0.01, "{}", t[0].para.space_before);
+        let TextKind::Area { frame } = &t[0].kind else { panic!("{:?}", t[0].kind) };
+        let w = frame.to_bezpath().bounding_box().width();
+        assert!(w <= 120.5 && w > 100.0, "{w}");
+        let origin = t[0].xf * Point::ZERO;
+        assert!((origin.x - 20.0).abs() < 0.05, "{origin:?}");
+    }
+}
+
+#[test]
+fn lines_that_were_not_wrapped_stay_point_type() {
+    // A list: each line its own, none ending in a space.
+    let bytes = source_sans(&[(20.0, 50.0, 10.0, "Hooks"), (20.0, 62.0, 10.0, "Swivels"), (20.0, 74.0, 10.0, "Leads")]);
+    assert_eq!(texts(&import(&bytes).unwrap()).len(), 3);
+    // Wrapped lines whose breaks a frame doesn't give again (a line far short of the others).
+    let bytes = source_sans(&[(20.0, 50.0, 10.0, "One two three four five six "), (20.0, 62.0, 10.0, "a "), (20.0, 74.0, 10.0, "seven")]);
+    assert_eq!(texts(&import(&bytes).unwrap()).len(), 3);
+}

crates/pdf/src/tests_live_text.rs

@@ -13,7 +13,7 @@ const SOURCE_SERIF: &[u8] = include_bytes!("../../../assets/fonts/SourceSerif4-R
 
 /// A 300 × 200 pt page with `lines` of (x, y from the top, size, text) in Source Sans 3, and the
 /// same rotated 90° when `rotated`.
-fn text_pdf(lines: &[(f32, f32, f32, &str)], rotated: bool) -> Vec<u8> {
+pub(crate) fn text_pdf(lines: &[(f32, f32, f32, &str)], rotated: bool) -> Vec<u8> {
     let mut pdf = krilla::Document::new();
     let mut page = pdf.start_page_with(PageSettings::from_wh(300.0, 200.0).unwrap());
     let mut s = page.surface();
@@ -269,7 +269,7 @@ fn a_single_upright_glyph_comes_in_as_vertical_type_and_takes_no_horizontal_glyp
     let mut line = TextLine::new(at(100.0, 100.0), 1.0);
     assert!(line.push_upright(&look, at(100.0, 100.0), 1.0, Upright { top: Point::new(110.0, 82.0) }, "§"));
     assert!(!line.push(&look, at(130.0, 100.0), 1.0, 10.0, "a"), "a horizontal glyph starts another line");
-    let (t, _) = line.finish().unwrap();
+    let (t, ..) = line.finish().unwrap();
     assert!(t.vertical, "one upright glyph is vertical type");
     assert_eq!(t.plain_text(), "§");
 }
@@ -294,7 +294,7 @@ fn letter_spaced_vertical_type_keeps_its_characters_together() {
         let y = 100.0 + 30.0 * i as f64;
         assert!(line.push_upright(&look, at(y), 1.0, Upright { top: Point::new(110.0, y - 18.0) }, c));
     }
-    let (t, _) = line.finish().unwrap();
+    let (t, ..) = line.finish().unwrap();
     assert!(t.vertical);
     assert_eq!(t.plain_text(), "§§§", "letter spacing isn't a space");
 }

crates/tools/src/catalog.rs

@@ -154,6 +154,17 @@ pub fn group_of(id: &str) -> Option<usize> {
     TOOL_GROUPS.iter().position(|g| g.iter().any(|t| t.id == id))
 }
 
+/// Selection, Direct Selection and Group Selection: the tools Cmd held lends the others for a drag.
+pub fn is_selection_tool(id: &str) -> bool {
+    matches!(id, "selection" | "directSelection" | "groupSelection")
+}
+
+/// The tools that show a selected path's anchors and handles as Direct Selection does, and drag
+/// them: a Cmd drag with one of them is a Direct Selection drag until a selection tool is chosen.
+pub fn edits_anchors(id: &str) -> bool {
+    matches!(id, "directSelection" | "pen" | "addAnchor" | "deleteAnchor" | "anchorPoint" | "curvature")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -178,5 +189,7 @@ mod tests {
         assert_eq!(tool_for_shortcut("V").unwrap().id, "selection");
         assert_eq!(tool_for_shortcut("Shift+M").unwrap().id, "shapeBuilder");
         assert_eq!(group_of("star"), group_of("rectangle"));
+        assert!(is_selection_tool("groupSelection") && !is_selection_tool("pen"));
+        assert!(edits_anchors("pen") && !edits_anchors("rectangle"));
     }
 }

crates/tools/src/direct.rs

@@ -28,11 +28,11 @@ use std::borrow::Cow;
 use serde_json::{Value, json};
 use vectorcraft_doc::hit::{HitKind, hit_test};
 use vectorcraft_doc::{AnchorRef, Node, NodeId, NodeKind};
-use vectorcraft_geom::{PathData, Point, Rect};
+use vectorcraft_geom::{Anchor, PathData, Point, Rect};
 
 use crate::bbox::move_delta;
 use crate::corners::{self, CornerDrag, over_widget};
-use crate::guides::{PointSnap, Targets};
+use crate::guides::{HandleSnap, PointSnap, Targets};
 use crate::meshedit::MeshEdit;
 use crate::pathtype::{self, BracketDrag, over_bracket};
 use crate::rulerguide::GuideEdit;
@@ -112,6 +112,8 @@ pub struct DirectSelectionTool {
     guides: Vec<Overlay>,
     /// What the dragged anchors snap to, gathered when the drag begins.
     anchor_snap: Option<PointSnap>,
+    /// What the dragged handle snaps to.
+    handle_snap: HandleSnap,
     /// What the objects being moved snap to, gathered when the move begins.
     move_snap: Option<MoveSnap>,
     /// The anchor under the pointer (Highlight anchors on mouse over): its path, where it is.
@@ -128,6 +130,7 @@ impl DirectSelectionTool {
             mesh: MeshEdit::default(),
             guides: vec![],
             anchor_snap: None,
+            handle_snap: HandleSnap::default(),
             move_snap: None,
             hover: None,
             guide: GuideEdit::default(),
@@ -217,30 +220,37 @@ fn hit_frame_edge(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, Vec<A
     })
 }
 
-/// Selection & Anchor Display → Show handles when multiple anchors are selected: off, handles show
-/// (and drag) only while a single anchor is selected.
-pub fn handles_shown(selection: &vectorcraft_doc::Selection, multiple: bool) -> bool {
-    multiple || selection.anchors.values().map(|set| set.len()).sum::<usize>() <= 1
+/// The anchors whose direction handles show, and drag, with the tools that edit anchors
+/// ([`crate::catalog::edits_anchors`]): the direct-selected anchors of a path, every anchor of a
+/// path selected as a whole. Selection & Anchor Display → Show handles when multiple anchors are
+/// selected off, none while more than one anchor is selected.
+fn handle_anchors(cx: &ToolContext) -> Vec<(NodeId, usize, usize, Anchor)> {
+    let mut v = vec![];
+    for &id in &cx.selection.objects {
+        let Some(pd) = cx.doc.node(id).and_then(|n| n.path_data()) else { continue };
+        let shown = cx.selection.partial(id);
+        v.extend(pd.anchors().filter(|(si, ai, _)| shown.is_none_or(|set| set.contains(&(*si, *ai)))).map(|(si, ai, a)| (id, si, ai, *a)));
+    }
+    if !cx.handles_multiple && v.len() > 1 {
+        v.clear();
+    }
+    v
 }
 
-/// Direction handle of a partially selected anchor under `p`: (id, si, ai, is_out).
-fn hit_handle(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, usize, usize, bool)> {
-    if !handles_shown(cx.selection, cx.handles_multiple) {
-        return None;
-    }
-    for (id, set) in &cx.selection.anchors {
-        let Some(pd) = cx.doc.node(*id).and_then(|n| n.path_data()) else { continue };
-        for &(si, ai) in set {
-            let Some(a) = pd.subpaths.get(si).and_then(|s| s.anchors.get(ai)) else { continue };
-            if a.has_out() && a.h_out.distance(p) <= tol {
-                return Some((*id, si, ai, true));
-            }
-            if a.has_in() && a.h_in.distance(p) <= tol {
-                return Some((*id, si, ai, false));
+/// The end of a shown direction handle ([`handle_anchors`]) nearest to `p` within `tol`, and
+/// nearer to it than the handle's anchor (a short handle leaves its anchor to be picked): (path,
+/// subpath, anchor, is_out).
+pub(crate) fn hit_handle(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, usize, usize, bool)> {
+    let mut best: Option<((NodeId, usize, usize, bool), f64)> = None;
+    for (id, si, ai, a) in handle_anchors(cx) {
+        for (out, has, h) in [(true, a.has_out(), a.h_out), (false, a.has_in(), a.h_in)] {
+            let d = h.distance(p);
+            if has && d <= tol && d < a.p.distance(p) && best.is_none_or(|b| d < b.1) {
+                best = Some(((id, si, ai, out), d));
             }
         }
     }
-    None
+    best.map(|b| b.0)
 }
 
 fn anchors_json(v: &[AnchorRef]) -> Value {
@@ -335,6 +345,7 @@ impl Tool for DirectSelectionTool {
                 self.mesh.unfocus();
                 if let Some((id, si, ai, out)) = hit_handle(cx, p, tol) {
                     self.state = State::Handle { id, si, ai, out };
+                    self.handle_snap = HandleSnap::default();
                     return vec![Action::Begin("Reshape".into())];
                 }
                 if let Some((id, anchor, from)) = hit_spine_point(cx, p, tol) {
@@ -471,7 +482,7 @@ impl Tool for DirectSelectionTool {
                 out
             }
             (PointerKind::Drag, State::Handle { id, si, ai, out }) => {
-                let (q, guides) = crate::guides::snap_handle(cx, (id, si, ai), p, ev.mods.shift);
+                let (q, guides) = self.handle_snap.snap(cx, (id, si, ai), p, ev.mods.shift);
                 self.guides = guides;
                 vec![Action::Preview(
                     "path.setHandle".into(),
@@ -871,6 +882,61 @@ mod tests {
         assert!(matches!(&a[..], [Action::Begin(_), Action::Preview(c, _)] if c == "object.transform"), "{a:?}");
     }
 
+    /// #494: the handles shown are the handles dragged. A path selected as a whole (the one the
+    /// Pen just drew) shows all its handles, and they drag; the direct-selected anchors' handles
+    /// only otherwise; none with Show handles when multiple anchors are selected off and several
+    /// anchors selected. A handle shorter than the tolerance leaves its anchor to be picked, and
+    /// the tolerance is the preference's, in screen pixels at any zoom.
+    #[test]
+    fn the_handles_shown_are_the_handles_dragged() {
+        let (d, arch) = arch_doc();
+        let p = paint();
+        // Does a press at (x, y) take a handle?
+        let handle = |c: &ToolContext, x: f64, y: f64| {
+            DirectSelectionTool::new(false).pointer(c, &PointerEvent::new(PointerKind::Down, x, y)) == vec![Action::Begin("Reshape".into())]
+        };
+        let mut whole = Selection::default();
+        whole.set([arch]);
+        let c = cx(&d, &whole, &p);
+        assert!(handle(&c, 101.0, 251.0), "the first anchor's handle, the path selected whole");
+        let mut t = DirectSelectionTool::new(false);
+        t.pointer(&c, &PointerEvent::new(PointerKind::Down, 101.0, 251.0));
+        let a = t.pointer(&c, &PointerEvent::new(PointerKind::Drag, 120.0, 240.0));
+        assert!(matches!(&a[..], [Action::Preview(c, v)] if c == "path.setHandle" && v["anchor"] == 0 && v["which"] == "out"), "{a:?}");
+        // Only the second anchor direct-selected: the first one's handle is hidden.
+        let second = anchors_of(arch, &[(0, 1)]);
+        assert!(!handle(&cx(&d, &second, &p), 101.0, 251.0));
+        assert!(handle(&cx(&d, &second, &p), 201.0, 251.0));
+        // Show handles when multiple anchors are selected off: the whole path's are hidden.
+        assert!(!handle(&ToolContext { handles_multiple: false, ..cx(&d, &whole, &p) }, 101.0, 251.0));
+        assert!(handle(&ToolContext { handles_multiple: false, ..cx(&d, &second, &p) }, 201.0, 251.0));
+        // The tolerance is the preference's, in screen pixels: 3 px is 0.75 pt at 400%.
+        let zoomed = ToolContext { zoom: 4.0, ..cx(&d, &whole, &p) };
+        assert!(!handle(&zoomed, 101.0, 251.0));
+        assert!(handle(&zoomed, 100.5, 250.5));
+        assert!(handle(&ToolContext { selection_tolerance: 8.0, ..cx(&d, &whole, &p) }, 106.0, 254.0));
+    }
+
+    /// #494: a handle 2 pt long, inside the tolerance round its anchor, doesn't hide the anchor.
+    #[test]
+    fn a_short_handle_leaves_its_anchor_to_be_picked() {
+        let (mut d, _) = doc_with_rect();
+        let l = d.layers[0].id;
+        let id = d.alloc_id();
+        let mut sp = vectorcraft_geom::SubPath::polyline(&[Point::new(100.0, 300.0), Point::new(200.0, 300.0)], false);
+        sp.anchors[0].h_out = Point::new(102.0, 300.0);
+        d.insert(Some(l), 1, vectorcraft_doc::Node::path(id, PathData::single(sp), vectorcraft_doc::Appearance::default_art())).unwrap();
+        let s = anchors_of(id, &[(0, 0)]);
+        let p = paint();
+        let c = cx(&d, &s, &p);
+        let mut t = DirectSelectionTool::new(false);
+        assert_eq!(t.pointer(&c, &PointerEvent::new(PointerKind::Down, 100.0, 300.0)), vec![], "the anchor, already selected");
+        let a = t.pointer(&c, &PointerEvent::new(PointerKind::Drag, 90.0, 290.0));
+        assert_eq!(a[0], Action::Begin("Move".into()));
+        t.pointer(&c, &PointerEvent::new(PointerKind::Up, 90.0, 290.0));
+        assert_eq!(t.pointer(&c, &PointerEvent::new(PointerKind::Down, 102.5, 300.0)), vec![Action::Begin("Reshape".into())], "the handle");
+    }
+
     /// [`doc_with_rect`] (A, 100..200) and a second square B, 300..400: (A, B).
     fn two_squares() -> (vectorcraft_doc::Document, NodeId, NodeId) {
         let (mut d, a) = doc_with_rect();

crates/tools/src/draw2.rs

@@ -15,7 +15,6 @@ use vectorcraft_geom::{Anchor, AnchorKind, BezPath, Point, SubPath};
 use crate::{Action, Tool, ToolContext};
 
 pub use anchor::AnchorTool;
-pub(crate) use anchor::hit_handle;
 pub use curvature::CurvatureTool;
 pub use family::FamilyTool;
 pub use gesture::GestureTool;

crates/tools/src/draw2/anchor.rs

@@ -12,6 +12,8 @@ use vectorcraft_doc::NodeId;
 use vectorcraft_geom::Point;
 
 use super::{hit_anchor, hit_segment, insert_anchor, remove_anchor};
+use crate::direct::hit_handle;
+use crate::guides::HandleSnap;
 use crate::{Action, Cursor, Mods, Overlay, PointerEvent, PointerKind, Tool, ToolContext};
 
 #[derive(Clone, Copy, Debug)]
@@ -25,8 +27,9 @@ enum State {
 pub struct AnchorTool {
     id: &'static str,
     state: State,
-    /// Smart guides of the handle being dragged.
+    /// Smart guides of the handle being dragged, and what it snaps to.
     guides: Vec<Overlay>,
+    snap: HandleSnap,
 }
 
 impl AnchorTool {
@@ -37,36 +40,18 @@ impl AnchorTool {
             "scissors" => "scissors",
             _ => "addAnchor",
         };
-        Self { id, state: State::Idle, guides: vec![] }
+        Self { id, state: State::Idle, guides: vec![], snap: HandleSnap::default() }
     }
 
     fn add(cx: &ToolContext, p: Point) -> Vec<Action> {
-        hit_segment(cx, p, cx.tol(4.0)).map(insert_anchor).into_iter().collect()
+        hit_segment(cx, p, cx.pick_tol()).map(insert_anchor).into_iter().collect()
     }
 
     fn delete(cx: &ToolContext, p: Point) -> Vec<Action> {
-        hit_anchor(cx, p, cx.tol(4.0)).map(remove_anchor).into_iter().collect()
+        hit_anchor(cx, p, cx.pick_tol()).map(remove_anchor).into_iter().collect()
     }
 }
 
-/// A direction handle of a selected path under `p`, among those shown (a path with anchors
-/// direct-selected shows theirs only): (id, subpath, anchor, is_out).
-pub(crate) fn hit_handle(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, usize, usize, bool)> {
-    for id in &cx.selection.objects {
-        let Some(pd) = cx.doc.node(*id).and_then(|n| n.path_data()) else { continue };
-        let shown = cx.selection.partial(*id);
-        for (si, ai, a) in pd.anchors().filter(|(si, ai, _)| shown.is_none_or(|set| set.contains(&(*si, *ai)))) {
-            if a.has_out() && a.h_out.distance(p) <= tol {
-                return Some((*id, si, ai, true));
-            }
-            if a.has_in() && a.h_in.distance(p) <= tol {
-                return Some((*id, si, ai, false));
-            }
-        }
-    }
-    None
-}
-
 impl Tool for AnchorTool {
     fn id(&self) -> &'static str {
         self.id
@@ -76,7 +61,7 @@ impl Tool for AnchorTool {
     }
     fn pointer(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Vec<Action> {
         let p = ev.pos;
-        let tol = cx.tol(4.0);
+        let tol = cx.pick_tol();
         match (self.id, ev.kind) {
             ("addAnchor", PointerKind::Down) => {
                 if ev.mods.alt {
@@ -104,6 +89,7 @@ impl Tool for AnchorTool {
             ("anchorPoint", PointerKind::Down) => {
                 if let Some((id, si, ai, out)) = hit_handle(cx, p, tol) {
                     self.state = State::Handle { id, si, ai, out, began: false };
+                    self.snap = HandleSnap::default();
                 } else if let Some((id, si, ai)) = hit_anchor(cx, p, tol) {
                     self.state = State::Convert { id, si, ai, start: p, began: false };
                 } else if let Some((id, si, seg, t)) = hit_segment(cx, p, tol) {
@@ -134,7 +120,7 @@ impl Tool for AnchorTool {
                         json!({"id": id.0, "subpath": si, "anchor": ai, "to": "smooth", "x": p.x, "y": p.y}),
                     ),
                     State::Handle { id, si, ai, out, .. } => {
-                        let (q, guides) = crate::guides::snap_handle(cx, (id, si, ai), p, ev.mods.shift);
+                        let (q, guides) = self.snap.snap(cx, (id, si, ai), p, ev.mods.shift);
                         self.guides = guides;
                         Action::Preview(
                             "path.setHandle".into(),
@@ -192,7 +178,7 @@ impl Tool for AnchorTool {
             "deleteAnchor" if !m.alt => Cursor::PenDelete,
             "deleteAnchor" => Cursor::PenAdd,
             "scissors" => {
-                if hit_segment(cx, p, cx.tol(4.0)).is_some() {
+                if hit_segment(cx, p, cx.pick_tol()).is_some() {
                     Cursor::Crosshair
                 } else {
                     Cursor::NotAllowed
@@ -257,4 +243,38 @@ mod tests {
         let a = t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 150.0, 230.0));
         assert!(matches!(&a[1], Action::Preview(c, v) if c == "path.reshapeSegment" && v["dy"] == 30.0));
     }
+
+    /// #494: the Anchor Point tool picks within Selection & Anchor Display → Tolerance, and drags
+    /// only the handles shown.
+    #[test]
+    fn anchor_point_picks_within_the_tolerance_and_drags_shown_handles() {
+        let (mut d, _) = doc_with_rect();
+        let l = d.layers[0].id;
+        let id = d.alloc_id();
+        let mut sp = vectorcraft_geom::SubPath::polyline(&[Point::new(100.0, 300.0), Point::new(200.0, 300.0), Point::new(300.0, 300.0)], false);
+        sp.anchors[1] = vectorcraft_geom::Anchor::smooth(Point::new(200.0, 300.0), Point::new(240.0, 300.0));
+        let path = vectorcraft_geom::PathData::single(sp);
+        d.insert(Some(l), 1, vectorcraft_doc::Node::path(id, path, vectorcraft_doc::Appearance::default_art())).unwrap();
+        let mut s = Selection::default();
+        s.set([id]);
+        let p = paint();
+        let press = |c: &ToolContext, x: f64, y: f64| {
+            let mut t = AnchorTool::new("anchorPoint");
+            t.pointer(c, &PointerEvent::new(PointerKind::Down, x, y));
+            t.pointer(c, &PointerEvent::new(PointerKind::Drag, x + 10.0, y + 30.0))
+        };
+        let dragged = |a: Vec<Action>| match a.as_slice() {
+            [Action::Begin(_), Action::Preview(c, _)] => c.clone(),
+            _ => String::new(),
+        };
+        // The segment 6 px off: picked with an 8 px tolerance, not with the default 3 px.
+        assert_eq!(dragged(press(&cx(&d, &s, &p), 150.0, 306.0)), "");
+        let wide = ToolContext { selection_tolerance: 8.0, ..cx(&d, &s, &p) };
+        assert_eq!(dragged(press(&wide, 150.0, 306.0)), "path.reshapeSegment");
+        // The middle anchor's handle drags; with Show handles when multiple anchors are selected
+        // off it's hidden (three anchors selected) and the press finds the segment under it.
+        assert_eq!(dragged(press(&cx(&d, &s, &p), 240.0, 301.0)), "path.setHandle");
+        let single = ToolContext { handles_multiple: false, ..cx(&d, &s, &p) };
+        assert_eq!(dragged(press(&single, 240.0, 301.0)), "path.reshapeSegment");
+    }
 }

crates/tools/src/guides.rs

@@ -553,25 +553,35 @@ impl PointSnap {
     }
 }
 
-/// Where a dragged direction handle of anchor `ai` of subpath `si` of path `id` goes for the
-/// pointer at `p`: with Shift at a multiple of 45° (from the Constrain Angle) round its anchor,
-/// else snapped as a drawn point is (smart guides, the grid, pixels).
-pub fn snap_handle(cx: &ToolContext, (id, si, ai): (NodeId, usize, usize), p: Point, shift: bool) -> (Point, Vec<Overlay>) {
-    let path = cx.doc.node(id).and_then(|n| n.path_data());
-    if shift && let Some(a) = path.and_then(|pd| pd.subpaths.get(si)?.anchors.get(ai)) {
-        return (a.p + vectorcraft_geom::constrain_angle_from(p - a.p, 45.0, cx.constrain_angle), vec![]);
-    }
-    snap_with(cx, p, || {
-        // The path's bounds move with the handle, so they would chase it: its anchors (which stay
-        // put) are the targets instead, the handle lining up with them too.
-        let mut t = Targets::collect(cx.doc, &[id], None);
-        for (_, _, a) in path.into_iter().flat_map(|pd| pd.anchors()).take(20_000) {
-            t.points.push((a.p, Kind::Anchor));
-            t.xs.push((a.p.x, a.p, Kind::Anchor));
-            t.ys.push((a.p.y, a.p, Kind::Anchor));
+/// Snapping for a dragged direction handle: Shift keeps it at 45° steps round its anchor, else it
+/// snaps as a drawn point does. The targets are gathered on the first move that needs them and
+/// kept for the rest of the drag (gathering them takes as long as the document is big).
+#[derive(Default)]
+pub struct HandleSnap(Option<PointSnap>);
+
+impl HandleSnap {
+    /// Where the handle of anchor `ai` of subpath `si` of path `id` goes with the pointer at `p`,
+    /// and the guides showing why.
+    pub fn snap(&mut self, cx: &ToolContext, (id, si, ai): (NodeId, usize, usize), p: Point, shift: bool) -> (Point, Vec<Overlay>) {
+        let path = cx.doc.node(id).and_then(|n| n.path_data());
+        if shift && let Some(a) = path.and_then(|pd| pd.subpaths.get(si)?.anchors.get(ai)) {
+            return (a.p + vectorcraft_geom::constrain_angle_from(p - a.p, 45.0, cx.constrain_angle), vec![]);
         }
-        t
-    })
+        let snap = self.0.get_or_insert_with(|| {
+            PointSnap::new(cx, || {
+                // The path's bounds move with the handle, so they would chase it: its anchors
+                // (which stay put) are the targets instead, the handle lining up with them too.
+                let mut t = Targets::collect(cx.doc, &[id], None);
+                for (_, _, a) in path.into_iter().flat_map(|pd| pd.anchors()).take(20_000) {
+                    t.points.push((a.p, Kind::Anchor));
+                    t.xs.push((a.p.x, a.p, Kind::Anchor));
+                    t.ys.push((a.p.y, a.p, Kind::Anchor));
+                }
+                t
+            })
+        });
+        snap.snap(cx, p)
+    }
 }
 
 /// Snap a picked point (a transform tool's reference point) to the nearest anchor or centre of the

crates/tools/src/pen.rs

@@ -3,11 +3,14 @@
 //! Click adds a corner anchor; click-drag adds a smooth anchor with symmetric handles (Alt breaks
 //! them: the incoming handle stays where it was when Alt went down and only the outgoing one
 //! follows the pointer; Space held moves the anchor, handles and all); Shift constrains to 45°.
-//! Clicking the first anchor closes the path. Clicking the last one retracts its outgoing handle, so
-//! the next segment leaves it as a corner; dragging from it pulls a new one out on its own.
-//! Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as
-//! the Anchor Point tool: dragging a handle moves it alone, clicking a smooth anchor makes it a
-//! corner and dragging an anchor pulls out new symmetric handles.
+//! A press on the first anchor closes the path, the drag shaping the closing curve. Clicking the
+//! last one retracts its outgoing handle, so the next segment leaves it as a corner; dragging from
+//! it pulls a new one out on its own.
+//! Alt held over a handle end, an anchor or a segment of a selected path (the one being drawn too)
+//! works as the Anchor Point tool: dragging a handle moves it alone, clicking a smooth anchor makes
+//! it a corner, dragging an anchor pulls out new symmetric handles and dragging a segment reshapes
+//! it. Cmd held lends the selection tool used last for a drag (the engine's
+//! `Session::pointer`); the path being drawn goes on afterwards while it stays selected.
 //! Enter/Esc (or switching tools) ends the path. Clicking the end of a selected open path continues
 //! it. The rubber-band preview shows the next segment (Enable Rubber Band for Pen Tool). Auto Add/Delete: between paths, a click on a
 //! segment of a selected path adds an anchor there and a click on one of its anchors deletes it
@@ -18,14 +21,18 @@ use serde_json::json;
 use vectorcraft_doc::{NodeId, NodeKind};
 use vectorcraft_geom::{BezPath, Point};
 
-use crate::draw2::{AnchorTool, hit_handle};
+use crate::direct::hit_handle;
+use crate::draw2::AnchorTool;
 use crate::{Action, Cursor, Mods, Overlay, PointerEvent, PointerKind, Tool, ToolContext, ToolKey};
 
 #[derive(Default)]
 pub struct PenTool {
-    /// The path being drawn (set once the first anchor exists and the engine selected it).
+    /// A path is being drawn...
     drawing: bool,
-    drag: Option<(Point, bool)>,
+    /// ...this one, once the engine made it: another path selected meanwhile isn't drawn on.
+    path: Option<NodeId>,
+    /// The anchor a press placed, while the drag shapes its handles.
+    drag: Option<Place>,
     hover: Option<Point>,
     /// The incoming handle of the anchor being dragged out, as last previewed.
     in_h: Point,
@@ -38,6 +45,17 @@ pub struct PenTool {
     convert: Option<AnchorTool>,
 }
 
+/// An anchor being placed, as the press decided: where it is, the path it goes on (none: the
+/// first anchor of a new path) and whether it closes that path (the press was on its first
+/// anchor). The drag only shapes its handles, whatever the path looks like meanwhile: a closing
+/// preview leaves the path closed, so no longer one the pen draws on.
+#[derive(Clone, Copy)]
+struct Place {
+    at: Point,
+    path: Option<NodeId>,
+    closing: bool,
+}
+
 /// The open path the pen is extending: the single selected open path.
 fn active_path(cx: &ToolContext) -> Option<(NodeId, Point, Point, Point)> {
     if cx.selection.objects.len() != 1 {
@@ -63,10 +81,14 @@ fn last_anchor(cx: &ToolContext, id: NodeId) -> Option<(usize, usize)> {
     Some((si, ai))
 }
 
-/// Alt held over a handle end or an anchor of a selected path: the Anchor Point tool's gesture.
+/// Alt held over a handle end, an anchor or a segment of a selected path: the Anchor Point tool's
+/// gesture, within its tolerance.
 fn alt_converts(cx: &ToolContext, p: Point, m: Mods) -> bool {
-    let tol = cx.tol(4.0);
-    m.alt && (hit_handle(cx, p, tol).is_some() || crate::draw2::anchor_in(cx, editable_paths(cx), p, tol).is_some())
+    let tol = cx.pick_tol();
+    m.alt
+        && (hit_handle(cx, p, tol).is_some()
+            || crate::draw2::anchor_in(cx, editable_paths(cx), p, tol).is_some()
+            || crate::draw2::segment_in(cx, editable_paths(cx), p, tol).is_some())
 }
 
 /// The selected paths the pen edits (not guides, nor locked or hidden ones).
@@ -97,9 +119,13 @@ impl Tool for PenTool {
         let exclude: Vec<vectorcraft_doc::NodeId> = if self.drawing { cx.selection.objects.clone() } else { vec![] };
         let (mut p, _) = if matches!(ev.kind, PointerKind::Down) { crate::guides::snap_draw(cx, ev.pos, &exclude) } else { (ev.pos, vec![]) };
         let tol = cx.tol(5.0);
-        let active = if self.drawing { active_path(cx) } else { None };
+        // The path a press began is the selected one by the next event.
+        if self.drawing && self.path.is_none() {
+            self.path = active_path(cx).map(|a| a.0);
+        }
+        let active = self.active(cx);
         if self.drawing && active.is_none() && ev.kind == PointerKind::Down {
-            self.drawing = false;
+            self.stop();
         }
         match ev.kind {
             PointerKind::Move => {
@@ -115,7 +141,7 @@ impl Tool for PenTool {
                     let end = last_anchor(cx, id);
                     // A one-anchor path doesn't close on itself: its anchor is the last one too.
                     if p.distance(first) <= tol && end.is_some_and(|(_, ai)| ai > 0) {
-                        self.drag = Some((first, true));
+                        self.drag = Some(Place { at: first, path: Some(id), closing: true });
                         return vec![Action::Begin("Close Path".into()), Action::Preview("path.close".into(), json!({"id": id.0}))];
                     }
                     if p.distance(last) <= tol
@@ -127,7 +153,7 @@ impl Tool for PenTool {
                     if let Some(acts) = self.alt_convert(cx, ev) {
                         return acts;
                     }
-                    self.drag = Some((p, false));
+                    self.drag = Some(Place { at: p, path: Some(id), closing: false });
                     self.in_h = p;
                     return vec![Action::Begin("Pen".into()), Action::Preview("path.appendAnchor".into(), json!({"id": id.0, "x": p.x, "y": p.y}))];
                 }
@@ -142,6 +168,7 @@ impl Tool for PenTool {
                     && (p.distance(last) <= tol || p.distance(first) <= tol)
                 {
                     self.drawing = true;
+                    self.path = active_path(cx).map(|a| a.0);
                     if p.distance(first) <= tol && p.distance(last) > tol {
                         return vec![Action::Exec("path.reverse".into(), json!({}))];
                     }
@@ -150,8 +177,8 @@ impl Tool for PenTool {
                 if let Some(act) = auto_add_delete(cx, ev.pos, ev.mods, tol) {
                     return vec![act];
                 }
-                self.drawing = true;
-                self.drag = Some((p, false));
+                (self.drawing, self.path) = (true, None);
+                self.drag = Some(Place { at: p, path: None, closing: false });
                 vec![Action::Begin("Pen".into()), Action::Preview("path.create".into(), json!({"anchors": [{"x": p.x, "y": p.y}]}))]
             }
             PointerKind::Drag => {
@@ -165,13 +192,13 @@ impl Tool for PenTool {
                     }
                     return vec![set_out_handle(id, si, ai, h)];
                 }
-                let Some((mut a, closing)) = self.drag else { return vec![] };
+                let Some(Place { at: mut a, path, closing }) = self.drag else { return vec![] };
                 // Space held moves the anchor being placed, handles and all.
                 if ev.mods.space && !closing {
                     let d = ev.pos - self.last;
                     a += d;
                     self.in_h += d;
-                    self.drag = Some((a, closing));
+                    self.drag = Some(Place { at: a, path, closing });
                 }
                 self.last = ev.pos;
                 let mut out_h = ev.pos;
@@ -179,7 +206,7 @@ impl Tool for PenTool {
                     out_h = a + vectorcraft_geom::constrain_angle(ev.pos - a, 45.0);
                 }
                 let alt = ev.mods.alt;
-                let Some((id, ..)) = active_path(cx).or(active) else {
+                let Some(id) = path else {
                     // First anchor of a new path: re-issue create with handles.
                     let in_h = a - (out_h - a);
                     return vec![Action::Preview(
@@ -209,9 +236,9 @@ impl Tool for PenTool {
                 if self.handle.take().is_some() {
                     return vec![Action::Commit];
                 }
-                let Some((_, closing)) = self.drag.take() else { return vec![] };
-                if closing {
-                    self.drawing = false;
+                let Some(place) = self.drag.take() else { return vec![] };
+                if place.closing {
+                    self.stop();
                 }
                 vec![Action::Commit]
             }
@@ -221,7 +248,7 @@ impl Tool for PenTool {
     fn key(&mut self, cx: &ToolContext, key: ToolKey, _m: Mods) -> Vec<Action> {
         match key {
             ToolKey::Enter | ToolKey::Escape => {
-                self.drawing = false;
+                self.stop();
                 self.drag = None;
                 self.handle = None;
                 // An Alt gesture under way ends as it stands.
@@ -231,17 +258,17 @@ impl Tool for PenTool {
         }
     }
     fn deactivate(&mut self, cx: &ToolContext) -> Vec<Action> {
-        self.drawing = false;
+        self.stop();
         self.convert.take().map(|mut t| t.deactivate(cx)).unwrap_or_default()
     }
     fn overlays(&self, cx: &ToolContext) -> Vec<Overlay> {
         if let Some(t) = &self.convert {
             return t.overlays(cx);
         }
-        if !cx.pen_rubber_band || !self.drawing || self.drag.is_some() || self.handle.is_some() {
+        if !cx.pen_rubber_band || self.drag.is_some() || self.handle.is_some() {
             return vec![];
         }
-        let (Some((id, _, last, out)), Some(h)) = (active_path(cx), self.hover) else { return vec![] };
+        let (Some((id, _, last, out)), Some(h)) = (self.active(cx), self.hover) else { return vec![] };
         let mut bp = BezPath::new();
         bp.move_to(last);
         if out.distance(last) > 1e-9 {
@@ -254,10 +281,7 @@ impl Tool for PenTool {
     }
     fn cursor(&self, cx: &ToolContext, p: Point, m: Mods) -> Cursor {
         let tol = cx.tol(5.0);
-        let active = active_path(cx);
-        if self.drawing
-            && let Some((id, first, last, _)) = active
-        {
+        if let Some((id, first, last, _)) = self.active(cx) {
             let one = last_anchor(cx, id).is_some_and(|(_, ai)| ai == 0);
             if p.distance(first) <= tol && !one {
                 return Cursor::PenClose;
@@ -275,7 +299,7 @@ impl Tool for PenTool {
                 Some([_]) => return Cursor::PenAdd,
                 _ => {}
             }
-            if active.is_some_and(|(_, first, last, _)| p.distance(last) <= tol || p.distance(first) <= tol) {
+            if active_path(cx).is_some_and(|(_, first, last, _)| p.distance(last) <= tol || p.distance(first) <= tol) {
                 return Cursor::PenContinue;
             }
             match auto_add_delete(cx, p, m, tol) {
@@ -289,13 +313,27 @@ impl Tool for PenTool {
 }
 
 impl PenTool {
-    /// Hand an Alt press on a selected path's handle or anchor to the Anchor Point tool.
+    /// The open path being drawn: the one the pen made or went on with, while it is the single
+    /// selected open path.
+    fn active(&self, cx: &ToolContext) -> Option<(NodeId, Point, Point, Point)> {
+        active_path(cx).filter(|(id, ..)| self.drawing && self.path.is_none_or(|p| p == *id))
+    }
+
+    /// The path is finished.
+    fn stop(&mut self) {
+        (self.drawing, self.path) = (false, None);
+    }
+
+    /// Hand an Alt press on a selected path's handle, anchor or segment to the Anchor Point tool.
     fn alt_convert(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Option<Vec<Action>> {
         if !alt_converts(cx, ev.pos, ev.mods) {
             return None;
         }
         let mut t = AnchorTool::new("anchorPoint");
         let acts = t.pointer(cx, ev);
+        if !t.busy() {
+            return None;
+        }
         self.convert = Some(t);
         Some(acts)
     }
@@ -467,6 +505,32 @@ mod tests {
         assert_eq!(t.cursor(&cx, Point::new(10.0, 300.0), Mods::default()), Cursor::PenClose);
     }
 
+    /// #501: a press on the first anchor closes the path, however far the drag then goes: the
+    /// closing preview leaves the path closed (so not one the pen extends), and each move still
+    /// previews the close with symmetric handles (Alt breaks them), released as a close.
+    #[test]
+    fn a_drag_from_the_first_anchor_always_closes() {
+        let pts = [Point::new(100.0, 300.0), Point::new(200.0, 300.0), Point::new(200.0, 400.0)];
+        let (mut d, id, s) = drawing(vectorcraft_geom::SubPath::polyline(&pts, false));
+        let p = paint();
+        let mut t = PenTool { drawing: true, ..PenTool::default() };
+        let a = t.pointer(&cx(&d, &s, &p), &PointerEvent::new(PointerKind::Down, 101.0, 301.0));
+        assert_eq!(a, vec![Action::Begin("Close Path".into()), Action::Preview("path.close".into(), json!({"id": id.0}))]);
+        // What the tool sees once the preview applied: the path closed.
+        d.node_mut(id).unwrap().path_data_mut().unwrap().subpaths[0].closed = true;
+        let c = cx(&d, &s, &p);
+        let close = |x: f64, y: f64, alt: bool| {
+            vec![Action::Preview("path.close".into(), json!({"id": id.0, "in": [200.0 - x, 600.0 - y], "independent": alt}))]
+        };
+        for (x, y) in [(105.0, 290.0), (130.0, 260.0), (160.0, 240.0)] {
+            assert_eq!(t.pointer(&c, &PointerEvent::new(PointerKind::Drag, x, y)), close(x, y, false), "at ({x}, {y})");
+        }
+        let alt = Mods { alt: true, ..Mods::default() };
+        assert_eq!(t.pointer(&c, &PointerEvent::new(PointerKind::Drag, 170.0, 250.0).with_mods(alt)), close(170.0, 250.0, true));
+        assert_eq!(t.pointer(&c, &PointerEvent::new(PointerKind::Up, 170.0, 250.0)), vec![Action::Commit]);
+        assert!(!t.busy() && t.active(&c).is_none(), "the path is done");
+    }
+
     #[test]
     fn a_one_anchor_path_does_not_close_on_itself() {
         let (d, id, s) = drawing(vectorcraft_geom::SubPath::polyline(&[Point::new(10.0, 300.0)], false));
@@ -587,4 +651,53 @@ mod tests {
         let cx1 = cx(&d, &s, &p);
         assert_eq!(t.cursor(&cx1, Point::new(250.0, 101.0), alt), Cursor::Pen);
     }
+
+    /// #494: Alt held over a segment of a selected path reshapes it as the Anchor Point tool does,
+    /// while drawing too; Alt away from paths still places an anchor.
+    #[test]
+    fn alt_over_a_segment_reshapes_it() {
+        let (d, id, s) = drawing(vectorcraft_geom::SubPath::polyline(&[Point::new(100.0, 300.0), Point::new(200.0, 300.0)], false));
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let alt = Mods { alt: true, ..Mods::default() };
+        let mut t = PenTool { drawing: true, ..PenTool::default() };
+        assert_eq!(t.cursor(&cx, Point::new(150.0, 302.0), alt), Cursor::PenConvert);
+        assert_eq!(t.cursor(&cx, Point::new(150.0, 302.0), Mods::default()), Cursor::Pen);
+        assert_eq!(t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 150.0, 302.0).with_mods(alt)), vec![]);
+        let a = t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 150.0, 262.0).with_mods(alt));
+        assert_eq!(a[0], Action::Begin("Reshape".into()));
+        assert!(
+            matches!(&a[1], Action::Preview(c, v) if c == "path.reshapeSegment" && v["id"] == id.0 && v["segment"] == 0 && v["dy"] == -40.0),
+            "{a:?}"
+        );
+        assert_eq!(t.pointer(&cx, &PointerEvent::new(PointerKind::Up, 150.0, 262.0)), vec![Action::Commit]);
+        let a = t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 250.0, 400.0).with_mods(alt));
+        assert!(matches!(&a[..], [Action::Begin(_), Action::Preview(c, _)] if c == "path.appendAnchor"), "{a:?}");
+    }
+
+    /// #494: the Pen goes on drawing the path it drew while that path stays selected (after a Cmd
+    /// drag with Direct Selection), but never another open path selected meanwhile.
+    #[test]
+    fn the_pen_draws_on_the_path_it_began_only() {
+        let (mut d, a, s) = drawing(vectorcraft_geom::SubPath::polyline(&[Point::new(10.0, 300.0), Point::new(60.0, 300.0)], false));
+        let l = d.layers[0].id;
+        let b = d.alloc_id();
+        let line = vectorcraft_geom::shapes::line(Point::new(10.0, 400.0), Point::new(60.0, 400.0));
+        d.insert(Some(l), 2, vectorcraft_doc::Node::path(b, line, vectorcraft_doc::Appearance::default_art())).unwrap();
+        let p = paint();
+        let mut t = PenTool { drawing: true, ..PenTool::default() };
+        let cx_a = cx(&d, &s, &p);
+        let appended = |acts: &[Action]| match acts {
+            [Action::Begin(_), Action::Preview(c, v)] if c == "path.appendAnchor" => v["id"].as_u64(),
+            _ => None,
+        };
+        assert_eq!(appended(&click(&mut t, &cx_a, 100.0, 320.0, Mods::default())), Some(a.0));
+        // Path B selected instead: the next click starts a new path.
+        let mut sb = Selection::default();
+        sb.set([b]);
+        let cx_b = cx(&d, &sb, &p);
+        assert_eq!(t.cursor(&cx_b, Point::new(150.0, 350.0), Mods::default()), Cursor::Pen);
+        let acts = click(&mut t, &cx_b, 150.0, 350.0, Mods::default());
+        assert!(matches!(&acts[..], [Action::Begin(_), Action::Preview(c, _)] if c == "path.create"), "{acts:?}");
+    }
 }

crates/ui-egui/src/canvas.rs

@@ -1,7 +1,7 @@
 //! The document canvas: rendering, rulers, navigation, pointer routing to tools and on-canvas
 //! selection visuals (bounding box, anchors, handles, smart-guide style labels).
 
-use egui::{Color32, CornerRadius, Pos2, Sense, Shape, Stroke, StrokeKind, Ui, pos2, vec2};
+use egui::{Color32, CornerRadius, Pos2, Sense, Shape, Stroke, StrokeKind, Ui, Vec2, pos2, vec2};
 use serde_json::json;
 use vectorcraft_doc::{Node, NodeKind, Unit};
 use vectorcraft_geom::{Affine, BezPath, PathEl, Point, Rect};
@@ -76,31 +76,19 @@ enum Drag {
         start_angle: f64,
         start_rot: f64,
     },
-    /// Cmd held: temporary selection tool; restore this tool on release.
-    TempSelect,
     /// A Selection tool move dragged off the canvas: the panels get the art
-    /// ([`widgets::PanelDrag::Art`]); `temp` restores the tool Cmd switched from on release.
-    Art {
-        temp: bool,
-    },
+    /// ([`widgets::PanelDrag::Art`]).
+    Art,
 }
 
 fn drag_id() -> egui::Id {
     egui::Id::new("canvas-drag")
 }
-fn temp_tool_id() -> egui::Id {
-    egui::Id::new("canvas-temp-tool")
-}
 /// Where the pointer was last seen during a press on the canvas.
 fn drag_pos_id() -> egui::Id {
     egui::Id::new("canvas-drag-pos")
 }
 
-/// Selection, Direct Selection and Group Selection: the tools Cmd switches to for a drag.
-pub(crate) fn is_selection_tool(id: &str) -> bool {
-    matches!(id, "selection" | "directSelection" | "groupSelection")
-}
-
 /// The pen pressure (0..1) of the press in progress: the force of this frame's pen or touch
 /// input, else the last one seen since the press (`pressed`: a new press, whose mouse has none
 /// until a pen reports it). A mouse presses fully (1).
@@ -158,10 +146,15 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     if app.ui.home.is_some_and(|k| k != crate::menus::home_key(app)) {
         app.ui.home = None;
     }
-    if app.session.active().is_none() || app.ui.home.is_some() {
+    if crate::menus::home_showing(app) {
         home(app, ui, full);
         return;
     }
+    if app.session.active().is_none() {
+        // No document and Show The Home Screen When No Documents Are Open off: an empty window.
+        ui.painter().rect_filled(full, 0.0, t.panel_darker);
+        return;
+    }
     let rect = if app.ui.view.rulers && app.ui.screen_mode < 3 { egui::Rect::from_min_max(full.min + vec2(RULER, RULER), full.max) } else { full };
     app.canvas_rect = Some(rect);
     let fitted = app.view().is_some_and(|v| v.fitted);
@@ -526,19 +519,10 @@ fn handle_input(app: &mut VectorcraftApp, ui: &Ui, resp: &egui::Response, rect:
             let c = rect.center();
             Drag::RotateView { start_angle: (p.y - c.y).atan2(p.x - c.x) as f64, start_rot: v.rotation }
         } else {
-            let mut kind = Drag::Tool;
-            // Cmd with another tool: drag with the selection tool used last.
-            if m.command && !is_selection_tool(tool) {
-                ui.data_mut(|d| d.insert_temp(temp_tool_id(), tool.to_string()));
-                let last = app.ui.last_selection_tool.clone();
-                app.select_tool(if is_selection_tool(&last) { &last } else { "selection" });
-                kind = Drag::TempSelect;
-            }
-            // Cmd only brought the selection tool: its click is a plain one, not Select Behind.
-            let mods = Mods { cmd: m.command && kind != Drag::TempSelect, ..mods(m, space) };
-            let ev = PointerEvent { kind: PointerKind::Down, pos: xf.to_doc(p), mods, pressure: pen_pressure(ui, true) };
+            // Cmd with another tool drags with the selection tool used last (the session lends it).
+            let ev = PointerEvent { kind: PointerKind::Down, pos: xf.to_doc(p), mods: mods(m, space), pressure: pen_pressure(ui, true) };
             dispatch(app, &ev, view);
-            kind
+            Drag::Tool
         };
         ui.data_mut(|dd| {
             dd.insert_temp(drag_id(), d);
@@ -575,11 +559,11 @@ fn handle_input(app: &mut VectorcraftApp, ui: &Ui, resp: &egui::Response, rect:
                         vm.rotation = vectorcraft_geom::normalize_deg(deg);
                     }
                 }
-                Drag::ZoomBox { .. } | Drag::Art { .. } => {}
-                Drag::Tool | Drag::TempSelect if drag_art_out(app, ui, resp, p, view) => {
-                    ui.data_mut(|dd| dd.insert_temp(drag_id(), Drag::Art { temp: d == Drag::TempSelect }));
+                Drag::ZoomBox { .. } | Drag::Art => {}
+                Drag::Tool if drag_art_out(app, ui, resp, p, view) => {
+                    ui.data_mut(|dd| dd.insert_temp(drag_id(), Drag::Art));
                 }
-                Drag::Tool | Drag::TempSelect => {
+                Drag::Tool => {
                     if pointer.delta() != egui::Vec2::ZERO {
                         let ev = PointerEvent { kind: PointerKind::Drag, pos: xf.to_doc(p), mods: mods(m, space), pressure: pen_pressure(ui, false) };
                         dispatch(app, &ev, view);
@@ -615,17 +599,11 @@ fn handle_input(app: &mut VectorcraftApp, ui: &Ui, resp: &egui::Response, rect:
                         }
                     }
                 }
-                Drag::Tool | Drag::TempSelect | Drag::Art { .. } => {
-                    if !matches!(d, Drag::Art { .. }) {
-                        let ev = PointerEvent { kind: PointerKind::Up, pos: xf.to_doc(p), mods: mods(m, space), pressure: pen_pressure(ui, false) };
-                        dispatch(app, &ev, view);
-                    }
-                    if matches!(d, Drag::TempSelect | Drag::Art { temp: true })
-                        && let Some(prev) = ui.data(|dd| dd.get_temp::<String>(temp_tool_id()))
-                    {
-                        app.restore_tool(&prev);
-                    }
+                Drag::Tool => {
+                    let ev = PointerEvent { kind: PointerKind::Up, pos: xf.to_doc(p), mods: mods(m, space), pressure: pen_pressure(ui, false) };
+                    dispatch(app, &ev, view);
                 }
+                Drag::Art => {}
                 Drag::Pan { .. } | Drag::RotateView { .. } => {}
             }
         }
@@ -1366,7 +1344,7 @@ fn selection_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
     let app = &*app;
     let Some(st) = app.session.active() else { return };
     let tool = app.session.tool_id();
-    let direct = matches!(tool, "directSelection" | "pen" | "addAnchor" | "deleteAnchor" | "anchorPoint" | "curvature");
+    let direct = vectorcraft_tools::catalog::edits_anchors(tool);
     // Selection & Anchor Display › Size (1–7, 3 the default): anchors, handles and the bounding
     // box's handles a point bigger or smaller per step.
     let look = HandleLook::of(&app.session.prefs);
@@ -1572,7 +1550,7 @@ fn draw_overlays(p: &egui::Painter, xf: &Xf, overlays: &[Overlay], t: &Tokens, l
     }
 }
 
-/// The Home screen shown when no document is open.
+/// The Home screen (`app.home`; with no document open, unless its preference is off).
 fn home(app: &mut VectorcraftApp, ui: &mut Ui, rect: egui::Rect) {
     let t = Tokens::get(ui.ctx());
     ui.painter().rect_filled(rect, 0.0, t.panel_darker);
@@ -1624,7 +1602,20 @@ fn upload(app: &mut VectorcraftApp, ctx: &egui::Context, img: &vectorcraft_rende
     }
 }
 
+/// The Contextual Task Bar's area.
+fn task_bar_id() -> egui::Id {
+    egui::Id::new("task-bar")
+}
+
+/// Where the Contextual Task Bar was last drawn (none while it isn't shown).
+pub(crate) fn task_bar_rect(ctx: &egui::Context) -> Option<egui::Rect> {
+    let id = task_bar_id();
+    ctx.memory(|m| m.areas().is_visible(&egui::LayerId::new(egui::Order::Middle, id)).then(|| m.area_rect(id)).flatten())
+}
+
 /// The Contextual Task Bar: a floating pill under the selection with the most likely next actions.
+/// Its handle drags it anywhere on the canvas; unpinned it keeps that offset as it follows the
+/// selection, pinned it stays put ([`crate::state::TaskBarPlace`]).
 fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
     let t = Tokens::get(ui.ctx());
     let Some(st) = app.session.active() else { return };
@@ -1657,12 +1648,36 @@ fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
     }
     items.push((tl!("Duplicate"), "copy", "edit.duplicate"));
     let fill = first.as_ref().map(|f| f.appearance.fill_paint()).unwrap_or_default();
+    let doc = st.uid;
     let anchor = xf.to_screen(Point::new(b.center().x, b.y1));
     let est_w = 118.0 + items.iter().map(|(l, _, _)| l.len() as f32 * 7.2 + 44.0).sum::<f32>();
-    let x = (anchor.x - est_w / 2.0).clamp(xf.rect.left() + 8.0, (xf.rect.right() - est_w - 8.0).max(xf.rect.left() + 8.0));
-    let y = (anchor.y + 28.0).min(xf.rect.bottom() - 56.0);
-    let mut run: Option<String> = None;
-    egui::Area::new(egui::Id::new("task-bar")).order(egui::Order::Middle).fixed_pos(pos2(x, y)).show(ui.ctx(), |ui| {
+    // Its place under the selection, then where the handle moved it, kept on the canvas (with the
+    // bar's size last frame, the estimate before it first shows).
+    let under = pos2(anchor.x - est_w / 2.0, anchor.y + 28.0);
+    let id = task_bar_id();
+    let size = egui::AreaState::load(ui.ctx(), id).and_then(|s| s.size).unwrap_or(vec2(est_w, 44.0));
+    let bounds = xf.rect.shrink(8.0);
+    let keep_in = |p: Pos2| p.clamp(bounds.min, (bounds.max - size).max(bounds.min));
+    let place = &mut app.ui.task_bar_place;
+    // Just unpinned: follow the selection from the pinned spot.
+    if !place.pinned
+        && let Some(at) = place.pin_at.take()
+    {
+        place.offset = Some((doc, xf.rect.min + at - under));
+    }
+    let pos = keep_in(match place.pin_at {
+        Some(at) => xf.rect.min + at,
+        None => under + place.offset.filter(|(d, _)| *d == doc).map_or(Vec2::ZERO, |(_, o)| o),
+    });
+    place.shown_at = Some(pos - xf.rect.min);
+    // Pinned before it ever showed: hold it here.
+    if place.pinned && place.pin_at.is_none() {
+        place.pin_at = place.shown_at;
+    }
+    let pinned = place.pinned;
+    let mut moved = Vec2::ZERO;
+    let mut run: Option<(&str, serde_json::Value)> = None;
+    egui::Area::new(id).order(egui::Order::Middle).fixed_pos(pos).show(ui.ctx(), |ui| {
         egui::Frame::NONE
             .fill(t.panel)
             .stroke(Stroke::new(1.0, t.tool_active))
@@ -1672,8 +1687,15 @@ fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
             .show(ui, |ui| {
                 ui.horizontal(|ui| {
                     ui.spacing_mut().item_spacing.x = 6.0;
-                    let (g, _) = ui.allocate_exact_size(vec2(4.0, 28.0), Sense::hover());
-                    ui.painter().rect_filled(g.shrink2(vec2(0.5, 4.0)), CornerRadius::same(2), t.button_border);
+                    let (g, grip) = ui.allocate_exact_size(vec2(4.0, 28.0), Sense::drag());
+                    let active = grip.hovered() || grip.dragged();
+                    ui.painter().rect_filled(g.shrink2(vec2(0.5, 4.0)), CornerRadius::same(2), if active { t.text_dim } else { t.button_border });
+                    if grip.dragged() {
+                        ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
+                        moved = grip.drag_delta();
+                    } else if grip.hovered() {
+                        ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
+                    }
                     for (label, icon, cmd) in &items {
                         let galley = ui.painter().layout_no_wrap(label.to_string(), egui::FontId::proportional(13.0), t.text_strong);
                         let (r, resp) = ui.allocate_exact_size(vec2(galley.size().x + 38.0, 30.0), Sense::click());
@@ -1684,7 +1706,7 @@ fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
                         crate::icons::paint(ui, icon, egui::Rect::from_min_size(r.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), t.icon);
                         ui.painter().galley(pos2(r.left() + 30.0, r.center().y - galley.size().y / 2.0), galley, t.text_strong);
                         if resp.clicked() {
-                            run = Some(cmd.to_string());
+                            run = Some((*cmd, json!({})));
                         }
                     }
                     let (r, resp) = ui.allocate_exact_size(vec2(26.0, 30.0), Sense::click());
@@ -1700,16 +1722,41 @@ fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
                         app.ui.open_panel = Some("swatches".into());
                     }
                     if widgets::icon_button(ui, "lock", tl!("Lock (⌘2)"), false, 30.0).clicked() {
-                        run = Some("object.lock".into());
-                    }
-                    if widgets::icon_button(ui, "ellipsis", tl!("Hide Contextual Task Bar"), false, 30.0).clicked() {
-                        run = Some("window.taskBar".into());
+                        run = Some(("object.lock", json!({})));
                     }
+                    let more = widgets::icon_button(ui, "ellipsis", tl!("More Options"), false, 30.0);
+                    egui::Popup::menu(&more).show(|ui| {
+                        ui.set_min_width(170.0);
+                        let bar = [
+                            (tl!("Hide Bar"), "window.taskBar", false),
+                            (tl!("Pin Bar Position"), "window.taskBar.pin", pinned),
+                            (tl!("Reset Bar Position"), "window.taskBar.reset", false),
+                        ];
+                        for (label, cmd, checked) in bar {
+                            if widgets::menu_item(ui, label, true, checked) {
+                                run = Some((cmd, json!({})));
+                            }
+                        }
+                        ui.separator();
+                        if widgets::menu_item(ui, tl!("Show Properties Panel"), true, false) {
+                            run = Some(("window.panel", json!({"panel": "properties"})));
+                        }
+                    });
                 });
             });
     });
-    if let Some(c) = run {
-        crate::menus::invoke(app, &c, json!({}));
+    if moved != Vec2::ZERO {
+        let to = keep_in(pos + moved);
+        let place = &mut app.ui.task_bar_place;
+        if place.pinned {
+            place.pin_at = Some(to - xf.rect.min);
+        } else {
+            place.offset = Some((doc, to - under));
+        }
+        ui.ctx().request_repaint();
+    }
+    if let Some((c, p)) = run {
+        crate::menus::invoke(app, c, p);
     }
 }
 
@@ -2812,4 +2859,83 @@ mod tests {
         assert_eq!(doc.selection.objects, vec![vectorcraft_doc::NodeId(id)]);
         assert_eq!(doc.doc.art_bounds(), before, "the tap moved nothing");
     }
+
+    /// The Contextual Task Bar's handle drags it: unpinned it keeps that offset as it follows the
+    /// selection, pinned it stays put when the selection changes, unpinned again it follows from
+    /// there, and Reset Bar Position puts it back under the selection. It never leaves the canvas,
+    /// also when the window shrinks.
+    #[test]
+    fn the_task_bar_is_dragged_by_its_handle_pinned_and_reset() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        let mut square =
+            |x: f64, y: f64| app.session.execute("shape.rectangle", &json!({"x": x, "y": y, "width": 40, "height": 40})).unwrap()["id"].clone();
+        let (a, b) = (square(120.0, 40.0), square(220.0, 150.0));
+        app.select_tool("selection");
+        let ctx = egui::Context::default();
+        let bar = || task_bar_rect(&ctx).expect("the task bar shows");
+        let select = |app: &mut VectorcraftApp, id: &serde_json::Value| {
+            app.session.execute("select.set", &json!({"ids": [id]})).unwrap();
+            frame(app, &ctx, vec![]);
+            frame(app, &ctx, vec![]);
+            bar().min
+        };
+        let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let drag = |app: &mut VectorcraftApp, by: Vec2| {
+            let grip = pos2(bar().left() + 11.0, bar().center().y);
+            frame(app, &ctx, vec![egui::Event::PointerMoved(grip)]);
+            frame(app, &ctx, vec![button(grip, true)]);
+            frame(app, &ctx, vec![egui::Event::PointerMoved(grip + by)]);
+            frame(app, &ctx, vec![button(grip + by, false)]);
+            frame(app, &ctx, vec![]);
+            bar().min
+        };
+        let near = |p: Pos2, q: Pos2| assert!((p - q).length() < 1.5, "{p:?} is not at {q:?}");
+        let (under_a, under_b) = (select(&mut app, &a), select(&mut app, &b));
+        assert!(under_b.y > under_a.y + 100.0, "each bar sits under its selection");
+
+        // Dragged unpinned: it keeps its offset from the selection.
+        select(&mut app, &a);
+        let by = vec2(40.0, -30.0);
+        near(drag(&mut app, by), under_a + by);
+        near(select(&mut app, &b), under_b + by);
+        assert!(!app.ui.task_bar_place.pinned);
+
+        // Pinned: it stays where it is across selection changes, and the handle still moves it.
+        assert_eq!(app.run("window.taskBar.pin", json!({})).unwrap(), json!(true));
+        assert_eq!(crate::menus::checked(&app, "window.taskBar.pin", &json!({})), Some(true));
+        near(select(&mut app, &a), under_b + by);
+        let spot = drag(&mut app, vec2(-20.0, 10.0));
+        near(spot, under_b + by + vec2(-20.0, 10.0));
+        near(select(&mut app, &b), spot);
+
+        // Unpinned: it follows the selection from where it is, kept on the canvas.
+        assert_eq!(app.run("window.taskBar.pin", json!({"pinned": false})).unwrap(), json!(false));
+        near(select(&mut app, &a), spot);
+        let canvas = app.canvas_rect.unwrap();
+        let last = canvas.max - vec2(8.0, 8.0) - bar().size();
+        near(select(&mut app, &b), (under_b + (spot - under_a)).min(last));
+        assert!(app.run("window.taskBar.pin", json!({"pinned": "yes"})).is_err());
+
+        // Kept on the canvas: dragged far off, then pinned in the corner of a shrinking window.
+        near(drag(&mut app, vec2(-2000.0, -2000.0)), canvas.min + vec2(8.0, 8.0));
+        app.run("window.taskBar.pin", json!({"pinned": true})).unwrap();
+        drag(&mut app, vec2(2000.0, 2000.0));
+        near(bar().max, canvas.max - vec2(8.0, 8.0));
+        let small = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, vec2(640.0, 480.0))), ..Default::default() };
+        for _ in 0..2 {
+            let mut out = ctx.run_ui(small.clone(), |ui| show(&mut app, ui));
+            out.textures_delta.clear();
+        }
+        let canvas = app.canvas_rect.unwrap();
+        assert!(canvas.width() < 700.0, "the canvas shrank: {canvas:?}");
+        near(bar().max, canvas.max - vec2(8.0, 8.0));
+
+        // Reset: back under the selection, unpinned.
+        frame(&mut app, &ctx, vec![]);
+        app.run("window.taskBar.reset", json!({})).unwrap();
+        assert!(!app.ui.task_bar_place.pinned);
+        near(select(&mut app, &a), under_a);
+        near(select(&mut app, &b), under_b);
+    }
 }

crates/ui-egui/src/chrome.rs

@@ -29,12 +29,13 @@ pub fn app_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
             let (r, _) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::hover());
             crate::brand::paint_mark(ui, r);
             ui.add_space(4.0);
-            let on_home = app.ui.home.is_some() || app.session.active().is_none();
+            let on_home = menus::home_showing(app);
             if widgets::icon_button(ui, "house", tl!("Home"), on_home, 24.0).clicked() {
                 app.run("app.home", json!({})).ok();
             }
             ui.add_space(2.0);
-            let menus_end = if app.native_menu {
+            // With the macOS menu bar the menus are at the top of the screen instead.
+            let menus_end = if app.services.native_menu.is_some() {
                 let full = ui.max_rect();
                 ui.painter().text(full.center(), egui::Align2::CENTER_CENTER, "VectorCraft", egui::FontId::proportional(13.5), t.text);
                 ui.cursor().min.x
@@ -108,10 +109,32 @@ pub fn app_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
 /// An anchor button: icon, tooltip, command and the convert command's `to`.
 type AnchorButton<'a> = (&'a str, &'a str, &'a str, Option<&'a str>);
 
-/// What the Control bar and the Properties panel offer for direct-selected anchors: "Convert:"
-/// corner or smooth, then "Anchors:" remove, connect (Join) and cut. Each group is a row of its
-/// own: inline in the Control bar, one under the other in a panel.
-pub fn anchor_buttons(app: &mut VectorcraftApp, ui: &mut Ui) {
+/// The anchor controls the Control bar and the Properties panel show.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum AnchorControls {
+    None,
+    /// Paths selected as a whole with a tool that edits anchors (Direct Selection, the Pen…),
+    /// which shows all their anchors selected: "Convert:" only, as removing or cutting at every
+    /// anchor isn't what they're for.
+    Convert,
+    /// Anchors direct-selected: "Convert:" and "Anchors:".
+    All,
+}
+
+/// Which anchor controls show for the selection and the active tool.
+pub fn anchor_controls(app: &VectorcraftApp) -> AnchorControls {
+    let Some(st) = app.session.active() else { return AnchorControls::None };
+    if !st.selection.anchors.is_empty() {
+        return AnchorControls::All;
+    }
+    let paths = st.selection.objects.iter().any(|id| st.doc.node(*id).is_some_and(|n| matches!(n.kind, NodeKind::Path { .. })));
+    if paths && vectorcraft_tools::catalog::edits_anchors(app.session.tool_id()) { AnchorControls::Convert } else { AnchorControls::None }
+}
+
+/// What the Control bar and the Properties panel offer for selected anchors ([`anchor_controls`]):
+/// "Convert:" corner or smooth, then "Anchors:" remove, connect (Join) and cut. Each group is a
+/// row of its own: inline in the Control bar, one under the other in a panel.
+pub fn anchor_buttons(app: &mut VectorcraftApp, ui: &mut Ui, controls: AnchorControls) {
     let t = Tokens::get(ui.ctx());
     let mut run = None;
     let groups: [(&str, &[AnchorButton]); 2] = [
@@ -131,7 +154,12 @@ pub fn anchor_buttons(app: &mut VectorcraftApp, ui: &mut Ui) {
             ],
         ),
     ];
-    for (label, buttons) in groups {
+    let shown = match controls {
+        AnchorControls::None => 0,
+        AnchorControls::Convert => 1,
+        AnchorControls::All => groups.len(),
+    };
+    for (label, buttons) in groups.into_iter().take(shown) {
         ui.horizontal(|ui| {
             ui.label(egui::RichText::new(label).size(12.0).color(t.text));
             for &(icon, tip, id, to) in buttons {
@@ -166,9 +194,9 @@ pub fn control_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
                 let sel = st.selection.objects.clone();
                 let units = app.session.general_unit();
                 let first = sel.first().and_then(|id| st.doc.node(*id)).cloned();
-                let anchor_mode = !st.selection.anchors.is_empty();
+                let anchors = anchor_controls(app);
                 let label = match &first {
-                    Some(_) if sel.len() == 1 && anchor_mode => tl!("Anchor Point"),
+                    Some(_) if sel.len() == 1 && anchors != AnchorControls::None => tl!("Anchor Point"),
                     Some(vectorcraft_doc::Node { kind: NodeKind::Image(im), .. }) if sel.len() == 1 => {
                         if im.link.is_some() {
                             tl!("Linked File")
@@ -180,8 +208,8 @@ pub fn control_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
                     _ => tl!(crate::panels::appearance::object_label(app)),
                 };
                 ui.label(egui::RichText::new(label).font(theme::semibold(12.0)).color(t.text));
-                if anchor_mode {
-                    anchor_buttons(app, ui);
+                if anchors != AnchorControls::None {
+                    anchor_buttons(app, ui, anchors);
                 }
                 ui.add_space(6.0);
                 // An image or an Image Trace object shows its own controls in place of Fill and Stroke.

crates/ui-egui/src/clipboard_probe.rs

@@ -0,0 +1,99 @@
+//! Checks the system clipboard for Paste off the UI thread. `has()` can block for seconds when the
+//! clipboard owner never answers (an unresponsive X11 client), so it must not run on the thread that
+//! draws the window: a worker owns a second clipboard handle, sends its verdict when it changes, and
+//! the UI only reads the latest one. Without a worker the check stays in line, as before (the web,
+//! and hosts that don't install a factory).
+
+use std::sync::mpsc::{Receiver, RecvTimeoutError, Sender, TryRecvError};
+use std::time::{Duration, Instant};
+
+use vectorcraft_engine::cmd::clipboard::PASTE_ORDER;
+
+use crate::sysclip::ClipboardProbeFactory;
+
+/// How often the worker looks at the clipboard while the UI wants to know.
+const PROBE_INTERVAL: Duration = Duration::from_millis(250);
+
+/// How long dropping the probe waits for the worker to let go of its clipboard handle.
+const STOP_WAIT: Duration = Duration::from_millis(250);
+
+/// The background clipboard check ([`crate::VectorcraftApp`]'s `clipboard_probe`).
+pub(crate) struct Probe {
+    /// Tells the worker whether Paste depends on the system clipboard; dropped to stop it.
+    wants: Option<Sender<bool>>,
+    wanted: bool,
+    verdicts: Receiver<bool>,
+    /// The worker's last verdict.
+    last: bool,
+}
+
+impl Probe {
+    /// Start the worker. `None` on wasm, or when the thread can't be spawned: the caller then falls
+    /// back to the in-line check.
+    pub(crate) fn start(make: ClipboardProbeFactory, ctx: egui::Context) -> Option<Self> {
+        if cfg!(target_arch = "wasm32") {
+            return None;
+        }
+        let (wants, wanted_rx) = std::sync::mpsc::channel();
+        let (tx, verdicts) = std::sync::mpsc::channel();
+        std::thread::Builder::new()
+            .name("vectorcraft-clip".into())
+            .spawn(move || {
+                let mut clipboard = make();
+                let (mut wanted, mut sent) = (false, None);
+                loop {
+                    if wanted {
+                        // This thread may wait here for a slow owner; the UI's never does.
+                        let verdict = clipboard.has(&PASTE_ORDER);
+                        if sent != Some(verdict) {
+                            if tx.send(verdict).is_err() {
+                                break;
+                            }
+                            sent = Some(verdict);
+                            ctx.request_repaint();
+                        }
+                    }
+                    // Sleep until the next look (no looks while unwanted) or the UI's next word.
+                    let next =
+                        if wanted { wanted_rx.recv_timeout(PROBE_INTERVAL) } else { wanted_rx.recv().map_err(|_| RecvTimeoutError::Disconnected) };
+                    match next {
+                        Ok(w) => wanted = w,
+                        Err(RecvTimeoutError::Timeout) => {}
+                        Err(RecvTimeoutError::Disconnected) => break,
+                    }
+                }
+                // The handle goes before the app stops waiting (`Drop`): on X11 the last one alive
+                // hands what the app copied to the clipboard manager, which must finish before exit.
+                drop(clipboard);
+                drop(tx);
+            })
+            .ok()?;
+        Some(Self { wants: Some(wants), wanted: false, verdicts, last: false })
+    }
+
+    /// Paste can take from the system clipboard: `wanted` (nothing copied in the app, a document
+    /// open) and the worker's latest verdict says so. Never blocks. `None` once the worker is gone.
+    pub(crate) fn pasteable(&mut self, wanted: bool) -> Option<bool> {
+        if wanted != self.wanted {
+            self.wants.as_ref()?.send(wanted).ok()?;
+            self.wanted = wanted;
+        }
+        loop {
+            match self.verdicts.try_recv() {
+                Ok(verdict) => self.last = verdict,
+                Err(TryRecvError::Empty) => return Some(wanted && self.last),
+                Err(TryRecvError::Disconnected) => return None,
+            }
+        }
+    }
+}
+
+impl Drop for Probe {
+    /// Wake the worker to stop and wait (a moment at most: it may be stuck on an owner that never
+    /// answers) until it has let go of its clipboard handle.
+    fn drop(&mut self) {
+        self.wants = None;
+        let end = Instant::now() + STOP_WAIT;
+        while self.verdicts.recv_timeout(end.saturating_duration_since(Instant::now())).is_ok() {}
+    }
+}

crates/ui-egui/src/control.rs

@@ -79,6 +79,11 @@ pub fn inspect(app: &VectorcraftApp, ctx: &egui::Context) -> Value {
         "ui": serde_json::to_value(&app.ui).unwrap_or_default(),
         // Not saved with the UI state, so not in `ui`: 0 normal … 3 Presentation Mode.
         "screenMode": app.ui.screen_mode,
+        // The Contextual Task Bar: pinned (not saved either) and where it shows.
+        "taskBar": {
+            "pinned": app.ui.task_bar_place.pinned,
+            "rect": crate::canvas::task_bar_rect(ctx).map(|r| json!([r.left(), r.top(), r.width(), r.height()])),
+        },
         "view": app.view().map(|v| serde_json::to_value(v).unwrap_or_default()),
         "canvasRect": app.canvas_rect.map(|c| json!([c.left(), c.top(), c.width(), c.height()])),
         "window": [r.width(), r.height()],
@@ -86,6 +91,8 @@ pub fn inspect(app: &VectorcraftApp, ctx: &egui::Context) -> Value {
         "activeDocument": app.session.active_index(),
         "perf": {"frameMs": app.perf.frame_ms, "renderMs": app.perf.render_ms, "fps": app.perf.fps},
         "graphicsAdapter": app.graphics_adapter,
+        // The menus are in the macOS menu bar rather than the window.
+        "nativeMenuBar": app.services.native_menu.is_some(),
         // Saves and exports still being written in the background (Background Save / Export).
         "background": app.background.jobs.iter().map(|j| j.label.as_str()).collect::<Vec<_>>(),
     })

crates/ui-egui/src/dialogs/modal.rs

@@ -12,7 +12,8 @@ use crate::theme::{self, Tokens};
 /// should start with [`heading`] (or [`drag_band`]) so the window can be moved.
 pub(crate) fn show<R>(ctx: &egui::Context, title: &str, id: Id, nudge: f32, margin: i8, add: impl FnOnce(&mut egui::Ui) -> R) -> Option<R> {
     let t = Tokens::get(ctx);
-    egui::Area::new(Id::new("modal-dim")).order(egui::Order::Middle).fixed_pos(egui::Pos2::ZERO).show(ctx, |ui| {
+    let dim = backdrop();
+    egui::Area::new(dim.id).order(dim.order).fixed_pos(egui::Pos2::ZERO).show(ctx, |ui| {
         // Modal, but the canvas isn't dimmed so previews stay readable (as in the reference app).
         ui.allocate_rect(ctx.content_rect(), egui::Sense::click());
     });
@@ -28,6 +29,12 @@ pub(crate) fn show<R>(ctx: &egui::Context, title: &str, id: Id, nudge: f32, marg
         .and_then(|r| r.inner)
 }
 
+/// The layer of the backdrop behind a modal dialog window, which takes the clicks the rest of
+/// the app would get.
+pub(crate) fn backdrop() -> egui::LayerId {
+    egui::LayerId::new(egui::Order::Middle, Id::new("modal-dim"))
+}
+
 /// The dialog's heading, which also moves the window ([`drag_band`]).
 pub(crate) fn heading(ui: &mut egui::Ui, text: &str) {
     let t = Tokens::get(ui.ctx());

crates/ui-egui/src/dialogs/perspective_presets.rs

@@ -209,11 +209,6 @@ pub fn slot_preset(app: &VectorcraftApp, id: &str) -> Option<String> {
     app.session.prefs.perspective_presets.iter().filter(|p| p.kind == kind).nth(n.checked_sub(1)?).map(|p| p.name.clone())
 }
 
-/// How many saved presets the slots list (the native menu is rebuilt when this changes).
-pub fn listed_slots(app: &VectorcraftApp) -> usize {
-    (1..=3u8).map(|k| app.session.prefs.perspective_presets.iter().filter(|p| p.kind == k).count().min(SLOTS)).sum()
-}
-
 /// View → Perspective Grid → One/Two/Three Point Perspective (`kind` 1–3): the built-in views of
 /// the type, then the saved presets' slots (`slots`, the type's ids).
 pub fn menu(kind: u8, slots: [&'static str; SLOTS]) -> Vec<Item> {

crates/ui-egui/src/dialogs/tests_perspective.rs

@@ -141,7 +141,11 @@ fn the_presets_manager_creates_edits_and_deletes_presets() {
     assert_eq!(app.session.prefs.perspective_presets[0].opacity, 90.0);
     // Its type's menu lists it in a slot, which applies it.
     assert_eq!(crate::menus::dynamic_label(&app, "ui.perspectiveUserPreset3.1", ""), "Gorge");
-    assert!(crate::menus::hidden_slot(&app, "ui.perspectiveUserPreset3.2") && crate::menus::hidden_slot(&app, "ui.perspectiveUserPreset2.1"));
+    assert!(
+        ["ui.perspectiveUserPreset3.2", "ui.perspectiveUserPreset2.1"]
+            .iter()
+            .all(|id| crate::menus::shown_state(&app, id, &serde_json::Value::Null).is_none())
+    );
     app.run("ui.perspectiveUserPreset3.1", json!({})).unwrap();
     assert_eq!(grid(&app).name, "Gorge");
     // Delete selects the one above it.

crates/ui-egui/src/dock.rs

@@ -8,7 +8,7 @@ use serde_json::json;
 
 use crate::state::{DockTab, ICON_PANEL_GROUPS, ICON_PANELS};
 use crate::theme::{self, Tokens};
-use crate::{VectorcraftApp, icons, panels, widgets};
+use crate::{VectorcraftApp, floating, icons, panels, widgets};
 
 const ICON_COL: f32 = 38.0;
 /// Height of the strip along the top of a dock column that carries its double arrow.
@@ -57,18 +57,26 @@ fn toggle(app: &mut VectorcraftApp, collapsed: bool) {
     }
 }
 
-/// One icon of the column: a click pops its panel out (or puts it away).
-fn panel_icon(app: &mut VectorcraftApp, ui: &mut Ui, id: &str, label: &str, icon: &str) {
+/// One icon of the column: a click pops its panel out (or puts it away); dragged out of the
+/// column (`column`), the panel floats.
+fn panel_icon(app: &mut VectorcraftApp, ui: &mut Ui, id: &'static str, label: &str, icon: &str, column: Rect) {
     let open = app.ui.open_panel.as_deref() == Some(id);
-    if widgets::icon_button(ui, icon, label, open, 30.0).clicked() {
+    // Its own id: the icons below it move up when it floats, and mustn't take over its drag.
+    let (_, rect) = ui.allocate_space(vec2(30.0, 30.0));
+    let resp = widgets::paint_icon_button(ui, ui.interact(rect, ui.id().with(("panel-icon", id)), Sense::click_and_drag()), icon, label, open);
+    if resp.clicked() {
         app.ui.open_panel = if open { None } else { Some(id.to_string()) };
     }
+    if resp.dragged() && ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| !column.contains(p)) {
+        floating::tear(app, ui.ctx(), &[id], id, floating::strip_grab(ui.ctx(), resp.rect.left()));
+    }
 }
 
 pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
-    // Main tabbed group, unless it is collapsed to icons.
-    if !app.ui.dock_collapsed {
+    let shown = floating::shown_tab(&app.ui);
+    // Main tabbed group, unless it is collapsed to icons or all its panels float.
+    let group = shown.filter(|_| !app.ui.dock_collapsed).map(|active| {
         egui::Panel::right("dock")
             .resizable(true)
             .default_size(DOCK_WIDTH)
@@ -78,47 +86,31 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
                 if collapse_header(ui, false) {
                     toggle(app, true);
                 }
-                // Tab strip.
-                let (strip, _) = ui.allocate_exact_size(vec2(ui.available_width(), 33.0), Sense::hover());
-                ui.painter().rect_filled(strip, 0.0, t.tab_strip);
-                ui.painter().line_segment([strip.left_bottom(), strip.right_bottom()], Stroke::new(1.0, t.border));
-                let mut x = strip.left();
-                for tab in DockTab::ALL {
-                    let (_, label, _) = tab.info();
-                    let active = app.ui.dock_tab == tab;
-                    let galley =
-                        ui.painter().layout_no_wrap(tl!(label).to_string(), theme::semibold(12.5), if active { t.text_strong } else { t.text_dim });
-                    let r = egui::Rect::from_min_size(egui::pos2(x, strip.top()), vec2(galley.size().x + 24.0, strip.height() - 1.0));
-                    let resp = ui.interact(r, ui.id().with(("docktab", label)), Sense::click());
-                    if active {
-                        ui.painter().rect_filled(r, 0.0, t.panel);
-                    }
-                    ui.painter().galley(egui::pos2(r.left() + 12.0, r.center().y - galley.size().y / 2.0), galley, t.text);
-                    ui.painter().line_segment([r.right_top(), r.right_bottom()], Stroke::new(1.0, t.border));
-                    if resp.clicked() {
-                        app.ui.dock_tab = tab;
-                    }
-                    x = r.right();
+                if tab_strip(app, ui, active) {
+                    // It floats from this frame on.
+                    return;
                 }
-                let menu_id = app.ui.dock_tab.info().0;
-                panels::panel_menu(app, ui, menu_id, egui::Rect::from_center_size(strip.right_center() - vec2(14.0, 0.0), vec2(16.0, 16.0)));
-                egui::Frame::NONE.inner_margin(egui::Margin { left: 12, right: 10, top: 10, bottom: 8 }).show(ui, |ui| match app.ui.dock_tab {
+                egui::Frame::NONE.inner_margin(egui::Margin { left: 12, right: 10, top: 10, bottom: 8 }).show(ui, |ui| match active {
                     DockTab::Properties => {
                         egui::ScrollArea::vertical().id_salt("props").auto_shrink([false, false]).show(ui, |ui| panels::properties::show(app, ui));
                     }
                     DockTab::Layers => panels::layers::show(app, ui),
                     DockTab::Libraries => panels::libraries(app, ui),
                 });
-            });
-    }
+            })
+            .response
+            .rect
+    });
     // Collapsed icon-panel strip, left of the expanded panel group (like Illustrator's dock). A
-    // collapsed group's panels head it, under the « that expands them again.
-    let collapsed = app.ui.dock_collapsed;
+    // collapsed group's panels head it, under the « that expands them again. Floating panels leave
+    // it.
+    let collapsed = app.ui.dock_collapsed && shown.is_some();
     let column = egui::Panel::right("icon_column")
         .resizable(false)
         .exact_size(ICON_COL)
         .frame(egui::Frame::NONE.fill(t.panel).stroke(Stroke::new(1.5, t.border)))
         .show(ui, |ui| {
+            let bounds = ui.max_rect();
             if collapsed && collapse_header(ui, true) {
                 toggle(app, false);
             }
@@ -129,41 +121,98 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
                     if collapsed {
                         for tab in DockTab::ALL {
                             let (id, label, icon) = tab.info();
-                            panel_icon(app, ui, id, label, icon);
+                            if floating::group_of(&app.ui, id).is_none() {
+                                panel_icon(app, ui, id, label, icon, bounds);
+                            }
                         }
                     }
-                    for (gi, group) in ICON_PANEL_GROUPS.iter().enumerate() {
-                        if gi > 0 || collapsed {
-                            let (r, _) = ui.allocate_exact_size(vec2(ui.available_width(), 7.0), Sense::hover());
-                            ui.painter()
-                                .line_segment([r.left_center() + vec2(4.0, 0.0), r.right_center() - vec2(4.0, 0.0)], Stroke::new(1.0, t.divider));
-                        }
+                    // A divider above each group with icons left, but the first.
+                    let mut divider = collapsed;
+                    for group in ICON_PANEL_GROUPS {
+                        let mut first = true;
                         for id in group.iter() {
                             let Some((_, label, icon)) = ICON_PANELS.iter().find(|p| p.0 == *id) else { continue };
-                            panel_icon(app, ui, id, label, icon);
+                            if floating::group_of(&app.ui, id).is_some() {
+                                continue;
+                            }
+                            if std::mem::take(&mut first) && std::mem::replace(&mut divider, true) {
+                                let (r, _) = ui.allocate_exact_size(vec2(ui.available_width(), 7.0), Sense::hover());
+                                ui.painter()
+                                    .line_segment([r.left_center() + vec2(4.0, 0.0), r.right_center() - vec2(4.0, 0.0)], Stroke::new(1.0, t.divider));
+                            }
+                            panel_icon(app, ui, id, label, icon, bounds);
                         }
                     }
                 });
             });
         });
-    let left = column.response.rect.left();
-    ui.ctx().data_mut(|d| d.insert_temp(column_left_id(), left));
+    let column = column.response.rect;
+    let dock = group.map_or(column, |g| g.union(column));
+    ui.ctx().data_mut(|d| {
+        d.insert_temp(column_left_id(), column.left());
+        d.insert_temp(floating::dock_rect_id(), dock);
+    });
+}
+
+/// The tabbed group's tab strip, showing `active`: a click on a tab shows it, a tab dragged out of
+/// the strip floats on its own, and the strip right of the tabs floats the whole group. True when
+/// the shown panel floats now.
+fn tab_strip(app: &mut VectorcraftApp, ui: &mut Ui, active: DockTab) -> bool {
+    let t = Tokens::get(ui.ctx());
+    let (strip, _) = ui.allocate_exact_size(vec2(ui.available_width(), 33.0), Sense::hover());
+    ui.painter().rect_filled(strip, 0.0, t.tab_strip);
+    ui.painter().line_segment([strip.left_bottom(), strip.right_bottom()], Stroke::new(1.0, t.border));
+    let out = ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| !strip.contains(p));
+    // What a drag out of the strip floats: the panels, the one shown, where its tab began.
+    let mut tear: Option<(Vec<&'static str>, &'static str, f32)> = None;
+    let mut x = strip.left();
+    for tab in DockTab::ALL {
+        let (id, label, _) = tab.info();
+        if floating::group_of(&app.ui, id).is_some() {
+            continue;
+        }
+        let galley =
+            ui.painter().layout_no_wrap(tl!(label).to_string(), theme::semibold(12.5), if tab == active { t.text_strong } else { t.text_dim });
+        let r = Rect::from_min_size(egui::pos2(x, strip.top()), vec2(galley.size().x + 24.0, strip.height() - 1.0));
+        let resp = ui.interact(r, ui.id().with(("docktab", label)), Sense::click_and_drag());
+        if tab == active {
+            ui.painter().rect_filled(r, 0.0, t.panel);
+        }
+        ui.painter().galley(egui::pos2(r.left() + 12.0, r.center().y - galley.size().y / 2.0), galley, t.text);
+        ui.painter().line_segment([r.right_top(), r.right_bottom()], Stroke::new(1.0, t.border));
+        if resp.clicked() {
+            app.ui.dock_tab = tab;
+        } else if resp.dragged() && out {
+            tear = Some((vec![id], id, r.left()));
+        }
+        x = r.right();
+    }
+    let menu = Rect::from_center_size(strip.right_center() - vec2(14.0, 0.0), vec2(16.0, 16.0));
+    let rest = Rect::from_min_max(egui::pos2(x, strip.top()), egui::pos2(menu.left() - 4.0, strip.bottom()));
+    if rest.width() > 0.0 {
+        let resp = ui.interact(rest, ui.id().with("dock-group-bar"), Sense::drag());
+        if resp.dragged() && out {
+            tear = Some((floating::docked_tabs(&app.ui).map(|t| t.info().0).collect(), active.info().0, strip.left()));
+        }
+        resp.on_hover_cursor(egui::CursorIcon::Grab).on_hover_text(tl!("Drag to float the panel group"));
+    }
+    panels::panel_menu(app, ui, active.info().0, menu);
+    if let Some((ids, id, left)) = tear {
+        floating::tear(app, ui.ctx(), &ids, id, floating::strip_grab(ui.ctx(), left));
+    }
+    // Torn off, or floated from its menu.
+    floating::group_of(&app.ui, active.info().0).is_some()
 }
 
 /// A panel popped out next to the icon column: an icon panel, or one of the tabbed group's panels
-/// while the dock is collapsed.
+/// while the dock is collapsed. Dragging its title floats it.
 pub fn floating_panel(app: &mut VectorcraftApp, ctx: &egui::Context) {
-    let Some(id) = app.ui.open_panel.clone() else { return };
-    let tab = DockTab::from_id(&id);
-    let label = match tab {
-        Some(tab) if app.ui.dock_collapsed => tab.info().1,
-        // Expanded, the group shows its panels in the dock itself.
-        Some(_) => return,
-        None => match ICON_PANELS.iter().find(|p| p.0 == id) {
-            Some((_, label, _)) => *label,
-            None => return,
-        },
-    };
+    let Some((id, label)) = app.ui.open_panel.as_deref().and_then(|p| crate::state::all_panels().find(|(q, _)| *q == p)) else { return };
+    let tab = DockTab::from_id(id);
+    // Expanded, the group shows its panels in the dock itself; a floating panel shows in its group.
+    if tab.is_some() && !app.ui.dock_collapsed || floating::group_of(&app.ui, id).is_some() {
+        return;
+    }
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
     // Pinned by its right edge, 6 points left of the icon column wherever the dock's width (or its
@@ -179,59 +228,94 @@ pub fn floating_panel(app: &mut VectorcraftApp, ctx: &egui::Context) {
     let right = column - 6.0;
     // The tabbed group's panels fill their height (Layers) or scroll (Properties): give them one
     // that keeps the flyout on screen.
-    // The tabbed group's panels keep the width the dock gives them; icon panels are 256 points.
-    let width = if tab.is_some() { DOCK_WIDTH } else { 256.0 };
+    let width = panel_width(id);
     let tall = (screen.height() - FLYOUT_TOP - 26.0 - 20.0 - 40.0).clamp(160.0, 560.0);
     let mut open = true;
+    let mut torn = None;
     let area = egui::Area::new(egui::Id::new("icon-panel")).order(egui::Order::Foreground).pivot(egui::Align2::RIGHT_TOP);
     area.fixed_pos(egui::pos2(right, FLYOUT_TOP)).show(ctx, |ui| {
         egui::Frame::popup(ui.style()).fill(t.panel).corner_radius(CornerRadius::same(4)).inner_margin(egui::Margin::ZERO).show(ui, |ui| {
             ui.set_width(width);
             let (strip, _) = ui.allocate_exact_size(vec2(width, 26.0), Sense::hover());
             ui.painter().rect_filled(strip, CornerRadius { nw: 4, ne: 4, sw: 0, se: 0 }, t.panel_darker);
-            let title = egui::Rect::from_min_size(
+            let title = Rect::from_min_size(
                 strip.min,
                 vec2(ui.painter().layout_no_wrap(tl!(label).to_string(), theme::semibold(12.0), t.text).size().x + 24.0, 26.0),
             );
             ui.painter().rect_filled(title, CornerRadius { nw: 4, ne: 0, sw: 0, se: 0 }, t.panel);
             ui.painter().text(title.left_center() + vec2(12.0, 0.0), egui::Align2::LEFT_CENTER, tl!(label), theme::semibold(12.0), t.text);
-            let close = egui::Rect::from_center_size(strip.right_center() - vec2(13.0, 0.0), vec2(14.0, 14.0));
+            let close = Rect::from_center_size(strip.right_center() - vec2(13.0, 0.0), vec2(14.0, 14.0));
             let cr = ui.interact(close, ui.id().with("close-panel"), Sense::click());
             icons::paint(ui, "chevrons-right", close, if cr.hovered() { t.text } else { t.text_dim });
             if cr.clicked() {
                 open = false;
             }
-            let menu_r = egui::Rect::from_center_size(strip.right_center() - vec2(34.0, 0.0), vec2(16.0, 16.0));
-            panels::panel_menu(app, ui, &id, menu_r);
-            egui::Frame::NONE.inner_margin(egui::Margin::same(10)).show(ui, |ui| {
-                ui.set_width(width - 20.0);
-                match tab {
-                    Some(DockTab::Properties) => {
-                        // At least `tall` when the sections are taller: the flyout's area keeps the
-                        // size its content needs, and egui sizes a new area at most 400 points high,
-                        // so a scroll area that only took the room it was given never grew past it.
-                        egui::ScrollArea::vertical()
-                            .id_salt("props-flyout")
-                            .max_height(tall)
-                            .min_scrolled_height(tall)
-                            .auto_shrink([false, true])
-                            .show(ui, |ui| panels::properties::show(app, ui));
-                    }
-                    Some(DockTab::Layers) => {
-                        ui.set_max_height(tall);
-                        panels::layers::show(app, ui);
-                    }
-                    Some(DockTab::Libraries) => panels::libraries(app, ui),
-                    None => panels::show_icon_panel(app, ui, &id),
-                }
-            });
+            let menu_r = Rect::from_center_size(strip.right_center() - vec2(34.0, 0.0), vec2(16.0, 16.0));
+            panels::panel_menu(app, ui, id, menu_r);
+            let drag = ui.interact(title, ui.id().with("title"), Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
+            if drag.dragged() && ui.input(|i| i.pointer.is_decidedly_dragging()) {
+                torn = Some(title.left());
+            }
+            // Torn off, or floated from its menu: it floats from this frame on.
+            if torn.is_some() || floating::group_of(&app.ui, id).is_some() {
+                return;
+            }
+            panel_body(app, ui, id, width, tall);
         });
     });
-    if !open {
+    // User Interface › Auto-Collapse Iconic Panels (#394): a press away from the flyout puts it
+    // away, on the canvas or a docked panel. Not one on the icon column (its icons swap or close the
+    // flyout themselves, on release), nor one on a foreground layer (the flyout itself, a dialog, a palette) or a modal dialog's
+    // backdrop, nor one that closes a popup (a panel menu, a dropdown the flyout opened).
+    if open && app.session.prefs.auto_collapse_icon_panels && !egui::Popup::is_any_open(ctx) {
+        let away = |p: egui::Pos2| {
+            !(column..=column + ICON_COL).contains(&p.x)
+                && ctx.layer_id_at(p).is_none_or(|l| l.order != egui::Order::Foreground && l != crate::dialogs::modal::backdrop())
+        };
+        if ctx.input(|i| i.pointer.any_pressed().then(|| i.pointer.interact_pos()).flatten()).is_some_and(away) {
+            open = false;
+        }
+    }
+    if let Some(left) = torn {
+        floating::tear(app, ctx, &[id], id, floating::strip_grab(ctx, left));
+    } else if !open {
         app.ui.open_panel = None;
     }
 }
 
+/// The width of a popped-out or floating panel: the tabbed group's panels keep the width the dock
+/// gives them; icon panels are 256 points.
+pub(crate) fn panel_width(id: &str) -> f32 {
+    if DockTab::from_id(id).is_some() { DOCK_WIDTH } else { 256.0 }
+}
+
+/// Panel `id`'s contents in a popped-out or floating panel `width` wide; the tabbed group's panels
+/// fill (Layers) or scroll (Properties) `tall` points.
+pub(crate) fn panel_body(app: &mut VectorcraftApp, ui: &mut Ui, id: &str, width: f32, tall: f32) {
+    egui::Frame::NONE.inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+        ui.set_width(width - 20.0);
+        match DockTab::from_id(id) {
+            Some(DockTab::Properties) => {
+                // At least `tall` when the sections are taller: the flyout's area keeps the size its
+                // content needs, and egui sizes a new area at most 400 points high, so a scroll area
+                // that only took the room it was given never grew past it.
+                egui::ScrollArea::vertical()
+                    .id_salt("props-flyout")
+                    .max_height(tall)
+                    .min_scrolled_height(tall)
+                    .auto_shrink([false, true])
+                    .show(ui, |ui| panels::properties::show(app, ui));
+            }
+            Some(DockTab::Layers) => {
+                ui.set_max_height(tall);
+                panels::layers::show(app, ui);
+            }
+            Some(DockTab::Libraries) => panels::libraries(app, ui),
+            None => panels::show_icon_panel(app, ui, id),
+        }
+    });
+}
+
 #[cfg(test)]
 mod tests {
     use serde_json::json;
@@ -319,6 +403,7 @@ mod tests {
                 .run_ui(input, |ui| {
                     show(app, ui);
                     floating_panel(app, ui.ctx());
+                    crate::dialogs::show(app, ui.ctx());
                 })
                 .textures_delta
                 .clear();
@@ -416,6 +501,53 @@ mod tests {
         assert!(rect.height() > 450.0 && rect.bottom() <= SCREEN.y, "Properties flyout {rect:?}");
     }
 
+    /// User Interface › Auto-Collapse Iconic Panels (#394): on, a click away from a popped-out
+    /// panel puts it away; off (the default), the panel stays until its » or its icon.
+    #[test]
+    fn auto_collapse_puts_a_flyout_away_on_a_click_elsewhere() {
+        let mut h = Harness::new();
+        h.app.run("window.collapseDock", json!({"collapsed": true})).unwrap();
+        h.settle();
+        let (properties, layers) = (h.icons()[0], h.icons()[1]);
+        let away = egui::pos2(300.0, 500.0);
+        h.click(layers.center());
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"));
+        h.click(away);
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"), "off: a click elsewhere leaves it");
+        h.app.session.execute("prefs.set", &json!({"key": "autoCollapseIconPanels", "value": true})).unwrap();
+        h.click(away);
+        assert_eq!(h.app.ui.open_panel, None, "on: a click elsewhere puts it away");
+        h.click(layers.center());
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"), "its icon still pops it out");
+        let rect = h.ctx.memory(|m| m.area_rect(egui::Id::new("icon-panel"))).unwrap();
+        h.click(egui::pos2(rect.center().x, rect.top() + 13.0 + 26.0 + 10.0));
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"), "a click inside keeps it");
+        // The icons still swap the flyout and put it away.
+        h.click(properties.center());
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("properties"), "another icon swaps it");
+        h.click(properties.center());
+        assert_eq!(h.app.ui.open_panel, None, "the same icon puts it away");
+        // A dialog (one a panel menu opens, say): a click in it or on its backdrop keeps the panel.
+        h.click(layers.center());
+        h.app.ui.dialog = Some(crate::state::Dialog::new("move", json!({"dx": "0 pt", "dy": "0 pt"})));
+        h.settle();
+        let dialog = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", "move")))).expect("the Move dialog");
+        h.click(dialog.left_top() + vec2(20.0, 30.0));
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"), "a click in the dialog keeps it");
+        h.click(egui::pos2(dialog.left() - 40.0, dialog.center().y));
+        assert_eq!(h.app.ui.open_panel.as_deref(), Some("layers"), "a click on the backdrop keeps it");
+        h.app.ui.dialog = None;
+        // The dock expanded: a click in its panel group puts a popped-out icon panel away too.
+        h.app.run("window.collapseDock", json!({"collapsed": false})).unwrap();
+        h.settle();
+        let icon = h.icons()[0];
+        h.click(icon.center());
+        let open = h.app.ui.open_panel.clone();
+        assert!(open.is_some(), "an icon panel pops out beside the expanded dock");
+        h.click(egui::pos2(SCREEN.x - 100.0, 300.0));
+        assert_eq!(h.app.ui.open_panel, None, "a click in the docked group puts {open:?} away");
+    }
+
     #[test]
     fn the_collapse_command_sets_or_toggles_the_dock() {
         let mut app = VectorcraftApp::new(Session::new(), Default::default());

crates/ui-egui/src/floating.rs

@@ -0,0 +1,769 @@
+//! Floating panels: panels dragged out of the dock float inside the window as groups of tabs.
+//!
+//! A dock tab, an icon of the icon column or a popped-out panel's title dragged out of the dock
+//! floats that panel; the strip right of the dock's tabs floats the whole tabbed group. A floating
+//! group moves by its title bar (or the strip right of its tabs, or the tab of a lone panel), and a
+//! tab dragged out of a group floats on its own. Dropped on the dock, which lights up while the
+//! pointer is over it, a group's panels go back to where they live in the dock (the tabbed group or
+//! the icon column); dropped on another group's title bar or tabs, they stack with that group. The
+//! × of a group puts its panels back in the dock too. The Tools panel floats the same way by its
+//! title bar ([`crate::toolbar`]) and docks again on the window's left edge.
+//!
+//! `window.panel.float` / `window.panel.dock` do the same for agents. The groups and the Tools
+//! panel's position are kept with the preferences and in user workspaces, and a position saved on
+//! a bigger window is clamped into this one when drawn.
+
+use egui::{CornerRadius, Id, Pos2, Rect, Sense, Stroke, Vec2, pos2, vec2};
+use serde_json::{Value, json};
+
+use crate::state::{DockTab, FloatingPanels, UiState, all_panels};
+use crate::theme::{self, Tokens};
+use crate::{VectorcraftApp, dock, icons, panels};
+
+/// Height of a floating group's title bar (its grip and ×).
+pub const TITLE: f32 = 14.0;
+/// Height of a floating group's tab strip.
+pub const STRIP: f32 = 26.0;
+/// Where `window.panel.float` floats a group given no position; each further group 24 points
+/// lower right.
+const FLOAT_AT: [f32; 2] = [420.0, 120.0];
+/// Where `window.panel.float {panel: "tools"}` floats the Tools panel given no position.
+const TOOLS_AT: [f32; 2] = [60.0, 120.0];
+/// Points the pointer travels from its press before a drop counts (a click on a title bar that
+/// overlaps the dock doesn't dock its group).
+const TRAVEL: f32 = 4.0;
+
+/// What a move carries.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Moving {
+    /// The floating group holding this panel.
+    Panel(&'static str),
+    /// The floating Tools panel.
+    Tools,
+}
+
+/// A move in progress: what moves, where the pointer holds it from its top-left corner, and where
+/// the press began.
+#[derive(Clone, Copy, Debug)]
+struct Move {
+    what: Moving,
+    grab: Vec2,
+    from: Pos2,
+}
+
+/// Where a moved group or Tools panel lands.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Drop {
+    /// Back in the dock (the Tools panel: at the window's left edge).
+    Dock,
+    /// Stacked with the floating group holding this panel.
+    Stack(&'static str),
+}
+
+fn move_id() -> Id {
+    Id::new("floating-move")
+}
+
+/// The dock (tabbed group and icon column) as last drawn: a group dropped there docks.
+pub(crate) fn dock_rect_id() -> Id {
+    Id::new("floating-dock-rect")
+}
+
+/// The strip along the window's left edge where the Tools panel docks, as last laid out.
+pub(crate) fn tools_zone_id() -> Id {
+    Id::new("floating-tools-zone")
+}
+
+/// The area of the floating group whose first panel is `first`.
+pub fn area_id(first: &str) -> Id {
+    Id::new(("floating-panels", first))
+}
+
+/// Panel `id` (`window.panel`) as a static string and its English label, if it is a panel.
+fn panel(id: &str) -> Option<(&'static str, &'static str)> {
+    all_panels().find(|(p, _)| *p == id)
+}
+
+/// The floating group holding panel `id`.
+pub fn group_of(ui: &UiState, id: &str) -> Option<usize> {
+    ui.floating_panels.iter().position(|g| g.panels.iter().any(|p| p == id))
+}
+
+/// The panels of group `g`, as static ids.
+fn ids_of(g: &FloatingPanels) -> Vec<&'static str> {
+    g.panels.iter().filter_map(|p| panel(p)).map(|(id, _)| id).collect()
+}
+
+/// The dock tabs left in the dock, in tab order.
+pub fn docked_tabs(ui: &UiState) -> impl Iterator<Item = DockTab> + '_ {
+    DockTab::ALL.into_iter().filter(|t| group_of(ui, t.info().0).is_none())
+}
+
+/// The dock tab the tabbed group shows: the chosen one, or the first left when it floats.
+pub fn shown_tab(ui: &UiState) -> Option<DockTab> {
+    docked_tabs(ui).find(|t| *t == ui.dock_tab).or_else(|| docked_tabs(ui).next())
+}
+
+/// Take `ids` out of the floating groups, dropping the groups left empty.
+fn take(ui: &mut UiState, ids: &[&str]) {
+    ui.floating_panels.retain_mut(|g| {
+        let active = g.panels.get(g.active).filter(|p| !ids.contains(&p.as_str())).cloned();
+        g.panels.retain(|p| !ids.contains(&p.as_str()));
+        g.active = active.and_then(|a| g.panels.iter().position(|p| *p == a)).unwrap_or(0);
+        !g.panels.is_empty()
+    });
+}
+
+/// Float `ids` (out of the dock or of the group they were in) as a new group with its top-left
+/// corner at `pos`, showing `active`.
+pub fn float(ui: &mut UiState, ids: &[&str], active: &str, pos: Pos2) {
+    take(ui, ids);
+    if ui.open_panel.as_deref().is_some_and(|p| ids.contains(&p)) {
+        ui.open_panel = None;
+    }
+    let panels: Vec<String> = ids.iter().map(|id| id.to_string()).collect();
+    let active = panels.iter().position(|p| p == active).unwrap_or(0);
+    ui.floating_panels.push(FloatingPanels { panels, active, pos: [pos.x, pos.y] });
+    // The tabbed group shows another of its tabs when the one it showed floats.
+    if let Some(tab) = shown_tab(ui) {
+        ui.dock_tab = tab;
+    }
+}
+
+/// Stack `ids` with the floating group holding `onto` (not one of them), showing `active`.
+pub fn stack(ui: &mut UiState, ids: &[&str], active: &str, onto: &str) {
+    take(ui, ids);
+    if ui.open_panel.as_deref().is_some_and(|p| ids.contains(&p)) {
+        ui.open_panel = None;
+    }
+    if let Some(g) = group_of(ui, onto).and_then(|i| ui.floating_panels.get_mut(i)) {
+        g.panels.extend(ids.iter().map(|id| id.to_string()));
+        g.active = g.panels.iter().position(|p| p == active).unwrap_or(g.active);
+    }
+    if let Some(tab) = shown_tab(ui) {
+        ui.dock_tab = tab;
+    }
+}
+
+/// Put `ids` back in the dock: the dock tabs in the tabbed group (showing `active`, or the first of
+/// them), the other panels in the icon column.
+pub fn dock(ui: &mut UiState, ids: &[&str], active: &str) {
+    take(ui, ids);
+    if let Some(tab) = DockTab::from_id(active).or_else(|| ids.iter().find_map(|id| DockTab::from_id(id))) {
+        ui.dock_tab = tab;
+    }
+    ui.dock = true;
+}
+
+/// `pos`, a saved top-left corner, moved so that a `size` box there is inside `screen` (its
+/// top-left corner first when it doesn't fit). Pulled in by whole points: egui rounds an area's
+/// position, which would push a box of fractional size half a point past the edge.
+pub fn clamp(pos: [f32; 2], size: Vec2, screen: Rect) -> Pos2 {
+    let [x, y] = pos;
+    let (x, y) = if x.is_finite() && y.is_finite() { (x, y) } else { (screen.left() + 60.0, screen.top() + 100.0) };
+    let fit = |v: f32, max: f32| if v > max { max.floor() } else { v };
+    pos2(fit(x, screen.right() - size.x).max(screen.left()), fit(y, screen.bottom() - size.y).max(screen.top()))
+}
+
+/// Start moving `what` with the pointer, held `grab` from its top-left corner.
+fn start(ctx: &egui::Context, what: Moving, grab: Vec2) {
+    let Some(from) = ctx.input(|i| i.pointer.press_origin().or(i.pointer.interact_pos())) else { return };
+    ctx.data_mut(|d| d.insert_temp(move_id(), Move { what, grab, from }));
+}
+
+/// Where the pointer holds a group torn off by a press `left` points right of where the group's
+/// tab strip will begin (under its title bar, past its 1-point border).
+pub(crate) fn strip_grab(ctx: &egui::Context, left: f32) -> Vec2 {
+    let x = ctx.input(|i| i.pointer.press_origin()).map_or(12.0, |p| p.x - left);
+    vec2(1.0 + x.max(0.0), 1.0 + TITLE + STRIP / 2.0)
+}
+
+/// Float `ids` under the pointer, held `grab` from the new group's top-left corner, and carry on
+/// moving them with the pointer (a tab or group dragged out of the dock or out of its group).
+pub(crate) fn tear(app: &mut VectorcraftApp, ctx: &egui::Context, ids: &[&'static str], active: &'static str, grab: Vec2) {
+    let Some(at) = ctx.input(|i| i.pointer.interact_pos()) else { return };
+    float(&mut app.ui, ids, active, at - grab);
+    start(ctx, Moving::Panel(active), grab);
+}
+
+/// The Tools panel's title bar was pressed (`title`, the panel's bounds `bounds`): docked, dragging
+/// it out of the panel floats the panel under the pointer; floating at `floating`, a drag moves it.
+pub(crate) fn drag_tools(app: &mut VectorcraftApp, ctx: &egui::Context, title: &egui::Response, bounds: Rect, floating: Option<Pos2>) {
+    let Some(at) = ctx.input(|i| i.pointer.interact_pos()) else { return };
+    match floating {
+        Some(pos) if title.drag_started() => start(ctx, Moving::Tools, at - pos),
+        None if title.dragged() && !bounds.contains(at) => {
+            // Held where the press grabbed the title bar.
+            let grab = ctx.input(|i| i.pointer.press_origin()).map_or(vec2(10.0, 7.0), |p| p - bounds.min);
+            let p = at - grab;
+            app.ui.toolbar_pos = Some([p.x, p.y]);
+            start(ctx, Moving::Tools, grab);
+        }
+        _ => {}
+    }
+}
+
+/// Where the pointer at `at` would drop `what`, and the zone that lights up for it.
+fn drop_target(app: &VectorcraftApp, ctx: &egui::Context, what: Moving, at: Pos2) -> Option<(Drop, Rect)> {
+    let zone = |id: Id| ctx.data(|d| d.get_temp::<Rect>(id)).filter(|r| r.contains(at));
+    let Moving::Panel(id) = what else { return zone(tools_zone_id()).map(|r| (Drop::Dock, r)) };
+    let own = group_of(&app.ui, id);
+    // Another group's title bar and tabs stack with it.
+    for (i, g) in app.ui.floating_panels.iter().enumerate() {
+        let Some((first, _)) = g.panels.first().and_then(|p| panel(p)).filter(|_| Some(i) != own) else { continue };
+        let head = ctx.memory(|m| m.area_rect(area_id(first))).map(|r| Rect::from_min_size(r.min, vec2(r.width(), 1.0 + TITLE + STRIP)));
+        if let Some(head) = head.filter(|h| h.contains(at)) {
+            return Some((Drop::Stack(first), head));
+        }
+    }
+    zone(dock_rect_id()).filter(|_| app.ui.dock && app.ui.screen_mode < 3).map(|r| (Drop::Dock, r))
+}
+
+/// Light up a drop zone: over the docked panels, under the floating ones (the moved one too).
+fn highlight(ctx: &egui::Context, zone: Rect) {
+    let t = Tokens::get(ctx);
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Background, Id::new("floating-drop-zone")));
+    painter.rect(zone.shrink(1.0), CornerRadius::same(2), t.accent.gamma_multiply(0.2), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+}
+
+/// Carry a move on (at the start of a frame, before the panels are drawn): the group or Tools panel
+/// follows the pointer and the zone it would drop on lights up; the release drops it there.
+pub fn track(app: &mut VectorcraftApp, ctx: &egui::Context) {
+    let Some(m) = ctx.data(|d| d.get_temp::<Move>(move_id())) else { return };
+    let at = ctx.input(|i| i.pointer.interact_pos());
+    let target = at.filter(|at| at.distance(m.from) > TRAVEL).and_then(|at| drop_target(app, ctx, m.what, at));
+    if ctx.input(|i| i.pointer.primary_down()) {
+        if let Some(p) = at.map(|at| at - m.grab)
+            && p.x.is_finite()
+            && p.y.is_finite()
+        {
+            match m.what {
+                Moving::Panel(id) => {
+                    if let Some(g) = group_of(&app.ui, id).and_then(|i| app.ui.floating_panels.get_mut(i)) {
+                        g.pos = [p.x, p.y];
+                    }
+                }
+                Moving::Tools if app.ui.toolbar_pos.is_some() => app.ui.toolbar_pos = Some([p.x, p.y]),
+                Moving::Tools => {}
+            }
+        }
+        if let Some((_, zone)) = target {
+            highlight(ctx, zone);
+        }
+        return;
+    }
+    ctx.data_mut(|d| d.remove::<Move>(move_id()));
+    let Some((drop, _)) = target else { return };
+    let Moving::Panel(id) = m.what else {
+        app.ui.toolbar_pos = None;
+        return;
+    };
+    let Some(g) = group_of(&app.ui, id).and_then(|i| app.ui.floating_panels.get(i)) else { return };
+    let ids = ids_of(g);
+    let active = ids.get(g.active).copied().unwrap_or(id);
+    match drop {
+        Drop::Dock => dock(&mut app.ui, &ids, active),
+        Drop::Stack(onto) => stack(&mut app.ui, &ids, active, onto),
+    }
+}
+
+/// What a press on a floating group did.
+enum Action {
+    /// Show the group's `k`th tab.
+    Activate(usize, usize),
+    /// Its × puts the group's panels back in the dock.
+    Close(usize),
+    /// Move the group holding this panel, drawn at this corner.
+    Move(&'static str, Pos2),
+    /// Float this panel out of its group; its tab began this far right.
+    Tear(&'static str, f32),
+}
+
+/// The floating groups, each a stack of tabs under a title bar. Hidden with the dock (Tab,
+/// Presentation Mode).
+pub fn show(app: &mut VectorcraftApp, ctx: &egui::Context) {
+    if app.ui.floating_panels.is_empty() || !app.ui.dock || app.ui.screen_mode >= 3 {
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let screen = ctx.content_rect();
+    let pointer = ctx.input(|i| i.pointer.interact_pos());
+    let mut action = None;
+    for gi in 0..app.ui.floating_panels.len() {
+        let Some(g) = app.ui.floating_panels.get(gi) else { break };
+        let ids = ids_of(g);
+        let Some(&first) = ids.first() else { continue };
+        let active = ids.get(g.active).copied().unwrap_or(first);
+        let area = area_id(first);
+        let size = ctx.memory(|m| m.area_rect(area)).map_or(vec2(dock::panel_width(active), 200.0), |r| r.size());
+        let pos = clamp(g.pos, size, screen);
+        // The tabbed group's panels fill (Layers) or scroll (Properties) to near the window's bottom,
+        // leaving room for their margins (a group that only just fitted would creep up a little each
+        // frame).
+        let tall = (screen.bottom() - pos.y - TITLE - STRIP - 60.0).clamp(120.0, 560.0);
+        let lone = ids.len() == 1;
+        egui::Area::new(area).order(egui::Order::Middle).fixed_pos(pos).show(ctx, |ui| {
+            let frame = egui::Frame::popup(ui.style()).fill(t.panel).corner_radius(CornerRadius::same(4)).inner_margin(egui::Margin::ZERO);
+            frame.show(ui, |ui| {
+                ui.spacing_mut().item_spacing = Vec2::ZERO;
+                let tabs: Vec<_> = ids
+                    .iter()
+                    .map(|id| {
+                        let label = panel(id).map_or(*id, |(_, label)| label);
+                        let color = if *id == active { t.text_strong } else { t.text_dim };
+                        ui.painter().layout_no_wrap(tl!(label).to_string(), theme::semibold(12.0), color)
+                    })
+                    .collect();
+                let tabs_width: f32 = tabs.iter().map(|g| g.size().x + 24.0).sum();
+                let width = ids.iter().map(|id| dock::panel_width(id)).fold(tabs_width + 32.0, f32::max);
+                ui.set_width(width);
+                // Title bar: a grip that moves the group, and the × that docks it.
+                let (bar, _) = ui.allocate_exact_size(vec2(width, TITLE), Sense::hover());
+                ui.painter().rect_filled(bar, CornerRadius { nw: 4, ne: 4, sw: 0, se: 0 }, t.tab_strip);
+                let close = Rect::from_center_size(bar.right_center() - vec2(10.0, 0.0), vec2(TITLE, TITLE));
+                let grip = ui.interact(Rect::from_min_max(bar.min, pos2(close.left(), bar.bottom())), ui.id().with("title"), Sense::drag());
+                for k in 0..2 {
+                    let y = bar.center().y - 1.5 + k as f32 * 3.0;
+                    ui.painter().line_segment([pos2(bar.center().x - 9.0, y), pos2(bar.center().x + 9.0, y)], Stroke::new(0.6, t.text_disabled));
+                }
+                if grip.drag_started() {
+                    action = Some(Action::Move(active, pos));
+                }
+                grip.on_hover_cursor(egui::CursorIcon::Grab).on_hover_text(tl!("Drag to move"));
+                let x = ui.interact(close, ui.id().with("close"), Sense::click());
+                icons::paint(ui, "x", close.shrink(3.0), if x.hovered() { t.text_strong } else { t.text_dim });
+                if x.on_hover_text(tl!("Put back in the dock")).clicked() {
+                    action = Some(Action::Close(gi));
+                }
+                // Tab strip: a click shows a tab, a drag out of the strip floats it on its own.
+                let (strip, _) = ui.allocate_exact_size(vec2(width, STRIP), Sense::hover());
+                ui.painter().rect_filled(strip, 0.0, t.panel_darker);
+                let mut left = strip.left();
+                for (k, (&id, galley)) in ids.iter().zip(tabs).enumerate() {
+                    let r = Rect::from_min_size(pos2(left, strip.top()), vec2(galley.size().x + 24.0, STRIP));
+                    left = r.right();
+                    let resp = ui.interact(r, ui.id().with(("tab", id)), Sense::click_and_drag());
+                    if id == active {
+                        ui.painter().rect_filled(r, 0.0, t.panel);
+                    }
+                    ui.painter().galley(pos2(r.left() + 12.0, r.center().y - galley.size().y / 2.0), galley, t.text);
+                    if resp.clicked() {
+                        action = Some(Action::Activate(gi, k));
+                    } else if lone && resp.drag_started() {
+                        action = Some(Action::Move(id, pos));
+                    } else if !lone && resp.dragged() && pointer.is_some_and(|p| !strip.expand(4.0).contains(p)) {
+                        action = Some(Action::Tear(id, r.left()));
+                    }
+                }
+                let menu = Rect::from_center_size(strip.right_center() - vec2(14.0, 0.0), vec2(16.0, 16.0));
+                let rest = Rect::from_min_max(pos2(left, strip.top()), pos2(menu.left() - 4.0, strip.bottom()));
+                if rest.width() > 0.0 {
+                    let resp = ui.interact(rest, ui.id().with("strip"), Sense::drag());
+                    if resp.drag_started() {
+                        action = Some(Action::Move(active, pos));
+                    }
+                    resp.on_hover_cursor(egui::CursorIcon::Grab).on_hover_text(tl!("Drag to move"));
+                }
+                panels::panel_menu(app, ui, active, menu);
+                dock::panel_body(app, ui, active, width, tall);
+            });
+        });
+    }
+    match action {
+        Some(Action::Activate(gi, k)) => {
+            if let Some(g) = app.ui.floating_panels.get_mut(gi) {
+                g.active = k;
+            }
+        }
+        Some(Action::Close(gi)) => {
+            if let Some(g) = app.ui.floating_panels.get(gi) {
+                let ids = ids_of(g);
+                let active = ids.get(g.active).copied().unwrap_or_default();
+                dock(&mut app.ui, &ids, active);
+            }
+        }
+        Some(Action::Move(id, pos)) => {
+            // From where it is drawn (a position saved on a bigger window was clamped into this one).
+            if let Some(g) = group_of(&app.ui, id).and_then(|i| app.ui.floating_panels.get_mut(i)) {
+                g.pos = [pos.x, pos.y];
+            }
+            if let Some(at) = pointer {
+                start(ctx, Moving::Panel(id), at - pos);
+            }
+        }
+        Some(Action::Tear(id, left)) => tear(app, ctx, &[id], id, strip_grab(ctx, left)),
+        None => {}
+    }
+}
+
+/// `window.panel.float` and `window.panel.dock`; `None` for other commands.
+pub fn command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<Value, String>> {
+    let float = match id {
+        "window.panel.float" => true,
+        "window.panel.dock" => false,
+        _ => return None,
+    };
+    Some(float_or_dock(app, float, p))
+}
+
+/// The `x`, `y` params: a top-left corner in screen points, if given.
+fn position(p: &Value) -> Result<Option<Pos2>, String> {
+    let coord = |k: &str| match p.get(k) {
+        None | Some(Value::Null) => Some(None),
+        Some(v) => v.as_f64().filter(|f| f.abs() < 1e6).map(|f| Some(f as f32)),
+    };
+    match (coord("x"), coord("y")) {
+        (Some(Some(x)), Some(Some(y))) => Ok(Some(pos2(x, y))),
+        (Some(None), Some(None)) => Ok(None),
+        _ => Err("x and y must both be numbers".into()),
+    }
+}
+
+fn float_or_dock(app: &mut VectorcraftApp, float_it: bool, p: &Value) -> Result<Value, String> {
+    let raw = p.get("panel").and_then(Value::as_str).unwrap_or_default().trim();
+    let group = crate::menus::opt_bool(p, "group")?.unwrap_or(false);
+    let at = position(p)?;
+    if raw.eq_ignore_ascii_case("tools") || raw.eq_ignore_ascii_case("toolbar") {
+        app.ui.toolbar_pos = float_it.then(|| at.map_or(TOOLS_AT, |p| [p.x, p.y]));
+        app.ui.toolbar |= float_it;
+        return Ok(json!({ "panel": "tools", "floating": float_it, "pos": app.ui.toolbar_pos }));
+    }
+    let Some(id) = crate::menus::normalize_panel(raw) else { return Err(format!("unknown panel `{raw}`")) };
+    let own = group_of(&app.ui, id);
+    // The panel, or with `group` its whole group: its floating group, or the tabs left in the dock.
+    let ids: Vec<&'static str> = match (group, own.and_then(|i| app.ui.floating_panels.get(i))) {
+        (true, Some(g)) => ids_of(g),
+        (true, None) if DockTab::from_id(id).is_some() => docked_tabs(&app.ui).map(|t| t.info().0).collect(),
+        _ => vec![id],
+    };
+    app.ui.dock = true;
+    if !float_it {
+        dock(&mut app.ui, &ids, id);
+        return Ok(json!({ "panel": id, "floating": false }));
+    }
+    match p.get("onto").and_then(Value::as_str) {
+        Some(onto) => {
+            let onto = crate::menus::normalize_panel(onto)
+                .filter(|o| !ids.contains(o) && group_of(&app.ui, o).is_some_and(|g| Some(g) != own))
+                .ok_or("onto must name a panel floating in another group")?;
+            stack(&mut app.ui, &ids, id, onto);
+        }
+        // Its own group already: moved there (or left where it is), showing the panel.
+        None => match own.and_then(|i| app.ui.floating_panels.get_mut(i)).filter(|g| g.panels.len() == ids.len()) {
+            Some(g) => {
+                g.active = g.panels.iter().position(|p| p == id).unwrap_or(g.active);
+                if let Some(at) = at {
+                    g.pos = [at.x, at.y];
+                }
+            }
+            None => {
+                let n = app.ui.floating_panels.len() as f32;
+                let at = at.unwrap_or(pos2(FLOAT_AT[0] + 24.0 * n, FLOAT_AT[1] + 24.0 * n));
+                float(&mut app.ui, &ids, id, at);
+            }
+        },
+    }
+    let g = group_of(&app.ui, id).and_then(|i| app.ui.floating_panels.get(i));
+    Ok(json!({ "panel": id, "floating": true, "group": g.map(|g| &g.panels), "pos": g.map(|g| g.pos) }))
+}
+
+#[cfg(test)]
+mod tests {
+    use egui::{Event, PointerButton};
+    use serde_json::json;
+    use vectorcraft_engine::Session;
+
+    use super::*;
+
+    const SCREEN: Vec2 = vec2(1400.0, 900.0);
+
+    /// Frames of the whole window, 1400 × 900, with pointer input one event a frame (as the
+    /// control channel's `ui.drag` sends it).
+    struct Harness {
+        app: VectorcraftApp,
+        ctx: egui::Context,
+        time: f64,
+    }
+
+    fn button(pos: Pos2, pressed: bool) -> Event {
+        Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Default::default() }
+    }
+
+    impl Harness {
+        fn new() -> Self {
+            let mut app = VectorcraftApp::new(Session::new(), Default::default());
+            app.run("file.new", json!({"width": 300, "height": 300})).unwrap();
+            let mut h = Self { app, ctx: egui::Context::default(), time: 0.0 };
+            h.settle();
+            h
+        }
+
+        fn frame(&mut self, events: Vec<Event>) {
+            self.time += 0.05;
+            let screen = Rect::from_min_size(Pos2::ZERO, SCREEN);
+            let raw = egui::RawInput { time: Some(self.time), screen_rect: Some(screen), events, ..Default::default() };
+            let app = &mut self.app;
+            self.ctx
+                .run_ui(raw, |ui| {
+                    app.logic(ui.ctx());
+                    app.ui(ui);
+                })
+                .textures_delta
+                .clear();
+        }
+
+        fn settle(&mut self) {
+            for _ in 0..4 {
+                self.frame(vec![]);
+            }
+        }
+
+        /// Press at `from` and move to `to` in steps, the button still down.
+        fn hold(&mut self, from: Pos2, to: Pos2) {
+            self.frame(vec![Event::PointerMoved(from)]);
+            self.frame(vec![button(from, true)]);
+            for k in 1..=8 {
+                self.frame(vec![Event::PointerMoved(from + (to - from) * (k as f32 / 8.0))]);
+            }
+        }
+
+        fn release(&mut self, at: Pos2) {
+            self.frame(vec![button(at, false)]);
+            self.settle();
+        }
+
+        fn drag(&mut self, from: Pos2, to: Pos2) {
+            self.hold(from, to);
+            self.release(to);
+        }
+
+        fn click(&mut self, at: Pos2) {
+            self.frame(vec![Event::PointerMoved(at), button(at, true)]);
+            self.release(at);
+        }
+
+        fn temp_rect(&self, id: Id) -> Rect {
+            self.ctx.data(|d| d.get_temp::<Rect>(id)).unwrap()
+        }
+
+        /// The floating group whose first panel is `first`, as drawn.
+        fn group(&self, first: &str) -> Rect {
+            self.ctx.memory(|m| m.area_rect(area_id(first))).unwrap()
+        }
+
+        /// A point on a floating group's title bar (left of its ×).
+        fn title(&self, first: &str) -> Pos2 {
+            let r = self.group(first);
+            pos2(r.left() + 30.0, r.top() + 1.0 + TITLE / 2.0)
+        }
+
+        /// The rects of the widgets that sense a drag and pass `keep`, top to bottom, left to right.
+        fn widgets(&self, keep: impl Fn(Rect) -> bool) -> Vec<Rect> {
+            let mut r: Vec<Rect> = self.ctx.viewport(|vp| {
+                vp.prev_pass.widgets.layers().flat_map(|(_, w)| w.iter()).filter(|w| w.sense.senses_drag() && keep(w.rect)).map(|w| w.rect).collect()
+            });
+            r.sort_by(|a, b| a.top().total_cmp(&b.top()).then(a.left().total_cmp(&b.left())));
+            r
+        }
+
+        /// The dock's tabs, left to right.
+        fn dock_tabs(&self) -> Vec<Rect> {
+            let dock = self.temp_rect(dock_rect_id());
+            self.widgets(|r| r.height() == 32.0 && dock.contains_rect(r))
+        }
+
+        /// The icon column's panel icons, top to bottom.
+        fn icons(&self) -> Vec<Rect> {
+            let dock = self.temp_rect(dock_rect_id());
+            self.widgets(|r| r.size() == vec2(30.0, 30.0) && dock.contains_rect(r))
+        }
+
+        fn groups(&self) -> Vec<Vec<&str>> {
+            self.app.ui.floating_panels.iter().map(|g| g.panels.iter().map(String::as_str).collect()).collect()
+        }
+    }
+
+    #[test]
+    fn a_dock_tab_dragged_out_floats_and_dropped_on_the_dock_docks_again() {
+        let mut h = Harness::new();
+        let tabs = h.dock_tabs();
+        assert_eq!(tabs.len(), 3, "Properties, Layers, Libraries: {tabs:?}");
+        let to = pos2(600.0, 400.0);
+        h.drag(tabs[1].center(), to);
+        assert_eq!(h.groups(), [["layers"]], "Layers floats");
+        assert!(h.group("layers").contains(to), "under the pointer: {:?}", h.group("layers"));
+        assert_eq!(h.dock_tabs().len(), 2, "its tab left the dock");
+        assert_eq!(h.app.ui.dock_tab, DockTab::Properties);
+        // A click on its title bar moves nothing, even over the dock.
+        let dock = h.temp_rect(dock_rect_id());
+        h.app.run("window.panel.float", json!({"panel": "layers", "x": dock.left() + 10.0, "y": 300})).unwrap();
+        h.settle();
+        h.click(h.title("layers"));
+        assert_eq!(h.groups(), [["layers"]], "a click doesn't dock it");
+        // Dragged by its title bar onto the dock, the dock lights up, and the release docks it.
+        h.app.run("window.panel.float", json!({"panel": "layers", "x": 500, "y": 300})).unwrap();
+        h.settle();
+        let over = dock.center();
+        h.hold(h.title("layers"), over);
+        assert!(h.group("layers").contains(over), "the group follows the pointer");
+        let target = drop_target(&h.app, &h.ctx, Moving::Panel("layers"), over);
+        assert_eq!(target.map(|t| t.0), Some(Drop::Dock), "the dock is the drop zone");
+        h.release(over);
+        assert!(h.groups().is_empty(), "docked: {:?}", h.groups());
+        assert_eq!((h.dock_tabs().len(), h.app.ui.dock_tab), (3, DockTab::Layers), "back in the dock, shown");
+    }
+
+    #[test]
+    fn the_strip_right_of_the_tabs_floats_the_whole_group_and_its_close_box_docks_it() {
+        let mut h = Harness::new();
+        let tabs = h.dock_tabs();
+        let rest = tabs[2].right_center() + vec2(30.0, 0.0);
+        h.drag(rest, pos2(500.0, 300.0));
+        assert_eq!(h.groups(), [["properties", "layers", "libraries"]]);
+        assert!(h.dock_tabs().is_empty(), "the tabbed group left the dock");
+        let column = h.temp_rect(dock_rect_id());
+        assert!(column.width() < 40.0, "only the icon column is left: {column:?}");
+        // Its × puts them back.
+        let g = h.group("properties");
+        h.click(pos2(g.right() - 11.0, g.top() + 1.0 + TITLE / 2.0));
+        assert!(h.groups().is_empty());
+        assert_eq!(h.dock_tabs().len(), 3);
+    }
+
+    #[test]
+    fn icons_dragged_out_float_stack_onto_another_group_and_tear_out_of_it() {
+        let mut h = Harness::new();
+        // Color, Color Guide, Swatches… top to bottom.
+        let icons = h.icons();
+        let count = icons.len();
+        h.drag(icons[2].center(), pos2(500.0, 250.0));
+        assert_eq!(h.groups(), [["swatches"]]);
+        assert_eq!(h.icons().len(), count - 1, "its icon left the column");
+        h.drag(h.icons()[0].center(), pos2(500.0, 650.0));
+        assert_eq!(h.groups(), [["swatches"], ["color"]]);
+        // Color's title bar dropped on the Swatches group's tabs stacks them.
+        let onto = h.group("swatches").left_top() + vec2(150.0, 1.0 + TITLE + STRIP / 2.0);
+        h.hold(h.title("color"), onto);
+        assert_eq!(drop_target(&h.app, &h.ctx, Moving::Panel("color"), onto).map(|t| t.0), Some(Drop::Stack("swatches")));
+        h.release(onto);
+        assert_eq!(h.groups(), [["swatches", "color"]]);
+        assert_eq!(h.app.ui.floating_panels[0].active, 1, "showing the panel dropped on it");
+        // A click shows a tab; a tab dragged out of the strip floats on its own again.
+        let g = h.group("swatches");
+        let tabs = h.widgets(|r| r.height() == STRIP && g.contains_rect(r));
+        assert_eq!(tabs.len(), 3, "two tabs and the strip right of them: {tabs:?}");
+        h.click(tabs[0].center());
+        assert_eq!(h.app.ui.floating_panels[0].active, 0);
+        let to = pos2(900.0, 500.0);
+        h.drag(tabs[1].center(), to);
+        assert_eq!(h.groups(), [["swatches"], ["color"]]);
+        assert!(h.group("color").contains(to));
+        // Window › Color shows it where it floats; Dock Panel puts it back.
+        assert_eq!(h.app.run("window.panel", json!({"panel": "Color"})).unwrap(), json!({"floating": ["color"]}));
+        assert_eq!(crate::menus::checked(&h.app, "window.panel", &json!({"panel": "color"})), Some(true));
+        h.app.run("window.panel.dock", json!({"panel": "color"})).unwrap();
+        h.settle();
+        assert_eq!(h.icons().len(), count - 1, "Color is back in the column");
+    }
+
+    #[test]
+    fn a_popped_out_panel_dragged_by_its_title_floats() {
+        let mut h = Harness::new();
+        h.app.run("window.panel", json!({"panel": "swatches"})).unwrap();
+        h.settle();
+        let flyout = h.ctx.memory(|m| m.area_rect(Id::new("icon-panel"))).unwrap();
+        let to = pos2(500.0, 400.0);
+        h.drag(flyout.left_top() + vec2(20.0, 13.0), to);
+        assert_eq!((h.groups(), h.app.ui.open_panel.as_deref()), (vec![vec!["swatches"]], None));
+        assert!(h.group("swatches").contains(to), "under the pointer: {:?}", h.group("swatches"));
+        // Its panel menu docks it again.
+        h.app.run("window.panel.dock", json!({"panel": "swatches"})).unwrap();
+        assert!(h.groups().is_empty());
+    }
+
+    #[test]
+    fn the_tools_panel_floats_by_its_title_bar_and_docks_on_the_left_edge() {
+        let mut h = Harness::new();
+        let zone = h.temp_rect(tools_zone_id());
+        let title = zone.left_top() + vec2(30.0, 7.0);
+        let to = pos2(400.0, 300.0);
+        h.drag(title, to);
+        let pos = h.app.ui.toolbar_pos.expect("the Tools panel floats");
+        let float = h.ctx.memory(|m| m.area_rect(Id::new("toolbar-floating"))).unwrap();
+        assert!(float.contains(to) && (pos2(pos[0], pos[1]) - float.min).length() < 1.0, "under the pointer: {float:?}");
+        // Back on the window's left edge.
+        let edge = pos2(10.0, 400.0);
+        h.hold(float.left_top() + vec2(30.0, 7.0), edge);
+        assert_eq!(drop_target(&h.app, &h.ctx, Moving::Tools, edge).map(|t| t.0), Some(Drop::Dock));
+        h.release(edge);
+        assert_eq!(h.app.ui.toolbar_pos, None, "docked");
+        // A click on the title bar still switches the columns.
+        let double = h.app.ui.toolbar_double;
+        h.click(title);
+        assert_ne!(h.app.ui.toolbar_double, double);
+    }
+
+    #[test]
+    fn floating_panels_are_kept_in_workspaces_and_preferences_and_clamped_into_the_window() {
+        let mut h = Harness::new();
+        let app = &mut h.app;
+        // Saved on a much bigger screen.
+        app.run("window.panel.float", json!({"panel": "layers", "x": 5000, "y": 4000})).unwrap();
+        let r = app.run("window.panel.float", json!({"panel": "stroke", "onto": "Layers"})).unwrap();
+        assert_eq!(r["group"], json!(["layers", "stroke"]));
+        app.run("window.panel.float", json!({"panel": "tools", "x": 300, "y": 200})).unwrap();
+        app.run("window.workspace.new", json!({"name": "Floating"})).unwrap();
+        let saved = app.ui.floating_panels.clone();
+        app.run("window.workspace", json!({"name": "Essentials"})).unwrap();
+        assert!(app.ui.floating_panels.is_empty() && app.ui.toolbar_pos.is_none(), "Essentials docks everything");
+        app.run("window.workspace", json!({"name": "Floating"})).unwrap();
+        assert_eq!((&app.ui.floating_panels, app.ui.toolbar_pos), (&saved, Some([300.0, 200.0])));
+        let prefs: UiState = serde_json::from_slice(&serde_json::to_vec(&app.ui).unwrap()).unwrap();
+        let prefs = prefs.sanitized();
+        assert_eq!((&prefs.floating_panels, prefs.toolbar_pos), (&saved, Some([300.0, 200.0])));
+        // Unknown and repeated panels (a hand-edited file) are dropped.
+        let edited: UiState = serde_json::from_value(json!({
+            "floating_panels": [{"panels": ["nope", "layers"], "active": 7, "pos": [1, 2]}, {"panels": ["layers"], "pos": [3, 4]}],
+        }))
+        .unwrap();
+        let edited = edited.sanitized();
+        assert_eq!(edited.floating_panels, [FloatingPanels { panels: vec!["layers".into()], active: 0, pos: [1.0, 2.0] }]);
+        h.settle();
+        let g = h.group("layers");
+        let screen = Rect::from_min_size(Pos2::ZERO, SCREEN);
+        assert!(screen.contains_rect(g), "clamped into the window: {g:?}");
+        assert!(h.dock_tabs().len() == 2 && h.app.ui.dock_tab == DockTab::Properties);
+    }
+
+    #[test]
+    fn float_and_dock_commands_check_their_params() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        assert!(app.run("window.panel.float", json!({"panel": "nope"})).is_err());
+        assert!(app.run("window.panel.float", json!({"panel": "layers", "x": "left", "y": 2})).is_err());
+        assert!(app.run("window.panel.float", json!({"panel": "layers", "x": 2})).is_err(), "both x and y");
+        assert!(app.run("window.panel.float", json!({"panel": "layers", "group": "yes"})).is_err());
+        assert!(app.run("window.panel.float", json!({"panel": "layers", "onto": "color"})).is_err(), "Color isn't floating");
+        assert!(app.ui.floating_panels.is_empty());
+        // The tabbed group's tabs float together.
+        let r = app.run("window.panel.float", json!({"panel": "layers", "group": true})).unwrap();
+        assert_eq!(r["group"], json!(["properties", "layers", "libraries"]));
+        assert_eq!(app.ui.floating_panels[0].active, 1);
+        assert!(app.run("window.panel.float", json!({"panel": "layers", "onto": "properties"})).is_err(), "not onto its own group");
+        // Floated out of its group; a lone panel moves.
+        app.run("window.panel.float", json!({"panel": "layers", "x": 10, "y": 20})).unwrap();
+        assert_eq!((app.ui.floating_panels.len(), floating_pos(&app, "layers")), (2, [10.0, 20.0]));
+        app.run("window.panel.float", json!({"panel": "layers", "x": 30, "y": 40})).unwrap();
+        assert_eq!((app.ui.floating_panels.len(), floating_pos(&app, "layers")), (2, [30.0, 40.0]));
+        app.run("window.panel.dock", json!({"panel": "properties", "group": true})).unwrap();
+        assert_eq!(app.ui.floating_panels.len(), 1);
+        assert_eq!(app.ui.dock_tab, DockTab::Properties);
+        assert_eq!(app.run("window.panel.dock", json!({"panel": "tools"})).unwrap()["floating"], json!(false));
+        app.ui.toolbar = false;
+        app.run("window.panel.float", json!({"panel": "Toolbar"})).unwrap();
+        assert!(app.ui.toolbar && app.ui.toolbar_pos == Some(TOOLS_AT), "floating shows the Tools panel");
+    }
+
+    fn floating_pos(app: &VectorcraftApp, id: &str) -> [f32; 2] {
+        group_of(&app.ui, id).map(|i| app.ui.floating_panels[i].pos).unwrap()
+    }
+}

crates/ui-egui/src/i18n/cs.tsv

@@ -490,6 +490,8 @@
 	Manage Workspaces…	Spravovat pracovní prostory…
 	Control	Ovládací panel
 	Contextual Task Bar	Kontextový panel úloh
+	Pin Bar Position	Připnout polohu panelu
+	Reset Bar Position	Obnovit polohu panelu
 	Tools	Nástroje
 	Toolbars	Panely nástrojů
 	Advanced	Rozšířený
@@ -609,4 +611,27 @@
 	Drag to move	Přetažením přesunete
 	Drag to float as a toolbar	Přetažením vytvoříte plovoucí panel nástrojů
 	Put back in the toolbar	Vrátit do panelu nástrojů
+	Float Panel	Plovoucí panel
+	Dock Panel	Ukotvit panel
 	Float Tool Group	Plovoucí skupina nástrojů
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	Služby
+	Hide VectorCraft	Skrýt VectorCraft
+	Hide Others	Skrýt ostatní
+	Minimize	Minimalizovat
+	Zoom	Zvětšit
+	Bring All to Front	Převést vše do popředí
+	Settings	Nastavení
+	General	Obecné
+	Selection & Anchor Display	Výběr a zobrazení kotevních bodů
+	Units	Jednotky
+	Guides & Grid	Vodítka a mřížka
+	Hyphenation	Dělení slov
+	Performance & Storage	Výkon a úložiště
+	User Interface	Uživatelské rozhraní
+	Performance	Výkon
+	File Handling	Práce se soubory
+	Clipboard Handling	Práce se schránkou
+	Appearance of Black	Vzhled černé
+	Devices	Zařízení

crates/ui-egui/src/i18n/es.tsv

@@ -435,6 +435,8 @@
 	Construction Guides	Guías de construcción
 	Contextual Alternates	Alternativas contextuales
 	Contextual Task Bar	Barra de tareas contextual
+	Pin Bar Position	Fijar posición de la barra
+	Reset Bar Position	Restablecer posición de la barra
 	Contrast	Contraste
 	Control	Control
 	Convert	Convertir
@@ -1089,7 +1091,9 @@
 	Hide Artboards	Ocultar mesas de trabajo
 	Hide Bounding Box	Ocultar cuadro delimitador
 	Hide Code	Ocultar código
-	Hide Contextual Task Bar	Ocultar barra de tareas contextual
+	Hide Bar	Ocultar barra
+	More Options	Más opciones
+	Show Properties Panel	Mostrar panel Propiedades
 	Hide Corner Widget	Ocultar widget de esquina
 	Hide Corner Widget for angles greater than	Ocultar widget de esquina para ángulos mayores que
 	Hide Edges	Ocultar bordes
@@ -3049,6 +3053,12 @@ axis	Both	Ambos
 	Drag to move	Arrastrar para mover
 	Drag to float as a toolbar	Arrastrar para flotar como barra de herramientas
 	Put back in the toolbar	Devolver a la barra de herramientas
+	Float Panel	Hacer flotar el panel
+	Dock Panel	Anclar panel
+	Drag to float the panel group	Arrastrar para hacer flotar el grupo de paneles
+	Put back in the dock	Devolver al área de paneles
+	Drag to float the toolbar	Arrastrar para hacer flotar la barra de herramientas
+	Drag to the window's left edge to dock	Arrastrar al borde izquierdo de la ventana para anclar
 	Float Tool Group	Hacer flotar el grupo de herramientas
 
 # Status and error messages (`@msg`), translated where the status bar shows them; the message itself
@@ -3213,7 +3223,6 @@ axis	Both	Ambos
 @msg	choose a folder to export to	elige una carpeta a la que exportar
 @msg	choose a location for the package	elige una ubicación para el paquete
 @msg	clipboard is empty	el portapapeles está vacío
-@msg	collapsed must be true or false	collapsed debe ser true o false
 @msg	colorTable.{what}: `{h}` is not a colour such as "#ff8800"	colorTable.{what}: `{h}` no es un color como "#ff8800"
 @msg	colorTable.{what}: at most {MAX_TABLE} colours	colorTable.{what}: como máximo {MAX_TABLE} colores
 @msg	command `{0}` is not available right now: {1}	el comando `{0}` no está disponible ahora: {1}
@@ -3562,13 +3571,21 @@ axis	Both	Ambos
 @msg	Sent to {_1}	Se envió a {_1}
 @msg	{_1} files	{_1} archivos
 @msg	The graphics were lost and have been restarted	Se perdieron los gráficos y se reiniciaron
+@msg	The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}	El procesador gráfico probado primero no pudo mostrar la ventana, así que VectorCraft se inició de nuevo con {summary}
 @msg	Loading VectorCraft…	Cargando VectorCraft…
 @msg	VectorCraft failed to start: {e}	VectorCraft no pudo iniciarse: {e}
 @msg	A browser with WebGPU or WebGL2 is required.	Se necesita un navegador con WebGPU o WebGL2.
 @msg	The graphics were lost and couldn't be restarted.	Se perdieron los gráficos y no se pudieron reiniciar.
 @msg	Your unsaved changes are kept in this browser: reload the page to get them back.	Tus cambios sin guardar se conservan en este navegador: vuelve a cargar la página para recuperarlos.
 @msg	Reload the page to go on (changes not saved yet may be lost).	Vuelve a cargar la página para continuar (los cambios que aún no se guardaron podrían perderse).
-@msg	floating must be true or false	floating debe ser true o false
 @msg	tool (a tool id) is required	se requiere tool (un id de herramienta)
 @msg	{tool} isn't in a toolbar group of several tools	{tool} no está en un grupo de la barra de herramientas con varias herramientas
-@msg	double must be true or false	double debe ser true o false
+@msg	onto must name a panel floating in another group	onto debe nombrar un panel que flote en otro grupo
+@msg	x and y must both be numbers	x e y deben ser números
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	Servicios
+	Hide VectorCraft	Ocultar VectorCraft
+	Zoom	Zoom
+	Bring All to Front	Traer todo al frente
+	Settings	Ajustes

crates/ui-egui/src/i18n/ja.tsv

@@ -511,6 +511,8 @@
 	Manage Workspaces…	ワークスペースを管理…
 	Control	コントロール
 	Contextual Task Bar	コンテキストタスクバー
+	Pin Bar Position	バーの位置を固定
+	Reset Bar Position	バーの位置をリセット
 	Tools	ツール
 	Toolbars	ツールバー
 	Advanced	詳細
@@ -1372,7 +1374,9 @@
 	Height:	高さ:
 	Help › Search Commands…	ヘルプ › コマンドを検索…
 	Hide Code	コードを隠す
-	Hide Contextual Task Bar	コンテキストタスクバーを隠す
+	Hide Bar	バーを隠す
+	More Options	その他のオプション
+	Show Properties Panel	プロパティパネルを表示
 	Hide Corner Widget for angles greater than	次の角度より大きい場合はコーナーウィジェットを隠す
 	Hide Note	メモを隠す
 	Hide Options	オプションを隠す
@@ -3037,4 +3041,18 @@ axis	Both	両方
 	Drag to move	移動するにはドラッグ
 	Drag to float as a toolbar	ドラッグしてツールバーとして浮かせる
 	Put back in the toolbar	ツールバーに戻す
+	Float Panel	パネルをフローティング
+	Dock Panel	パネルをドッキング
+	Drag to float the panel group	ドラッグしてパネルグループをフローティング
+	Put back in the dock	ドックに戻す
+	Drag to float the toolbar	ドラッグしてツールバーをフローティング
+	Drag to the window's left edge to dock	ウィンドウの左端までドラッグしてドッキング
 	Float Tool Group	ツールグループをフローティング
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	サービス
+	Hide VectorCraft	VectorCraft を隠す
+	Zoom	拡大/縮小
+	Bring All to Front	すべてを手前に移動
+	Settings	環境設定
+theme	Appearance	外観

crates/ui-egui/src/i18n/mod.rs

@@ -64,7 +64,7 @@ fn plural_czech(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 7] = [
+pub static LANGUAGES: [LangInfo; 8] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, complete_menus: false, catalog: OnceLock::new() },
     // Japanese: the whole interface (every menu string and `tl!` literal), keeping the product,
     // workspace and perspective preset names in English (`MENU_KEEP_AS_IS`).
@@ -81,6 +81,16 @@ pub static LANGUAGES: [LangInfo; 7] = [
         complete_menus: true,
         catalog: OnceLock::new(),
     },
+    // Italian: the whole interface and the status and error messages, keeping the same names in
+    // English as Spanish; every `it-*` locale (`it-IT`, `it-CH`, `it-SM` …) resolves here.
+    LangInfo {
+        code: "it",
+        name: "Italiano",
+        source: include_str!("it.tsv"),
+        plural: plural_one_other,
+        complete_menus: true,
+        catalog: OnceLock::new(),
+    },
     // Brazilian Portuguese: every menu label (`menu_catalogs_translate_every_menu_label`), every
     // `tl!` literal and the plural messages; left English on purpose are the `MENU_KEEP_AS_IS`
     // strings (product name, language names, workspace names, perspective grid presets).

crates/ui-egui/src/i18n/pt-br.tsv

@@ -447,6 +447,8 @@
 	Construction Guides	Guias de Construção
 	Contextual Alternates	Variantes Contextuais
 	Contextual Task Bar	Barra de Tarefas Contextual
+	Pin Bar Position	Fixar Posição da Barra
+	Reset Bar Position	Redefinir Posição da Barra
 	Control	Controle
 	Convert	Converter
 	Convert All Spot Colors to Process	Converter Todas as Cores Spot em Processo
@@ -1006,7 +1008,9 @@
 	Hide Artboards	Ocultar Mesas de Trabalho
 	Hide Bounding Box	Ocultar Caixa Delimitadora
 	Hide Code	Ocultar Código
-	Hide Contextual Task Bar	Ocultar Barra de Tarefas Contextual
+	Hide Bar	Ocultar Barra
+	More Options	Mais Opções
+	Show Properties Panel	Mostrar Painel Propriedades
 	Hide Corner Widget	Ocultar Widget de Canto
 	Hide Corner Widget for angles greater than	Ocultar Widget de Canto para ângulos maiores que
 	Hide Edges	Ocultar Bordas
@@ -2629,4 +2633,14 @@
 	Drag to move	Arraste para mover
 	Drag to float as a toolbar	Arraste para flutuar como barra de ferramentas
 	Put back in the toolbar	Devolver à barra de ferramentas
+	Float Panel	Flutuar Painel
+	Dock Panel	Encaixar Painel
 	Float Tool Group	Flutuar Grupo de Ferramentas
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	Serviços
+	Hide VectorCraft	Ocultar o VectorCraft
+	Hide Others	Ocultar Outros
+	Zoom	Zoom
+	Bring All to Front	Trazer Todas para a Frente
+	Settings	Configurações

crates/ui-egui/src/i18n/tests.rs

@@ -15,6 +15,10 @@ fn tags_map_to_languages() {
     for tag in ["es", "es_ES.UTF-8", "es-MX", "es_AR", "es-419", "es-US"] {
         assert_eq!(lang_from_tag(tag), Lang::from_code("es"), "{tag}");
     }
+    // Italian: Italy, Switzerland and San Marino share the one catalog.
+    for tag in ["it", "it_IT.UTF-8", "it-CH", "it_SM"] {
+        assert_eq!(lang_from_tag(tag), Lang::from_code("it"), "{tag}");
+    }
     // Traditional Chinese: by region, by script, and with a region after the script.
     assert_eq!(lang_from_tag("zh_TW.UTF-8"), Some(ZH()));
     assert_eq!(lang_from_tag("zh-TW"), Some(ZH()));
@@ -391,9 +395,9 @@ fn cs() -> Lang {
 }
 
 /// Languages whose catalogs leave [`MENU_KEEP_AS_IS`] in English.
-const KEEPS_MENU_NAMES: [&str; 4] = ["cs", "es", "ja", "pt-br"];
+const KEEPS_MENU_NAMES: [&str; 5] = ["cs", "es", "it", "ja", "pt-br"];
 
-/// Menu labels the menu-complete catalogs (Czech, Spanish, Japanese, Brazilian Portuguese) show as they are: the product name, a format name, the built-in workspace
+/// Menu labels the menu-complete catalogs (Czech, Spanish, Italian, Japanese, Brazilian Portuguese) show as they are: the product name, a format name, the built-in workspace
 /// names and the perspective grid presets (names, shown untranslated wherever else they appear).
 /// Each language's own name in the Language menu is left alone too.
 const MENU_KEEP_AS_IS: &[&str] = &[
@@ -483,7 +487,7 @@ fn toggled_labels() -> Vec<String> {
     labels
 }
 
-/// Czech, Spanish, Japanese and Brazilian Portuguese cover every menu label, the Show/Hide pairs
+/// Czech, Spanish, Italian, Japanese and Brazilian Portuguese cover every menu label, the Show/Hide pairs
 /// and the canvas context menu included (panels and dialogs not yet).
 #[test]
 fn menu_catalogs_translate_every_menu_label() {
@@ -499,6 +503,9 @@ fn menu_catalogs_translate_every_menu_label() {
     let mut all: Vec<String> = labels.iter().filter(|l| interface(l)).map(|(l, ..)| l.to_string()).collect();
     all.extend(toggled_labels());
     all.extend(crate::menus::CONTEXT_LABELS.iter().map(|l| l.to_string()));
+    // The macOS menu bar's own labels, and its Settings submenu's Preferences pages.
+    all.extend(crate::native_menu::MAC_LABELS.iter().map(|l| l.to_string()));
+    all.extend(vectorcraft_engine::cmd::prefscmds::PREF_CATEGORIES.iter().map(|l| l.to_string()));
     all.sort();
     all.dedup();
     for code in KEEPS_MENU_NAMES {
@@ -514,12 +521,17 @@ fn menu_catalogs_translate_every_menu_label() {
     assert_eq!(tr(Lang::from_code("ja").expect("ja"), "File"), "ファイル");
     assert_eq!(tr(Lang::from_code("pt-br").expect("pt-br"), "File"), "Arquivo");
     assert_eq!(tr(es(), "File"), "Archivo");
+    assert_eq!(tr(it(), "Edit"), "Modifica");
 }
 
 fn es() -> Lang {
     Lang::from_code("es").expect("es registered")
 }
 
+fn it() -> Lang {
+    Lang::from_code("it").expect("it registered")
+}
+
 /// Spanish uses the vector-illustration vocabulary its users know, has two plural forms like
 /// English, and reads the same in the menus and in the panels.
 #[test]
@@ -541,6 +553,27 @@ fn spanish_reads_as_spanish() {
     assert_eq!(trn(es(), 3, "{n} Layer", "{n} Layers"), "3 capas");
 }
 
+/// Italian uses the vector-illustration vocabulary its users know, has two plural forms like
+/// English (zero takes the plural), and reads the same in the menus and in the panels.
+#[test]
+fn italian_reads_as_italian() {
+    for (en, want) in [
+        ("Artboard Tool", "Strumento Tavola da disegno"),
+        ("Swatches", "Campioni"),
+        ("Pathfinder", "Elaborazione tracciati"),
+        ("Stroke", "Traccia"),
+        ("Fill", "Riempimento"),
+        ("Direct Selection Tool", "Strumento Selezione diretta"),
+        ("Save As…", "Salva con nome…"),
+        ("Undo", "Annulla"),
+    ] {
+        assert_eq!(tr(it(), en), want);
+    }
+    assert_eq!(trn(it(), 1, "{n} Layer", "{n} Layers"), "1 livello");
+    assert_eq!(trn(it(), 0, "{n} Layer", "{n} Layers"), "0 livelli");
+    assert_eq!(trn(it(), 3, "{n} Layer", "{n} Layers"), "3 livelli");
+}
+
 /// Catalogs written with spaces between words keep a fragment's leading and trailing spaces: the
 /// hint bar and a few labels are joined from pieces (" to finish", "Press ").
 #[test]
@@ -559,11 +592,11 @@ fn czech_plurals_have_three_forms() {
     assert_eq!(forms, [2, 0, 1, 1, 2, 2, 2]);
 }
 
-/// Czech and Spanish letters (and the punctuation their text uses) come from each family's own first font, not
+/// Czech, Spanish and Italian letters (and the punctuation their text uses) come from each family's own first font, not
 /// from a fallback further down the stack. (`has_glyph` can't tell: it counts characters of the
 /// face that draws missing glyphs, the first one, as missing.)
 #[test]
-fn czech_and_spanish_glyphs_are_available_without_system_fonts() {
+fn czech_spanish_and_italian_glyphs_are_available_without_system_fonts() {
     let ctx = egui::Context::default();
     crate::theme::install_fonts(&ctx);
     let mut output = ctx.run_ui(egui::RawInput::default(), |_| {});
@@ -574,7 +607,8 @@ fn czech_and_spanish_glyphs_are_available_without_system_fonts() {
             let first = first.unwrap();
             let mut font = fonts.fonts.font(&family);
             let chars = font.characters();
-            for ch in "áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽ„“‚‘…–ñÑüÜ¿¡”".chars() {
+            for ch in "áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽ„“‚‘…–ñÑüÜ¿¡”àèìòùÀÈÌÒÙ«»’".chars()
+            {
                 assert!(chars.get(&ch).is_some_and(|fonts| fonts.contains(&first)), "{first} ({family:?}) has no {ch}");
             }
         }
@@ -651,7 +685,7 @@ fn complete_languages_translate_every_message() {
 }
 
 /// Languages whose catalogs cover every status and error message.
-const COMPLETE_MESSAGES: &[&str] = &["es"];
+const COMPLETE_MESSAGES: &[&str] = &["es", "it"];
 
 /// Crates whose error and status messages reach the status bar.
 const MESSAGE_CRATES: &[&str] = &["ui-egui", "engine", "doc", "format", "svg", "pdf", "eps", "text", "plugins", "metafile", "cad"];

crates/ui-egui/src/i18n/zh-hans.tsv

@@ -436,6 +436,8 @@
 	Construction Guides	构造参考线
 	Contextual Alternates	上下文替代
 	Contextual Task Bar	上下文任务栏
+	Pin Bar Position	固定任务栏位置
+	Reset Bar Position	重置任务栏位置
 	Contrast	对比
 	Control	控制栏
 	Convert	转换
@@ -1080,7 +1082,9 @@
 	Hide Artboards	隐藏画板
 	Hide Bounding Box	隐藏定界框
 	Hide Code	隐藏代码
-	Hide Contextual Task Bar	隐藏快捷工作列
+	Hide Bar	隐藏任务栏
+	More Options	更多选项
+	Show Properties Panel	显示属性面板
 	Hide Corner Widget	隐藏角控件
 	Hide Corner Widget for angles greater than	角度大于此值时隐藏圆角控件
 	Hide Edges	隐藏边缘
@@ -3294,4 +3298,16 @@ axis	Both	两者
 	Drag to move	拖动以移动
 	Drag to float as a toolbar	拖动使其浮动为工具栏
 	Put back in the toolbar	放回工具栏
+	Float Panel	浮动面板
+	Dock Panel	停放面板
+	Drag to float the panel group	拖动以浮动面板组
+	Put back in the dock	放回停放区
+	Drag to float the toolbar	拖动以浮动工具栏
+	Drag to the window's left edge to dock	拖到窗口左边缘以停放
 	Float Tool Group	浮动工具组
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	服务
+	Hide VectorCraft	隐藏 VectorCraft
+	Bring All to Front	前置全部窗口
+	Settings	设置

crates/ui-egui/src/i18n/zh-hant.tsv

@@ -450,6 +450,8 @@
 	Construction Guides	建構參考線
 	Contextual Alternates	前後關聯替代字
 	Contextual Task Bar	快捷工作列
+	Pin Bar Position	釘選工作列位置
+	Reset Bar Position	重設工作列位置
 	Contrast	對比
 	Control	控制
 	Convert	轉換
@@ -1106,7 +1108,9 @@
 	Hide Artboards	隱藏工作區域
 	Hide Bounding Box	隱藏邊框
 	Hide Code	隱藏程式碼
-	Hide Contextual Task Bar	隱藏快捷工作列
+	Hide Bar	隱藏工作列
+	More Options	更多選項
+	Show Properties Panel	顯示內容面板
 	Hide Corner Widget	隱藏轉角 Widget
 	Hide Corner Widget for angles greater than	角度大於以下數值時隱藏轉角 Widget
 	Hide Edges	隱藏邊緣
@@ -3068,4 +3072,17 @@ axis	Both	兩者
 	Drag to move	拖曳以移動
 	Drag to float as a toolbar	拖曳使其浮動為工具列
 	Put back in the toolbar	放回工具列
+	Float Panel	浮動面板
+	Dock Panel	停駐面板
+	Drag to float the panel group	拖曳以浮動面板群組
+	Put back in the dock	放回停駐區
+	Drag to float the toolbar	拖曳以浮動工具列
+	Drag to the window's left edge to dock	拖曳到視窗左側邊緣以停駐
 	Float Tool Group	浮動工具組
+
+# The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
+	Services	服務
+	Hide VectorCraft	隱藏 VectorCraft
+	Zoom	縮放
+	Bring All to Front	將全部移至最前
+	Settings	設定

crates/ui-egui/src/lib.rs

@@ -17,6 +17,7 @@ pub mod background;
 mod brand;
 pub mod canvas;
 pub mod chrome;
+mod clipboard_probe;
 pub mod community;
 pub mod control;
 pub mod credits;
@@ -24,6 +25,7 @@ pub mod cursors;
 pub mod dialogs;
 pub mod dock;
 pub mod find_font;
+pub mod floating;
 pub mod font_menu;
 pub mod graphics;
 pub mod i18n;
@@ -31,6 +33,7 @@ pub mod icon_data;
 pub mod icons;
 pub mod io;
 pub mod menus;
+pub mod native_menu;
 pub mod palette;
 pub mod panels;
 pub mod place;
@@ -76,6 +79,8 @@ mod tests_home;
 #[cfg(test)]
 mod tests_labels;
 #[cfg(test)]
+mod tests_nativemenu;
+#[cfg(test)]
 mod tests_nativeoptions;
 #[cfg(test)]
 mod tests_numfields;
@@ -128,6 +133,8 @@ mod tests_sysclip;
 #[cfg(test)]
 mod tests_sysclip_emf;
 #[cfg(test)]
+mod tests_sysclip_probe;
+#[cfg(test)]
 mod tests_transparencygrid;
 #[cfg(test)]
 mod tests_widthtool;
@@ -141,7 +148,7 @@ use vectorcraft_engine::{Session, ViewInfo};
 
 pub use control::{ControlRequest, ControlResponse};
 pub use state::{UiState, View};
-pub use sysclip::SystemClipboard;
+pub use sysclip::{ClipboardProbeFactory, SystemClipboard};
 
 /// What a file dialog shows: a suggested file name (save dialogs), the folder to start in and the
 /// file-type filters.
@@ -204,6 +211,10 @@ pub struct Services {
     /// Paste takes SVG, PDF, text and bitmaps from other apps. Without it, SVG text only (through
     /// egui and `clipboard_read`).
     pub system_clipboard: Option<Box<dyn SystemClipboard>>,
+    /// A second system-clipboard handle, for checking whether Paste has something to take on a
+    /// background thread (Linux: an X11 clipboard owner that never answers would freeze the UI).
+    /// Taken on the first frame. Without it the check runs on the UI thread.
+    pub clipboard_probe: Option<ClipboardProbeFactory>,
     /// File → Show in Folder: select a file in the system file manager (desktop).
     pub reveal: Option<RevealFn>,
     /// Write a file from any thread (desktop): lets Background Save and Export write off the UI
@@ -220,6 +231,8 @@ pub struct Services {
     /// File → Print: the system's printers and print queue (desktop), the browser's print dialog
     /// (web). Without it Print saves the job as a PDF.
     pub print: Option<Box<dyn print::PrintService>>,
+    /// The macOS menu bar, when the desktop app installed one: the in-window menus are hidden then.
+    pub native_menu: Option<native_menu::NativeMenu>,
 }
 
 /// Cached canvas raster.
@@ -280,12 +293,11 @@ pub struct VectorcraftApp {
     pub perf: Perf,
     /// macOS: draw our own title strip under the traffic lights.
     pub integrated_titlebar: bool,
-    /// The host installed a native menu bar (macOS): don't draw in-window menus.
-    pub native_menu: bool,
     /// Last applied effect (Effect → Apply Last Effect).
     pub last_effect: Option<(String, serde_json::Value)>,
-    /// Commands whose shortcuts the native menu handles (skip them in egui to avoid double firing).
-    pub native_shortcuts: std::collections::HashSet<String>,
+    /// Commands run through [`Self::run`] so far: the native menu bar reads its rows again when it
+    /// moves ([`native_menu::sync`]).
+    run_count: u64,
     control_rx: Option<Receiver<ControlRequest>>,
     /// (token, path, reply, deadline ms): a window that isn't presented never delivers its frame.
     pending_screenshots: Vec<(u64, Option<String>, Sender<ControlResponse>, f64)>,
@@ -326,8 +338,11 @@ pub struct VectorcraftApp {
     /// (SVG without a `system_clipboard`) while the internal clipboard is empty. It enables the
     /// Paste menu items.
     pub(crate) system_paste: bool,
-    /// When `system_paste` was last checked (app time, s; at most once per frame).
+    /// When `system_paste` was last checked in line (app time, s; at most once per frame).
     system_paste_at: f64,
+    /// The thread that checks the system clipboard for `system_paste` instead
+    /// ([`Services::clipboard_probe`]).
+    clipboard_probe: Option<clipboard_probe::Probe>,
     /// Keyboard pastes of something other than text (see [`shortcuts::PasteChord`]).
     pub(crate) paste_chord: shortcuts::PasteChord,
     /// Saves and exports running in the background (Preferences → File Handling).
@@ -378,9 +393,8 @@ impl VectorcraftApp {
             },
             perf: Perf::default(),
             integrated_titlebar: false,
-            native_menu: false,
             last_effect: None,
-            native_shortcuts: Default::default(),
+            run_count: 0,
             clipboard_out: None,
             clipboard_published: None,
             clipboard_in: None,
@@ -403,6 +417,7 @@ impl VectorcraftApp {
             place: Default::default(),
             system_paste: false,
             system_paste_at: f64::NEG_INFINITY,
+            clipboard_probe: None,
             paste_chord: Default::default(),
             background: Default::default(),
             recovery: Default::default(),
@@ -465,6 +480,7 @@ impl VectorcraftApp {
 
     /// Run a UI or engine command by id. The single entry point for every frontend path.
     pub fn run(&mut self, id: &str, params: Value) -> Result<Value, String> {
+        self.run_count = self.run_count.wrapping_add(1);
         if let Some(r) = menus::run_ui_command(self, id, &params) {
             return r;
         }
@@ -539,19 +555,8 @@ impl VectorcraftApp {
 
     /// Select a tool (also used by the toolbar and shortcuts).
     pub fn select_tool(&mut self, id: &str) {
-        self.change_tool(id, true);
-    }
-
-    /// Go back to tool `id` after a temporary one, without choosing it afresh
-    /// ([`vectorcraft_engine::Session::switch_tool`]).
-    pub fn restore_tool(&mut self, id: &str) {
-        self.change_tool(id, false);
-    }
-
-    fn change_tool(&mut self, id: &str, choose: bool) {
         let v = self.view_info();
-        let r = if choose { self.session.select_tool(id, v) } else { self.session.switch_tool(id, v) };
-        if let Err(e) = r {
+        if let Err(e) = self.session.select_tool(id, v) {
             self.ui.status = e.to_string();
         }
         if let Some(g) = vectorcraft_tools::catalog::group_of(id)
@@ -559,9 +564,6 @@ impl VectorcraftApp {
         {
             *slot = id.to_string();
         }
-        if canvas::is_selection_tool(id) {
-            self.ui.last_selection_tool = id.to_string();
-        }
         toolbar::remember(self, id);
         self.ui.flyout = None;
     }
@@ -742,11 +744,20 @@ impl VectorcraftApp {
         }
         self.last_time = now;
         self.sync_views();
-        // Read the system clipboard only when that alone decides whether Paste is enabled, and at
-        // most a few times a second (opening it locks it against other apps on some systems).
-        if !(0.0..SYSTEM_CLIPBOARD_POLL).contains(&(now - self.system_paste_at)) {
+        // Read the system clipboard only when that alone decides whether Paste is enabled. A
+        // background thread reads it where the host installs one (an unresponsive owner must never
+        // stall the frame loop); otherwise, or once that thread is gone, it is read here, at most a
+        // few times a second (opening it locks it against other apps on some systems).
+        let wanted = self.session.clipboard.is_empty() && self.session.active().is_some();
+        if let Some(make) = self.services.clipboard_probe.take() {
+            self.clipboard_probe = clipboard_probe::Probe::start(make, ctx.clone());
+        }
+        if let Some(pasteable) = self.clipboard_probe.as_mut().and_then(|p| p.pasteable(wanted)) {
+            self.system_paste = pasteable;
+        } else if !(0.0..SYSTEM_CLIPBOARD_POLL).contains(&(now - self.system_paste_at)) {
+            self.clipboard_probe = None;
             self.system_paste_at = now;
-            self.system_paste = self.session.clipboard.is_empty() && self.session.active().is_some() && self.system_clipboard_pasteable();
+            self.system_paste = wanted && self.system_clipboard_pasteable();
         }
         background::poll(self);
         if !self.background.jobs.is_empty() {
@@ -786,6 +797,7 @@ impl VectorcraftApp {
             ctx.copy_text(t);
         }
         self.drain_inbox();
+        native_menu::run(self, ctx);
         if self.fonts_ready {
             shortcuts::handle(self, ctx);
         }
@@ -831,6 +843,13 @@ impl VectorcraftApp {
     /// modifiers egui holds (`i.modifiers`), so a synthetic key, button or wheel turn holds its own
     /// for the frames it spans (a drag's moves included); the keyboard's come back after.
     pub fn raw_input_hook(&mut self, raw: &mut egui::RawInput) {
+        // The native menu's key equivalents become the input their keys make, ahead of what came
+        // after them (see `native_menu`).
+        let keys = self.services.native_menu.as_mut().map(native_menu::NativeMenu::take_keys).unwrap_or_default();
+        if !keys.is_empty() {
+            let events: Vec<egui::Event> = keys.into_iter().flat_map(|k| native_menu::key_events(k, || self.system_clipboard_text())).collect();
+            raw.events.splice(0..0, events);
+        }
         for e in &raw.events {
             match e {
                 egui::Event::ModifiersChanged(m) => self.host_modifiers = *m,
@@ -895,6 +914,7 @@ impl VectorcraftApp {
         let t0 = now_ms();
         scrub::begin_frame(self, &ctx);
         font_menu::end_stale_preview(self, &ctx);
+        floating::track(self, &ctx);
         let t = theme::Tokens::get(&ctx);
         if self.ui.screen_mode < 2 {
             chrome::app_bar(self, ui);
@@ -919,6 +939,7 @@ impl VectorcraftApp {
             canvas::show(self, ui);
         });
         dock::floating_panel(self, &ctx);
+        floating::show(self, &ctx);
         panels::library_panel::show_window(self, &ctx);
         dialogs::show(self, &ctx);
         palette::show(self, &ctx);
@@ -927,6 +948,7 @@ impl VectorcraftApp {
         }
         self.ui_fonts.frame(&ctx);
         scrub::end_frame(self, &ctx);
+        native_menu::sync(self, &ctx);
         self.perf.frame_ms = now_ms() - t0;
         let _ = json!(null);
     }

crates/ui-egui/src/menus.rs

@@ -216,8 +216,27 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         "{tool: id, floating?: bool} float the toolbar group holding `tool` (in the current Basic or Advanced layout) as its own strip of tool buttons (true), put it back in the toolbar (false) or toggle (omitted), as dragging or clicking a flyout's tear-off bar and the strip's × do; returns the new state",
     ),
     ("window.taskBar", "Contextual Task Bar", "", "{}"),
+    (
+        "window.taskBar.pin",
+        "Pin Bar Position",
+        "",
+        "{pinned?: bool} keep the Contextual Task Bar where it is instead of following the selection (true), let it follow the selection again from where it is (false) or toggle (omitted), as the bar's More Options menu does; returns the new state",
+    ),
+    ("window.taskBar.reset", "Reset Bar Position", "", "{} unpin the Contextual Task Bar and put it back under the selection"),
     ("window.dock", "Panels", "Tab", "{} show/hide all panels"),
     ("window.panel", "Show Panel", "", "{panel: id} e.g. layers, swatches, stroke (case-insensitive; display labels like \"Layers\" work too)"),
+    (
+        "window.panel.float",
+        "Float Panel",
+        "",
+        "{panel: id or \"tools\", x?, y?, onto?: id, group?: bool} float a panel out of the dock (or out of its floating group) as its own floating group with its top-left corner at x, y in window points (default: cascaded), as dragging its tab out of the dock does; `onto` stacks it with the floating group holding that panel instead; `group` takes its whole group (its floating group, or the Properties | Layers | Libraries tabs left in the dock); a panel alone in its group is moved. \"tools\" floats the Tools panel. Returns {panel, floating, group, pos}",
+    ),
+    (
+        "window.panel.dock",
+        "Dock Panel",
+        "",
+        "{panel: id or \"tools\", group?: bool} put a floating panel (with `group`, its whole group) back in the dock, as dropping it on the dock or its group's × does: Properties, Layers and Libraries in the tabbed group, the other panels in the icon column; \"tools\" docks the Tools panel at the window's left edge",
+    ),
     (
         "window.collapseDock",
         "Collapse Panels to Icons",
@@ -765,11 +784,20 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
 
 /// Canonical panel id for `window.panel`: a dock tab's or an icon panel's id or display label,
 /// matched case-insensitively (`"Layers"`, `"swatches"`, `"Color Guide"`).
-fn normalize_panel(input: &str) -> Option<&'static str> {
+pub(crate) fn normalize_panel(input: &str) -> Option<&'static str> {
     let name = input.trim();
     crate::state::all_panels().find(|(id, label)| name.eq_ignore_ascii_case(id) || name.eq_ignore_ascii_case(label)).map(|(id, _)| id)
 }
 
+/// An optional `{key?: bool}` param: none when it is omitted or null (the commands then toggle).
+pub(crate) fn opt_bool(p: &Value, key: &str) -> Result<Option<bool>, String> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::Bool(b)) => Ok(Some(*b)),
+        Some(_) => Err(format!("`{key}` must be true or false")),
+    }
+}
+
 /// Handle a UI command. `None` = not a UI command (the engine handles it).
 pub fn run_ui_command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<Value, String>> {
     if id == "app.language" {
@@ -787,7 +815,10 @@ pub fn run_ui_command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<R
     if let Some(r) = crate::panels::character::intercept_text_command(app, id) {
         return Some(r);
     }
-    if let Some(r) = crate::shortcut_editor::run_command(app, id, p).or_else(|| crate::workspaces::run_command(app, id, p)) {
+    if let Some(r) = crate::shortcut_editor::run_command(app, id, p)
+        .or_else(|| crate::workspaces::run_command(app, id, p))
+        .or_else(|| crate::floating::command(app, id, p))
+    {
         return Some(r);
     }
     let s = |k: &str| p.get(k).and_then(Value::as_str).map(str::to_string);
@@ -994,25 +1025,38 @@ pub fn run_ui_command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<R
         }
         "window.control" => flag(&mut app.ui.control_bar),
         "window.toolbar" => flag(&mut app.ui.toolbar),
-        "window.toolbarColumns" => {
-            app.ui.toolbar_double = match p.get("double") {
-                None | Some(Value::Null) => !app.ui.toolbar_double,
-                Some(Value::Bool(b)) => *b,
-                Some(_) => return Some(Err("double must be true or false".into())),
-            };
-            Ok(json!(app.ui.toolbar_double))
-        }
+        "window.toolbarColumns" => opt_bool(p, "double").map(|on| {
+            let on = on.unwrap_or(!app.ui.toolbar_double);
+            app.ui.toolbar_double = on;
+            json!(on)
+        }),
         "window.toolbarAdvanced" => flag(&mut app.ui.toolbar_advanced),
         "window.floatTools" => {
-            let floating = match p.get("floating") {
-                None | Some(Value::Null) => None,
-                Some(Value::Bool(b)) => Some(*b),
-                Some(_) => return Some(Err("floating must be true or false".into())),
+            let floating = match opt_bool(p, "floating") {
+                Ok(on) => on,
+                Err(e) => return Some(Err(e)),
             };
             let Some(tool) = s("tool") else { return Some(Err("tool (a tool id) is required".into())) };
             crate::toolbar::float_group(app, &tool, floating).map(Value::Bool)
         }
         "window.taskBar" => flag(&mut app.ui.task_bar),
+        "window.taskBar.pin" => {
+            let place = &mut app.ui.task_bar_place;
+            opt_bool(p, "pinned").map(|pinned| {
+                let pinned = pinned.unwrap_or(!place.pinned);
+                // Pinning holds the bar where it shows; unpinning lets it follow the selection from
+                // there (the bar turns its pinned spot into an offset when it is next drawn).
+                if pinned && !place.pinned {
+                    place.pin_at = place.shown_at;
+                }
+                place.pinned = pinned;
+                json!(pinned)
+            })
+        }
+        "window.taskBar.reset" => {
+            app.ui.task_bar_place = Default::default();
+            Ok(Value::Null)
+        }
         "window.dock" => {
             let on = !(app.ui.dock && app.ui.toolbar);
             app.ui.dock = on;
@@ -1020,20 +1064,25 @@ pub fn run_ui_command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<R
             app.ui.control_bar = on;
             Ok(json!(on))
         }
-        "window.collapseDock" => {
-            let collapsed = match p.get("collapsed") {
-                None | Some(Value::Null) => !app.ui.dock_collapsed,
-                Some(Value::Bool(b)) => *b,
-                Some(_) => return Some(Err("collapsed must be true or false".into())),
-            };
+        "window.collapseDock" => opt_bool(p, "collapsed").map(|collapsed| {
+            let collapsed = collapsed.unwrap_or(!app.ui.dock_collapsed);
             crate::dock::set_collapsed(app, collapsed);
-            Ok(json!(collapsed))
-        }
+            json!(collapsed)
+        }),
         "window.panel" => {
             let raw = s("panel").unwrap_or_default();
             // Canonical id (case-insensitive; display labels work too), then the
             // dock tab it names, if any.
             let canonical = normalize_panel(&raw);
+            // A floating panel shows its tab in its group.
+            if let Some(p) = canonical
+                && let Some(g) = crate::floating::group_of(&app.ui, p).and_then(|i| app.ui.floating_panels.get_mut(i))
+            {
+                g.active = g.panels.iter().position(|q| q == p).unwrap_or(g.active);
+                let out = json!({ "floating": g.panels });
+                app.ui.dock = true;
+                return Some(Ok(out));
+            }
             let tab = canonical.and_then(DockTab::from_id);
             match (canonical, tab) {
                 // A collapsed dock pops the panel out of its icon, like the icon panels.
@@ -1304,14 +1353,20 @@ pub fn checked(app: &VectorcraftApp, id: &str, p: &Value) -> Option<bool> {
         });
     }
     let v = &app.ui.view;
+    // An item that can be on or off is `Some` whatever the document and selection (off with none):
+    // the macOS menu bar can't change an item's kind without rebuilding.
+    let selected_text = |onpath: bool| {
+        let st = app.session.active()?;
+        st.selection.objects.iter().find_map(|id| match st.doc.node(*id).map(|n| &n.kind) {
+            Some(vectorcraft_engine::doc::NodeKind::Text(t)) if !onpath || matches!(t.kind, vectorcraft_engine::doc::TextKind::OnPath { .. }) => {
+                Some(t)
+            }
+            _ => None,
+        })
+    };
     Some(match id {
         "type.orientation.vertical" | "type.orientation.horizontal" => {
-            let st = app.session.active()?;
-            let t = st.selection.objects.iter().find_map(|id| match st.doc.node(*id).map(|n| &n.kind) {
-                Some(vectorcraft_engine::doc::NodeKind::Text(t)) => Some(t),
-                _ => None,
-            })?;
-            t.vertical == (id == "type.orientation.vertical")
+            selected_text(false).is_some_and(|t| t.vertical == (id == "type.orientation.vertical"))
         }
         "view.outline" => v.outline,
         "view.pixelPreview" => v.pixel_preview,
@@ -1319,12 +1374,7 @@ pub fn checked(app: &VectorcraftApp, id: &str, p: &Value) -> Option<bool> {
         "view.snapToPixel" => v.snap_to_pixel,
         // Type on a Path effect of the selected path type.
         "type.pathOptions" if p.get("effect").is_some() => {
-            let st = app.session.active()?;
-            let t = st.selection.objects.iter().find_map(|id| match st.doc.node(*id).map(|n| &n.kind) {
-                Some(vectorcraft_engine::doc::NodeKind::Text(t)) if matches!(t.kind, vectorcraft_engine::doc::TextKind::OnPath { .. }) => Some(t),
-                _ => None,
-            })?;
-            p.get("effect").and_then(Value::as_str) == Some(t.path_effect.id())
+            selected_text(true).is_some_and(|t| p.get("effect").and_then(Value::as_str) == Some(t.path_effect.id()))
         }
         "view.smartGuides" => v.smart_guides,
         "view.grid" => v.grid,
@@ -1340,11 +1390,13 @@ pub fn checked(app: &VectorcraftApp, id: &str, p: &Value) -> Option<bool> {
             app.ui.floating_flyouts.iter().any(|f| f.tools.iter().any(|id| id == tool))
         }
         "window.taskBar" => app.ui.task_bar,
+        "window.taskBar.pin" => app.ui.task_bar_place.pinned,
         "window.panel" => {
             let panel = p.get("panel").and_then(Value::as_str).unwrap_or("");
             let canonical = normalize_panel(panel);
             match canonical.and_then(DockTab::from_id) {
-                Some(tab) if !app.ui.dock_collapsed => app.ui.dock_tab == tab,
+                _ if canonical.is_some_and(|id| crate::floating::group_of(&app.ui, id).is_some()) => true,
+                Some(tab) if !app.ui.dock_collapsed => crate::floating::shown_tab(&app.ui) == Some(tab),
                 _ => canonical.is_some_and(|id| app.ui.open_panel.as_deref() == Some(id)),
             }
         }
@@ -1356,8 +1408,8 @@ pub fn checked(app: &VectorcraftApp, id: &str, p: &Value) -> Option<bool> {
         "view.proofColors" => vectorcraft_render::proof::view().proof_colors,
         "view.overprintPreview" => vectorcraft_render::proof::view().overprint,
         "view.proofSetup" => p.get("target").and_then(Value::as_str) == Some(vectorcraft_render::proof::view().setup.target.id().as_str()),
-        "perspective.grid.snap" => perspective_grid(app)?.snap,
-        "perspective.grid.lockStation" => perspective_grid(app)?.lock_station,
+        "perspective.grid.snap" => perspective_grid(app).is_some_and(|g| g.snap),
+        "perspective.grid.lockStation" => perspective_grid(app).is_some_and(|g| g.lock_station),
         "file.documentColorMode" | "object.convertDocumentColorMode" => {
             let cmyk = app.session.active().is_some_and(|d| d.doc.color_mode == vectorcraft_engine::doc::ColorMode::Cmyk);
             p.get("mode").and_then(Value::as_str) == Some(if cmyk { "cmyk" } else { "rgb" })
@@ -1560,28 +1612,81 @@ fn recent_slot<'a>(app: &'a VectorcraftApp, id: &str) -> Option<&'a String> {
     io::recent_files(app).get(n.checked_sub(1)?)
 }
 
-/// A menu slot hidden while it is empty ([`hidden_when_disabled`]) rather than shown disabled (the
-/// native menu leaves it out).
-pub fn hidden_slot(app: &VectorcraftApp, id: &str) -> bool {
-    hidden_when_disabled(id) && !enabled(app, id)
+/// How the menus show item `id` (params `p`) now: (enabled, checked: `Some` for an item that is on
+/// or off), or `None` while they leave it out: an empty slot ([`hidden_when_disabled`]) or an item
+/// another stands in for ([`swapped_out`]).
+pub fn shown_state(app: &VectorcraftApp, id: &str, p: &Value) -> Option<(bool, Option<bool>)> {
+    let en = enabled(app, id);
+    if (!en && hidden_when_disabled(id)) || swapped_out(app, id) {
+        return None;
+    }
+    Some((en, checked(app, id, p)))
 }
 
-/// How many saved-view, recent-file and User Defined library slots are listed: a menu that can't
-/// hide items (the native one) is rebuilt when this changes.
-pub fn listed_slots(app: &VectorcraftApp) -> usize {
-    use vectorcraft_engine::cmd::{stylelib, swatchlib};
-    let user = |libs: Vec<swatchlib::LibraryInfo>| libs.iter().filter(|l| l.category == "user").count().min(10);
-    let views = app.session.active().map_or(0, |d| d.doc.views.len().min(10));
-    views
-        + app.session.active().map_or(0, |d| d.doc.saved_selections.len().min(SAVED_SELECTION_IDS.len()))
-        + io::recent_files(app).len().min(RECENT_IDS.len())
-        + user(swatchlib::libraries(&app.session))
-        + user(stylelib::libraries(&app.session))
-        + crate::dialogs::perspective_presets::listed_slots(app)
+/// One row of a menu as it shows now. The in-window menus draw these and the macOS menu bar
+/// ([`crate::native_menu`]) is built from them, so the two can't drift.
+pub enum Entry<'a> {
+    Sep,
+    /// A section header (a disabled label), in the UI language.
+    Header(&'static str),
+    /// A submenu: its label in the UI language, and its items.
+    Sub(&'static str, &'a [Item]),
+    Item(Row<'a>),
+}
+
+/// A menu item as it shows now ([`entry`]).
+pub struct Row<'a> {
+    /// The command and its params; `None` for an item not implemented yet (always disabled).
+    pub command: Option<(&'static str, &'a Value)>,
+    /// The tree's own English label, which [`click_target`] reads.
+    pub source: &'static str,
+    /// The label in the UI language, as it reads now (Undo *Move*, Show/Hide…, a recent file).
+    pub label: std::borrow::Cow<'static, str>,
+    /// The shortcut as the registry writes it (`Cmd+Shift+Z`), the user's overrides applied.
+    pub shortcut: Option<&'static str>,
+    pub enabled: bool,
+    /// `Some` for an item that is on or off.
+    pub checked: Option<bool>,
+}
+
+impl Row<'_> {
+    /// What choosing it runs ([`click_target`]); `None` for an item not implemented yet.
+    pub fn target(&self) -> Option<(String, Value)> {
+        self.command.map(|(id, p)| click_target(self.source, id, p))
+    }
+}
+
+/// Item `it` as the menus show it now, or `None` while they leave it out ([`shown_state`]).
+pub fn entry<'a>(app: &VectorcraftApp, it: &'a Item) -> Option<Entry<'a>> {
+    use crate::i18n::t;
+    Some(match it {
+        Item::Sep => Entry::Sep,
+        Item::Header(h) => Entry::Header(t(h)),
+        Item::Sub(label, children) => Entry::Sub(t(label), children),
+        Item::Todo(label, sc) => Entry::Item(Row {
+            command: None,
+            source: label,
+            label: t(label).into(),
+            shortcut: Some(*sc).filter(|s| !s.is_empty()),
+            enabled: false,
+            checked: None,
+        }),
+        Item::Cmd(label, id, p) => {
+            let (enabled, checked) = shown_state(app, id, p)?;
+            Entry::Item(Row {
+                command: Some((id, p)),
+                source: label,
+                label: display_label(app, id, label).into(),
+                shortcut: item_shortcut(id, p),
+                enabled,
+                checked,
+            })
+        }
+    })
 }
 
 /// Changes whenever a plug-in is installed or removed: Object › Plug-ins and Effect › Plug-ins
-/// list them, so a menu built once (the native one) is rebuilt.
+/// list them (the command palette's cache follows it).
 pub fn plugin_revision() -> u64 {
     vectorcraft_plugins::registry::revision()
 }
@@ -2537,9 +2642,24 @@ pub fn context_menu_body(app: &VectorcraftApp, ui: &mut egui::Ui, clicked: &mut
 /// The in-window menu bar. Returns where its titles end (x): the bar itself takes the full width.
 pub fn menu_bar(app: &mut VectorcraftApp, ui: &mut egui::Ui) -> f32 {
     let t = Tokens::get(ui.ctx());
+    let ctx = ui.ctx().clone();
+    // The press that opens a menu takes the keyboard from a focused text field: the field and its
+    // selection are kept while the menus are open, so their Select All, Cut, Copy and Paste act on
+    // its text (#516), the frame after the click that chose them (that click takes the keyboard
+    // from it again).
+    type Field = (egui::Id, egui::text_edit::TextEditState);
+    let (field_key, chosen_key) = (egui::Id::new("menu-bar-field"), egui::Id::new("menu-bar-field-event"));
+    if let Some(((field, state), e)) = ctx.data(|d| d.get_temp::<(Field, egui::Event)>(chosen_key)) {
+        ctx.data_mut(|d| d.remove::<(Field, egui::Event)>(chosen_key));
+        state.store(&ctx, field);
+        to_field(&ctx, field, e);
+    }
+    if let Some(field) = focused_text_field(&ctx).and_then(|id| Some((id, egui::TextEdit::load_state(&ctx, id)?))) {
+        ctx.data_mut(|d| d.insert_temp::<Field>(field_key, field));
+    }
     let mut clicked: Option<(String, Value)> = None;
     let tree = menu_tree();
-    let end = egui::MenuBar::new()
+    let (end, open) = egui::MenuBar::new()
         .ui(ui, |ui| {
             let mut titles = Vec::with_capacity(tree.len());
             for (i, (title, items)) in tree.iter().enumerate() {
@@ -2550,12 +2670,21 @@ pub fn menu_bar(app: &mut VectorcraftApp, ui: &mut egui::Ui) -> f32 {
                 };
                 titles.push(ui.menu_button(text, |ui| menu_body(app, ui, items, &mut clicked)).response);
             }
-            switch_on_hover(ui.ctx(), &titles);
-            ui.cursor().min.x
+            (ui.cursor().min.x, switch_on_hover(ui.ctx(), &titles))
         })
         .inner;
+    let field = ctx.data(|d| d.get_temp::<Field>(field_key));
+    if !open && focused_text_field(&ctx).is_none() {
+        ctx.data_mut(|d| d.remove::<Field>(field_key));
+    }
     if let Some((id, p)) = clicked {
-        invoke(app, &id, p);
+        match field.and_then(|f| Some((f, field_event(app, &id)?))) {
+            Some(chosen) => {
+                ctx.data_mut(|d| d.insert_temp(chosen_key, chosen));
+                ctx.request_repaint();
+            }
+            None => invoke(app, &id, p),
+        }
     }
     end
 }
@@ -2568,29 +2697,25 @@ fn pointer_reaches_title(ctx: &egui::Context, title: &egui::Response, p: egui::P
 }
 
 /// Like a native menu bar: while one top-level menu is open, moving the pointer onto another
-/// title opens that menu instead (egui alone needs a click on each title).
-fn switch_on_hover(ctx: &egui::Context, titles: &[egui::Response]) {
+/// title opens that menu instead (egui alone needs a click on each title). Returns whether a menu
+/// is open.
+fn switch_on_hover(ctx: &egui::Context, titles: &[egui::Response]) -> bool {
     let ids: Vec<egui::Id> = titles.iter().map(egui::Popup::default_response_id).collect();
     let Some(open) = ids.iter().position(|id| egui::Popup::is_id_open(ctx, *id)) else {
-        return;
+        return false;
     };
     // `Response::hovered` is false while a menu's popup is open, so hit-test the titles here.
-    let Some(p) = ctx.pointer_hover_pos() else {
-        return;
-    };
     // Only a moving pointer switches: one resting on a title leaves the open menu alone.
-    if ctx.input(|i| i.pointer.delta() == egui::Vec2::ZERO) {
-        return;
-    }
-    let Some(i) = titles.iter().position(|title| pointer_reaches_title(ctx, title, p)) else {
-        return;
-    };
-    if i != open
+    let moving = ctx.input(|i| i.pointer.delta() != egui::Vec2::ZERO);
+    if let Some(p) = ctx.pointer_hover_pos().filter(|_| moving)
+        && let Some(i) = titles.iter().position(|title| pointer_reaches_title(ctx, title, p))
+        && i != open
         && let Some(id) = ids.get(i)
     {
         egui::Popup::open_id(ctx, *id);
         ctx.request_repaint();
     }
+    true
 }
 
 /// A top-level menu's popup: as wide as its widest item (label plus shortcut), at least 230 pt;
@@ -2606,77 +2731,75 @@ fn menu_body(app: &VectorcraftApp, ui: &mut egui::Ui, items: &[Item], clicked: &
 /// room for one).
 fn render_items(app: &VectorcraftApp, ui: &mut egui::Ui, items: &[Item], checks: bool, clicked: &mut Option<(String, Value)>) {
     let t = Tokens::get(ui.ctx());
-    for it in items {
-        match it {
-            Item::Sep => {
+    for e in items.iter().filter_map(|it| entry(app, it)) {
+        match e {
+            Entry::Sep => {
                 ui.separator();
             }
-            Item::Header(h) => {
-                ui.label(egui::RichText::new(tl!(h)).size(11.0).color(t.text_dim));
+            Entry::Header(h) => {
+                ui.label(egui::RichText::new(h).size(11.0).color(t.text_dim));
             }
-            Item::Sub(label, children) => {
-                ui.menu_button(tl!(label), |ui| {
+            Entry::Sub(label, children) => {
+                ui.menu_button(label, |ui| {
                     widgets::menu_scroll(ui, |ui| {
                         ui.set_min_width(200.0);
                         render_items(app, ui, children, checks, clicked);
                     });
                 });
             }
-            Item::Todo(label, sc) => {
-                ui.add_enabled_ui(false, |ui| {
-                    ui.add(egui::Button::new(tl!(label)).shortcut_text(pretty_shortcut(sc)));
-                })
-                .response
-                .on_disabled_hover_text(tl!("Coming soon — tracked in the parity plan"));
-            }
-            Item::Cmd(label, id, p) => {
-                let en = enabled(app, id);
-                // Unused saved-view and recent-file slots are hidden (only the real ones are listed).
-                if (!en && hidden_when_disabled(id)) || swapped_out(app, id) {
-                    continue;
-                }
-                let label = display_label(app, id, label);
-                let sc = item_shortcut(id, p).map(pretty_shortcut).unwrap_or_default();
-                let chk = checks.then(|| checked(app, id, p)).flatten();
-                let text = match chk {
-                    Some(true) => format!("✓  {label}"),
-                    Some(false) => format!("     {label}"),
-                    None => label,
-                };
-                // Type → Font: each family's sample after its name (Enable in-menu font previews).
-                let sampled = p.get("font").and_then(Value::as_str).filter(|_| *id == "text.setStyle" && app.session.prefs.font_preview);
-                let r = match sampled {
-                    Some(family) => {
-                        let slot = ui.id().with(("font-sample", family));
-                        let button = egui::Button::new(text).right_text(egui::Atom::custom(slot, crate::font_menu::MENU_SAMPLE_SIZE));
-                        let out = ui.add_enabled_ui(en, |ui| button.atom_ui(ui)).inner;
-                        if let Some(rect) = out.rect(slot) {
-                            crate::font_menu::menu_item_sample(ui, rect, family);
-                        }
-                        out.response
-                    }
-                    None => ui.add_enabled(en, egui::Button::new(text).shortcut_text(sc)),
-                };
-                if r.clicked() {
-                    *clicked = Some(click_target(label_of(it), id, p));
-                    ui.close();
-                }
-            }
+            Entry::Item(row) => render_row(app, ui, &row, checks, clicked),
         }
     }
 }
 
+/// One menu item: its label (with a check mark, or the room for one, under `checks`), its shortcut,
+/// and Type › Font's samples.
+fn render_row(app: &VectorcraftApp, ui: &mut egui::Ui, row: &Row, checks: bool, clicked: &mut Option<(String, Value)>) {
+    let sc = row.shortcut.map(pretty_shortcut).unwrap_or_default();
+    let Some((id, p)) = row.command else {
+        ui.add_enabled_ui(false, |ui| {
+            ui.add(egui::Button::new(row.label.as_ref()).shortcut_text(sc));
+        })
+        .response
+        .on_disabled_hover_text(tl!("Coming soon — tracked in the parity plan"));
+        return;
+    };
+    let text = match row.checked.filter(|_| checks) {
+        Some(true) => format!("✓  {}", row.label),
+        Some(false) => format!("     {}", row.label),
+        None => row.label.to_string(),
+    };
+    // Type → Font: each family's sample after its name (Enable in-menu font previews).
+    let sampled = p.get("font").and_then(Value::as_str).filter(|_| id == "text.setStyle" && app.session.prefs.font_preview);
+    let r = match sampled {
+        Some(family) => {
+            let slot = ui.id().with(("font-sample", family));
+            let button = egui::Button::new(text).right_text(egui::Atom::custom(slot, crate::font_menu::MENU_SAMPLE_SIZE));
+            let out = ui.add_enabled_ui(row.enabled, |ui| button.atom_ui(ui)).inner;
+            if let Some(rect) = out.rect(slot) {
+                crate::font_menu::menu_item_sample(ui, rect, family);
+            }
+            out.response
+        }
+        None => ui.add_enabled(row.enabled, egui::Button::new(text).shortcut_text(sc)),
+    };
+    if r.clicked() {
+        *clicked = row.target();
+        ui.close();
+    }
+}
+
 /// What the Home screen remembers when it opens (`app.home`): the active document and the
 /// document count. When either changes, the Home screen gives way to the document.
 pub(crate) fn home_key(app: &VectorcraftApp) -> (Option<u64>, usize) {
     (app.session.active().map(|d| d.uid), app.session.documents().len())
 }
 
-fn label_of(it: &Item) -> &'static str {
-    match it {
-        Item::Cmd(l, _, _) => l,
-        _ => "",
-    }
+/// Whether the Home screen is up: chosen with the Home button (`app.home`), or no document is open
+/// and Preferences › General › Show The Home Screen When No Documents Are Open is on (#394). Off,
+/// an app with no document shows an empty window, and the Home button still opens the screen.
+pub(crate) fn home_showing(app: &VectorcraftApp) -> bool {
+    app.ui.home.is_some() || (app.session.active().is_none() && app.session.prefs.show_home_screen)
 }
 
 /// What a menu click runs: items whose label ends with "…" and that carry default params open a
@@ -2732,18 +2855,26 @@ fn field_event(app: &mut VectorcraftApp, id: &str) -> Option<egui::Event> {
     })
 }
 
-/// Invoke an item of the system menu bar (macOS), chosen by a click or by its key equivalent: the
-/// system takes those keys before the window sees them. While a text field has the keyboard,
-/// Select All, Cut, Copy and Paste act on the field's text, as their keys do in the window;
-/// everything else (and those commands with no field focused) goes to [`invoke`].
+/// Invoke an item clicked in the system menu bar (macOS; its key equivalents come back to egui as
+/// key presses, see [`crate::native_menu`]). While a text field has the keyboard, Select All, Cut,
+/// Copy and Paste act on the field's text, as their keys do; everything else (and those commands
+/// with no field focused) goes to [`invoke`].
 pub fn invoke_from_system_menu(app: &mut VectorcraftApp, ctx: &egui::Context, id: &str, p: Value) {
-    if ctx.text_edit_focused()
-        && let Some(e) = field_event(app, id)
-    {
-        ctx.input_mut(|i| i.events.push(e));
-        return;
+    match focused_text_field(ctx).and_then(|f| Some((f, field_event(app, id)?))) {
+        Some((field, e)) => to_field(ctx, field, e),
+        None => invoke(app, id, p),
     }
-    invoke(app, id, p);
+}
+
+/// The text field that has the keyboard, if any.
+fn focused_text_field(ctx: &egui::Context) -> Option<egui::Id> {
+    ctx.memory(|m| m.focused()).filter(|&id| egui::TextEdit::load_state(ctx, id).is_some())
+}
+
+/// Give text field `field` the keyboard (back) and event `e`, a [`field_event`], this frame.
+fn to_field(ctx: &egui::Context, field: egui::Id, e: egui::Event) {
+    ctx.memory_mut(|m| m.request_focus(field));
+    ctx.input_mut(|i| i.events.push(e));
 }
 
 /// Invoke a menu/command id with UI side effects (dialogs for "…" commands that need input).
@@ -2942,15 +3073,17 @@ pub fn context_entries(app: &VectorcraftApp) -> Vec<MenuEntry> {
 fn flatten(app: &VectorcraftApp, path: Vec<String>, items: &[Item], out: &mut Vec<MenuEntry>) {
     for it in items {
         match it {
-            Item::Cmd(_, id, _) if (hidden_when_disabled(id) && !enabled(app, id)) || swapped_out(app, id) => {}
-            Item::Cmd(l, id, p) => out.push(MenuEntry {
-                path: path.clone(),
-                label: dynamic_label(app, id, l),
-                command: Some(id.to_string()),
-                params: p.clone(),
-                enabled: enabled(app, id),
-                shortcut: item_shortcut(id, p).or_else(|| shortcut_of(id)).unwrap_or("").to_string(),
-            }),
+            Item::Cmd(l, id, p) => {
+                let Some((enabled, _)) = shown_state(app, id, p) else { continue };
+                out.push(MenuEntry {
+                    path: path.clone(),
+                    label: dynamic_label(app, id, l),
+                    command: Some(id.to_string()),
+                    params: p.clone(),
+                    enabled,
+                    shortcut: item_shortcut(id, p).or_else(|| shortcut_of(id)).unwrap_or("").to_string(),
+                })
+            }
             Item::Todo(l, sc) => out.push(MenuEntry {
                 path: path.clone(),
                 label: l.to_string(),
@@ -3227,6 +3360,7 @@ pub fn menu_strings() -> std::collections::BTreeSet<String> {
         out.insert(title.to_string());
         walk(&items, title, &mut out);
     }
+    out.extend(crate::native_menu::MAC_LABELS.iter().map(|s| s.to_string()));
     out.extend(DYNAMIC_LABELS.iter().map(|s| s.to_string()));
     out.extend(CONTEXT_LABELS.iter().map(|s| s.to_string()));
     out.extend(UI_COMMANDS.iter().map(|c| c.1.to_string()));
@@ -3491,11 +3625,11 @@ mod tests {
         let r = app.run("select.recall2", json!({})).unwrap();
         assert!(r["count"].as_u64().unwrap() >= 1);
         assert_eq!(app.session.active().unwrap().selection.len(), 2);
-        // The native menu is rebuilt when the number of slots changes.
-        let listed = listed_slots(&app);
+        // A deleted selection's slot leaves the menus.
         app.run("select.editSaved", json!({"name": "Ellipse", "delete": true})).unwrap();
-        assert_eq!(listed_slots(&app), listed - 1);
         assert!(!enabled(&app, "select.recall2"));
+        assert!(shown_state(&app, "select.recall2", &Value::Null).is_none());
+        assert!(shown_state(&app, "select.recall1", &Value::Null).is_some());
     }
 
     #[test]

crates/ui-egui/src/native_menu.rs

@@ -0,0 +1,528 @@
+//! The macOS menu bar: the menus of the in-window bar ([`crate::menus::menu_tree`], each item as
+//! [`crate::menus::entry`] shows it), laid out the way a Mac app's are and handed to a platform
+//! [`Backend`] (the desktop app's, through muda).
+//!
+//! Pure and platform-free, so it is tested everywhere and builds for the web; only the backend
+//! touches AppKit. What the layout does ([`mac_layout`], Illustrator on the Mac as the reference):
+//! - an **app menu** named VectorCraft: About; Settings, a submenu with one item per Preferences
+//!   page (General… ⌘K first); Language; Appearance (the UI brightness); Services; Hide VectorCraft
+//!   ⌃⌘H (⌘H stays View › Hide Edges), Hide Others ⌥⌘H, Show All; and Quit ⌘Q, still the app's own
+//!   `app.quit`, so documents with unsaved changes are asked about. These leave the other menus
+//!   (Edit › Preferences…, Help › About), and Join Our Discord stays under Help only;
+//! - **Window** gets Minimize ⌃⌘M, Zoom and Bring All to Front, and **Help** the system's search
+//!   field;
+//! - a system key already bound to a command keeps the command's: the system item goes without.
+//!
+//! **Keys stay with egui.** AppKit runs a menu's key equivalents before the window sees the key,
+//! which would skip VectorCraft's key rules (a focused text field takes ⌘A, ⌘C, ⌘V and ⌘Z; dialogs
+//! and the Type tool's input method have the keyboard). So the backend reports a key equivalent as
+//! [`Event::Key`], and [`key_events`] feeds it to egui as the key press it was (the clipboard
+//! events egui's window integration makes of ⌘X, ⌘C and ⌘V): the shortcut runs through
+//! [`crate::shortcuts::handle`] exactly as without a native menu, user overrides included. A click
+//! is [`Event::Click`] and runs like an in-window menu click.
+//!
+//! **Updates are cheap.** The rows are read again only when something they show may have changed
+//! ([`sync`]); labels, enabled and checked are then updated in place, and the menus are rebuilt
+//! only when their structure changes ([`structure_key`]: a recent file added, the language or a
+//! shortcut changed).
+
+use std::hash::{DefaultHasher, Hash, Hasher};
+
+use egui::{Key, KeyboardShortcut};
+use serde_json::{Value, json};
+
+use crate::VectorcraftApp;
+use crate::i18n::{Lang, tr, tr_ctx};
+use crate::menus::{self, Entry};
+
+pub const APP_NAME: &str = "VectorCraft";
+/// Hide VectorCraft: an item of ours (AppKit's always takes ⌘H, which is View › Hide Edges).
+pub const HIDE: &str = "app.hide";
+/// Hide Others: an item of ours, so a command bound to ⌥⌘H keeps it.
+pub const HIDE_OTHERS: &str = "app.hideOthers";
+/// Minimize: an item of ours with ⌃⌘M (AppKit's always takes ⌘M).
+pub const MINIMIZE: &str = "window.minimize";
+
+/// The labels the Mac layout adds to the menus (translated like every menu string:
+/// [`crate::menus::menu_strings`]).
+pub const MAC_LABELS: &[&str] =
+    &["Settings", "Appearance", "Services", "Hide VectorCraft", "Hide Others", "Show All", "Minimize", "Zoom", "Bring All to Front"];
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct MenuBar {
+    pub menus: Vec<Menu>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Menu {
+    /// In the UI language (the app menu is the app's name).
+    pub title: String,
+    pub role: MenuRole,
+    pub children: Vec<Node>,
+}
+
+/// What a top-level menu is for: macOS treats the app, Window and Help menus specially.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum MenuRole {
+    #[default]
+    Normal,
+    App,
+    Window,
+    Help,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum Node {
+    Item(Item),
+    Separator,
+    /// A section header (a disabled label).
+    Header(String),
+    Submenu {
+        label: String,
+        children: Vec<Node>,
+    },
+    /// An item AppKit provides and runs itself.
+    Standard(Standard),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Item {
+    /// The command id, one of [`HIDE`], [`HIDE_OTHERS`], [`MINIMIZE`], or `None` for an item not
+    /// implemented yet.
+    pub command: Option<&'static str>,
+    pub params: Value,
+    /// The menu tree's English label ([`crate::menus::click_target`] reads it).
+    pub source: &'static str,
+    /// In the UI language, as it reads now.
+    pub label: String,
+    /// As the registry writes it (`Cmd+Shift+Z`): `Cmd` is ⌘ and `Ctrl` the Control key.
+    pub shortcut: Option<&'static str>,
+    pub enabled: bool,
+    /// `Some` for an item that is on or off.
+    pub checked: Option<bool>,
+}
+
+/// Items AppKit provides and runs: none has a key equivalent, so none can take a command's.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Standard {
+    Services,
+    ShowAll,
+    Zoom,
+    BringAllToFront,
+}
+
+impl Standard {
+    /// The English label ([`MAC_LABELS`]).
+    pub fn label(self) -> &'static str {
+        match self {
+            Standard::Services => "Services",
+            Standard::ShowAll => "Show All",
+            Standard::Zoom => "Zoom",
+            Standard::BringAllToFront => "Bring All to Front",
+        }
+    }
+}
+
+impl Item {
+    /// An item of the layout's own (Hide, Minimize…): always enabled, `shortcut` unless a command
+    /// has it.
+    fn system(command: &'static str, source: &'static str, shortcut: Option<&'static str>, lang: Lang) -> Item {
+        Item { command: Some(command), params: Value::Null, source, label: tr(lang, source).into(), shortcut, enabled: true, checked: None }
+    }
+}
+
+impl MenuBar {
+    /// Every item, depth first.
+    pub fn items(&self) -> Vec<&Item> {
+        fn walk<'a>(nodes: &'a [Node], out: &mut Vec<&'a Item>) {
+            for n in nodes {
+                match n {
+                    Node::Item(it) => out.push(it),
+                    Node::Submenu { children, .. } => walk(children, out),
+                    Node::Separator | Node::Header(_) | Node::Standard(_) => {}
+                }
+            }
+        }
+        let mut out = Vec::new();
+        for m in &self.menus {
+            walk(&m.children, &mut out);
+        }
+        out
+    }
+
+    pub fn menu(&self, role: MenuRole) -> Option<&Menu> {
+        self.menus.iter().find(|m| m.role == role)
+    }
+}
+
+/// The menus as the in-window bar shows them now, as a tree: `tree`'s items through
+/// [`crate::menus::entry`] (labels in the UI language, live state, empty slots left out).
+pub fn from_tree(app: &VectorcraftApp, tree: &[(&'static str, Vec<menus::Item>)]) -> MenuBar {
+    fn level(app: &VectorcraftApp, items: &[menus::Item]) -> Vec<Node> {
+        let nodes = items
+            .iter()
+            .filter_map(|it| menus::entry(app, it))
+            .map(|e| match e {
+                Entry::Sep => Node::Separator,
+                Entry::Header(h) => Node::Header(h.to_string()),
+                Entry::Sub(label, children) => Node::Submenu { label: label.to_string(), children: level(app, children) },
+                Entry::Item(row) => Node::Item(Item {
+                    command: row.command.map(|(id, _)| id),
+                    params: row.command.map_or(Value::Null, |(_, p)| p.clone()),
+                    source: row.source,
+                    label: row.label.into_owned(),
+                    shortcut: row.shortcut,
+                    enabled: row.enabled,
+                    checked: row.checked,
+                }),
+            })
+            .collect();
+        tidy(nodes)
+    }
+    let menus = tree
+        .iter()
+        .enumerate()
+        .map(|(i, (title, items))| {
+            // The first menu is the in-window bar's application menu.
+            let role = match *title {
+                _ if i == 0 => MenuRole::App,
+                "Window" => MenuRole::Window,
+                "Help" => MenuRole::Help,
+                _ => MenuRole::Normal,
+            };
+            Menu { title: crate::i18n::t(title).to_string(), role, children: level(app, items) }
+        })
+        .collect();
+    MenuBar { menus }
+}
+
+/// Drop separators at the start or end of a level and collapse runs of them, at every depth.
+fn tidy(nodes: Vec<Node>) -> Vec<Node> {
+    let mut out: Vec<Node> = Vec::with_capacity(nodes.len());
+    for n in nodes {
+        let n = match n {
+            Node::Submenu { label, children } => Node::Submenu { label, children: tidy(children) },
+            other => other,
+        };
+        if matches!(n, Node::Separator) && matches!(out.last(), None | Some(Node::Separator)) {
+            continue;
+        }
+        out.push(n);
+    }
+    while matches!(out.last(), Some(Node::Separator)) {
+        out.pop();
+    }
+    out
+}
+
+/// A hash of everything a native menu can only change by rebuilding: menus, items (command,
+/// params, kind: plain or check, shortcut), submenu and header labels. Item labels, enabled and
+/// checked are updated in place.
+pub fn structure_key(bar: &MenuBar) -> u64 {
+    fn walk(nodes: &[Node], h: &mut DefaultHasher) {
+        for n in nodes {
+            match n {
+                Node::Item(it) => ('i', it.command, it.params.to_string(), it.checked.is_some(), it.shortcut).hash(h),
+                Node::Separator => '-'.hash(h),
+                Node::Header(label) => ('h', label).hash(h),
+                Node::Submenu { label, children } => {
+                    ('[', label).hash(h);
+                    walk(children, h);
+                    ']'.hash(h);
+                }
+                Node::Standard(s) => ('s', s).hash(h),
+            }
+        }
+    }
+    let mut h = DefaultHasher::new();
+    for m in &bar.menus {
+        (&m.title, m.role).hash(&mut h);
+        walk(&m.children, &mut h);
+    }
+    h.finish()
+}
+
+// ----------------------------------------------------------------------------- shortcuts
+
+/// Does a shortcut make a key equivalent in the native menu? Only with ⌘ or ⌃, or a function key:
+/// bare keys and ⌥/⇧ chords are typing (⌥ types accented letters), which AppKit would otherwise
+/// take from a text field.
+pub fn native_ok(sc: &KeyboardShortcut) -> bool {
+    sc.modifiers.command || sc.modifiers.mac_cmd || sc.modifiers.ctrl || is_function_key(sc.logical_key)
+}
+
+pub fn is_function_key(key: Key) -> bool {
+    key.name().strip_prefix('F').and_then(|n| n.parse::<u8>().ok()).is_some_and(|n| (1..=24).contains(&n))
+}
+
+/// The input egui's window integration would have made of a press of `sc` (key and modifiers
+/// held): the key press and its release, but for ⌘X, ⌘C and ⌘V the Cut, Copy and Paste events
+/// (Paste with the clipboard's text, from `paste_text`). A paste's release is left to the window's
+/// own key-up: one without a press or a Paste event is how a paste of a picture or a PDF is told
+/// apart ([`crate::shortcuts`]).
+pub fn key_events(sc: KeyboardShortcut, paste_text: impl FnOnce() -> Option<String>) -> Vec<egui::Event> {
+    let key = |pressed| egui::Event::Key { key: sc.logical_key, physical_key: None, pressed, repeat: false, modifiers: sc.modifiers };
+    if sc.modifiers.command {
+        match sc.logical_key {
+            Key::X => return vec![egui::Event::Cut, key(false)],
+            Key::C => return vec![egui::Event::Copy, key(false)],
+            Key::V => return paste_text().map(|t| t.replace("\r\n", "\n")).filter(|t| !t.is_empty()).map(egui::Event::Paste).into_iter().collect(),
+            _ => {}
+        }
+    }
+    vec![key(true), key(false)]
+}
+
+// ----------------------------------------------------------------------------- macOS layout
+
+/// A system key equivalent VectorCraft already uses for a command.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Clash {
+    pub shortcut: &'static str,
+    /// What macOS uses it for.
+    pub system: &'static str,
+    /// The command bound to it.
+    pub command: &'static str,
+}
+
+pub struct Layout {
+    pub bar: MenuBar,
+    /// System keys left to commands (logged once).
+    pub clashes: Vec<Clash>,
+}
+
+/// The Mac menu bar of `bar` (the in-window menus, [`from_tree`]): see the module docs.
+pub fn mac_layout(bar: &MenuBar, lang: Lang) -> Layout {
+    let mut bar = bar.clone();
+    let mut clashes = Vec::new();
+    let bound = crate::shortcuts::all_shortcuts();
+    // A system item's key, unless a command has it.
+    let mut key = |sc: &'static str, system: &'static str| {
+        let chord = crate::shortcuts::parse(sc)?;
+        match bound.iter().find(|(b, ..)| *b == chord) {
+            Some((_, command, _)) => {
+                clashes.push(Clash { shortcut: sc, system, command });
+                None
+            }
+            None => Some(sc),
+        }
+    };
+    let hide = Item::system(HIDE, "Hide VectorCraft", key("Ctrl+Cmd+H", "Hide"), lang);
+    let hide_others = Item::system(HIDE_OTHERS, "Hide Others", key("Cmd+Alt+H", "Hide Others"), lang);
+    let minimize = Item::system(MINIMIZE, "Minimize", key("Ctrl+Cmd+M", "Minimize"), lang);
+
+    // What the application menu takes from the others (every copy: About is in Help too, Settings
+    // in Edit as Preferences…).
+    let about = take_items(&mut bar, "help.about").into_iter().next();
+    let settings = take_items(&mut bar, "edit.preferences").into_iter().next();
+    let quit = take_items(&mut bar, "app.quit").into_iter().next();
+    let language = take_submenu(&mut bar, "app.language");
+    let appearance = take_submenu(&mut bar, "window.brightness");
+    // Its other items (Join Our Discord) stay where the in-window bar also has them: Help.
+    bar.menus.retain(|m| m.role != MenuRole::App);
+
+    let mut app = Vec::new();
+    app.extend(about.map(Node::Item));
+    app.push(Node::Separator);
+    app.extend(settings.map(|s| Node::Submenu { label: tr(lang, "Settings").into(), children: settings_pages(&s, lang) }));
+    app.extend(language);
+    app.extend(appearance.map(|n| match n {
+        // The theme, as Mac apps call it.
+        Node::Submenu { children, .. } => Node::Submenu { label: tr_ctx(lang, "theme", "Appearance").into(), children },
+        other => other,
+    }));
+    app.extend([Node::Separator, Node::Standard(Standard::Services), Node::Separator]);
+    app.extend([Node::Item(hide), Node::Item(hide_others), Node::Standard(Standard::ShowAll), Node::Separator]);
+    app.extend(quit.map(Node::Item));
+    bar.menus.insert(0, Menu { title: APP_NAME.into(), role: MenuRole::App, children: app });
+
+    if let Some(window) = bar.menus.iter_mut().find(|m| m.role == MenuRole::Window) {
+        let mut children = vec![Node::Item(minimize), Node::Standard(Standard::Zoom), Node::Separator];
+        children.append(&mut window.children);
+        children.extend([Node::Separator, Node::Standard(Standard::BringAllToFront)]);
+        window.children = children;
+    }
+    for m in &mut bar.menus {
+        m.children = tidy(std::mem::take(&mut m.children));
+    }
+    // A menu the moves emptied goes away (Help stays: it has the search field).
+    bar.menus.retain(|m| !m.children.is_empty() || m.role == MenuRole::Help);
+    Layout { bar, clashes }
+}
+
+/// Settings ▸: one item per page of the Preferences dialog (its own list), each opening it there;
+/// the first (General…) has Preferences' shortcut (⌘K), as in Illustrator.
+fn settings_pages(preferences: &Item, lang: Lang) -> Vec<Node> {
+    vectorcraft_engine::cmd::prefscmds::PREF_CATEGORIES
+        .iter()
+        .enumerate()
+        .map(|(i, page)| {
+            Node::Item(Item {
+                command: preferences.command,
+                params: json!({ "category": page }),
+                // The page's name, not a "…" label: it runs, rather than asking for its params.
+                source: page,
+                label: format!("{}…", tr(lang, page)),
+                shortcut: preferences.shortcut.filter(|_| i == 0),
+                enabled: preferences.enabled,
+                checked: None,
+            })
+        })
+        .collect()
+}
+
+/// Remove every item running `command`, at any depth; returns them in order.
+fn take_items(bar: &mut MenuBar, command: &str) -> Vec<Item> {
+    fn walk(nodes: &mut Vec<Node>, command: &str, out: &mut Vec<Item>) {
+        let mut kept = Vec::with_capacity(nodes.len());
+        for n in std::mem::take(nodes) {
+            match n {
+                Node::Item(it) if it.command == Some(command) => out.push(it),
+                Node::Submenu { label, mut children } => {
+                    walk(&mut children, command, out);
+                    kept.push(Node::Submenu { label, children });
+                }
+                other => kept.push(other),
+            }
+        }
+        *nodes = kept;
+    }
+    let mut out = Vec::new();
+    for m in &mut bar.menus {
+        walk(&mut m.children, command, &mut out);
+    }
+    out
+}
+
+/// Remove the first submenu that lists `command`, and any other item running it.
+fn take_submenu(bar: &mut MenuBar, command: &str) -> Option<Node> {
+    fn find(nodes: &mut Vec<Node>, command: &str) -> Option<Node> {
+        let lists = |n: &Node| matches!(n, Node::Submenu { children, .. } if children.iter().any(|c| matches!(c, Node::Item(it) if it.command == Some(command))));
+        if let Some(i) = nodes.iter().position(lists) {
+            return Some(nodes.remove(i));
+        }
+        nodes.iter_mut().find_map(|n| match n {
+            Node::Submenu { children, .. } => find(children, command),
+            _ => None,
+        })
+    }
+    let sub = bar.menus.iter_mut().find_map(|m| find(&mut m.children, command));
+    take_items(bar, command);
+    sub
+}
+
+/// VectorCraft's menus as a Mac menu bar, as they show now.
+pub fn layout(app: &VectorcraftApp) -> Layout {
+    mac_layout(&from_tree(app, &menus::menu_tree()), crate::i18n::current())
+}
+
+// ----------------------------------------------------------------------------- the app's side
+
+/// What the native menu reports.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Event {
+    /// An item chosen with the mouse (or the keyboard inside an open menu).
+    Click(Item),
+    /// A key equivalent pressed: the item's key with the modifiers held, to be handled as the key
+    /// press it was.
+    Key(KeyboardShortcut),
+}
+
+/// A platform's native menu bar (the desktop app implements it for macOS with muda).
+pub trait Backend {
+    /// Bring the menu in step with `bar`: update labels, enabled and checked in place, or rebuild
+    /// when its structure changed.
+    fn sync(&mut self, bar: &MenuBar);
+    /// What was chosen since the last call. Items the platform runs itself (Services, Zoom, Hide…)
+    /// are handled there and not reported.
+    fn drain(&mut self) -> Vec<Event>;
+}
+
+/// The native menu bar, while VectorCraft uses one (the in-window menus are hidden then).
+pub struct NativeMenu {
+    backend: Box<dyn Backend>,
+    /// Hash of the state the menus were last read in ([`state_hash`]).
+    state: Option<u64>,
+    clicks: Vec<Item>,
+    /// Something was chosen (AppKit may have toggled a check mark itself): read the menus again.
+    dirty: bool,
+    logged: bool,
+}
+
+impl NativeMenu {
+    pub fn new(backend: Box<dyn Backend>) -> NativeMenu {
+        NativeMenu { backend, state: None, clicks: Vec::new(), dirty: true, logged: false }
+    }
+
+    /// The key equivalents pressed since the last frame, for [`key_events`]; clicks wait for
+    /// [`run`].
+    pub fn take_keys(&mut self) -> Vec<KeyboardShortcut> {
+        let mut keys = Vec::new();
+        for e in self.backend.drain() {
+            match e {
+                Event::Key(k) => keys.push(k),
+                Event::Click(it) => self.clicks.push(it),
+            }
+            self.dirty = true;
+        }
+        keys
+    }
+}
+
+/// Run the items clicked in the native menu since the last frame, like in-window menu clicks.
+pub fn run(app: &mut VectorcraftApp, ctx: &egui::Context) {
+    let Some(menu) = app.services.native_menu.as_mut() else { return };
+    for it in std::mem::take(&mut menu.clicks) {
+        match it.command {
+            Some(MINIMIZE) => ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true)),
+            Some(command) => {
+                let (id, p) = menus::click_target(it.source, command, &it.params);
+                menus::invoke_from_system_menu(app, ctx, &id, p);
+            }
+            None => {}
+        }
+    }
+}
+
+/// Bring the native menu up to date when anything it shows may have changed: a command ran, the
+/// document, its history or selection changed, the user clicked or pressed a key. Reading the rows
+/// asks every command whether it is enabled, so frames that only animate or scroll skip it.
+pub fn sync(app: &mut VectorcraftApp, ctx: &egui::Context) {
+    let Some(menu) = app.services.native_menu.as_ref() else { return };
+    let input = ctx
+        .input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Key { pressed: true, .. } | egui::Event::PointerButton { pressed: false, .. })));
+    let state = state_hash(app, input.then_some(app.frame));
+    if menu.state == Some(state) && !menu.dirty {
+        return;
+    }
+    let layout = layout(app);
+    let Some(menu) = app.services.native_menu.as_mut() else { return };
+    if !menu.logged {
+        for c in &layout.clashes {
+            log::info!("menu: {} is {} on macOS and {} in VectorCraft, which keeps it", c.shortcut, c.system, c.command);
+        }
+        menu.logged = true;
+    }
+    menu.backend.sync(&layout.bar);
+    menu.state = Some(state);
+    menu.dirty = false;
+}
+
+/// What the menus' rows depend on, cheaply (no allocation): commands run, the active document,
+/// its revision (edits, selection and view changes), history and clipboard, the language,
+/// shortcuts and plug-ins. `input` forces a change on frames with a click or a key press, which
+/// covers what the hash doesn't list (panels shown, a tool picked).
+fn state_hash(app: &VectorcraftApp, input: Option<u64>) -> u64 {
+    let mut h = DefaultHasher::new();
+    input.hash(&mut h);
+    app.run_count.hash(&mut h);
+    let s = &app.session;
+    (s.journal.len(), s.active_index(), s.clipboard.is_empty(), s.tool_composing()).hash(&mut h);
+    if let Some(d) = s.active() {
+        (d.uid, d.revision, d.history.undo.len(), d.history.redo.len(), d.transparency_grid, d.print_tiling).hash(&mut h);
+    }
+    (app.system_paste, app.last_effect.is_some(), app.ui.recent_files.len(), app.ui.recent_files.first(), app.recent_fonts().len()).hash(&mut h);
+    (crate::i18n::current().code(), menus::plugin_revision()).hash(&mut h);
+    crate::shortcut_editor::GENERATION.load(std::sync::atomic::Ordering::Relaxed).hash(&mut h);
+    h.finish()
+}

crates/ui-egui/src/panels/mod.rs

@@ -113,8 +113,9 @@ pub fn show_icon_panel(app: &mut VectorcraftApp, ui: &mut Ui, id: &str) {
     }
 }
 
-/// Items of a panel's (≡) menu. Unimplemented Illustrator items are listed disabled.
-pub fn panel_menu_items(app: &mut VectorcraftApp, ui: &mut Ui, id: &str) {
+/// Items of a panel's (≡) menu. Unimplemented Illustrator items are listed disabled. False for a
+/// panel without items of its own.
+pub fn panel_menu_items(app: &mut VectorcraftApp, ui: &mut Ui, id: &str) -> bool {
     match id {
         "swatches" => swatches::menu(app, ui),
         "color" => color::menu(app, ui),
@@ -152,10 +153,9 @@ pub fn panel_menu_items(app: &mut VectorcraftApp, ui: &mut Ui, id: &str) {
         links::ID => links::menu(app, ui),
         asset_export::ID => asset_export::menu(app, ui),
         css_properties::ID => css_properties::menu(app, ui),
-        _ => {
-            ui.add_enabled(false, egui::Button::new(tl!("No options")).frame(false));
-        }
+        _ => return false,
     }
+    true
 }
 
 /// The ≡ panel-menu button drawn into `rect` (the right end of a panel's title/tab strip).
@@ -167,7 +167,20 @@ pub fn panel_menu(app: &mut VectorcraftApp, ui: &mut Ui, id: &str, rect: Rect) {
     egui::Popup::menu(&resp).show(|ui| {
         crate::widgets::menu_scroll(ui, |ui| {
             ui.set_min_width(220.0);
-            panel_menu_items(app, ui, id);
+            if panel_menu_items(app, ui, id) {
+                ui.separator();
+            }
+            // The panel floats out of the dock or goes back in, as dragging its tab does.
+            let (label, cmd) = if crate::floating::group_of(&app.ui, id).is_some() {
+                (tl!("Dock Panel"), "window.panel.dock")
+            } else {
+                (tl!("Float Panel"), "window.panel.float")
+            };
+            if crate::widgets::menu_item(ui, label, true, false)
+                && let Err(e) = app.run(cmd, json!({ "panel": id }))
+            {
+                app.ui.status = e;
+            }
         });
     });
 }

crates/ui-egui/src/panels/properties.rs

@@ -16,7 +16,7 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
         return;
     };
     let n_sel = st.selection.len();
-    let anchor_mode = !st.selection.anchors.is_empty();
+    let anchors = crate::chrome::anchor_controls(app);
     let first = first_selected(app);
     let label = match (&first, n_sel) {
         (None, _) => tl!("Document").to_string(),
@@ -85,10 +85,10 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
             }
         });
     }
-    if anchor_mode {
+    if anchors != crate::chrome::AnchorControls::None {
         divider(ui);
         section_header(ui, tl!("Anchor Point"));
-        crate::chrome::anchor_buttons(app, ui);
+        crate::chrome::anchor_buttons(app, ui, anchors);
     }
     divider(ui);
     section_header(ui, tl!("Quick Actions"));

crates/ui-egui/src/prefs_dialog.rs

@@ -6,7 +6,7 @@
 
 use serde_json::{Map, Value, json};
 use vectorcraft_engine::Prefs;
-use vectorcraft_engine::cmd::prefscmds::{PREF_CATEGORIES, PREF_GROUPS, PREF_SPECS, PrefKind};
+use vectorcraft_engine::cmd::prefscmds::{GPU_PREFERENCES, PREF_CATEGORIES, PREF_GROUPS, PREF_SPECS, PrefKind};
 
 use crate::state::Dialog;
 use crate::theme::{self, Brightness, Tokens};
@@ -69,6 +69,11 @@ pub fn restore(app: &mut VectorcraftApp) {
     {
         p.interface_language = code;
     }
+    // 0.5.0 saved its default, `powerSaving`, which Automatic replaced (#502): any value this
+    // version doesn't offer reads as the default, as the desktop app reads it at startup.
+    if !GPU_PREFERENCES.iter().any(|(v, _)| *v == p.gpu_preference) {
+        p.gpu_preference = Prefs::default().gpu_preference;
+    }
     app.session.apply_prefs(p);
 }
 
@@ -79,6 +84,7 @@ struct Applied {
     threads: i32,
     tool_tips: bool,
     scrub: bool,
+    bare_points: bool,
 }
 
 /// Per frame: push UI-side preferences into egui / the renderer when they change.
@@ -95,6 +101,7 @@ pub fn apply_runtime(app: &mut VectorcraftApp, ctx: &egui::Context) {
         threads: p.render_threads,
         tool_tips: p.show_tool_tips,
         scrub: p.scrub_numeric_fields,
+        bare_points: p.numbers_without_units_are_points,
     };
     let id = egui::Id::new("dc-applied-prefs");
     let prev: Option<Applied> = ctx.data(|d| d.get_temp::<Option<Applied>>(id)).flatten();
@@ -105,6 +112,7 @@ pub fn apply_runtime(app: &mut VectorcraftApp, ctx: &egui::Context) {
         let delay = if want.tool_tips { egui::style::Interaction::default().tooltip_delay } else { f32::INFINITY };
         ctx.global_style_mut(|s| s.interaction.tooltip_delay = delay);
         crate::scrub::set_enabled(ctx, want.scrub);
+        crate::widgets::set_bare_numbers_are_points(ctx, want.bare_points);
         if want.white_canvas {
             let mut t = Tokens::get(ctx);
             t.pasteboard = egui::Color32::WHITE;
@@ -231,6 +239,11 @@ fn category_fields(ui: &mut egui::Ui, d: &mut Dialog, cat: &str) {
         first = false;
         let v = d.fields.get(sp.key).cloned().unwrap_or(Value::Null);
         match sp.kind {
+            // Units › Numbers Without Units Are Points only tells points from picas: dimmed
+            // unless a unit is Picas.
+            PrefKind::Bool if sp.key == "numbersWithoutUnitsArePoints" => {
+                ui.add_enabled_ui(picas_in_use(d), |ui| bool_row(ui, d, sp.key, sp.label));
+            }
             PrefKind::Bool => bool_row(ui, d, sp.key, sp.label),
             PrefKind::Num { min, max, unit } => {
                 labeled(ui, sp.label, |ui| {
@@ -319,6 +332,11 @@ fn category_fields(ui: &mut egui::Ui, d: &mut Dialog, cat: &str) {
     }
 }
 
+/// Is one of the dialog's Units (General, Stroke, Type, East Asian Type) Picas?
+fn picas_in_use(d: &Dialog) -> bool {
+    ["unitsGeneral", "unitsStroke", "unitsType", "unitsAsianType"].iter().any(|k| d.str(k) == vectorcraft_doc::Unit::Picas.key())
+}
+
 fn bool_row(ui: &mut egui::Ui, d: &mut Dialog, key: &str, label: &str) {
     let mut b = d.bool(key);
     if ui.checkbox(&mut b, tl!(label)).changed() {
@@ -441,8 +459,8 @@ mod tests {
         assert_eq!(a.session.prefs.ui_brightness, "light");
     }
 
-    /// Performance › Graphics Processor (#306): shown with its restart note, applied by OK and
-    /// saved with the UI state under the key the desktop app reads before the window opens.
+    /// Performance › Graphics Processor (#306, #502): shown with its restart note, applied by OK
+    /// and saved with the UI state under the key the desktop app reads before the window opens.
     #[test]
     fn graphics_processor_preference_shows_and_persists() {
         fn texts(s: &egui::Shape, out: &mut Vec<String>) {
@@ -464,7 +482,7 @@ mod tests {
         let mut shown = vec![];
         out.shapes.iter().for_each(|c| texts(&c.shape, &mut shown));
         assert!(shown.iter().any(|t| t.starts_with("Graphics Processor")), "{shown:?}");
-        assert!(shown.iter().any(|t| t == "Power Saving (integrated)"), "{shown:?}");
+        assert!(shown.iter().any(|t| t == "Automatic"), "{shown:?}");
         assert!(shown.iter().any(|t| t == "Applies the next time VectorCraft starts."), "{shown:?}");
         a.ui.dialog.as_mut().unwrap().fields.insert("gpuPreference".into(), json!("highPerformance"));
         confirm(&mut a).unwrap();
@@ -473,6 +491,47 @@ mod tests {
         assert_eq!(saved["engine_prefs"]["gpuPreference"], json!("highPerformance"));
     }
 
+    /// Units › Numbers Without Units Are Points (#394): the preference reaches the fields when it
+    /// changes, and its checkbox is dimmed unless a unit is Picas.
+    #[test]
+    fn numbers_without_units_are_points_reaches_the_fields_and_dims_without_picas() {
+        let mut a = app();
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx);
+        let frame = |a: &mut VectorcraftApp| {
+            let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+                apply_runtime(a, ui.ctx());
+                show(a, ui.ctx());
+            });
+            out.textures_delta.clear();
+        };
+        let read = |ctx: &egui::Context| widgets::typed_unit(ctx, vectorcraft_doc::Unit::Picas);
+        frame(&mut a);
+        assert_eq!(read(&ctx), vectorcraft_doc::Unit::Points, "on by default");
+        a.run("prefs.set", json!({"key": "numbersWithoutUnitsArePoints", "value": false})).unwrap();
+        frame(&mut a);
+        assert_eq!(read(&ctx), vectorcraft_doc::Unit::Picas, "off");
+        // The checkbox: dimmed with every unit in points, enabled once a unit is Picas.
+        open(&mut a, Some("Units"));
+        let d = a.ui.dialog.as_mut().unwrap();
+        assert!(!picas_in_use(d), "dimmed in points");
+        d.fields.insert("unitsStroke".into(), json!("picas"));
+        assert!(picas_in_use(d), "enabled with a unit in picas");
+    }
+
+    /// 0.5.0 saved `powerSaving` for everyone (its default): it reads as Automatic, while the
+    /// choices this version offers are kept (#502).
+    #[test]
+    fn a_graphics_processor_this_version_does_not_offer_reads_as_automatic() {
+        for (saved, read) in [("powerSaving", "automatic"), ("turbo", "automatic"), ("lowPower", "lowPower"), ("highPerformance", "highPerformance")]
+        {
+            let mut a = app();
+            a.ui.engine_prefs = json!({"gpuPreference": saved});
+            restore(&mut a);
+            assert_eq!(a.session.prefs.gpu_preference, read, "{saved}");
+        }
+    }
+
     #[test]
     fn every_category_renders_fields() {
         for c in PREF_CATEGORIES {

crates/ui-egui/src/shortcuts.rs

@@ -82,10 +82,9 @@ pub(crate) fn all_shortcuts() -> Vec<(KeyboardShortcut, &'static str, serde_json
 
 /// Consume a press of `sc`. A `=` chord also takes [`Key::Plus`], which is how `+` arrives from
 /// the numpad and from layouts where it has its own key (Shift+`=` arrives as either; extra Shift
-/// is ignored). `native`: the system menu already handles the chord as written, so only that
-/// alias is left to match here.
-pub(crate) fn consume(i: &mut egui::InputState, sc: &KeyboardShortcut, native: bool) -> bool {
-    (!native && i.consume_shortcut(sc))
+/// is ignored).
+pub(crate) fn consume(i: &mut egui::InputState, sc: &KeyboardShortcut) -> bool {
+    i.consume_shortcut(sc)
         || (sc.logical_key == Key::Equals && i.consume_key(sc.modifiers, Key::Plus))
         || (sc.modifiers.shift && shifted(sc.logical_key).is_some_and(|k| i.consume_key(sc.modifiers, k)))
 }
@@ -246,7 +245,7 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context) {
                 // Enter with a selection tool opens the Move dialog, as a double-click on its button
                 // does.
                 let tool = app.session.tool_id();
-                if app.ui.dialog.is_none() && crate::canvas::is_selection_tool(tool) {
+                if app.ui.dialog.is_none() && vectorcraft_tools::catalog::is_selection_tool(tool) {
                     // Nothing selected: it fails and nothing opens (the menu item is disabled then too).
                     let _ = crate::toolbar::open_options(app, tool);
                 }
@@ -281,14 +280,13 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context) {
         // Editing keys with modifiers and the clipboard (Cmd+A is Select All's, below: the text).
         crate::panels::character::route_type_input(app, ctx);
         // Enter was already delivered above as ToolKey::Enter (newline).
-        let fire = all_shortcuts().into_iter().filter(|(sc, ..)| sc.modifiers.command).find(|(sc, ..)| ctx.input_mut(|i| consume(i, sc, false)));
+        let fire = all_shortcuts().into_iter().filter(|(sc, ..)| sc.modifiers.command).find(|(sc, ..)| ctx.input_mut(|i| consume(i, sc)));
         if let Some((_, id, p)) = fire {
             crate::menus::invoke(app, id, p);
         }
         return;
     }
-    // Clipboard keys arrive as events, not key presses (except where the native menu has them);
-    // the chord held says which paste.
+    // Clipboard keys arrive as events, not key presses; the chord held says which paste.
     let mut clip = vec![];
     ctx.input_mut(|i| {
         let held = i.modifiers;
@@ -299,17 +297,13 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context) {
                 egui::Event::Paste(t) => (paste_command(held), Some(t.clone())),
                 _ => return true,
             };
-            if app.native_shortcuts.contains(id) {
-                return true;
-            }
             clip.push((id, text));
             false
         })
     });
-    // Only the system clipboard service reads what isn't text (the native menu has its own Paste).
+    // Only the system clipboard service reads what isn't text.
     if let Some(id) = textless_paste.map(paste_command)
         && app.services.system_clipboard.is_some()
-        && !app.native_shortcuts.contains(id)
     {
         clip.push((id, None));
     }
@@ -389,8 +383,7 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context) {
         if plain && (sc.logical_key.name().len() == 1 || matches!(sc.logical_key, Key::Slash | Key::Comma | Key::Period)) {
             continue;
         }
-        let native = app.native_shortcuts.contains(id);
-        if ctx.input_mut(|i| consume(i, &sc, native)) {
+        if ctx.input_mut(|i| consume(i, &sc)) {
             fire = Some((id, p));
             break;
         }
@@ -669,13 +662,6 @@ mod tests {
         let before = zoom(&mut app);
         frame(&mut app, vec![press(Key::Minus, Modifiers::COMMAND)]);
         assert!(zoom(&mut app) < before, "Cmd+- zooms out");
-        // The system menu handles `Cmd+=` itself; the `+` key is still matched here.
-        app.native_shortcuts.insert("view.zoomIn".into());
-        let before = zoom(&mut app);
-        frame(&mut app, vec![press(Key::Equals, Modifiers::COMMAND)]);
-        assert_eq!(zoom(&mut app), before, "left to the system menu");
-        frame(&mut app, vec![press(Key::Plus, Modifiers::COMMAND)]);
-        assert!(zoom(&mut app) > before);
     }
 
     #[test]

crates/ui-egui/src/state.rs

@@ -258,12 +258,23 @@ pub struct UiState {
     pub toolbar_advanced: bool,
     #[serde(default = "yes")]
     pub task_bar: bool,
+    /// Where the Contextual Task Bar was dragged or pinned. Not saved, as in Illustrator: the bar
+    /// starts under the selection at every launch.
+    #[serde(skip)]
+    pub task_bar_place: TaskBarPlace,
     /// Last tool shown in each toolbar slot (keyed by the slot's first tool id).
     #[serde(default)]
     pub slot_tool: std::collections::BTreeMap<String, String>,
     /// Tool flyouts torn off the toolbar into floating panels.
     #[serde(default)]
     pub floating_flyouts: Vec<FloatingFlyout>,
+    /// Panels dragged out of the dock: each group floats as its own stack of tabs.
+    #[serde(default)]
+    pub floating_panels: Vec<FloatingPanels>,
+    /// The Tools panel floats with its top-left corner here (dragged out by its title bar); `None`:
+    /// docked at the window's left edge.
+    #[serde(default)]
+    pub toolbar_pos: Option<[f32; 2]>,
     pub status_bar: bool,
     pub dock: bool,
     pub view: ViewFlags,
@@ -272,9 +283,6 @@ pub struct UiState {
     pub flyout: Option<usize>,
     /// Last tool shown for each toolbar group (flyout selection sticks).
     pub group_tool: Vec<String>,
-    /// The selection tool used last (Selection, Direct Selection or Group Selection): a Cmd press
-    /// with any other tool drags with it.
-    pub last_selection_tool: String,
     pub status: String,
     pub palette_open: bool,
     pub palette_query: String,
@@ -389,6 +397,52 @@ pub struct FloatingFlyout {
     pub pos: [f32; 2],
 }
 
+/// Where the Contextual Task Bar sits once its handle has moved it (`window.taskBar.pin`,
+/// `window.taskBar.reset`).
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct TaskBarPlace {
+    /// More Options › Pin Bar Position: the bar stays where it is instead of following the selection.
+    pub pinned: bool,
+    /// Where a pinned bar's top-left corner sits from the canvas's top-left (none when it was
+    /// pinned before it ever showed, until it is drawn). Unpinning leaves it for the next frame
+    /// to turn into `offset`.
+    pub pin_at: Option<egui::Vec2>,
+    /// Where the bar was last drawn, from the canvas's top-left: where pinning holds it.
+    pub shown_at: Option<egui::Vec2>,
+    /// How far an unpinned bar was dragged from its place under the selection, which it keeps while
+    /// it follows the selection, and the document (`DocState::uid`) it was moved in: in another
+    /// document the bar starts under the selection again.
+    pub offset: Option<(u64, egui::Vec2)>,
+}
+
+/// A group of panels dragged out of the dock: it floats as a stack of tabs, one panel shown.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct FloatingPanels {
+    /// Panel ids (`window.panel`), in tab order.
+    pub panels: Vec<String>,
+    /// The tab shown.
+    #[serde(default)]
+    pub active: usize,
+    /// Top-left corner in screen points.
+    pub pos: [f32; 2],
+}
+
+impl FloatingPanels {
+    /// Keep known panels, each in one group, drop the groups left empty and the toolbar position
+    /// that isn't a number (a hand-edited preferences file or workspace).
+    pub fn sanitize(groups: &mut Vec<FloatingPanels>, toolbar_pos: &mut Option<[f32; 2]>) {
+        let mut seen = std::collections::BTreeSet::new();
+        groups.retain_mut(|g| {
+            g.panels.retain(|id| all_panels().any(|(p, _)| p == id) && seen.insert(id.clone()));
+            g.active = g.active.min(g.panels.len().saturating_sub(1));
+            !g.panels.is_empty()
+        });
+        if toolbar_pos.is_some_and(|p| !p.iter().all(|v| v.is_finite())) {
+            *toolbar_pos = None;
+        }
+    }
+}
+
 impl UiState {
     /// Clear transient state after loading saved preferences.
     pub fn sanitized(mut self) -> Self {
@@ -407,6 +461,7 @@ impl UiState {
             f.tools.retain(|id| vectorcraft_tools::tool_info(id).is_some());
             f.tools.first().is_some_and(|k| seen.insert(k.clone()))
         });
+        FloatingPanels::sanitize(&mut self.floating_panels, &mut self.toolbar_pos);
         // Overrides that can't fire (modifier-only chords recorded by older versions, #487) give
         // the default back.
         self.shortcut_overrides.retain(|_, c| c.is_empty() || crate::shortcut_editor::normalize(c).is_some());
@@ -427,15 +482,17 @@ impl Default for UiState {
             toolbar_double: false,
             toolbar_advanced: false,
             task_bar: true,
+            task_bar_place: TaskBarPlace::default(),
             slot_tool: Default::default(),
             floating_flyouts: vec![],
+            floating_panels: vec![],
+            toolbar_pos: None,
             status_bar: true,
             dock: true,
             view: ViewFlags::default(),
             dialog: None,
             flyout: None,
             group_tool: vectorcraft_tools::TOOL_GROUPS.iter().map(|g| g[0].id.to_string()).collect(),
-            last_selection_tool: "selection".into(),
             status: String::new(),
             palette_open: false,
             palette_query: String::new(),

crates/ui-egui/src/sysclip.rs

@@ -24,6 +24,11 @@ pub trait SystemClipboard {
     fn has(&mut self, mimes: &[&'static str]) -> bool;
 }
 
+/// Makes a second system-clipboard handle, to check off the UI thread whether Paste has something
+/// to take ([`Services::clipboard_probe`](crate::Services::clipboard_probe)). It is called on that
+/// thread and the handle lives and dies there, so the handle needn't be `Send`.
+pub type ClipboardProbeFactory = Box<dyn FnOnce() -> Box<dyn SystemClipboard> + Send>;
+
 /// The command (and its params) that loads `f` into the internal clipboard, centred on `center`.
 pub(crate) fn import_command(f: &Flavour, center: Option<[f64; 2]>) -> (&'static str, Value) {
     let b64 = || vectorcraft_format::base64_encode(&f.data);

crates/ui-egui/src/tests_home.rs

@@ -39,6 +39,49 @@ fn home_shows_over_open_documents_until_a_document_is_chosen() {
     assert!(app.ui.home.is_none());
 }
 
+/// Draw one canvas frame; whether it drew any text (the Home screen's labels; an empty window
+/// draws none).
+fn draws_text(app: &mut VectorcraftApp) -> bool {
+    fn has_text(s: &egui::Shape) -> bool {
+        match s {
+            egui::Shape::Text(_) => true,
+            egui::Shape::Vec(v) => v.iter().any(has_text),
+            _ => false,
+        }
+    }
+    app.canvas_rect = None;
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    let raw = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 600.0))), ..Default::default() };
+    let mut out = ctx.run_ui(raw, |ui| canvas::show(app, ui));
+    out.textures_delta.clear();
+    out.shapes.iter().any(|c| has_text(&c.shape))
+}
+
+/// General › Show The Home Screen When No Documents Are Open (#394): off, an app with no document
+/// shows an empty window instead of the Home screen, and the Home button still opens it.
+#[test]
+fn home_screen_without_documents_follows_its_preference() {
+    let mut app = VectorcraftApp::new(vectorcraft_engine::Session::new(), crate::Services::default());
+    assert!(app.session.active().is_none());
+    assert!(draws_text(&mut app), "Home with no document open (the default)");
+    assert!(crate::menus::home_showing(&app));
+    app.session.execute("prefs.set", &json!({"key": "showHomeScreen", "value": false})).unwrap();
+    assert!(!draws_text(&mut app), "off: an empty window");
+    assert!(!shows_document(&mut app));
+    assert!(!crate::menus::home_showing(&app), "the Home button isn't lit");
+    app.run("app.home", json!({})).unwrap();
+    assert!(draws_text(&mut app), "the Home button still shows the Home screen");
+    app.run("file.new", json!({})).unwrap();
+    assert!(shows_document(&mut app));
+    assert!(app.ui.home.is_none());
+    app.run("file.close", json!({})).unwrap();
+    assert!(app.session.active().is_none());
+    assert!(!draws_text(&mut app), "closing the last document leaves the window empty");
+    app.session.execute("prefs.set", &json!({"key": "showHomeScreen", "value": true})).unwrap();
+    assert!(draws_text(&mut app), "on again: Home");
+}
+
 #[test]
 fn cmd_n_opens_the_new_document_dialog() {
     assert_eq!(crate::shortcut_editor::command_for_key("Cmd+N"), Some("file.newDialog"));

crates/ui-egui/src/tests_nativemenu.rs

@@ -0,0 +1,422 @@
+//! The macOS menu bar's model ([`crate::native_menu`]), tested on every platform with a fake
+//! backend: the Mac layout of the in-window menus, the keys it hands back to egui, the clicks it
+//! runs and when it reads the menus again.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::rc::Rc;
+
+use egui::{Event, Key, KeyboardShortcut, Modifiers, PointerButton, Pos2, Rect, vec2};
+use serde_json::{Value, json};
+use vectorcraft_engine::Session;
+use vectorcraft_engine::cmd::prefscmds::PREF_CATEGORIES;
+
+use crate::i18n::Lang;
+use crate::native_menu::{self, Backend, MenuBar, MenuRole, NativeMenu, Node, Standard};
+use crate::{VectorcraftApp, menus};
+
+fn app(doc: bool) -> VectorcraftApp {
+    let mut app = VectorcraftApp::new(Session::new(), Default::default());
+    if doc {
+        app.run("file.new", json!({"width": 400, "height": 300})).unwrap();
+        app.run("shape.rectangle", json!({"x": 20, "y": 20, "width": 37, "height": 40})).unwrap();
+    }
+    app
+}
+
+fn bar(app: &VectorcraftApp) -> MenuBar {
+    native_menu::mac_layout(&native_menu::from_tree(app, &menus::menu_tree()), Lang::EN).bar
+}
+
+/// A level's nodes as short names: an item's command (`---` a separator, `[label]` a submenu,
+/// `<Standard>` an AppKit item).
+fn ids(nodes: &[Node]) -> Vec<String> {
+    nodes
+        .iter()
+        .map(|n| match n {
+            Node::Item(it) => it.command.unwrap_or("").to_string(),
+            Node::Separator => "---".into(),
+            Node::Header(h) => format!("#{h}"),
+            Node::Submenu { label, .. } => format!("[{label}]"),
+            Node::Standard(s) => format!("<{s:?}>"),
+        })
+        .collect()
+}
+
+fn menu<'a>(bar: &'a MenuBar, title: &str) -> &'a [Node] {
+    &bar.menus.iter().find(|m| m.title == title).unwrap_or_else(|| panic!("no {title} menu")).children
+}
+
+fn submenu<'a>(nodes: &'a [Node], name: &str) -> &'a [Node] {
+    nodes
+        .iter()
+        .find_map(|n| match n {
+            Node::Submenu { label, children } if label == name => Some(children.as_slice()),
+            _ => None,
+        })
+        .unwrap_or_else(|| panic!("no {name} submenu in {:?}", ids(nodes)))
+}
+
+fn items(nodes: &[Node]) -> Vec<&native_menu::Item> {
+    nodes.iter().filter_map(|n| if let Node::Item(it) = n { Some(it) } else { None }).collect()
+}
+
+fn find<'a>(bar: &'a MenuBar, command: &str) -> &'a native_menu::Item {
+    bar.items().into_iter().find(|it| it.command == Some(command)).unwrap_or_else(|| panic!("no {command} item"))
+}
+
+#[test]
+fn vectorcraft_gets_a_mac_app_menu() {
+    let bar = bar(&app(true));
+    let titles: Vec<&str> = bar.menus.iter().map(|m| m.title.as_str()).collect();
+    assert_eq!(titles, ["VectorCraft", "File", "Edit", "Object", "Type", "Select", "Effect", "View", "Window", "Help"]);
+    let app_menu = &bar.menus[0];
+    assert_eq!(app_menu.role, MenuRole::App);
+    assert_eq!(
+        ids(&app_menu.children),
+        [
+            "help.about",
+            "---",
+            "[Settings]",
+            "[Language]",
+            "[Appearance]",
+            "---",
+            "<Services>",
+            "---",
+            native_menu::HIDE,
+            native_menu::HIDE_OTHERS,
+            "<ShowAll>",
+            "---",
+            "app.quit"
+        ]
+    );
+    let shown = |command: &str| {
+        let it = find(&bar, command);
+        (it.label.as_str(), it.shortcut)
+    };
+    assert_eq!(shown("help.about"), ("About VectorCraft", None));
+    assert_eq!(shown("app.quit"), ("Quit VectorCraft", Some("Cmd+Q")), "Quit is the app's own, so unsaved documents are asked about");
+    // ⌘H stays View › Hide Edges (Illustrator's); Hide takes ⌃⌘H.
+    assert_eq!(shown(native_menu::HIDE), ("Hide VectorCraft", Some("Ctrl+Cmd+H")));
+    assert_eq!(shown(native_menu::HIDE_OTHERS), ("Hide Others", Some("Cmd+Alt+H")));
+    assert_eq!(find(&bar, "view.edges").shortcut, Some("Cmd+H"));
+    assert_eq!(bar.menu(MenuRole::Help).map(|m| m.title.as_str()), Some("Help"));
+}
+
+/// Settings ▸ lists the Preferences dialog's own pages, General… with ⌘K, and each opens the
+/// dialog on its page.
+#[test]
+fn settings_lists_every_preferences_page() {
+    let mut app = app(true);
+    let bar = bar(&app);
+    let pages = items(submenu(&bar.menus[0].children, "Settings"));
+    assert_eq!(pages.len(), PREF_CATEGORIES.len());
+    assert_eq!((pages[0].label.as_str(), pages[0].shortcut), ("General…", Some("Cmd+K")));
+    assert!(pages[1..].iter().all(|it| it.shortcut.is_none()));
+    for (it, page) in pages.iter().zip(PREF_CATEGORIES) {
+        assert_eq!((it.command, &it.params, it.label.clone()), (Some("edit.preferences"), &json!({"category": page}), format!("{page}…")));
+    }
+    let units = pages.iter().find(|it| it.source == "Units").unwrap();
+    let (id, p) = menus::click_target(units.source, units.command.unwrap(), &units.params);
+    assert_eq!(id, "edit.preferences", "a page opens the dialog, not a parameter form");
+    menus::invoke(&mut app, &id, p);
+    let dialog = app.ui.dialog.as_ref().expect("Preferences open");
+    assert_eq!((dialog.kind.as_str(), dialog.fields.get("__category")), ("preferences", Some(&json!("Units"))));
+}
+
+/// Language ▸: Automatic, then each language in its own name (in any UI language), the
+/// preference checked; Appearance ▸: the UI brightness choices, the current one checked.
+#[test]
+fn language_and_appearance_are_in_the_app_menu() {
+    let mut app = app(false);
+    app.session.prefs.interface_language = "ja".into();
+    let bar = bar(&app);
+    let app_menu = &bar.menus[0].children;
+    assert_eq!(ids(submenu(app_menu, "Language"))[..2], ["app.language", "---"], "Automatic, then the languages");
+    let langs: Vec<(String, Option<bool>)> = items(submenu(app_menu, "Language")).iter().map(|it| (it.label.clone(), it.checked)).collect();
+    let mut want = vec![("Automatic".to_string(), Some(false))];
+    want.extend(Lang::all().map(|l| (l.name().to_string(), Some(l.code() == "ja"))));
+    assert_eq!(langs, want);
+    // In every UI language the languages keep their own names.
+    for ui in Lang::all() {
+        for l in Lang::all() {
+            assert_eq!(crate::i18n::tr_id(ui, "app.language", l.name()), l.name(), "{} in {}", l.name(), ui.code());
+        }
+    }
+    let appearance: Vec<(&'static str, Option<bool>)> = items(submenu(app_menu, "Appearance")).iter().map(|it| (it.source, it.checked)).collect();
+    assert_eq!(appearance.len(), crate::theme::Brightness::ALL.len());
+    assert_eq!(appearance.iter().filter(|(_, c)| *c == Some(true)).count(), 1, "{appearance:?}");
+    assert!(appearance.iter().all(|(_, c)| c.is_some()));
+    assert_eq!(crate::i18n::tr_ctx(Lang::from_code("ja").unwrap(), "theme", "Appearance"), "外観", "the theme, not the Appearance panel");
+}
+
+/// Everything the in-window bar lists is in the Mac menu bar, once: what moved to the app menu
+/// (About, Settings, Quit, Language, UI Brightness) leaves its other places, and Join Our Discord
+/// stays under Help.
+#[test]
+fn every_in_window_item_is_in_the_mac_menu_bar_once() {
+    let app = app(true);
+    let count = |bar: &MenuBar| {
+        let mut n: HashMap<(String, String), usize> = HashMap::new();
+        for it in bar.items() {
+            if let Some(c) = it.command {
+                // Settings ▸ opens Preferences on each page: one item per page instead of one.
+                let params = if c == "edit.preferences" { String::new() } else { it.params.to_string() };
+                *n.entry((c.to_string(), params)).or_default() += 1;
+            }
+        }
+        n
+    };
+    let in_window = native_menu::from_tree(&app, &menus::menu_tree());
+    let mac = bar(&app);
+    let (a, b) = (count(&in_window), count(&mac));
+    // The in-window application menu's commands, its submenus' included.
+    let moved: Vec<&str> = MenuBar { menus: vec![in_window.menus[0].clone()] }.items().iter().filter_map(|it| it.command).collect();
+    for (key, n) in &a {
+        let m = b.get(key).copied().unwrap_or(0);
+        let want = match key.0.as_str() {
+            "edit.preferences" => PREF_CATEGORIES.len(),
+            c if moved.contains(&c) => 1,
+            _ => *n,
+        };
+        assert_eq!(m, want, "{key:?} is listed {m} times on the Mac, {n} in the window");
+    }
+    let system = [native_menu::HIDE, native_menu::HIDE_OTHERS, native_menu::MINIMIZE];
+    for key in b.keys() {
+        assert!(a.contains_key(key) || system.contains(&key.0.as_str()), "{key:?} isn't an in-window item");
+    }
+    let help = ids(menu(&mac, "Help"));
+    assert!(help.contains(&"help.discord".to_string()) && !help.contains(&"help.about".to_string()), "{help:?}");
+    let edit = ids(menu(&mac, "Edit"));
+    assert!(!edit.contains(&"edit.preferences".to_string()) && edit.contains(&"edit.keyboardShortcuts".to_string()), "{edit:?}");
+    assert!(ids(menu(&mac, "Window")).contains(&"[Workspace]".to_string()));
+}
+
+#[test]
+fn the_window_menu_has_the_system_items() {
+    let bar = bar(&app(true));
+    let window = ids(&bar.menu(MenuRole::Window).unwrap().children);
+    assert_eq!(window[..3], [native_menu::MINIMIZE.to_string(), "<Zoom>".into(), "---".into()]);
+    assert_eq!(window[window.len() - 2..], ["---".to_string(), "<BringAllToFront>".into()]);
+    assert_eq!(window[3], "window.newWindow", "then VectorCraft's own items");
+    assert_eq!(find(&bar, native_menu::MINIMIZE).shortcut, Some("Ctrl+Cmd+M"));
+    assert!(!window.iter().any(|i| i == "window.brightness"), "the theme is only in the app menu");
+    assert_eq!(Standard::Zoom.label(), "Zoom");
+}
+
+/// A system key a command already has stays the command's: the system item goes without. The
+/// user's shortcuts show in the menus.
+#[test]
+fn a_command_keeps_a_system_key_it_is_bound_to() {
+    let mut app = app(true);
+    app.ui.shortcut_overrides.insert("view.grid".into(), "Ctrl+Cmd+H".into());
+    crate::shortcut_editor::sync(&app.ui);
+    let layout = native_menu::mac_layout(&native_menu::from_tree(&app, &menus::menu_tree()), Lang::EN);
+    app.ui.shortcut_overrides.clear();
+    crate::shortcut_editor::sync(&app.ui);
+    assert_eq!(find(&layout.bar, native_menu::HIDE).shortcut, None);
+    assert_eq!(find(&layout.bar, "view.grid").shortcut, Some("Ctrl+Cmd+H"), "the user's override shows in the menu");
+    assert_eq!(layout.clashes.iter().map(|c| (c.shortcut, c.command)).collect::<Vec<_>>(), [("Ctrl+Cmd+H", "view.grid")]);
+}
+
+/// A native menu can't turn a plain item into a check item in place: opening a document or
+/// selecting must not change the menus' structure, or every change rebuilds them.
+#[test]
+fn documents_and_selections_change_state_not_structure() {
+    let empty = native_menu::structure_key(&bar(&app(false)));
+    let mut a = app(true);
+    assert_eq!(native_menu::structure_key(&bar(&a)), empty, "a document with a selected rectangle");
+    a.run("select.none", json!({})).unwrap();
+    a.run("text.create", json!({"x": 50, "y": 50, "text": "Hi"})).unwrap();
+    assert!(!a.session.active().unwrap().selection.objects.is_empty());
+    assert_eq!(native_menu::structure_key(&bar(&a)), empty, "type selected");
+    // A recent file is a new item: the menus are rebuilt.
+    crate::io::note_recent(&mut a, "/art/a.svg");
+    assert_ne!(native_menu::structure_key(&bar(&a)), empty);
+}
+
+#[test]
+fn key_equivalents_are_command_and_function_keys_only() {
+    let ok = |s| crate::shortcuts::parse(s).is_some_and(|k| native_menu::native_ok(&k));
+    assert!(ok("Cmd+B") && ok("F7") && ok("Ctrl+Cmd+M") && ok("Shift+F7"));
+    assert!(!ok("B") && !ok("Alt+F") && !ok("Shift+X"));
+}
+
+/// What a key equivalent becomes: the press and release egui's window integration sends, or for
+/// ⌘X, ⌘C and ⌘V its clipboard events (a paste's release comes from the window).
+#[test]
+fn key_equivalents_become_the_input_their_keys_make() {
+    let cmd = |key| KeyboardShortcut::new(Modifiers::COMMAND, key);
+    let key = |key, pressed| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::COMMAND };
+    assert_eq!(native_menu::key_events(cmd(Key::A), || None), [key(Key::A, true), key(Key::A, false)]);
+    assert_eq!(native_menu::key_events(cmd(Key::C), || None), [Event::Copy, key(Key::C, false)]);
+    assert_eq!(native_menu::key_events(cmd(Key::X), || None), [Event::Cut, key(Key::X, false)]);
+    assert_eq!(native_menu::key_events(cmd(Key::V), || Some("a\r\nb".into())), [Event::Paste("a\nb".into())]);
+    assert_eq!(native_menu::key_events(cmd(Key::V), || None), [], "a picture: the release tells the paste");
+}
+
+/// The fake backend: the menus the app synced, and events to report.
+#[derive(Clone, Default)]
+struct Fake(Rc<RefCell<(Vec<MenuBar>, Vec<native_menu::Event>)>>);
+
+impl Backend for Fake {
+    fn sync(&mut self, bar: &MenuBar) {
+        self.0.borrow_mut().0.push(bar.clone());
+    }
+    fn drain(&mut self) -> Vec<native_menu::Event> {
+        std::mem::take(&mut self.0.borrow_mut().1)
+    }
+}
+
+impl Fake {
+    fn synced(&self) -> usize {
+        self.0.borrow().0.len()
+    }
+    fn last(&self) -> MenuBar {
+        self.0.borrow().0.last().cloned().unwrap()
+    }
+    fn report(&self, e: native_menu::Event) {
+        self.0.borrow_mut().1.push(e);
+    }
+}
+
+/// The app with the fake native menu (or none), driven a whole frame at a time like the desktop
+/// app.
+struct Mac {
+    app: VectorcraftApp,
+    fake: Fake,
+    ctx: egui::Context,
+    time: f64,
+}
+
+impl Mac {
+    fn new(native: bool) -> Self {
+        let mut app = app(true);
+        let fake = Fake::default();
+        if native {
+            app.services.native_menu = Some(NativeMenu::new(Box::new(fake.clone())));
+        }
+        let mut m = Mac { app, fake, ctx: egui::Context::default(), time: 0.0 };
+        for _ in 0..3 {
+            m.frame(vec![]);
+        }
+        m
+    }
+
+    fn frame(&mut self, events: Vec<Event>) -> egui::FullOutput {
+        self.time += 0.1;
+        let mut raw = egui::RawInput {
+            events,
+            time: Some(self.time),
+            screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(1600.0, 850.0))),
+            ..Default::default()
+        };
+        self.app.raw_input_hook(&mut raw);
+        let app = &mut self.app;
+        let mut out = self.ctx.run_ui(raw, |ui| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        });
+        out.textures_delta.clear();
+        out
+    }
+
+    /// AppKit chose an item by its key equivalent `sc` (⌘ held).
+    fn key_equivalent(&mut self, sc: &str) -> egui::FullOutput {
+        let mut k = crate::shortcuts::parse(sc).unwrap();
+        k.modifiers.mac_cmd = k.modifiers.command;
+        self.fake.report(native_menu::Event::Key(k));
+        self.frame(vec![])
+    }
+
+    fn selected(&self) -> usize {
+        self.app.session.active().unwrap().selection.objects.len()
+    }
+}
+
+/// A key equivalent runs through the app's own key handling, once: ⌘A selects every object, ⌘Z
+/// undoes one step; and frames where nothing changed don't read the menus again.
+#[test]
+fn key_equivalents_run_through_the_normal_shortcut_path_once() {
+    let mut m = Mac::new(true);
+    m.app.run("shape.rectangle", json!({"x": 200, "y": 150, "width": 20, "height": 20})).unwrap();
+    m.app.run("select.none", json!({})).unwrap();
+    m.frame(vec![]);
+    m.key_equivalent("Cmd+A");
+    assert_eq!(m.selected(), 2, "⌘A selected every object");
+    let undo = |m: &Mac| m.app.session.active().unwrap().history.undo.len();
+    let before = undo(&m);
+    m.key_equivalent("Cmd+Z");
+    assert_eq!(undo(&m), before - 1, "⌘Z undid one step");
+    let synced = m.fake.synced();
+    assert!(synced >= 1, "the menus were built");
+    m.frame(vec![]);
+    m.frame(vec![]);
+    assert_eq!(m.fake.synced(), synced, "nothing changed: the menus weren't read again");
+    assert_eq!(crate::control::inspect(&m.app, &m.ctx)["nativeMenuBar"], json!(true));
+}
+
+/// A click runs its command like an in-window click, and the menus follow: View › Show Rulers
+/// reads Hide Rulers afterwards; the app menu's Appearance items run with their params.
+#[test]
+fn clicks_run_their_command_and_the_menus_follow() {
+    let mut m = Mac::new(true);
+    let rulers = find(&m.fake.last(), "view.rulers").clone();
+    let before = m.app.ui.view.rulers;
+    m.fake.report(native_menu::Event::Click(rulers.clone()));
+    m.frame(vec![]);
+    assert_eq!(m.app.ui.view.rulers, !before);
+    assert_ne!(find(&m.fake.last(), "view.rulers").label, rulers.label, "the label flipped");
+    let other = m.fake.last().items().into_iter().find(|it| it.command == Some("window.brightness") && it.checked == Some(false)).cloned().unwrap();
+    m.fake.report(native_menu::Event::Click(other.clone()));
+    m.frame(vec![]);
+    assert_eq!(Some(m.app.ui.brightness.id()), other.params.get("brightness").and_then(Value::as_str));
+    let now = m.fake.last().items().into_iter().find(|it| it.params == other.params).cloned().unwrap();
+    assert_eq!(now.checked, Some(true), "the checkmark moved");
+}
+
+/// With a text field focused, the menu's ⌘A and ⌘C act on the field, as the keys do without the
+/// native menu.
+#[test]
+fn a_focused_field_keeps_select_all_and_copy() {
+    let mut m = Mac::new(true);
+    let (id, rect) = m
+        .ctx
+        .viewport(|vp| vp.prev_pass.widgets.layers().flat_map(|(_, w)| w.iter()).map(|w| (w.id, w.rect)).collect::<Vec<_>>())
+        .into_iter()
+        .find(|&(id, _)| m.ctx.data(|d| d.get_temp::<String>(id)).is_some_and(|t| t == "37 pt") && egui::TextEdit::load_state(&m.ctx, id).is_some())
+        .expect("the W field");
+    let click = |pressed| Event::PointerButton { pos: rect.center(), button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+    m.frame(vec![Event::PointerMoved(rect.center()), click(true)]);
+    m.frame(vec![click(false)]);
+    m.frame(vec![Event::Key { key: Key::End, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }]);
+    assert!(m.ctx.text_edit_focused());
+    m.key_equivalent("Cmd+A");
+    let r = egui::TextEdit::load_state(&m.ctx, id).and_then(|s| s.cursor.char_range()).unwrap();
+    let (a, b): (usize, usize) = (r.primary.index.into(), r.secondary.index.into());
+    assert_eq!((a.min(b), a.max(b)), (0, 5), "⌘A selected the field's text");
+    assert_eq!(m.selected(), 1, "not the art");
+    let out = m.key_equivalent("Cmd+C");
+    let copied: Vec<_> =
+        out.platform_output.commands.iter().filter_map(|c| if let egui::OutputCommand::CopyText(t) = c { Some(t.as_str()) } else { None }).collect();
+    assert_eq!(copied, ["37 pt"]);
+    assert!(m.app.session.clipboard.is_empty(), "no art copied");
+}
+
+/// With the macOS menu bar the app bar draws no menu titles: each shows once fewer.
+#[test]
+fn the_app_bar_hides_its_menus_with_the_mac_menu_bar() {
+    let texts = |native: bool| {
+        let mut m = Mac::new(native);
+        let out = m.frame(vec![]);
+        out.shapes
+            .iter()
+            .filter_map(|s| if let egui::Shape::Text(t) = &s.shape { Some(t.galley.text().to_string()) } else { None })
+            .collect::<Vec<_>>()
+    };
+    let (in_window, native) = (texts(false), texts(true));
+    for (title, _) in menus::menu_tree().iter().skip(1) {
+        let n = |t: &[String]| t.iter().filter(|s| s == title).count();
+        assert_eq!(n(&native) + 1, n(&in_window), "{title}");
+    }
+}

crates/ui-egui/src/tests_numfields.rs

@@ -132,6 +132,31 @@ fn plain_fields_do_math_with_their_suffix() {
     assert_eq!(f.frame(vec![enter()], &draw), Some(90.0));
 }
 
+/// Preferences › Units › Numbers Without Units Are Points (#394): on (the default), a number typed
+/// with no unit into a field in picas is read in points; a typed unit still wins (`2p6`, `1in`);
+/// off, it is in picas. A field in any other unit reads it in its unit either way.
+#[test]
+fn bare_numbers_in_picas_fields_are_points_when_the_preference_says_so() {
+    let mut f = Field::new();
+    let typed = |f: &mut Field, u: Unit, text: &str| {
+        let pt = Cell::new(u.to_pt(4.0));
+        let draw = |ui: &mut egui::Ui| widgets::num_field(ui, "f", Some(pt.get()), u, 80.0).inspect(|&v| pt.set(v));
+        f.frame(vec![], &draw);
+        f.frame(f.click(1), &draw);
+        f.frame(vec![Event::Text(text.into())], &draw);
+        f.frame(vec![enter()], &draw)
+    };
+    let (pc, mm) = (Unit::Picas, Unit::Millimeters);
+    assert_eq!(typed(&mut f, pc, "12"), Some(12.0), "on by default: points in a picas field");
+    assert_eq!(typed(&mut f, pc, "2p6"), Some(30.0), "picas and points as typed");
+    assert_eq!(typed(&mut f, pc, "1in"), Some(72.0), "a typed unit wins");
+    assert_eq!(typed(&mut f, pc, "10+5"), Some(15.0), "arithmetic in points too");
+    assert_eq!(typed(&mut f, mm, "12"), Some(mm.to_pt(12.0)), "a millimetre field keeps millimetres");
+    widgets::set_bare_numbers_are_points(&f.ctx, false);
+    assert_eq!(typed(&mut f, pc, "12"), Some(pc.to_pt(12.0)), "off: picas");
+    assert_eq!(typed(&mut f, mm, "12"), Some(mm.to_pt(12.0)));
+}
+
 /// ↑/↓ step a focused numeric field by one of its unit (Shift: ten, Ctrl/Cmd: a tenth) and apply it
 /// at once, the new value selected so typing replaces it; an unfocused field leaves the arrows to
 /// the canvas (nudge).

crates/ui-egui/src/tests_removeanchors.rs

@@ -205,3 +205,26 @@ fn the_control_bar_converts_connects_and_cuts_selected_anchors() {
     assert!(app.session.active().unwrap().doc.node(id).unwrap().path_data().unwrap().subpaths[0].closed);
     assert_eq!(anchor_count(&app, id), 4, "the coincident ends merge");
 }
+
+/// #504: with a tool that edits anchors (Direct Selection, the Pen…), a path selected as a whole
+/// shows all its anchors selected, and the Control bar and the Properties panel offer to convert
+/// them; removing and cutting wait for anchors direct-selected. The Selection tool shows neither.
+#[test]
+fn a_whole_path_converts_with_the_tools_that_edit_anchors() {
+    let mut app = app();
+    let id = rect(&mut app);
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    app.select_tool("selection");
+    assert!(!has(&control_frame(&mut app, &ctx, vec![]), "Convert:"));
+    for tool in ["directSelection", "pen"] {
+        app.select_tool(tool);
+        let texts = control_frame(&mut app, &ctx, vec![]);
+        assert!(has(&texts, "Convert:") && !has(&texts, "Anchors:"), "{tool}: {texts:?}");
+        let props = crate::tests_labels::painted_text(&mut app, crate::panels::properties::show);
+        assert!(props.contains("Convert:") && !props.contains("Anchors:"), "{tool}: {props}");
+    }
+    click_button(&mut app, &ctx, "Convert:", 1);
+    let sp = app.session.active().unwrap().doc.node(id).unwrap().path_data().unwrap().subpaths[0].clone();
+    assert!(sp.anchors.iter().all(|a| a.has_in() && a.has_out()), "every corner made smooth: {sp:?}");
+}

crates/ui-egui/src/tests_save.rs

@@ -107,7 +107,7 @@ fn recent_files_show_as_many_as_the_preference_keeps() {
     assert!(menus::enabled(&app, "file.openRecent30"));
     app.session.prefs.recent_files_count = 0;
     assert_eq!((io::recent_files(&app).len(), listed(&app)), (0, 0), "0 hides the list");
-    assert_eq!(menus::listed_slots(&app), 0, "the native menu rebuilds without them");
+    assert!(menus::shown_state(&app, "file.openRecent1", &json!(null)).is_none(), "the slots leave the menus");
     assert!(app.run("file.openRecent1", json!({})).is_err());
     app.session.prefs.recent_files_count = 5;
     assert_eq!(io::recent_files(&app)[0], "/art/34.svg", "hiding them didn't forget them");

crates/ui-egui/src/tests_selectall.rs

@@ -171,3 +171,94 @@ fn cmd_a_on_the_canvas_selects_all_objects() {
     a.menu("select.all");
     assert_eq!(a.selected(), 2, "so does the menu's Select All");
 }
+
+/// The copied texts of a frame's output.
+fn copied(out: &egui::FullOutput) -> Vec<String> {
+    out.platform_output.commands.iter().filter_map(|c| if let egui::OutputCommand::CopyText(t) = c { Some(t.clone()) } else { None }).collect()
+}
+
+/// #516: Ctrl/Cmd+C, X and V in a focused field (the window's own clipboard keys, which egui sends
+/// as Copy, Cut and Paste events) edit the field's text, never the art.
+#[test]
+fn the_clipboard_keys_in_a_focused_field_edit_its_text() {
+    let mut a = App::new();
+    a.app.run("window.panel", json!({"panel": "color"})).unwrap();
+    for _ in 0..3 {
+        a.frame(vec![]);
+    }
+    for text in ["37 pt", "FFFFFF"] {
+        let (id, rect) = a.field(text);
+        a.frame(vec![Event::PointerMoved(rect.center()), click(rect.center(), true)]);
+        a.frame(vec![click(rect.center(), false)]);
+        a.frame(vec![press(Key::A, Modifiers::COMMAND)]);
+        assert!(a.ctx.memory(|m| m.has_focus(id)), "{text}: the field has the keyboard");
+        let out = a.frame(vec![Event::Copy]);
+        assert_eq!(copied(&out), [text], "Copy copies the field's text");
+        assert!(a.app.session.clipboard.is_empty(), "{text}: no art copied");
+        let out = a.frame(vec![Event::Cut]);
+        assert_eq!(copied(&out), [text], "Cut cuts the field's text");
+        a.frame(vec![Event::Paste("12".into())]);
+        assert_eq!(a.ctx.data(|d| d.get_temp::<String>(id)).as_deref(), Some("12"), "Paste pastes into the field");
+        assert_eq!(a.selected(), 1, "{text}: the art stays");
+        a.frame(vec![press(Key::Escape, Modifiers::NONE)]);
+    }
+}
+
+/// The centre of the text `label` painted last (in the topmost layer) in a frame's output; with
+/// `title`, the first one painted (the menu bar's).
+fn text_at(out: &egui::FullOutput, label: &str, title: bool) -> Pos2 {
+    let mut shapes: Box<dyn Iterator<Item = _>> = if title { Box::new(out.shapes.iter()) } else { Box::new(out.shapes.iter().rev()) };
+    shapes
+        .find_map(|s| match &s.shape {
+            egui::Shape::Text(t) if t.galley.text().trim() == label => Some(Rect::from_min_size(t.pos, t.galley.size()).center()),
+            _ => None,
+        })
+        .unwrap_or_else(|| panic!("no {label:?} painted"))
+}
+
+/// A click on `at` → the frame after it.
+fn click_at(a: &mut App, at: Pos2) -> egui::FullOutput {
+    a.frame(vec![Event::PointerMoved(at), click(at, true)]);
+    a.frame(vec![click(at, false)]);
+    a.frame(vec![])
+}
+
+/// The in-window menus' Select › All, Edit › Copy and Edit › Paste act on the text field that had the keyboard
+/// when the menu was opened (the click on the menu took it), and give it the keyboard back.
+#[test]
+fn the_in_window_edit_menu_acts_on_the_field_it_was_opened_from() {
+    let mut a = App::new();
+    // Text on the system clipboard.
+    a.app.services.clipboard_read = Some(Box::new(|| Some("42 pt".into())));
+    let (id, rect) = a.field("37 pt");
+    a.frame(vec![Event::PointerMoved(rect.center()), click(rect.center(), true)]);
+    a.frame(vec![click(rect.center(), false)]);
+    let out = a.frame(vec![press(Key::End, Modifiers::NONE)]);
+    let (edit, select) = (text_at(&out, "Edit", true), text_at(&out, "Select", true));
+    let menu = |a: &mut App, title: Pos2, item: &str| {
+        let out = click_at(a, title);
+        assert!(!a.ctx.text_edit_focused(), "the menu took the keyboard");
+        click_at(a, text_at(&out, item, false))
+    };
+    menu(&mut a, select, "All");
+    assert!(a.ctx.memory(|m| m.has_focus(id)), "the field has the keyboard back");
+    assert_eq!(a.field_selection(id), Some((0, 5)), "Select All selected the field's text");
+    assert_eq!(a.selected(), 1, "not the art");
+    a.frame(vec![press(Key::End, Modifiers::NONE)]);
+    a.frame(vec![press(Key::A, Modifiers::COMMAND)]);
+    a.frame(vec![]);
+    let out = menu(&mut a, edit, "Copy");
+    assert_eq!(copied(&out), ["37 pt"], "Copy copied the field's text");
+    assert!(a.app.session.clipboard.is_empty(), "no art copied");
+    // Art on the app's clipboard (Paste is enabled): the field still takes the text.
+    a.app.run("edit.copy", json!({})).unwrap();
+    a.frame(vec![press(Key::A, Modifiers::COMMAND)]);
+    menu(&mut a, edit, "Paste");
+    assert_eq!(a.ctx.data(|d| d.get_temp::<String>(id)).as_deref(), Some("42 pt"), "Paste pasted into the field");
+    assert_eq!(a.selected(), 1, "nothing pasted on the canvas");
+    // With no field focused, the menu's Select All selects the art.
+    a.frame(vec![press(Key::Escape, Modifiers::NONE)]);
+    a.frame(vec![]);
+    menu(&mut a, select, "All");
+    assert_eq!(a.selected(), 2);
+}

crates/ui-egui/src/tests_sysclip.rs

@@ -66,7 +66,7 @@ pub(super) fn run(app: &mut VectorcraftApp, id: &str, p: Value) -> Value {
     app.run(id, p).unwrap_or_else(|e| panic!("{id}: {e}"))
 }
 
-fn copy_rect(app: &mut VectorcraftApp) {
+pub(super) fn copy_rect(app: &mut VectorcraftApp) {
     let id = run(app, "shape.rectangle", json!({"x": 10, "y": 10, "width": 40, "height": 20}))["id"].clone();
     run(app, "paint.setFill", json!({"color": "#ff0000"}));
     run(app, "select.set", json!({"ids": [id]}));

crates/ui-egui/src/tests_sysclip_probe.rs

@@ -0,0 +1,156 @@
+//! The system clipboard is checked for Paste off the UI thread where the host installs a probe
+//! (Linux): an X11 clipboard owner that never answers used to block the frame loop for seconds, so
+//! the window stopped drawing and could not even be closed. The in-line check (no probe: the web,
+//! Windows, macOS) is covered by `tests_clipboard` and `tests_sysclip`.
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use serde_json::json;
+use vectorcraft_engine::Session;
+use vectorcraft_engine::cmd::clipboard::Flavour;
+
+use crate::tests_sysclip::{copy_rect, run};
+use crate::{Services, SystemClipboard, VectorcraftApp, menus};
+
+/// What the clipboard handles saw: the thread each `has()` ran on, and how many handles are alive.
+#[derive(Default)]
+struct Recorder {
+    threads: Mutex<Vec<Option<String>>>,
+    alive: AtomicUsize,
+}
+
+impl Recorder {
+    fn looks(&self) -> usize {
+        self.threads.lock().unwrap().len()
+    }
+}
+
+/// A system clipboard whose `has()` takes `delay` (an owner slow to answer) and answers `verdict`,
+/// or panics without one (a bug in the platform code).
+struct Slow {
+    rec: Arc<Recorder>,
+    delay: Duration,
+    verdict: Option<bool>,
+}
+
+impl Slow {
+    fn boxed(rec: &Arc<Recorder>, delay: Duration, verdict: Option<bool>) -> Box<dyn SystemClipboard> {
+        rec.alive.fetch_add(1, Ordering::SeqCst);
+        Box::new(Self { rec: Arc::clone(rec), delay, verdict })
+    }
+}
+
+impl Drop for Slow {
+    fn drop(&mut self) {
+        self.rec.alive.fetch_sub(1, Ordering::SeqCst);
+    }
+}
+
+impl SystemClipboard for Slow {
+    fn write(&mut self, _flavours: &[Flavour]) -> Result<(), String> {
+        Ok(())
+    }
+    fn holds_ours(&mut self) -> bool {
+        false
+    }
+    fn read(&mut self, _mimes: &[&'static str]) -> Option<Flavour> {
+        None
+    }
+    fn has(&mut self, _mimes: &[&'static str]) -> bool {
+        self.rec.threads.lock().unwrap().push(std::thread::current().name().map(str::to_owned));
+        std::thread::sleep(self.delay);
+        self.verdict.expect("the clipboard failed")
+    }
+}
+
+/// An app whose two clipboard handles record into `rec`: the UI's says `inline`, the probe's
+/// `probe`, each after `delay`.
+fn app(rec: &Arc<Recorder>, delay: Duration, inline: bool, probe: Option<bool>) -> VectorcraftApp {
+    let make = {
+        let rec = Arc::clone(rec);
+        move || Slow::boxed(&rec, delay, probe)
+    };
+    let services =
+        Services { system_clipboard: Some(Slow::boxed(rec, delay, Some(inline))), clipboard_probe: Some(Box::new(make)), ..Default::default() };
+    VectorcraftApp::new(Session::new(), services)
+}
+
+/// One headless frame of app logic in the test's one context (a new one would restart the fonts),
+/// half a second after the last: past the in-line check's throttle, so it would run every frame.
+fn frame(app: &mut VectorcraftApp) {
+    thread_local! {
+        static CTX: egui::Context = egui::Context::default();
+        static NOW: std::cell::Cell<f64> = const { std::cell::Cell::new(0.0) };
+    }
+    let time = NOW.with(|t| {
+        t.set(t.get() + 0.5);
+        t.get()
+    });
+    let input = egui::RawInput { time: Some(time), ..Default::default() };
+    CTX.with(|ctx| ctx.run_ui(input, |ui| app.logic(ui.ctx())).textures_delta.clear());
+}
+
+/// Frames for `wait`, or until `done` holds; whether it does.
+fn frames_until(app: &mut VectorcraftApp, wait: Duration, done: impl Fn(&VectorcraftApp) -> bool) -> bool {
+    let end = Instant::now() + wait;
+    loop {
+        frame(app);
+        if done(app) || Instant::now() > end {
+            return done(app);
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}
+
+#[test]
+fn a_slow_clipboard_is_read_off_the_ui_thread() {
+    let rec = Arc::new(Recorder::default());
+    let mut app = app(&rec, Duration::from_secs(1), false, Some(true));
+    // The first frames install the UI fonts. Without a document Paste is off whatever the clipboard
+    // holds: nobody looks.
+    assert!(!frames_until(&mut app, Duration::from_millis(100), |_| rec.looks() > 0));
+    run(&mut app, "file.new", json!({"width": 100, "height": 100}));
+    frame(&mut app);
+    let t0 = Instant::now();
+    frame(&mut app);
+    assert!(t0.elapsed() < Duration::from_millis(300), "the frame waited on the clipboard: {:?}", t0.elapsed());
+    // The probe's verdict (the UI's own handle would say no) enables Paste once it arrives.
+    assert!(frames_until(&mut app, Duration::from_secs(3), |app| app.system_paste), "the probe's verdict never arrived");
+    assert!(menus::enabled(&app, "edit.paste"));
+    let threads = rec.threads.lock().unwrap().clone();
+    assert!(threads.iter().all(|n| n.as_deref() == Some("vectorcraft-clip")), "checked on: {threads:?}");
+}
+
+#[test]
+fn the_probe_rests_after_a_copy_and_stops_with_the_app() {
+    let rec = Arc::new(Recorder::default());
+    let mut app = app(&rec, Duration::ZERO, false, Some(true));
+    run(&mut app, "file.new", json!({"width": 100, "height": 100}));
+    assert!(frames_until(&mut app, Duration::from_secs(2), |app| app.system_paste));
+    // Something copied in the app enables Paste alone: the clipboard isn't read any more.
+    copy_rect(&mut app);
+    frames_until(&mut app, Duration::from_millis(50), |_| false);
+    let looks = rec.looks();
+    frames_until(&mut app, Duration::from_millis(600), |_| false);
+    assert_eq!(rec.looks(), looks);
+    assert!(!app.system_paste && menus::enabled(&app, "edit.paste"));
+    // Quitting waits until the probe's thread has let go of its handle: on X11 the last handle
+    // alive hands what the app copied to the clipboard manager.
+    assert_eq!(rec.alive.load(Ordering::SeqCst), 2);
+    drop(app);
+    assert_eq!(rec.alive.load(Ordering::SeqCst), 0, "the probe's thread kept its clipboard");
+}
+
+#[test]
+fn without_its_thread_the_check_runs_in_line_again() {
+    let rec = Arc::new(Recorder::default());
+    // The probe's clipboard panics: its thread ends.
+    let mut app = app(&rec, Duration::ZERO, true, None);
+    run(&mut app, "file.new", json!({"width": 100, "height": 100}));
+    assert!(frames_until(&mut app, Duration::from_secs(2), |app| app.system_paste), "no fallback");
+    assert!(app.clipboard_probe.is_none());
+    let threads = rec.threads.lock().unwrap().clone();
+    assert_eq!(threads.first().cloned().flatten().as_deref(), Some("vectorcraft-clip"), "{threads:?}");
+}

crates/ui-egui/src/toolbar.rs

@@ -89,148 +89,170 @@ pub fn remember(app: &mut VectorcraftApp, id: &str) {
 
 pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
-    let all = slots(app);
     // The user's choice alone: a window too short for the tools scrolls them.
     let cols = if app.ui.toolbar_double { 2 } else { 1 };
     let w = if cols == 2 { 76.0 } else { WIDTH };
-    egui::Panel::left("toolbar")
-        .resizable(false)
-        .exact_size(w)
-        .frame(egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 0, right: 0, top: 0, bottom: 4 }).stroke(Stroke::new(1.5, t.border)))
-        .show(ui, |ui| {
-            ui.spacing_mut().item_spacing = vec2(0.0, 0.0);
-            // Dock header with » and a grip strip.
-            let (hdr, hresp) = ui.allocate_exact_size(vec2(ui.available_width(), 14.0), Sense::click());
-            ui.painter().rect_filled(hdr, 0.0, t.tab_strip);
-            icons::paint(
-                ui,
-                if cols == 2 { "chevrons-left" } else { "chevrons-right" },
-                egui::Rect::from_min_size(hdr.left_top() + vec2(3.0, 2.0), vec2(10.0, 10.0)),
-                if hresp.hovered() { t.text_strong } else { t.text },
-            );
-            if hresp.on_hover_text(tl!("Toggle single/double column")).clicked()
-                // It only fails on bad params, which this never sends; show it all the same.
-                && let Err(e) = app.run("window.toolbarColumns", json!({ "double": cols == 1 }))
-            {
-                app.ui.status = e;
-            }
-            let (grip, _) = ui.allocate_exact_size(vec2(ui.available_width(), 6.0), Sense::hover());
-            for k in 0..6 {
-                ui.painter().line_segment(
-                    [pos2(grip.center().x - 9.0, grip.top() + 1.5 + k as f32 * 0.6), pos2(grip.center().x + 9.0, grip.top() + 1.5 + k as f32 * 0.6)],
-                    Stroke::new(0.4, t.text_disabled),
-                );
-            }
-            // The tools and the controls under them scroll in a window too short for them.
-            widgets::strip_scroll(ui, "toolbar", |ui| {
-                let active = app.session.tool_id();
-                // The tool button whose long press opened its flyout, until the next press.
-                let held_id = egui::Id::new("toolbar-held");
-                if ui.input(|inp| inp.pointer.any_pressed()) {
-                    ui.data_mut(|d| d.remove::<egui::Id>(held_id));
-                }
-                let held: Option<egui::Id> = ui.data(|d| d.get_temp(held_id));
-                let mut open_flyout: Option<(Vec<&'static str>, egui::Rect)> = None;
-                // A group torn off into a floating flyout is raised instead of opening its flyout.
-                let mut raise: Option<&'static str> = None;
-                let mut i = 0;
-                while i < all.len() {
-                    if let Some(cat) = all[i].0 {
-                        let (r, _) = ui.allocate_exact_size(vec2(ui.available_width(), 18.0), Sense::hover());
-                        // A long name is cut to its first four characters in the single column.
-                        let cat = tl!(cat);
-                        let label = if cols == 1 && cat.chars().count() > 6 {
-                            format!("{}...", cat.chars().take(4).collect::<String>())
-                        } else {
-                            cat.to_string()
-                        };
-                        ui.painter().text(r.center() + vec2(0.0, 2.0), egui::Align2::CENTER_CENTER, label, egui::FontId::proportional(11.0), t.text);
-                    }
-                    // One row = `cols` slots (a category label always starts a new row).
-                    let mut row = vec![i];
-                    while row.len() < cols && i + row.len() < all.len() && all[i + row.len()].0.is_none() {
-                        row.push(i + row.len());
-                    }
-                    ui.horizontal(|ui| {
-                        ui.spacing_mut().item_spacing.x = 0.0;
-                        if cols == 1 {
-                            ui.add_space((WIDTH - 36.0) / 2.0);
-                        } else {
-                            ui.add_space(2.0);
-                        }
-                        for &k in &row {
-                            let slot = &all[k].1;
-                            let shown_id = if slot.contains(&active) {
-                                active.to_string()
-                            } else {
-                                app.ui.slot_tool.get(slot[0]).cloned().unwrap_or_else(|| slot[0].to_string())
-                            };
-                            let Some(shown) = tool_info(&shown_id).or_else(|| tool_info(slot[0])) else { continue };
-                            let is_active = slot.contains(&active);
-                            let (rect, resp) = ui.allocate_exact_size(vec2(36.0, PITCH - 1.0), Sense::click_and_drag());
-                            let well = egui::Rect::from_center_size(rect.center(), vec2(35.5, 27.5));
-                            if is_active {
-                                ui.painter().rect_filled(well, CornerRadius::same(1), t.tool_active);
-                            } else if resp.hovered() {
-                                ui.painter().rect_filled(well, CornerRadius::same(1), t.hover);
-                            }
-                            let ir = egui::Rect::from_center_size(rect.center(), vec2(18.0, 18.0));
-                            icons::paint(ui, icons::tool_icon(shown.icon), ir, if is_active { t.text_strong } else { t.icon });
-                            if slot.len() > 1 {
-                                let c = rect.center() + vec2(12.5, 10.0);
-                                ui.painter().add(egui::Shape::convex_polygon(
-                                    vec![c, c + vec2(-3.5, 0.0), c + vec2(0.0, -3.5)],
-                                    t.icon,
-                                    Stroke::NONE,
-                                ));
-                            }
-                            let press = if slot.len() > 1 { flyout_press(ui, &resp, rect) } else { None };
-                            let alt = ui.input(|inp| inp.modifiers.alt);
-                            if press.is_some() {
-                                if is_floating(app, slot[0]) {
-                                    raise = Some(slot[0]);
-                                } else {
-                                    open_flyout = Some((slot.clone(), rect));
-                                }
-                                if press == Some(FlyoutPress::Primary) {
-                                    ui.data_mut(|d| d.insert_temp(held_id, resp.id));
-                                }
-                            } else if resp.clicked() && held == Some(resp.id) {
-                                // Releasing the long press that opened the flyout leaves it open.
-                            } else if resp.clicked() && alt && slot.len() > 1 {
-                                let idx = slot.iter().position(|x| *x == shown.id).unwrap_or(0);
-                                app.select_tool(slot[(idx + 1) % slot.len()]);
-                            } else if resp.double_clicked() {
-                                app.select_tool(shown.id);
-                                app.run("tool.options", json!({ "tool": shown.id })).ok();
-                            } else if resp.clicked() {
-                                app.select_tool(shown.id);
-                            }
-                            resp.on_hover_text(tip(shown));
-                        }
-                    });
-                    i += row.len();
-                }
-                if let Some(key) = raise {
-                    raise_floating(ui.ctx(), key);
-                }
-                if let Some((slot, rect)) = open_flyout {
-                    app.ui.flyout = Some(0);
-                    ui.data_mut(|d| {
-                        d.insert_temp(egui::Id::new("flyout-anchor"), rect);
-                        d.insert_temp(egui::Id::new("flyout-tools"), slot.iter().map(|s| s.to_string()).collect::<Vec<String>>());
-                    });
-                }
-                ui.add_space(8.0);
-                bottom_controls(app, ui, &t);
+    // Where the panel docks: along the window's left edge, under the bars.
+    let edge = ui.available_rect_before_wrap();
+    ui.ctx().data_mut(|d| d.insert_temp(crate::floating::tools_zone_id(), egui::Rect::from_min_size(edge.min, vec2(WIDTH, edge.height()))));
+    let frame =
+        egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 0, right: 0, top: 0, bottom: 4 }).stroke(Stroke::new(1.5, t.border));
+    match app.ui.toolbar_pos {
+        None => {
+            egui::Panel::left("toolbar").resizable(false).exact_size(w).frame(frame).show(ui, |ui| body(app, ui, cols, None));
+        }
+        Some(pos) => {
+            // Floating, kept inside the window, its tools scrolling when they don't fit under it.
+            let ctx = ui.ctx().clone();
+            let id = egui::Id::new("toolbar-floating");
+            let screen = ctx.content_rect();
+            // Kept on screen by its title bar and first tools: the rest scrolls.
+            let size = ctx.memory(|m| m.area_rect(id)).map_or(vec2(w, 160.0), |r| vec2(r.width(), r.height().min(160.0)));
+            let at = crate::floating::clamp(pos, size, screen);
+            egui::Area::new(id).order(egui::Order::Middle).fixed_pos(at).show(&ctx, |ui| {
+                flyout_frame(&t, false).inner_margin(egui::Margin { left: 0, right: 0, top: 0, bottom: 4 }).show(ui, |ui| {
+                    ui.set_width(w);
+                    ui.set_max_height(screen.bottom() - at.y - 12.0);
+                    body(app, ui, cols, Some(at));
+                });
             });
-        });
+        }
+    }
     // Before the flyout: one torn off this frame floats from the next (its bar mustn't be in two
     // layers in one frame).
     floating(app, ui.ctx());
     flyout(app, ui.ctx());
 }
 
+/// The Tools panel's contents, docked or floating at `floating`.
+fn body(app: &mut VectorcraftApp, ui: &mut Ui, cols: usize, floating: Option<egui::Pos2>) {
+    let t = Tokens::get(ui.ctx());
+    let all = slots(app);
+    let bounds = ui.max_rect();
+    ui.spacing_mut().item_spacing = vec2(0.0, 0.0);
+    // Title bar with » and a grip strip: a drag on either floats the panel or moves it.
+    let (hdr, hresp) = ui.allocate_exact_size(vec2(ui.available_width(), 14.0), Sense::click_and_drag());
+    ui.painter().rect_filled(hdr, 0.0, t.tab_strip);
+    icons::paint(
+        ui,
+        if cols == 2 { "chevrons-left" } else { "chevrons-right" },
+        egui::Rect::from_min_size(hdr.left_top() + vec2(3.0, 2.0), vec2(10.0, 10.0)),
+        if hresp.hovered() { t.text_strong } else { t.text },
+    );
+    let (grip, gresp) = ui.allocate_exact_size(vec2(ui.available_width(), 6.0), Sense::drag());
+    for k in 0..6 {
+        ui.painter().line_segment(
+            [pos2(grip.center().x - 9.0, grip.top() + 1.5 + k as f32 * 0.6), pos2(grip.center().x + 9.0, grip.top() + 1.5 + k as f32 * 0.6)],
+            Stroke::new(0.4, t.text_disabled),
+        );
+    }
+    crate::floating::drag_tools(app, ui.ctx(), &hresp.union(gresp.clone()), bounds, floating);
+    if hresp.on_hover_text(tl!("Toggle single/double column")).clicked()
+        // It only fails on bad params, which this never sends; show it all the same.
+        && let Err(e) = app.run("window.toolbarColumns", json!({ "double": cols == 1 }))
+    {
+        app.ui.status = e;
+    }
+    let grip_tip = if floating.is_some() { tl!("Drag to the window's left edge to dock") } else { tl!("Drag to float the toolbar") };
+    gresp.on_hover_cursor(egui::CursorIcon::Grab).on_hover_text(grip_tip);
+    // The tools and the controls under them scroll in a window too short for them.
+    widgets::strip_scroll(ui, "toolbar", |ui| {
+        let active = app.session.tool_id();
+        // The tool button whose long press opened its flyout, until the next press.
+        let held_id = egui::Id::new("toolbar-held");
+        if ui.input(|inp| inp.pointer.any_pressed()) {
+            ui.data_mut(|d| d.remove::<egui::Id>(held_id));
+        }
+        let held: Option<egui::Id> = ui.data(|d| d.get_temp(held_id));
+        let mut open_flyout: Option<(Vec<&'static str>, egui::Rect)> = None;
+        // A group torn off into a floating flyout is raised instead of opening its flyout.
+        let mut raise: Option<&'static str> = None;
+        let mut i = 0;
+        while i < all.len() {
+            if let Some(cat) = all[i].0 {
+                let (r, _) = ui.allocate_exact_size(vec2(ui.available_width(), 18.0), Sense::hover());
+                // A long name is cut to its first four characters in the single column.
+                let cat = tl!(cat);
+                let label =
+                    if cols == 1 && cat.chars().count() > 6 { format!("{}...", cat.chars().take(4).collect::<String>()) } else { cat.to_string() };
+                ui.painter().text(r.center() + vec2(0.0, 2.0), egui::Align2::CENTER_CENTER, label, egui::FontId::proportional(11.0), t.text);
+            }
+            // One row = `cols` slots (a category label always starts a new row).
+            let mut row = vec![i];
+            while row.len() < cols && i + row.len() < all.len() && all[i + row.len()].0.is_none() {
+                row.push(i + row.len());
+            }
+            ui.horizontal(|ui| {
+                ui.spacing_mut().item_spacing.x = 0.0;
+                if cols == 1 {
+                    ui.add_space((WIDTH - 36.0) / 2.0);
+                } else {
+                    ui.add_space(2.0);
+                }
+                for &k in &row {
+                    let slot = &all[k].1;
+                    let shown_id = if slot.contains(&active) {
+                        active.to_string()
+                    } else {
+                        app.ui.slot_tool.get(slot[0]).cloned().unwrap_or_else(|| slot[0].to_string())
+                    };
+                    let Some(shown) = tool_info(&shown_id).or_else(|| tool_info(slot[0])) else { continue };
+                    let is_active = slot.contains(&active);
+                    let (rect, resp) = ui.allocate_exact_size(vec2(36.0, PITCH - 1.0), Sense::click_and_drag());
+                    let well = egui::Rect::from_center_size(rect.center(), vec2(35.5, 27.5));
+                    if is_active {
+                        ui.painter().rect_filled(well, CornerRadius::same(1), t.tool_active);
+                    } else if resp.hovered() {
+                        ui.painter().rect_filled(well, CornerRadius::same(1), t.hover);
+                    }
+                    let ir = egui::Rect::from_center_size(rect.center(), vec2(18.0, 18.0));
+                    icons::paint(ui, icons::tool_icon(shown.icon), ir, if is_active { t.text_strong } else { t.icon });
+                    if slot.len() > 1 {
+                        let c = rect.center() + vec2(12.5, 10.0);
+                        ui.painter().add(egui::Shape::convex_polygon(vec![c, c + vec2(-3.5, 0.0), c + vec2(0.0, -3.5)], t.icon, Stroke::NONE));
+                    }
+                    let press = if slot.len() > 1 { flyout_press(ui, &resp, rect) } else { None };
+                    let alt = ui.input(|inp| inp.modifiers.alt);
+                    if press.is_some() {
+                        if is_floating(app, slot[0]) {
+                            raise = Some(slot[0]);
+                        } else {
+                            open_flyout = Some((slot.clone(), rect));
+                        }
+                        if press == Some(FlyoutPress::Primary) {
+                            ui.data_mut(|d| d.insert_temp(held_id, resp.id));
+                        }
+                    } else if resp.clicked() && held == Some(resp.id) {
+                        // Releasing the long press that opened the flyout leaves it open.
+                    } else if resp.clicked() && alt && slot.len() > 1 {
+                        let idx = slot.iter().position(|x| *x == shown.id).unwrap_or(0);
+                        app.select_tool(slot[(idx + 1) % slot.len()]);
+                    } else if resp.double_clicked() {
+                        app.select_tool(shown.id);
+                        app.run("tool.options", json!({ "tool": shown.id })).ok();
+                    } else if resp.clicked() {
+                        app.select_tool(shown.id);
+                    }
+                    resp.on_hover_text(tip(shown));
+                }
+            });
+            i += row.len();
+        }
+        if let Some(key) = raise {
+            raise_floating(ui.ctx(), key);
+        }
+        if let Some((slot, rect)) = open_flyout {
+            app.ui.flyout = Some(0);
+            ui.data_mut(|d| {
+                d.insert_temp(egui::Id::new("flyout-anchor"), rect);
+                d.insert_temp(egui::Id::new("flyout-tools"), slot.iter().map(|s| s.to_string()).collect::<Vec<String>>());
+            });
+        }
+        ui.add_space(8.0);
+        bottom_controls(app, ui, &t);
+    });
+}
+
 /// How a press on a tool group's button opens its flyout.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 enum FlyoutPress {
@@ -278,7 +300,7 @@ pub fn open_options(app: &mut VectorcraftApp, tool: &str) -> Result<serde_json::
         "hand" => app.run("view.fitArtboard", json!({})),
         "zoom" => app.run("view.actualSize", json!({})),
         "rotate" | "scale" | "reflect" | "shear" | "selection" | "directSelection" | "groupSelection" => {
-            let dialog = if crate::canvas::is_selection_tool(tool) { "move" } else { tool };
+            let dialog = if vectorcraft_tools::catalog::is_selection_tool(tool) { "move" } else { tool };
             let id = format!("object.{dialog}");
             if let Some(c) = vectorcraft_engine::find_command(&id) {
                 (c.enabled)(&app.session)?;
@@ -631,9 +653,7 @@ fn floating(app: &mut VectorcraftApp, ctx: &egui::Context) {
         }
         // Kept on screen (a smaller window, or a position saved on a bigger one).
         let size = ctx.memory(|m| m.area_rect(id)).map_or(vec2(strip_width(&f.tools), PITCH), |r| r.size());
-        let [x, y] = f.pos;
-        let (x, y) = if x.is_finite() && y.is_finite() { (x, y) } else { (screen.left() + 60.0, screen.top() + 100.0) };
-        let pos = pos2(x.min(screen.right() - size.x).max(screen.left()), y.min(screen.bottom() - size.y).max(screen.top()));
+        let pos = crate::floating::clamp(f.pos, size, screen);
         let mut input = FlyoutInput::default();
         egui::Area::new(id).order(egui::Order::Middle).fixed_pos(pos).show(ctx, |ui| {
             flyout_frame(&t, flash).show(ui, |ui| input = flyout_body(ui, &t, active, &f.tools, true));

crates/ui-egui/src/widgets.rs

@@ -9,8 +9,15 @@ use crate::{icons, scrub};
 
 /// Square icon button; `selected` draws the pressed well.
 pub fn icon_button(ui: &mut Ui, icon: &str, tip: &str, selected: bool, size: f32) -> Response {
+    let (_, resp) = ui.allocate_exact_size(Vec2::splat(size), Sense::click());
+    paint_icon_button(ui, resp, icon, tip, selected)
+}
+
+/// [`icon_button`] drawn for a response the caller made (its own id or sense).
+pub fn paint_icon_button(ui: &mut Ui, resp: Response, icon: &str, tip: &str, selected: bool) -> Response {
     let t = Tokens::get(ui.ctx());
-    let (rect, resp) = ui.allocate_exact_size(Vec2::splat(size), Sense::click());
+    let rect = resp.rect;
+    let size = rect.width();
     let bg = if selected {
         t.tool_active
     } else if resp.hovered() {
@@ -146,8 +153,24 @@ pub fn dim_name(ui: &mut Ui, text: &str) -> Response {
     ui.label(egui::RichText::new(text).color(t.text).size(12.5))
 }
 
+/// Preferences › Units › Numbers Without Units Are Points (#394; on until set): the app sets it
+/// when the preference changes (`prefs_dialog::apply_runtime`), the length fields read it.
+pub(crate) fn set_bare_numbers_are_points(ctx: &egui::Context, on: bool) {
+    ctx.data_mut(|d| d.insert_temp(egui::Id::new("bare_numbers_are_points"), on));
+}
+
+/// The unit a number typed with no unit into a field in `unit` is read in: `unit`, or for a field
+/// in picas points with Numbers Without Units Are Points on (where `12` could be either). A typed
+/// unit (`12 mm`, `2p6`, `1in`) always wins.
+pub(crate) fn typed_unit(ctx: &egui::Context, unit: Unit) -> Unit {
+    let bare_points = ctx.data(|d| d.get_temp::<bool>(egui::Id::new("bare_numbers_are_points"))).unwrap_or(true);
+    if bare_points && unit == Unit::Picas { Unit::Points } else { unit }
+}
+
 /// A recessed numeric field showing `value` (points) in `unit`. Returns the new value (points)
-/// when the user commits (Enter / focus loss). Supports unit suffixes and arithmetic.
+/// when the user commits (Enter / focus loss). Supports unit suffixes and arithmetic; a number
+/// without a unit is in `unit` ([`typed_unit`]: in points in a picas field with Numbers Without
+/// Units Are Points on).
 pub fn num_field(ui: &mut Ui, id: impl std::hash::Hash + std::fmt::Debug, value: Option<f64>, unit: Unit, width: f32) -> Option<f64> {
     let t = Tokens::get(ui.ctx());
     let id = ui.id().with(id);
@@ -182,11 +205,12 @@ pub fn num_field(ui: &mut Ui, id: impl std::hash::Hash + std::fmt::Debug, value:
         .inner;
     select_all_on_focus(ui, &resp, &buf);
     // ↑/↓ and the wheel step in the field's unit; a drag on its label scrubs it.
-    let stepped = step_value(ui, &resp, &mut buf, |b| Some(unit.from_pt(unit.parse(b)?)), |v| unit.format(unit.to_pt(v)));
+    let read = typed_unit(ui.ctx(), unit);
+    let stepped = step_value(ui, &resp, &mut buf, |b| Some(unit.from_pt(read.parse(b)?)), |v| unit.format(unit.to_pt(v)));
     let scrubbed = scrub::field(ui, id, rect, &buf, value.map(|v| unit.from_pt(v)), STEP_DECIMALS);
     let commit = resp.lost_focus() && buf != shown;
     ui.data_mut(|d| d.insert_temp(id, buf.clone()));
-    if commit { unit.parse(&buf) } else { stepped.or(scrubbed).map(|v| unit.to_pt(v)) }
+    if commit { read.parse(&buf) } else { stepped.or(scrubbed).map(|v| unit.to_pt(v)) }
 }
 
 /// The places a stepped value in a unit field keeps (no 12.300000001).
@@ -1319,7 +1343,7 @@ pub fn opt_field(ui: &mut Ui, id: impl std::hash::Hash + std::fmt::Debug, value:
     ui.data_mut(|d| d.insert_temp(id, buf.clone()));
     if resp.lost_focus() && buf != shown {
         let s = buf.trim();
-        if s.is_empty() { Some(None) } else { unit.parse(s).map(Some) }
+        if s.is_empty() { Some(None) } else { typed_unit(ui.ctx(), unit).parse(s).map(Some) }
     } else {
         stepped.or(scrubbed).map(|v| Some(unit.to_pt(v)))
     }

crates/ui-egui/src/workspaces.rs

@@ -7,7 +7,7 @@ use std::sync::atomic::Ordering;
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
-use crate::state::{Dialog, DockTab, FloatingFlyout, UiState};
+use crate::state::{Dialog, DockTab, FloatingFlyout, FloatingPanels, UiState};
 use crate::theme::Tokens;
 use crate::{VectorcraftApp, widgets};
 
@@ -29,6 +29,10 @@ pub struct Workspace {
     pub status_bar: bool,
     /// Tool groups torn off the toolbar into floating strips (built-in workspaces: none).
     pub floating_flyouts: Vec<FloatingFlyout>,
+    /// Panels dragged out of the dock, where they float (built-in workspaces: none).
+    pub floating_panels: Vec<FloatingPanels>,
+    /// Where the Tools panel floats (built-in workspaces: docked).
+    pub toolbar_pos: Option<[f32; 2]>,
 }
 
 impl Default for Workspace {
@@ -123,6 +127,8 @@ pub fn capture(ui: &UiState, name: &str) -> Workspace {
         open_panel: ui.open_panel.clone(),
         status_bar: ui.status_bar,
         floating_flyouts: ui.floating_flyouts.clone(),
+        floating_panels: ui.floating_panels.clone(),
+        toolbar_pos: ui.toolbar_pos,
     }
 }
 
@@ -140,6 +146,9 @@ pub fn apply(ui: &mut UiState, w: &Workspace) {
     ui.open_panel = w.open_panel.clone();
     ui.status_bar = w.status_bar;
     ui.floating_flyouts = w.floating_flyouts.clone();
+    ui.floating_panels = w.floating_panels.clone();
+    ui.toolbar_pos = w.toolbar_pos;
+    FloatingPanels::sanitize(&mut ui.floating_panels, &mut ui.toolbar_pos);
     ui.flyout = None;
     ui.workspace = w.name.clone();
 }

docs/control-protocol.md

@@ -18,11 +18,11 @@ so only enable it while you use it. Transport: `apps/vectorcraft/src/control_ser
 | `engine.execute` | `{command, params}` | run any engine or UI command (see `engine.commands`) |
 | `engine.commands` | | every command with label, shortcut, params doc, enablement |
 | `document.inspect` | `{depth?, childLimit?}` | layer tree, selection, history, paint defaults; the options slice the layer tree as `document.node {summary: true}` does |
-| `ui.inspect` | | tool, UI state, `screenMode` (0 normal, 1 full screen with menu bar, 2 full screen, 3 Presentation Mode), view, canvas rect, window size, perf, background saves and exports still running |
+| `ui.inspect` | | tool, UI state, `screenMode` (0 normal, 1 full screen with menu bar, 2 full screen, 3 Presentation Mode), `taskBar` (`pinned`, and `rect` `[x, y, w, h]` while the Contextual Task Bar shows), view, canvas rect, window size, perf, background saves and exports still running, `nativeMenuBar` (true when the menus are in the macOS menu bar rather than the window; `ui.menu.list` lists the in-window menus either way) |
 | `ui.menu.list` / `ui.menu.invoke` | `{command, params}` | the full menu tree / invoke an item |
 | `ui.contextMenu.list` | | the canvas context menu for the current selection, flattened like `ui.menu.list` (`path` holds its submenus). `ui.click {x, y, button: "right"}` on the canvas opens it, after selecting the object there unless it is already selected |
 | `ui.tool.select` / `ui.tool.list` | `{tool}` | |
-| `ui.pointer` | `{events:[{kind: down|drag|up|move|doubleclick, x, y, space?: "doc"|"screen", mods?}]}` | drive the active tool exactly like the mouse |
+| `ui.pointer` | `{events:[{kind: down|drag|up|move|doubleclick, x, y, space?: "doc"|"screen", mods?}]}` | drive the active tool exactly like the mouse: `mods.cmd` held at a press with any tool but a selection tool drags with the selection tool chosen last (Direct Selection with the Pen until one is), and the release gives the tool back as it was |
 | `ui.key` / `ui.text` | `{key, shift?, alt?, cmd?}` / `{text}` | synthetic keyboard input |
 | `ui.wheel` | `{x, y, dy?, dx?, unit?: "line"\|"point", shift?, alt?, cmd?}` | a mouse wheel turn over screen point (x, y): `dy` notches up (+) or down, `dx` sideways. Over the canvas the wheel scrolls and Cmd- or Alt-wheel (Option on the Mac) zooms about the pointer; with the `zoomWithMouseWheel` preference the wheel and Alt-wheel zoom about the pointer, Shift-wheel scrolls up and down and Cmd-wheel (Ctrl on Windows and Linux) sideways. Over a focused numeric field (click it first) each notch steps its value as Up/Down do (Shift: ten, Cmd/Ctrl: a tenth) and the panel stays put; over anything else in a panel the wheel scrolls it |
 | `ui.set` | `{brightness?, panel?, rulers?, outline?, grid?, smartGuides?, boundingBox?, controlBar?}` | |
@@ -205,6 +205,29 @@ that open its flyout raise the strip instead. The strips (`ui.floating_flyouts`
 and the strip's top-left corner) are saved with the preferences and in user workspaces; the built-in workspaces
 float none.
 
+The Contextual Task Bar: its handle (the grip at its left end) drags it anywhere on the canvas, which always holds
+it whole, also when the window shrinks. Unpinned, the bar keeps that offset as it follows the selection, until
+another document becomes active. Its More Options (…) menu has Hide Bar (`window.taskBar`); Pin Bar Position
+(`window.taskBar.pin {pinned?}`, omitted toggles, checked while pinned), which holds the bar where it is across
+selection changes (the handle still moves it) and, turned off, lets it follow the selection again from there; Reset
+Bar Position (`window.taskBar.reset`), which unpins it and puts it back under the selection; and Show Properties
+Panel. As in Illustrator, neither the position nor the pin is saved: each launch starts with the bar under the
+selection.
+
+Floating panels: dragging a dock tab, a panel icon or a popped-out panel's title out of the dock floats that panel
+inside the window, and the strip right of the dock's tabs floats the whole Properties | Layers | Libraries group. A
+floating group moves by its title bar (or the strip right of its tabs); a tab dragged out of it floats on its own;
+dropped on another group's title bar or tabs it stacks with that group, and dropped on the dock (lit up while the
+pointer is over it) or closed with its × its panels go back to the tabbed group or the icon column.
+`window.panel.float {panel, x?, y?, onto?, group?}` floats a panel (with `group`, its whole group) with its top-left
+corner at `x`, `y` (window points; default cascaded), or stacks it with the floating group holding `onto`;
+`window.panel.dock {panel, group?}` puts it back. `panel` takes the `window.panel` ids and labels, and `"tools"` for
+the Tools panel, which floats by its title bar and docks on the window's left edge. `window.panel` on a floating
+panel shows its tab. `ui.floating_panels` in `ui.inspect` lists the groups (panel ids, the index of the tab shown,
+the top-left corner) and `ui.toolbar_pos` the Tools panel's corner (null: docked); both are saved with the
+preferences and in user workspaces (the built-in workspaces dock everything), and a corner saved on a bigger window
+is clamped into this one when drawn. Floating panels stay inside the app window (no separate OS windows).
+
 Flatten Transparency: `ui.flattenTransparencyDialog` opens the `flattenTransparency` dialog for the selection
 (fields `preset`: a preset name, setting it loads that preset's options; the option keys of
 `object.flattenTransparency`: `balance` 0–100, `lineArtPpi` and `gradientPpi` 1–2400, `textToOutlines`,

docs/development.md

@@ -36,10 +36,19 @@ How the web shell (`apps/vectorcraft-web/src/web.rs`) differs from desktop:
 
 ## Desktop graphics processor
 
-The canvas is rasterized on the CPU (`vectorcraft-render`, vello_cpu); the GPU (wgpu, through eframe) only composites the canvas texture and draws the UI. The desktop app (`apps/vectorcraft/src/main.rs`) therefore asks wgpu for the **power-saving** adapter by default, which is the integrated GPU on hybrid-graphics laptops. Presenting frames rendered on a discrete GPU through the integrated one made the window flicker on some laptops (#306). A machine with one GPU gets that GPU either way.
+The canvas is rasterized on the CPU (`vectorcraft-render`, vello_cpu); the GPU (wgpu, through eframe) only composites the canvas texture and draws the UI, so any GPU that can show the window will do. The desktop app picks the window's adapter itself (`apps/vectorcraft/src/gpu.rs`, eframe's `native_adapter_selector`) and logs every adapter it found and the one it uses.
 
-- **Preferences › Performance › Graphics Processor** (`gpuPreference`: `powerSaving` or `highPerformance`) picks the other one. The adapter is chosen when the window opens, so a change applies after a restart.
-- The `WGPU_POWER_PREF` environment variable (`low`, `high` or `none`) overrides the preference.
+- **Order:** adapters that report they can't present to the window are never tried; then the one `WGPU_ADAPTER_NAME` names; hardware before software (llvmpipe, WARP); the native backends (Vulkan, Metal, DX12) before OpenGL; then the power preference, keeping the system's order among equals.
+- **Preferences › Performance › Graphics Processor** (`gpuPreference`): `automatic` (the default), `lowPower` (Power Saving, the integrated GPU) or `highPerformance` (the discrete GPU). The adapter is chosen when the window opens, so a change applies after a restart.
+  - **Automatic on Windows and macOS** is power saving: the system shows frames from any GPU, and presenting frames rendered on a discrete GPU through the integrated one made the window flicker on some hybrid laptops (#306).
+  - **Automatic on Linux and the BSDs** keeps the system's order: Mesa's Vulkan device-select layer puts the GPU the desktop runs on first (the integrated one on hybrid laptops; `DRI_PRIME` and `MESA_VK_DEVICE_SELECT` steer it). A Wayland compositor may not accept frames from another GPU: on a desktop whose compositor ran on an NVIDIA GPU, rendering on the Ryzen's integrated GPU made KWin end the window's connection ("importing the supplied dmabufs failed") and 0.5.0 crashed at startup (#502).
+  - 0.5.0 saved `powerSaving`, its default, for everyone; it reads as `automatic`.
+- **If the window fails on its adapter while starting up** (an error from wgpu, or a panic inside wgpu or egui-wgpu during the first frames), the app starts again without that adapter and tries the next one, telling which in the status bar; the run that failed keeps its log as `vectorcraft.1.log`. On Unix the new app replaces the process (an AppImage stays mounted); on Windows it starts beside it. The adapters left out travel in `VECTORCRAFT_GPU_SKIP` (`backend:vendor:device`, such as `Vulkan:1002:164e`), one more on each restart, so the restarts end. When no adapter is left, the app logs why and exits with an error instead of panicking.
+- **Environment variables** for when the choice still goes wrong, all read at startup and stronger than the preference:
+  - `WGPU_POWER_PREF`: `low`, `high` or `none` (the system's order).
+  - `WGPU_ADAPTER_NAME`: part of an adapter's name, any case (`WGPU_ADAPTER_NAME=nvidia`, `=radv`, `=intel`); the names are in the log.
+  - `WGPU_BACKEND`: the backends to use, such as `vulkan`, `dx12`, `metal` or `gl`.
+  - On Linux with Mesa, `MESA_VK_DEVICE_SELECT=10de:2f04!` (vendor:device as `vulkaninfo --summary` or `lspci -nn` show it) leaves only that GPU to Vulkan, and `DRI_PRIME=1` picks the other GPU.
 - Help › About and the control channel's `ui.inspect` (`graphicsAdapter`) show the adapter in use, and the app logs it at startup.
 
 ## Logs
@@ -53,15 +62,29 @@ By default VectorCraft's own crates log at `info` and everything else at `warn`.
 | Variable | Effect |
 |---|---|
 | `VECTORCRAFT_CONTROL_PORT` | Same as `--control <port>` |
+| `VECTORCRAFT_IN_WINDOW_MENUS` | Any value but empty or `0`: same as `--in-window-menus` (see [macOS: the menu bar](#macos-the-menu-bar)) |
 | `VECTORCRAFT_NO_PREFS` | No preferences read or written, no default Data Recovery folder and no log file (agents' test runs) |
 | `WGPU_POWER_PREF` | Graphics adapter: `low`, `high` or `none` (see [Desktop graphics processor](#desktop-graphics-processor)) |
+| `WGPU_ADAPTER_NAME` | Graphics adapter by (part of) its name, any case (see [Desktop graphics processor](#desktop-graphics-processor)) |
+| `WGPU_BACKEND` | Graphics backends: `vulkan`, `dx12`, `metal`, `gl` |
+| `VECTORCRAFT_GPU_SKIP` | Set by the app when it starts again without a graphics adapter that failed (see [Desktop graphics processor](#desktop-graphics-processor)) |
 | `RUST_LOG` | Log levels for standard error and the log file (see [Logs](#logs)) |
 
+## macOS: the menu bar
+
+On macOS the menus live in the system menu bar, not in the window's app bar (which keeps the brand mark, Home, the search box and the workspace switcher next to the traffic lights). `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps them in the window, as on Windows, Linux and the web; so does a menu bar AppKit refuses to build (logged). `ui.inspect` says which with `nativeMenuBar`.
+
+- **One menu model.** `crates/ui-egui/src/native_menu.rs` (platform-free, tested on every platform) builds the menu bar from the in-window menus (`menus::menu_tree`, each item through `menus::entry`, which the in-window menus draw too) and lays it out the Mac way: the VectorCraft menu holds About, Settings ▸ (one item per Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays View › Hide Edges), Hide Others ⌥⌘H, Show All and Quit ⌘Q (the app's own `app.quit`, so unsaved documents are asked about); those leave Edit and Help. Window starts with Minimize ⌃⌘M and Zoom and ends with Bring All to Front, and Help is the system's Help menu (its search field). A system key a command (or a user's shortcut) already has stays the command's, and the log says so.
+- **The native side** is `apps/vectorcraft/src/mac_menu.rs`: muda (`=0.21.1`, default features off, macOS only, no `unsafe`) builds the `NSMenu`s. Labels, enabled and checked are updated in place when anything they show may have changed (a command ran, the document, its history or selection changed, a click or a key press); a change of structure (a recent file, the language, a shortcut) rebuilds the menus.
+- **Keys stay with egui.** AppKit runs a menu's key equivalents before the window sees the key, so the item's key goes back to egui as the key press it was (⌘X/⌘C/⌘V as egui's Cut/Copy/Paste events), through `raw_input_hook`: `shortcuts::handle` runs it once, user shortcuts apply, and a focused text field keeps ⌘A, ⌘C, ⌘V and ⌘Z. A click runs the item like an in-window click. Bare keys and ⌥/⇧ chords are never key equivalents (they type).
+- Built and clippy-checked for `aarch64-apple-darwin` and `x86_64-apple-darwin` from any host: `cargo clippy -p vectorcraft --target aarch64-apple-darwin --all-targets -- -D warnings`.
+
 ## Linux: Wayland and X11
 
-The window runs natively on Wayland (eframe's `wayland` feature) and on X11. The system clipboard (`apps/vectorcraft/src/clipboard.rs`) is arboard with its `wayland-data-control` feature:
+The window runs natively on Wayland (eframe's `wayland` feature) and on X11. On machines with two GPUs it renders on the one the desktop runs on unless Preferences say otherwise; see [Desktop graphics processor](#desktop-graphics-processor) (#502). The system clipboard (`apps/vectorcraft/src/clipboard.rs`) is arboard with its `wayland-data-control` feature:
 
 - **Clipboard:** under Wayland arboard talks to the compositor through the data-control protocol (wlroots compositors such as Sway and Hyprland, KDE Plasma), so bitmaps (`image/png`), SVG markup and text copied in any app paste (#398). Where the compositor lacks the protocol (GNOME's Mutter, [arboard#223](https://github.com/1Password/arboard/issues/223)), arboard falls back to the X11 clipboard through XWayland, which only holds what X11 apps copied. egui's own text paste into fields goes through smithay-clipboard and works either way.
+- **Clipboard owners that never answer (#510):** reading the clipboard waits on the app that owns it: arboard gives up on an X11 owner after 4 s, and a Wayland read waits for the owner to send its data. So on Linux the check that enables the Paste menu items runs on a background thread with a second clipboard handle (`crates/ui-egui/src/clipboard_probe.rs`, installed as `Services::clipboard_probe`), only while nothing is copied in the app and a document is open, and the window keeps drawing. A paste itself still reads on the UI thread, so pasting from such an owner waits for it once. Windows and macOS keep the check on the UI thread: Windows only asks which formats the clipboard holds, macOS asks the pasteboard server.
 - **Copied files:** files copied in a file manager (`text/uri-list`; `CF_HDROP` on Windows, file URLs on macOS) paste as the first one that is art (SVG, PDF, EMF/WMF or a bitmap), before the clipboard's other formats (which include the files' paths as text).
 - **Dropping files on the window does not work under Wayland:** winit 0.30, which eframe 0.36 runs on, has no Wayland drag and drop ([winit#1881](https://github.com/rust-windowing/winit/issues/1881), added in winit 0.31; [egui#1563](https://github.com/emilk/egui/issues/1563)), so no `dropped_files` arrive. Until eframe moves to winit 0.31: copy the files in the file manager and paste them, use File › Place or Open, or run the app under XWayland, where drops work (`WAYLAND_DISPLAY= vectorcraft`).
 - **Pens and pen displays under Wayland (#491):** winit 0.30 doesn't bind the Wayland tablet protocol (`zwp_tablet_v2`; tablet input arrives in winit 0.31, [winit#4318](https://github.com/rust-windowing/winit/pull/4318), [egui#7731](https://github.com/emilk/egui/pull/7731)). Since Plasma 6.3, KWin no longer turns tablet input into pointer input for such apps ([kwin!6336](https://invent.kde.org/plasma/kwin/-/merge_requests/6336)): the pen moves the compositor's cursor over the window, but the app gets no motion or presses and shows none of its own cursors. Until eframe moves to winit 0.31, either run the app under XWayland, which supports the tablet protocol and hands the pen to X11 apps as a pointer (`WAYLAND_DISPLAY= vectorcraft`, or `env -u WAYLAND_DISPLAY vectorcraft`; for a desktop launcher, put `env WAYLAND_DISPLAY=` before the command in its `Exec=` line), or turn KWin's deprecated emulation back on for the whole session by setting `KWIN_WAYLAND_EMULATE_TABLET=1` in KWin's environment (for example in a file under `~/.config/environment.d/` or in `/etc/environment`) and logging in again. The pen then works as a mouse, without pressure: winit 0.30 reads pen pressure on Windows only (Windows Ink, which reaches the Liquify tools' Use Pressure Pen). Other compositors that don't emulate a pointer for tablets behave the same way.
@@ -111,7 +134,8 @@ Languages shipped: English (`en`, the source), Traditional Chinese (`zh-hant`, c
 in Taiwan; `zh-TW`, `zh-HK`, `zh-MO` and `zh-Hant-*` locales all resolve to it), Simplified Chinese (`zh-hans`,
 complete, in the vocabulary used in mainland China; `zh-CN`, `zh-SG`, `zh-Hans-*` and a bare `zh` resolve to it,
 so the two scripts never mix), Japanese (`ja`, complete), Spanish (`es`, complete, in neutral
-international Spanish; every `es-*` locale such as `es-ES`, `es-MX`, `es-AR` or `es-419` resolves to it), Czech (`cs`, every menu label) and Brazilian Portuguese
+international Spanish; every `es-*` locale such as `es-ES`, `es-MX`, `es-AR` or `es-419` resolves to it), Italian (`it`,
+complete; `it-IT`, `it-CH` and every other `it-*` locale resolve to it), Czech (`cs`, every menu label) and Brazilian Portuguese
 (`pt-br`, every menu label and every `tl!` literal). Untranslated text falls back to English until its rows are added.
 
 - `tl!("…")` translates a literal into the language the UI is drawn in; `i18n::t(s)` is the same for a
@@ -139,10 +163,10 @@ international Spanish; every `es-*` locale such as `es-ES`, `es-MX`, `es-AR` or
   control channel, MCP and tests read them) and are translated only where the status bar draws them
   (`i18n::msg`). `@msg` catalog rows hold a whole message or a template such as
   `Couldn't open {name}: {e}`; `{_1}`, `{_2}` … stand for the format string's `{}`, and the values in the
-  placeholders are translated in turn (the reason after `: {e}` is often a message too). Spanish covers every
+  placeholders are translated in turn (the reason after `: {e}` is often a message too). Spanish and Italian cover every
   message literal the test scan finds (`complete_languages_translate_every_message`, languages listed in
   `COMPLETE_MESSAGES`): a new `Err("…")`, `Other(…)`, `#[error(…)]` or `status(…)` message needs an `es.tsv`
-  row (`VECTORCRAFT_I18N_DUMP_MESSAGES=messages.txt cargo test -p vectorcraft-ui-egui
+  and an `it.tsv` row (`VECTORCRAFT_I18N_DUMP_MESSAGES=messages.txt cargo test -p vectorcraft-ui-egui
   complete_languages_translate_every_message` lists them all). Other languages show messages in English
   until they add `@msg` rows.
 - Not translated on purpose: names that are user data (layers, swatches, fonts, documents), the tab

docs/mcp.md

@@ -402,11 +402,14 @@ their stop opacity and stop where the shading doesn't extend. Text becomes point
 the file's font (by name; fonts that aren't available are listed in `warnings` and show in the fallback font, and
 every export that draws that type — PDF, EPS, EMF/WMF, raster images, SVG with outlined or embedded fonts — says in
 its `warnings` that it wrote the fallback font) — `textAs: "outlines"` keeps the glyph outlines the file draws instead
-(its embedded fonts, installed or not). Strokes stay live strokes (width, cap, join, miter limit, dash and paint), and
+(its embedded fonts, installed or not). Lines wrapped in a frame (each wrapped line ending in a space, sharing a left
+edge, font and leading) come back as one area type object, left aligned or justified, where laying it out breaks the
+lines where the file does; a stroke written as each glyph's outline stroked is the type object's stroke; glyphs set
+apart by gaps wider than a space keep their places. Strokes stay live strokes (width, cap, join, miter limit, dash and paint), and
 an object written as a fill and then a stroke of the same outline is one path with both. Optional content groups (the
 layers of PDF and PDF-compatible `.ai` files) become layers with their name, visibility (the default configuration's,
-or a view state that is off), print state and lock, nested as sublayers the way the file's layer order nests them; art
-that is off comes in as a hidden layer. Art outside them goes to a layer per page (except the opaque white page a `.ai`
+or a view state that is off), print state and lock, nested as sublayers the way the file's layer order nests them, stacked as the pages mark them
+(layers with no art come in empty); art that is off comes in as a hidden layer. Art outside them goes to a layer per page (except the opaque white page a `.ai`
 paints under its layers, which isn't art). `layers: false` gives one layer per page of only what shows:
 
 ```json
@@ -1049,7 +1052,20 @@ on top of each other, and an open path becomes one path per piece. Each cut leav
 so `path.moveAnchors {dx, dy}` (or a Direct Selection drag) pulls the path apart there; `path.join {}` (Connect
 Selected End Points) joins the ends again. `path.convertAnchor {id, subpath?, anchor, to, x?, y?}` and
 `path.split {id, subpath?, anchor}` do the same to one anchor (the Anchor Point and Scissors tools); the Pen with Alt
-held over a selected path's handle or anchor works as the Anchor Point tool.
+held over a selected path's handle, anchor or segment works as the Anchor Point tool. `path.reshapeSegment {id,
+subpath?, segment, t, dx, dy}` (a segment dragged with Direct Selection or the Anchor Point tool) moves the segment's
+point at `t` by `dx`, `dy`: a smooth anchor at either end stays smooth, its other handle turning with the moved one.
+
+A `pointer_gesture` with `mods: {cmd: true}` held at the press, with any tool but the selection tools (Command on
+macOS, Ctrl elsewhere), drags with the selection tool chosen last (`select_tool`), or Direct Selection with the Pen,
+Curvature and anchor tools until one is chosen; the release gives the tool back as it was, so the Pen goes on drawing
+the path it had begun while that stays selected. Its reply's `tool` is the tool given back.
+
+```json
+{"name":"pointer_gesture","arguments":{"tool":"pen","events":[{"kind":"down","x":100,"y":300},{"kind":"up","x":100,"y":300},{"kind":"down","x":200,"y":300},{"kind":"drag","x":250,"y":300},{"kind":"up","x":250,"y":300}]}}
+{"name":"pointer_gesture","arguments":{"mods":{"cmd":true},"events":[{"kind":"down","x":250,"y":300},{"kind":"drag","x":250,"y":260},{"kind":"up","x":250,"y":260}]}}
+{"name":"pointer_gesture","arguments":{"events":[{"kind":"down","x":300,"y":350},{"kind":"up","x":300,"y":350}]}}
+```
 
 ```json
 {"name":"run_command","arguments":{"command":"select.anchors","params":{"id":12,"anchors":[[0,2]]}}}
@@ -1153,8 +1169,9 @@ Effects off a 100 pt wide rectangle with a 10 pt stroke set to `width: 220` gets
 
 The Selection & Anchor Display and General preferences apply to `pointer_gesture` as they do to the mouse:
 
-- `selectionTolerance` (1–8 px, 3 by default): how near a click must be to a path to pick it, and to an anchor or
-  handle for Direct Selection.
+- `selectionTolerance` (1–8 px, 3 by default): how near a click must be to a path to pick it, and to an anchor,
+  handle or segment for Direct Selection, the Anchor Point, Add and Delete Anchor Point and Scissors tools, and the
+  Pen with Alt. A handle shorter than that leaves its anchor to be picked when pressed nearer the anchor.
 - `objectSelectionByPathOnly`: a click inside a filled path or compound path doesn't select it, one on its path does.
 - `ctrlClickSelectsBehind` (on by default): a Selection tool click with `mods: {cmd: true}` (Command on macOS, Ctrl
   elsewhere) selects the object under the selected one there, the next such click the one under that, then the
@@ -1168,8 +1185,9 @@ The Selection & Anchor Display and General preferences apply to `pointer_gesture
   hidden art with the artboard too; off (the default) it stays where it is.
 - `penRubberBand`, `curvatureRubberBand` (on by default): off, the Pen and Curvature tools draw no preview segment to
   the pointer.
-- `showHandlesMultipleAnchors` (on by default): off, Direct Selection shows and drags direction handles only while a
-  single anchor is selected. `handleStyle` (`solid`, `hollow`, `large`) draws their ends (desktop app).
+- `showHandlesMultipleAnchors` (on by default): off, Direct Selection (and the Anchor Point tool, and the Pen with Alt)
+  shows and drags direction handles only while a single anchor is selected. On, the handles of the direct-selected
+  anchors, or of every anchor of a path selected as a whole, show and drag. `handleStyle` (`solid`, `hollow`, `large`) draws their ends (desktop app).
 - `hideCornerWidgetAbove` (177° by default): corners wider than this show no Live Corners widget (a rectangle's right
   angles hide below 90°).
 - `transformPatternTiles` (off by default): the default of the transforms' `patterns` param (`object.transform`,
@@ -1190,9 +1208,11 @@ wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel s
 default: in View › Pixel Preview at 600% zoom and above, a line at every document pixel over the art),
 `recentFontsCount`, `antiAliasedArtwork` (on by default; off, the canvas draws the art with hard edges — a pixel is
 painted when the art covers at least half of it — while raster effects and pattern tiles stay smooth; exports keep
-their own Anti-aliasing option) and
+their own Anti-aliasing option),
 `scrubNumericFields` (on: a horizontal drag on a numeric field's label steps the field, one undo step per drag; the
-control channel's `ui.drag` scrubs).
+control channel's `ui.drag` scrubs), `showHomeScreen` (on by default: the Home screen while no document is open;
+off, an empty window, and the Home button or `app.home` still shows the screen) and `autoCollapseIconPanels` (off by
+default: on, a click away from a panel popped out of the icon column puts it away).
 
 The Smart Guides preferences (Preferences › Smart Guides) apply to `pointer_gesture` with Smart Guides on (the
 default view) and to the mouse; they change what the tools show and how far a target pulls, never where a snapped
@@ -1325,6 +1345,10 @@ three: General (rulers, positions and sizes, the Info panel, dialog distances, c
 (`document.inspect` → `units`): `document.setUnits {units}` (Document Setup) sets it for that document, and
 `prefs.set {key: "unitsGeneral", value}` sets it for the active document too (one undo step) and is the units
 `file.new` starts in when it gets no `units`. Stroke and Type are the preferences `unitsStroke` and `unitsType`.
+`numbersWithoutUnitsArePoints` (on by default) makes the desktop app's length fields in picas read a number typed
+with no unit in points (`12` is 12 pt, `2p6` and `1p` stay picas, `12 mm` millimetres); off, it is in picas. Fields in
+other units read it in their unit either way, and the Preferences dialog dims the option unless a unit is Picas.
+Command params are in points either way.
 `prefs.list` marks the length preferences (`keyboardIncrement`, `cornerRadius`, `pasteOffset`, `gridlineEvery`,
 `typeSizeIncrement`, `baselineShiftIncrement`) with `measure: "general"|"type"`; they are kept in points and also take
 a string with a unit. Unit names: `Points`, `Picas`, `Inches`, `Millimeters`, `Centimeters`, `Pixels`, `Feet & Inches`,

docs/releasing.md

@@ -1,7 +1,7 @@
 # Releasing VectorCraft
 
 Every push to the `release` branch runs `.github/workflows/release.yml`. The workflow builds
-installers for macOS, Windows, Linux and FreeBSD, plus the web build, and creates or updates a
+installers for macOS, Windows, Linux (including Flatpak bundles) and FreeBSD, plus the web build, and creates or updates a
 **draft** GitHub Release named `VectorCraft v<version>`. Nobody sees a draft until a maintainer
 publishes it.
 
@@ -34,8 +34,11 @@ Once the draft is published, the workflow refuses to touch that version again: b
 
 **Test runs:** *Actions › Release › Run workflow* runs the whole pipeline by hand. The optional
 `version` input (such as `0.4.0-rc.1`) overrides `Cargo.toml` for that run only; each build job
-applies it with `cargo xtask version set` before building. The jobs run in the `release`
-environment, which only the `release` branch can use, so pick that branch in the dialog.
+applies it with `cargo xtask version set` before building. The signing jobs (macOS, Windows) and
+the draft-release job run in the `release` environment, which only the `release` branch can use, so
+pick that branch for a full run. Run on any other branch, it is a dry run: the Linux, Flatpak,
+FreeBSD and web jobs build and upload their artifacts, the environment refuses the signing jobs,
+and no draft release is created.
 
 ## What gets built
 
@@ -47,6 +50,8 @@ environment, which only the `release` branch can use, so pick that branch in the
 | Windows on ARM64 | `vectorcraft-<v>-windows-arm64.msi`, `vectorcraft-<v>-windows-arm64-portable.zip` | `windows-latest` (cross-compiled) |
 | Linux x86_64 | `vectorcraft-<v>-linux-x86_64.{AppImage,deb,rpm,tar.gz}` | `ubuntu-22.04` |
 | Linux aarch64 | `vectorcraft-<v>-linux-aarch64.{AppImage,deb,rpm,tar.gz}` | `ubuntu-22.04-arm` |
+| Linux AppImage updates | `vectorcraft-<v>-linux-{x86_64,aarch64}.AppImage.zsync` | with the AppImages |
+| Flatpak x86_64, aarch64 | `vectorcraft-<v>-linux-{x86_64,aarch64}.flatpak` | `ubuntu-24.04`, `ubuntu-24.04-arm` (repackages the Linux tarball) |
 | FreeBSD 14 x86_64 | `vectorcraft-<v>-freebsd-x86_64.tar.gz` | a FreeBSD 14.3 VM on `ubuntu-latest` |
 | Web | `vectorcraft-web-<v>.zip`, a static site (see [`packaging/web/README.md`](../packaging/web/README.md)) | `ubuntu-latest` |
 
@@ -80,7 +85,9 @@ The rules are in craftrules `standards/fonts.md`, the build option in
 - **Notarization:** the app is zipped and sent with `xcrun notarytool submit --wait`, then the
   ticket is stapled and checked with `stapler validate` and `spctl`. The app goes on a DMG
   (`hdiutil makehybrid` and `convert`, with an `Applications` link to drag onto), which is signed,
-  notarized and stapled too.
+  notarized and stapled too. Its Finder window (background, icon size and positions) comes from
+  [`packaging/macos/dmg/`](../packaging/macos/dmg/README.md), and its volume is named `VectorCraft`
+  without the version, which the window's background needs; the DMG file name keeps the version.
 - **CLI:** the universal `vectorcraft-cli` is signed the same way, zipped, and the zip is
   notarized. A bare executable can't hold a stapled ticket, so Gatekeeper looks the CLI's ticket up
   online the first time a downloaded copy runs.
@@ -130,9 +137,21 @@ glibc 2.35 or newer: Ubuntu 22.04+, Debian 12+, Fedora 36+ and RHEL 10. Moving t
 image raises that floor, so do it deliberately. After packaging, the job prints the `.deb`'s
 metadata and contents, runs `ldd` on the binary and runs each AppImage with `--version`.
 
-`packaging/linux/flatpak/ai.storyteller.vectorcraft.yml` is a Flatpak manifest ready for a
-Flathub submission (its header says how to build it). The release doesn't build a Flatpak; the
-workflows only check the manifest's id.
+**AppImage updates.** Each AppImage embeds the update information
+`gh-releases-zsync|storytold|vectorcraft|latest|vectorcraft-*-linux-<arch>.AppImage.zsync`
+(appimagetool `-u`), and `package.sh` writes the matching `.zsync` beside it when `zsyncmake` (the
+`zsync` package) is installed. [AppImageUpdate](https://github.com/AppImageCommunity/AppImageUpdate)
+and AppImageLauncher then download only the changed blocks from the newest published,
+non-pre-release release. The job checks both are there.
+
+**Flatpak.** The `flatpak` jobs (x86_64 on `ubuntu-24.04`, aarch64 on `ubuntu-24.04-arm`) take the
+Linux job's tarball and repackage it with `packaging/linux/flatpak-bundle.sh` and
+`packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml` into a single-file bundle
+(`flatpak install --user vectorcraft-<v>-linux-<arch>.flatpak`), then install it and run
+`vectorcraft-cli --version` in the sandbox. No Rust build happens there, so the bundle carries the
+same binaries as the AppImage. `packaging/linux/flatpak/ai.storyteller.vectorcraft.yml` is the
+from-source manifest for a Flathub submission (its header says how to build it); packaging-lint
+keeps the runtime and sandbox permissions of the two manifests identical.
 
 ### FreeBSD
 
@@ -157,8 +176,9 @@ the job fails and asks for a version bump (`cargo xtask version set`).
 
 ## Secrets
 
-All jobs run in the `release` environment, which only the `release` branch can use and which holds
-the signing secrets. Every secret is optional: a missing one produces unsigned artifacts and a
+The jobs that sign (macOS, Windows) and the draft-release job run in the `release` environment,
+which only the `release` branch can use and which holds the signing secrets. The other jobs get no
+secrets. Every secret is optional: a missing one produces unsigned artifacts and a
 warning, never a failed build.
 
 | Secret | Used for |

packaging/linux/flatpak-bundle.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Repackage a VectorCraft Linux tarball as a single-file Flatpak bundle:
+#
+#   $DIST/vectorcraft-<version>-linux-<arch>.flatpak
+#
+# Usage: packaging/linux/flatpak-bundle.sh [--no-test] [TARBALL]
+#
+# TARBALL defaults to $DIST/vectorcraft-<version>-linux-<arch>.tar.gz from package.sh. The bundle
+# is built for the host architecture (x86_64 or aarch64), which must match the tarball's.
+# Needs flatpak, flatpak-builder and the SVG pixbuf loader (librsvg2-common) for the host's
+# `appstreamcli compose`; the freedesktop runtime and SDK named in the manifest are
+# installed per-user from Flathub. Unless --no-test, the bundle is then installed per-user and
+# `vectorcraft-cli --version` is run inside the sandbox as a smoke test.
+# Manifest: packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml.
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+APP_ID=ai.storyteller.vectorcraft
+FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
+
+TEST=1
+TARBALL=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --no-test) TEST=0; shift ;;
+    -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+BASENAME="vectorcraft-$VERSION-linux-$ARCH"
+TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
+[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+for tool in flatpak flatpak-builder; do
+  command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
+done
+
+echo "==> VectorCraft $VERSION Flatpak bundle for $ARCH from $(basename "$TARBALL")"
+
+WORK="$CARGO_TARGET_DIR/flatpak-bundle"
+rm -rf "$WORK"
+mkdir -p "$WORK/stage"
+tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
+[ -x "$WORK/stage/bin/vectorcraft" ] || { echo "error: $TARBALL has no bin/vectorcraft" >&2; exit 1; }
+cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"
+
+flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
+# --disable-rofiles-fuse: no FUSE in containers and CI runners.
+flatpak-builder --user --install-deps-from=flathub --disable-rofiles-fuse --force-clean \
+  --default-branch=stable --repo="$WORK/repo" --state-dir="$WORK/state" "$WORK/build" "$WORK/$APP_ID.yml"
+
+OUT="$DIST/$BASENAME.flatpak"
+# --runtime-repo lets `flatpak install` fetch the freedesktop runtime from Flathub if missing.
+flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
+echo "wrote $OUT"
+
+if [ "$TEST" = 1 ]; then
+  flatpak install --user -y --noninteractive --reinstall "$OUT"
+  flatpak info --user "$APP_ID"
+  flatpak run --command=vectorcraft-cli "$APP_ID" --version
+  flatpak run --command=sh "$APP_ID" -c 'ls /app/share/applications /app/share/metainfo /app/share/mime/packages /app/share/icons/hicolor/scalable/apps'
+fi
+echo "==> done"
+ls -lh "$OUT"

packaging/linux/flatpak/ai.storyteller.vectorcraft.bundle.yml

@@ -0,0 +1,47 @@
+# Flatpak manifest for the single-file bundle attached to every GitHub release
+# (vectorcraft-<version>-linux-<arch>.flatpak). Build it with packaging/linux/flatpak-bundle.sh.
+#
+# It repackages the release's own Linux tarball (vectorcraft-<version>-linux-<arch>.tar.gz,
+# built on Ubuntu 22.04 by package.sh) instead of compiling Rust inside flatpak-builder: no
+# network and no vendored crate sources during the build, a few seconds instead of 20+ minutes,
+# and byte-for-byte the same binaries as the AppImage/deb/rpm. The script unpacks the tarball
+# into `stage/` next to a copy of this file. The binaries need glibc >= 2.35 and load X11,
+# Wayland, xkbcommon and Vulkan at runtime; the freedesktop runtime has all of them, and the
+# GPU driver comes from its org.freedesktop.Platform.GL extension.
+#
+# ai.storyteller.vectorcraft.yml (same directory) is the from-source manifest for Flathub. Keep
+# runtime, runtime-version, sdk and finish-args identical in both (packaging-lint checks this).
+id: ai.storyteller.vectorcraft
+runtime: org.freedesktop.Platform
+runtime-version: '25.08'
+sdk: org.freedesktop.Sdk
+command: vectorcraft
+finish-args:
+  # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
+  - --share=ipc
+  # Display: Wayland first; X11 only when no Wayland compositor is running.
+  - --socket=wayland
+  - --socket=fallback-x11
+  # GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
+  - --device=dri
+  # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
+  # portal, so broad filesystem access isn't needed. Pictures is granted for opening files by
+  # path from the command line.
+  - --filesystem=xdg-pictures
+  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.vectorcraft` exposes it
+  # to host agents) and home/host filesystem access.
+modules:
+  - name: vectorcraft
+    buildsystem: simple
+    build-commands:
+      - install -Dm755 bin/vectorcraft /app/bin/vectorcraft
+      - install -Dm755 bin/vectorcraft-cli /app/bin/vectorcraft-cli
+      - install -Dm644 share/applications/ai.storyteller.vectorcraft.desktop /app/share/applications/ai.storyteller.vectorcraft.desktop
+      - install -Dm644 share/mime/packages/ai.storyteller.vectorcraft.xml /app/share/mime/packages/ai.storyteller.vectorcraft.xml
+      # Already has the release's version and date substituted by package.sh.
+      - install -Dm644 share/metainfo/ai.storyteller.vectorcraft.metainfo.xml /app/share/metainfo/ai.storyteller.vectorcraft.metainfo.xml
+      - mkdir -p /app/share/icons /app/share/doc && cp -R share/icons/hicolor /app/share/icons/ && cp -R share/doc/vectorcraft /app/share/doc/
+    sources:
+      - type: dir
+        path: stage

packaging/linux/flatpak/ai.storyteller.vectorcraft.yml

@@ -8,6 +8,7 @@
 #   flatpak run ai.storyteller.vectorcraft
 #
 # For Flathub, replace the `dir` source with a `git` source pinned to a release tag and commit.
+# Release bundles (.flatpak on GitHub Releases) use ai.storyteller.vectorcraft.bundle.yml instead.
 id: ai.storyteller.vectorcraft
 runtime: org.freedesktop.Platform
 runtime-version: '25.08'
@@ -16,6 +17,7 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: vectorcraft
 finish-args:
+  # Keep identical to ai.storyteller.vectorcraft.bundle.yml (the release bundle); comments there.
   - --share=ipc
   - --socket=wayland
   - --socket=fallback-x11

packaging/linux/package.sh

@@ -2,6 +2,7 @@
 # Build and package VectorCraft for Linux (<arch> is x86_64 or aarch64):
 #
 #   $DIST/vectorcraft-<version>-linux-<arch>.AppImage  any distro with glibc >= the build host's
+#   $DIST/vectorcraft-<version>-linux-<arch>.AppImage.zsync  delta updates (needs zsyncmake)
 #   $DIST/vectorcraft-<version>-linux-<arch>.deb       Debian, Ubuntu, Mint, Pop!_OS, ...
 #   $DIST/vectorcraft-<version>-linux-<arch>.rpm       Fedora, openSUSE, RHEL, ...
 #   $DIST/vectorcraft-<version>-linux-<arch>.tar.gz    plain FHS-style tree (bin/, share/)
@@ -10,7 +11,8 @@
 #
 # Needs: cargo; nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage
 # (downloaded into $CARGO_TARGET_DIR if missing). Build on an old distro (CI: Ubuntu 22.04,
-# glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli.
+# glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli,
+# zsyncmake (the zsync package) for the AppImage's .zsync.
 set -euo pipefail
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
@@ -108,11 +110,29 @@ if has appimage; then
       chmod +x "$TOOL"
     fi
   fi
-  OUT="$DIST/$BASENAME.AppImage"
+  # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be
+  # relative, e.g. target/agent-<name>).
+  OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage"
+  APPDIR="$(cd "$APPDIR" && pwd)"
+  TOOL="$(cd "$(dirname "$TOOL")" && pwd)/$(basename "$TOOL")"
+  # A .zsync left by an earlier run would hide a missing zsyncmake and describe another file.
+  rm -f "$OUT.zsync"
+  # Update information: AppImageUpdate, AppImageLauncher and the like read it from the file and
+  # fetch only the blocks that changed in a newer release, through the .zsync published next to
+  # each AppImage on GitHub Releases. `latest` is the newest published release that is not a
+  # pre-release. A fork's builds point at its own releases through GITHUB_REPOSITORY.
+  REPO="${GITHUB_REPOSITORY:-storytold/vectorcraft}"
+  UPDATE_INFO="gh-releases-zsync|${REPO%%/*}|${REPO#*/}|latest|vectorcraft-*-linux-$ARCH.AppImage.zsync"
   # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime,
-  # so users don't need libfuse2 either.
-  ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream "$APPDIR" "$OUT"
+  # so users don't need libfuse2 either. With zsyncmake on the host (CI installs the zsync
+  # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
+  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
   echo "wrote $OUT"
+  if [ -s "$OUT.zsync" ]; then
+    echo "wrote $OUT.zsync"
+  else
+    warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
+  fi
 fi
 
 "$STAGE/usr/bin/vectorcraft-cli" --version

packaging/macos/dmg/README.md

@@ -0,0 +1,37 @@
+# macOS DMG window
+
+What Finder shows when the DMG opens: a 660 × 400 pt background with the app icon and the
+`Applications` link side by side. `package.sh` copies these files into the image; nothing here is
+generated at build time, so the DMG still builds with `hdiutil makehybrid` (no mounted device, no
+Finder scripting on CI).
+
+| File | What |
+|---|---|
+| `background.svg` | Source of the background: the app icon (`assets/app-icon/vectorcraft-small.svg`, linked, not copied) cropped as a cover on the VectorCraft colour field (`#e8573f`), Ink and Paper, Inter and JetBrains Mono (from `assets/fonts`, not embedded). |
+| `background.tiff` | The background at 1x (660 × 400 px, 72 dpi) and 2x (1320 × 800 px, 144 dpi) in one HiDPI TIFF (Deflate, sRGB). Goes to `.background/background.tiff`. |
+| `DS_Store` | Finder's view settings for the volume: window size, icon size 128, VectorCraft.app at (326, 205), `Applications` at (574, 205), and the background. Goes to `.DS_Store`. |
+| `generate.py` | Writes `background.tiff` and `DS_Store` from the SVG and the layout above. |
+
+## Rules
+
+- **The volume name has no version** (`VectorCraft`, not `VectorCraft <version>`). `.DS_Store` points at the
+  background through an alias that includes the volume name, so a versioned name loses the
+  background. The DMG file name still carries the version.
+- **Finder draws the icon labels in black in light and dark mode** when a window has a background,
+  so the area under both icons stays light (Paper).
+- **Nothing goes inside the icon boxes:** artwork keeps 10 pt clear of each 128 pt icon box and of
+  the label strip under it.
+
+## Regenerate
+
+Edit `background.svg` (or the layout constants in `generate.py`), then run, on any OS:
+
+```sh
+pip install 'pillow>=12' ds_store==1.3.3 mac_alias==2.2.3
+python3 packaging/macos/dmg/generate.py   # needs resvg on PATH, as packaging/icons.sh
+```
+
+It renders the SVG with resvg using only the fonts in `assets/fonts`, so the pixels are the same
+on every machine, and writes `DS_Store` from scratch: the background alias holds the volume name
+and `/.background/background.tiff`, nothing from the machine that ran it. The window is 660 × 432
+with Finder's 32 pt title bar; the content area is 660 × 400.

packaging/macos/dmg/background.svg

@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="660" height="400" viewBox="0 0 660 400">
+<defs><clipPath id="panel"><rect width="232" height="400"/></clipPath><filter id="grain" x="0" y="0" width="100%" height="100%">
+  <feTurbulence type="fractalNoise" baseFrequency="0.9" numOctaves="2" seed="7"/>
+  <feColorMatrix values="0 0 0 0 0.04  0 0 0 0 0.04  0 0 0 0 0.05  0.5 0 0 0 -0.225"/>
+</filter></defs>
+
+<rect width="660" height="400" fill="#efe9dc"/><rect width="660" height="400" filter="url(#grain)"/>
+<g clip-path="url(#panel)"><rect width="232" height="400" fill="#e8573f"/><g transform="translate(-62.5,-31.0) scale(1.05)"><image href="../../../assets/app-icon/vectorcraft-small.svg" width="512" height="512"/></g></g>
+<line x1="232.5" y1="0" x2="232.5" y2="400" stroke="#0b0b0c" stroke-width="1.2"/>
+<line x1="236.5" y1="0" x2="236.5" y2="400" stroke="#0b0b0c" stroke-width="0.5"/>
+<text x="266" y="72" font-family="Inter" font-weight="600" font-size="30" letter-spacing="-0.5" fill="#0b0b0c">VectorCraft</text>
+<line x1="267" y1="88.5" x2="624" y2="88.5" stroke="#0b0b0c" stroke-width="0.6"/>
+<path d="M271.5,81.5 L276,88.5 L271.5,95.5 L267,88.5 Z" fill="#e8573f"/>
+<text x="267" y="112" font-family="JetBrains Mono" font-size="9" fill="#0b0b0c" fill-opacity="0.7">Path · 2 anchors · 2 pt stroke</text>
+<path d="M412,213 C438,169 452,237 482,205" fill="none" stroke="#0b0b0c" stroke-width="2"/><rect x="408.5" y="209.5" width="7" height="7" fill="#efe9dc" stroke="#e8573f" stroke-width="1.4"/><path d="M494.8,201.9 L484.3,211.9 L480.5,199.5 Z" fill="#0b0b0c"/>
+<line x1="267" y1="335.5" x2="624" y2="335.5" stroke="#0b0b0c" stroke-width="0.6"/>
+<text x="267" y="358" font-family="Inter" font-weight="500" font-size="11" letter-spacing="1.5"
+      fill="#0b0b0c" fill-opacity="0.65">DRAG ONTO APPLICATIONS TO INSTALL</text>
+
+</svg>

packaging/macos/dmg/generate.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+"""Regenerate background.tiff and DS_Store for the macOS DMG window (see README.md here).
+
+Needs resvg on PATH (as packaging/icons.sh) and:
+    pip install 'pillow>=12' ds_store==1.3.3 mac_alias==2.2.3
+
+Runs on any OS, no Mac needed. Both outputs come from this script alone, so they carry nothing
+from the machine that made them: no local paths, user or disk names, dates or volume UUIDs.
+
+    python3 packaging/macos/dmg/generate.py
+"""
+
+import datetime
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+from ds_store import DSStore
+from mac_alias import Alias, TargetInfo, VolumeInfo
+from PIL import Image, ImageCms
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+FONTS = os.path.join(HERE, "..", "..", "..", "assets", "fonts")
+
+# Keep in sync with package.sh (volume name) and README.md (layout).
+VOLUME = "VectorCraft"
+WIDTH, HEIGHT = 660, 400  # window content, pt; the background's 1x size
+TITLE_BAR = 32
+ICON_SIZE = 128
+ICONS = {"VectorCraft.app": (326, 205), "Applications": (574, 205)}
+# A fixed date for the alias and the colour profile. Finder never matches it against the image
+# (each build is a new volume): it finds the background by volume name and path.
+FIXED_DATE = datetime.datetime(2026, 10, 8, tzinfo=datetime.timezone.utc)
+
+
+def render(svg, width, out):
+    # Only the repo's fonts (Inter, JetBrains Mono), so every machine draws the same pixels.
+    subprocess.run(
+        ["resvg", "--skip-system-fonts", "--use-fonts-dir", FONTS, "-w", str(width), svg, out],
+        check=True,
+    )
+    with Image.open(out) as im:
+        return im.convert("RGB")
+
+
+def srgb_profile():
+    # LittleCMS's built-in sRGB ("No copyright, use freely"), with its creation date fixed.
+    icc = bytearray(ImageCms.ImageCmsProfile(ImageCms.createProfile("sRGB")).tobytes())
+    d = FIXED_DATE
+    icc[24:36] = b"".join(v.to_bytes(2, "big") for v in (d.year, d.month, d.day, 0, 0, 0))
+    if icc[84:100] != bytes(16):
+        sys.exit("error: the sRGB profile has an ID; recompute it after fixing the date")
+    return bytes(icc)
+
+
+def write_tiff(svg, out):
+    """1x (72 dpi) and 2x (144 dpi) in one TIFF, as `tiffutil -cathidpicheck` writes them."""
+    with tempfile.TemporaryDirectory() as tmp:
+        one, two = (render(svg, WIDTH * s, os.path.join(tmp, f"{s}x.png")) for s in (1, 2))
+    two.encoderinfo = {"dpi": (144, 144)}  # the rest as the first page
+    # Opaque RGB, Deflate without a predictor: the paper grain is noise, which a predictor inflates.
+    one.save(
+        out,
+        "TIFF",
+        save_all=True,
+        append_images=[two],
+        compression="tiff_adobe_deflate",  # brand-ok: Pillow's name for TIFF compression 8 (Deflate)
+        dpi=(72, 72),
+        icc_profile=srgb_profile(),
+    )
+    with Image.open(out) as im:
+        im.seek(1)
+        if im.info.get("dpi") != (144, 144):
+            sys.exit("error: the 2x page isn't 144 dpi (needs Pillow 12 or later)")
+
+
+def background_alias():
+    # What Finder stores for /.background/background.tiff on the volume, minus anything about the
+    # machine (dmgbuild writes the same kind of alias from a mounted image). Disk type 5 (ejectable),
+    # the volume flags and the folder/file ids (25, 26) are what Finder wrote on a test image; the ids
+    # are only hints, as the volume's creation date.
+    volume = VolumeInfo(VOLUME, FIXED_DATE, b"H+", 5, 0x0D02, b"\0\0")
+    volume.posix_path = f"/Volumes/{VOLUME}"
+    target = TargetInfo(0, "background.tiff", 25, 26, FIXED_DATE, b"\0\0\0\0", b"\0\0\0\0")
+    target.folder_name = ".background"
+    target.cnid_path = [25]
+    target.carbon_path = f"{VOLUME}:.background:\0background.tiff"
+    target.posix_path = "/.background/background.tiff"
+    return Alias(volume=volume, target=target).to_bytes()
+
+
+def write_ds_store(out):
+    if os.path.exists(out):
+        os.remove(out)
+    with DSStore.open(out, "w+") as d:
+        d["."]["bwsp"] = {
+            "ShowStatusBar": False,
+            "ShowToolbar": False,
+            "ShowTabView": False,
+            "ContainerShowSidebar": False,
+            "ShowSidebar": False,
+            "WindowBounds": f"{{{{200, 528}}, {{{WIDTH}, {HEIGHT + TITLE_BAR}}}}}",
+        }
+        d["."]["icvp"] = {
+            "viewOptionsVersion": 1,
+            "backgroundType": 2,
+            "backgroundImageAlias": background_alias(),
+            "backgroundColorRed": 1.0,
+            "backgroundColorGreen": 1.0,
+            "backgroundColorBlue": 1.0,
+            "gridOffsetX": 0.0,
+            "gridOffsetY": 0.0,
+            "gridSpacing": 100.0,
+            "arrangeBy": "none",
+            "showIconPreview": True,
+            "showItemInfo": False,
+            "labelOnBottom": True,
+            "textSize": 16.0,
+            "iconSize": float(ICON_SIZE),
+        }
+        d["."]["vSrn"] = ("long", 1)
+        for name, pos in ICONS.items():
+            d[name]["Iloc"] = pos
+
+
+def main():
+    if not shutil.which("resvg"):
+        sys.exit("error: resvg not found (brew install resvg / cargo install resvg)")
+    write_tiff(os.path.join(HERE, "background.svg"), os.path.join(HERE, "background.tiff"))
+    write_ds_store(os.path.join(HERE, "DS_Store"))
+
+
+if __name__ == "__main__":
+    main()

packaging/macos/package.sh

@@ -131,10 +131,15 @@ STAGE="$WORK/dmg"
 mkdir -p "$STAGE"
 ditto "$APP" "$STAGE/VectorCraft.app"
 ln -s /Applications "$STAGE/Applications"
+# Finder window layout: background, icon size and positions (packaging/macos/dmg/README.md).
+mkdir -p "$STAGE/.background"
+cp "$HERE/dmg/background.tiff" "$STAGE/.background/background.tiff"
+cp "$HERE/dmg/DS_Store" "$STAGE/.DS_Store"
 rm -f "$DMG" "$WORK/raw.dmg"
 # makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
 # which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
-hdiutil makehybrid -hfs -hfs-volume-name "VectorCraft $VERSION" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
+# The volume name has no version: .DS_Store finds the background through an alias that includes it.
+hdiutil makehybrid -hfs -hfs-volume-name "VectorCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
 hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"