Fix #593: anchors and handle ends are easier to grab than the segments through them

An anchor was picked within the selection tolerance (3 px), the same reach
as its segments: a press a little off the anchor's 5 px square took the
curve instead.

- `ToolContext::point_tol`: anchors and direction handle ends are picked
  within the selection tolerance, but at least 2 px past the drawn point
  (4.5 px at the default Size 3, more with a larger Size). Anchors are
  tested before segments, so where both are within reach the anchor wins.
- Direct Selection (presses, Highlight anchors on mouse over, blend spine
  points and handles), the Anchor Point, Delete Anchor Point and Scissors
  tools, and the Pen (its Alt conversions; its close/continue reach stays
  5 px unless the points are drawn larger) use it. Segments, objects and
  frame edges keep the selection tolerance.
- Of the topmost path with anchors in reach, the nearest anchor is picked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -4312,8 +4312,10 @@ dependencies = [
  "rfd",
  "serde_json",
  "vectorcraft-engine",
+ "vectorcraft-text",
  "vectorcraft-ui-egui",
  "webbrowser",
+ "windows",
  "winit",
  "winresource",
 ]

README.md

@@ -194,7 +194,7 @@ milestones, and honest time-to-parity estimates.
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
-speaks English, Japanese, Traditional and Simplified Chinese, Spanish and Italian (and Czech and Brazilian Portuguese in the menus).
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish, Italian and Russian (and Czech and Brazilian Portuguese in the menus).
 The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-09 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG window (#493), panels, panel groups and the Tools panel undocking into flLine truncated
+_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
 
 ## Where we are
 
@@ -60,7 +60,8 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
    renderer in its own crate (layering allows it below L6), with output in SVG/PDF as rasters or projected vectors.
    The largest single gap. 50–80 h.
 4. **Advanced type:** CJK composition for vertical type (ruby, mojikumi, proportional vertical metrics, manual
-   tate-chu-yoko), Optical Margin Alignment, the composer/hyphenation options, tab leaders, a
+   tate-chu-yoko), Optical Margin Alignment, the hyphenation and justification options (the Every-line/Single-line
+   composer choice is done), tab leaders, a
    spell-check dictionary (open licence), Touch Type and Snap to Glyph. Vertical point, area and path type have
    initial support. 35–48 h across type core and advanced.
 5. **Brushes, symbols and libraries:** brush options depth; original brush, symbol and graphic-style libraries
@@ -101,8 +102,8 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
   - Panels undock (#495): a dock tab, a panel icon or a popped-out panel's title dragged out of the dock floats that panel inside the window, and the strip right of the dock's tabs floats the whole tabbed group. A floating group moves by its title bar, a tab dragged out of it floats on its own, and dropped on another group's title bar or tabs it stacks with that group; dropped on the dock, which lights up under the pointer, its panels go back where they live (the tabbed group or the icon column), as its × and the panel menus' Float Panel / Dock Panel do (`window.panel.float`, `window.panel.dock`). The Tools panel floats by its title bar and docks again on the window's left edge. Floating panels and the Tools panel's position are kept with the preferences and in user workspaces, and clamped into a smaller window. Not done: panels in separate OS windows, docking a panel into a dock group it doesn't belong to, reordering tabs by dragging, collapsing a floating group to icons, resizing floating panels.
   - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
-  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish and Italian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
-  - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool.
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish, Italian and Russian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool. Native menus explicitly end tracking on command selection, outside window presses and Escape; menu updates wait until tracking ends, and a dismissing press never starts a canvas gesture (M14.8).
   - The macOS menu bar is built from the in-window menus (one model, `native_menu`) and laid out as a Mac app's: the VectorCraft menu holds About, Settings ▸ (each Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays Hide Edges), Hide Others, Show All and Quit; Window gains Minimize ⌃⌘M, Zoom and Bring All to Front, and Help the system's search field. Its key equivalents go back to egui as key presses, so user shortcuts, focused text fields and the Type tool's input method behave as in the window, and nothing fires twice; enabled, check marks and labels update in place. `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps the menus in the window; `ui.inspect` reports `nativeMenuBar`.
   - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats. The DMG opens on a designed Finder window, VectorCraft.app beside the `Applications` link over a background with the app icon (#493).
   - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
@@ -138,10 +139,10 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Geometry and effects:**
   - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
-- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
-- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale) and Italian (every `it-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish and Italian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish and Italian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline, vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale), Italian (every `it-*` locale) and Russian (every `ru-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish, Italian and Russian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish, Italian and Russian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
-- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets; Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
   - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved and loaded as `.vcswatches`, `.gpl` or CSS. Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
   - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
@@ -156,8 +157,9 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
 - **Files (M4):**
   - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
-  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420; hidden objects written hidden on Save and `convert`, and `data-*` attributes kept as the objects' own data: #522); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
   - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
+  - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
   - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
 - **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so any GPU that can show the window will do. Preferences › Performance › Graphics Processor (`gpuPreference`) is Automatic by default: the power-saving GPU on Windows and macOS (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306), and the GPU the desktop runs on under Linux, where KWin on an NVIDIA GPU refused frames from a Ryzen's integrated GPU and 0.5.0 crashed at startup (#502). Power Saving and High Performance pick a kind of GPU; `WGPU_POWER_PREF`, `WGPU_ADAPTER_NAME` and `WGPU_BACKEND` override them. The app picks among the adapters that can present to the window (native backends before OpenGL, hardware before software, and on Windows a GPU's DX12 adapter before its Vulkan one: Intel's Vulkan driver made the whole window flicker black, #545), and if the window fails on one while starting up it starts again without it instead of crashing; Help › About, `ui.inspect` and the log name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
@@ -174,14 +176,14 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 | M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info. Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, polish | 3–6 |
 | M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
 | M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
-| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, Hebrew/Arabic bidirectional text and Paragraph Direction done; tab leaders, spell check, vertical type pending | 45–60 |
+| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height and vertical Align), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, Hebrew/Arabic bidirectional text, Paragraph Direction, Every-line/Single-line Composer per object (ragged text too) done; tab leaders, spell check, vertical type pending | 45–60 |
 | M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
 | M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
 | M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
 | M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (12 presets, 18 ms/1k² image), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
 | M13 | Automation (Actions ✅ record/playback, persisted; variables, scripting, batch) | 🟡 | 18–27 |
-| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs and menus that scroll when longer than the window done; an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
+| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs, menus that scroll when longer than the window and macOS native menu dismissal done (M14.8); an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
 | — | Interaction fidelity pass (every tool's modifiers, Properties panel per context, isolation, nuance) | ⬜ | 60–90 |
 | — | Hardening at scale (big-file corpus, fuzzing, cross-platform + browser QA) | 🟡 | 50–80 |
 | | **Total to full parity** (one agent; re-derived from the [Parity estimate](#parity-estimate) table) | | **~320–500** |
@@ -209,7 +211,7 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Live vector effects | 5 | 85% | Outline Object, Pathfinder Hard/Soft Mix and Trap, SVG Filters | 6–10 |
 | Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 20% | ~55 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery; Document Raster Effects Settings and raster effects in PDF are done | 28–42 |
 | 3D and Materials | 4 | 0% | Extrude & Bevel, Revolve, Inflate, Rotate, lighting, materials (software renderer) | 50–80 |
-| Type core | 9 | 79% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); composer/hyphenation options, Optical Margin Alignment, hidden characters, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 15–20 |
+| Type core | 9 | 79% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); Hyphenation… and Justification… options (Every-line Composer for justified and ragged text, per object, is done; it is tuned by eye, not yet compared side by side with Illustrator; mixed type sizes in a paragraph still break single-line), Optical Margin Alignment, paragraph spacing limit for vertically justified area type, hidden characters, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 14–19 |
 | Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko, Character Alignment on the ICF top and bottom), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
 | Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), Image Trace View modes (Outlines, Source Image) (Vector Halftone is done) | 6–10 |
@@ -220,8 +222,8 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
-| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 30 Preferences options stored but not yet acted on (#394: Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
-| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done | 5–8 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | macOS native menu dismissal fixed (M14.8); remaining: Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 30 Preferences options stored but not yet acted on (#394: Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
+| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done; placed VectorCraft documents are done (linked by default, vectors in every output, previews, Break Link, Expand, Edit Original, refresh on save) | 5–8 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
 | Hardening (big-file corpus, fuzzing, cross-platform and browser QA, accessibility, packaging) | | | | 50–80 |

apps/vectorcraft-cli/src/main.rs

@@ -69,7 +69,8 @@ USAGE:
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
       formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
-      Live effects are kept; --outline-text writes SVG text as paths.
+      Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
+      SVG's data-* attributes; --outline-text writes SVG text as paths.
 
   vectorcraft-cli info FILE
       Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
@@ -177,12 +178,10 @@ fn convert(args: &[String]) -> Result<(), String> {
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
     let mut h = Headless::new();
     h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
-    let r = h
-        .call(
-            "engine.execute",
-            json!({"command": "document.export", "params": {"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text}}),
-        )
-        .map_err(|e| format!("export {output}: {e}"))?;
+    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
+    // PSD).
+    let params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true});
+    let r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     outln!("{r}");
     Ok(())
 }

apps/vectorcraft/Cargo.toml

@@ -19,6 +19,7 @@ windows7 = ["eframe/glow"]
 [dependencies]
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
+vectorcraft-text = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
@@ -36,12 +37,17 @@ winit = { version = "0.30", default-features = false }
 [target.'cfg(windows)'.dependencies]
 clipboard-win = { workspace = true }
 
+# DirectWrite's system font collection (src/system_fonts.rs): fonts that font services such as
+# Adobe Fonts load in place (#579). MIT OR Apache-2.0, already in the build through accesskit.
+[target.'cfg(all(windows, not(target_vendor = "win7")))'.dependencies]
+windows = { version = "0.62", features = ["Win32_Graphics_DirectWrite"] }
+
 [target.'cfg(target_os = "macos")'.dependencies]
 # The macOS menu bar (src/mac_menu.rs): Tauri's menu crate, AppKit menus behind a safe API (no GTK
 # with default features off). Pinned exactly: review the diff before bumping.
 muda = { version = "=0.21.1", default-features = false }
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSMenu", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
 # Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
 objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
 block2 = "0.6"

apps/vectorcraft/src/mac_menu.rs

@@ -12,16 +12,83 @@
 //! - Hide and Hide Others are items of ours calling `NSApplication`: AppKit's own always take ⌘H
 //!   (View › Hide Edges) and ⌥⌘H.
 
+use std::sync::Once;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::{Receiver, channel};
 
+use block2::RcBlock;
+
 use egui::{Key, KeyboardShortcut};
 use muda::accelerator::{Accelerator, Code, Modifiers};
 use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
 use objc2::MainThreadMarker;
-use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType};
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType, NSMenuDidBeginTrackingNotification, NSMenuDidEndTrackingNotification};
+use objc2_foundation::{NSNotification, NSNotificationCenter};
 use vectorcraft_ui_egui::VectorcraftApp;
 use vectorcraft_ui_egui::native_menu::{self, Backend, Event, MenuBar, MenuRole, Node, Standard};
 
+// AppKit can deliver window input while its system menu is still tracking (especially with
+// asynchronous menu presentation). Keep the native tracking state separate from egui popups.
+static TRACKING: AtomicBool = AtomicBool::new(false);
+
+fn observe_tracking(ctx: &egui::Context) {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        // SAFETY: AppKit initializes these immutable notification-name constants.
+        #[allow(unsafe_code)]
+        let notifications = unsafe { [(NSMenuDidBeginTrackingNotification, true), (NSMenuDidEndTrackingNotification, false)] };
+        for (name, tracking) in notifications {
+            let repaint = ctx.clone();
+            let block = RcBlock::new(move |_: std::ptr::NonNull<NSNotification>| {
+                TRACKING.store(tracking, Ordering::Relaxed);
+                // Apply any deferred menu updates as soon as the tracking session ends.
+                if !tracking {
+                    repaint.request_repaint();
+                }
+            });
+            // SAFETY: these are AppKit's notification names. The notification center retains
+            // the observer and block for the application's lifetime; callbacks update an atomic and request repaint.
+            #[allow(unsafe_code)]
+            unsafe {
+                NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(Some(name), None, None, &block);
+            }
+        }
+    });
+}
+
+fn cancel_tracking() {
+    if let Some(mtm) = MainThreadMarker::new()
+        && let Some(menu) = NSApplication::sharedApplication(mtm).mainMenu()
+    {
+        menu.cancelTracking();
+    }
+    TRACKING.store(false, Ordering::Relaxed);
+}
+
+/// A dismissing click belongs to the menu, so the canvas and panel controls must not see it.
+fn dismiss_input(raw: &mut egui::RawInput, tracking: bool) -> bool {
+    if !raw
+        .events
+        .iter()
+        .any(|e| matches!(e, egui::Event::PointerButton { pressed: true, .. } | egui::Event::Key { key: egui::Key::Escape, pressed: true, .. }))
+    {
+        return false;
+    }
+    if tracking {
+        raw.events.retain(|e| !matches!(e, egui::Event::PointerButton { .. } | egui::Event::Key { key: egui::Key::Escape, .. }));
+    }
+    true
+}
+
+/// Inspect real window input before native key equivalents and control events are added.
+pub fn raw_input_hook(raw: &mut egui::RawInput) {
+    // Asynchronous menu presentation may leave a displayed menu after its tracking notification.
+    // Still cancel it, but consume the dismissing input only during a reported tracking session.
+    if dismiss_input(raw, TRACKING.load(Ordering::Relaxed)) {
+        cancel_tracking();
+    }
+}
+
 enum Handle {
     Plain(MenuItem),
     Check(CheckMenuItem),
@@ -48,10 +115,13 @@ pub struct MacMenu {
     entries: Vec<Entry>,
     rx: Receiver<Chosen>,
     structure: u64,
+    /// Latest menu state to apply after AppKit finishes tracking; item ids stay stable meanwhile.
+    pending: Option<MenuBar>,
 }
 
 impl MacMenu {
     fn new(ctx: &egui::Context) -> MacMenu {
+        observe_tracking(ctx);
         let (tx, rx) = channel();
         let repaint = ctx.clone();
         MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
@@ -67,7 +137,7 @@ impl MacMenu {
             // Wake egui, so the item runs now rather than on the next mouse move.
             repaint.request_repaint();
         }));
-        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0 }
+        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0, pending: None }
     }
 
     /// Build the menus of `bar` and make them the app's, in place of the ones before.
@@ -146,6 +216,13 @@ fn append(sub: &Submenu, nodes: &[Node], entries: &mut Vec<Entry>) -> muda::Resu
 
 impl Backend for MacMenu {
     fn sync(&mut self, bar: &MenuBar) {
+        // Replacing or mutating an NSMenu during tracking can strand its displayed menu. Keep
+        // the latest state: the shared model considers this sync complete and may not resend it.
+        if TRACKING.load(Ordering::Relaxed) {
+            self.pending = Some(bar.clone());
+            return;
+        }
+        self.pending = None;
         let items = bar.items();
         if self.menu.is_none() || native_menu::structure_key(bar) != self.structure || items.len() != self.entries.len() {
             if let Err(e) = self.build(bar) {
@@ -183,6 +260,7 @@ impl Backend for MacMenu {
     fn drain(&mut self) -> Vec<Event> {
         let mut out = Vec::new();
         while let Ok(chosen) = self.rx.try_recv() {
+            cancel_tracking();
             // Ids that aren't ours are AppKit's own items (Services, Zoom…), already handled.
             let Some(e) = chosen.id.strip_prefix("vc").and_then(|n| n.parse::<usize>().ok()).and_then(|i| self.entries.get(i)) else { continue };
             if let Some(command @ (native_menu::HIDE | native_menu::HIDE_OTHERS)) = e.item.command {
@@ -207,6 +285,12 @@ impl Backend for MacMenu {
                 None => Event::Click(e.item.clone()),
             });
         }
+        // Drain against the old item ids before a deferred structure change replaces them.
+        if !TRACKING.load(Ordering::Relaxed)
+            && let Some(bar) = self.pending.take()
+        {
+            self.sync(&bar);
+        }
         out
     }
 }
@@ -364,4 +448,40 @@ mod tests {
         assert_ne!(parse("Cmd+M"), parse("Ctrl+Cmd+M"));
         assert!(parse("Cmd+M").is_some());
     }
+
+    fn press() -> egui::Event {
+        egui::Event::PointerButton {
+            pos: egui::pos2(300.0, 200.0),
+            button: egui::PointerButton::Primary,
+            pressed: true,
+            modifiers: Default::default(),
+        }
+    }
+
+    #[test]
+    fn outside_press_dismisses_without_starting_a_canvas_gesture() {
+        let moved = egui::Event::PointerMoved(egui::pos2(300.0, 200.0));
+        let mut raw = egui::RawInput { events: vec![moved.clone(), press()], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert_eq!(raw.events, [moved]);
+        assert!(!dismiss_input(&mut raw, true));
+        raw.events.push(press());
+        assert!(dismiss_input(&mut raw, false));
+        assert_eq!(raw.events.len(), 2, "ordinary canvas presses still reach egui");
+    }
+
+    #[test]
+    fn escape_dismisses_without_reaching_the_active_tool() {
+        let escape = |pressed| egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed, repeat: false, modifiers: Default::default() };
+        let mut raw = egui::RawInput { events: vec![escape(true), escape(false)], ..Default::default() };
+        assert!(dismiss_input(&mut raw, true));
+        assert!(raw.events.is_empty());
+    }
+
+    #[test]
+    fn moving_the_pointer_does_not_dismiss_a_tracking_menu() {
+        let mut raw = egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(300.0, 200.0))], ..Default::default() };
+        assert!(!dismiss_input(&mut raw, true));
+        assert_eq!(raw.events.len(), 1);
+    }
 }

apps/vectorcraft/src/main.rs

@@ -27,6 +27,8 @@ mod mac_menu;
 #[cfg(target_os = "macos")]
 mod open_documents;
 mod printing;
+#[cfg(all(windows, not(target_vendor = "win7")))]
+mod system_fonts;
 mod window;
 
 use vectorcraft_engine::Session;
@@ -68,6 +70,10 @@ impl eframe::App for App {
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        #[cfg(target_os = "macos")]
+        if self.app.services.native_menu.is_some() {
+            mac_menu::raw_input_hook(raw);
+        }
         self.app.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -310,6 +316,9 @@ fn main() -> std::process::ExitCode {
     // First, so every start-up warning is recorded (`logging`).
     let logger = logging::install();
     vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
+    // Before the first font scan (the app's start): the fonts font services load (#579).
+    #[cfg(all(windows, not(target_vendor = "win7")))]
+    system_fonts::install();
     let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
     let mut files = Vec::new();
     let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");

apps/vectorcraft/src/system_fonts.rs

@@ -0,0 +1,91 @@
+//! Windows: the font files in DirectWrite's system font collection, scanned with the font folders
+//! (`vectorcraft_text::set_platform_font_files`).
+//!
+//! Font services such as Adobe Fonts load their fonts with GDI at run time, from files in their
+//! own folders, without installing them: the font folders and the registry don't list them. Since
+//! Windows 10 (version 1607) DirectWrite's system font collection holds them too
+//! (<https://learn.microsoft.com/windows/win32/directwrite/what-s-new-in-directwrite-for-windows-8-consumer-preview>,
+//! "Support for Adobe Typekit and other font-service clients"), so VectorCraft lists them as other
+//! apps do, reading the files in place (#579).
+//!
+//! DirectWrite is COM, which has no safe API, hence the scoped `unsafe_code` allowance.
+#![allow(unsafe_code)]
+
+use std::collections::BTreeSet;
+
+use windows::Win32::Graphics::DirectWrite::{
+    DWRITE_FACTORY_TYPE_SHARED, DWriteCreateFactory, IDWriteFactory3, IDWriteFontSet, IDWriteLocalFontFileLoader,
+};
+use windows::core::Interface;
+
+/// The most fonts read from the collection (a system has a few thousand).
+const MAX_FONTS: u32 = 1 << 16;
+/// The longest file path taken, in UTF-16 units (Windows' own limit).
+const MAX_PATH: u32 = 32_767;
+
+/// Have the font scans read the font files DirectWrite lists.
+pub fn install() {
+    vectorcraft_text::set_platform_font_files(font_files);
+}
+
+/// The local files of the fonts in DirectWrite's system font collection as it is now (fonts
+/// loaded since the last call included). None before Windows 10, or when DirectWrite fails: the
+/// font folders and the registry still list the installed fonts.
+fn font_files() -> Vec<String> {
+    match collection_files() {
+        Ok(files) => files.into_iter().collect(),
+        Err(e) => {
+            log::debug!("DirectWrite's system fonts aren't listed: {e}");
+            Vec::new()
+        }
+    }
+}
+
+fn collection_files() -> windows::core::Result<BTreeSet<String>> {
+    // SAFETY: plain DirectWrite calls on interfaces it returned, each checked for failure; the
+    // collection is asked to check for fonts loaded since the factory last looked.
+    let set = unsafe {
+        let factory: IDWriteFactory3 = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED)?;
+        let mut collection = None;
+        factory.GetSystemFontCollection(false, &mut collection, true)?;
+        let Some(collection) = collection else { return Ok(BTreeSet::new()) };
+        collection.GetFontSet()?
+    };
+    // SAFETY: a count of the set's fonts.
+    let count = unsafe { set.GetFontCount() }.min(MAX_FONTS);
+    // Faces of one file (a collection's, a variable font's instances) name it once.
+    Ok((0..count).filter_map(|i| local_path(&set, i)).collect())
+}
+
+/// The path of the file holding font `i` of `set`, when it is a local file (not a downloadable
+/// font, nor one in memory).
+fn local_path(set: &IDWriteFontSet, i: u32) -> Option<String> {
+    // SAFETY: `i` is below the set's count; the key DirectWrite hands back stays valid while
+    // `file` (which owns it) lives, and is passed back with its own size; the path buffer is
+    // sized from DirectWrite's answer plus the terminating NUL.
+    unsafe {
+        let file = set.GetFontFaceReference(i).ok()?.GetFontFile().ok()?;
+        let loader: IDWriteLocalFontFileLoader = file.GetLoader().ok()?.cast().ok()?;
+        let (mut key, mut size) = (std::ptr::null_mut(), 0u32);
+        file.GetReferenceKey(&mut key, &mut size).ok()?;
+        let len = loader.GetFilePathLengthFromKey(key, size).ok()?;
+        if len == 0 || len > MAX_PATH {
+            return None;
+        }
+        let mut path = vec![0u16; len as usize + 1];
+        loader.GetFilePathFromKey(key, size, &mut path).ok()?;
+        Some(String::from_utf16_lossy(path.get(..len as usize)?))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    /// DirectWrite lists the installed fonts, by their files' full paths.
+    #[test]
+    fn directwrite_lists_the_installed_font_files() {
+        let files = super::font_files();
+        assert!(files.iter().all(|f| std::path::Path::new(f).is_absolute()), "{:?}", files.first());
+        let fonts = std::path::Path::new(&std::env::var("WINDIR").unwrap()).join("Fonts").to_string_lossy().to_lowercase();
+        assert!(files.iter().any(|f| f.to_lowercase().starts_with(&fonts)), "{} files, {:?}", files.len(), files.first());
+    }
+}

contributors/people.toml

@@ -25,3 +25,9 @@ sync_github_name = false
 [people.callmeBalloch]
 real_name = "Riccardo Balloch"
 sync_github_name = false
+
+[people.mo0kid]
+sync_github_name = true
+
+[people.omd0]
+sync_github_name = true

crates/cad/src/scene.rs

@@ -315,7 +315,7 @@ impl<'a> Scene<'a> {
                 }
             }
             // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(c, false);

crates/doc/src/blend.rs

@@ -527,7 +527,8 @@ impl Lerp {
             (NodeKind::Mesh(ma), NodeKind::Mesh(mb)) if ma.rows == mb.rows && ma.cols == mb.cols && ma.points.len() == mb.points.len() => Shape::Mesh,
             (NodeKind::Text(_), NodeKind::Text(_))
             | (NodeKind::SymbolInstance { .. }, NodeKind::SymbolInstance { .. })
-            | (NodeKind::Image(_), NodeKind::Image(_)) => Shape::Placed,
+            | (NodeKind::Image(_), NodeKind::Image(_))
+            | (NodeKind::PlacedDocument(_), NodeKind::PlacedDocument(_)) => Shape::Placed,
             _ => match (node_path(a), node_path(b)) {
                 (Some((pa, ra, ma)), Some((pb, rb, mb))) => {
                     Shape::Path { pair: PathPair::new(&pa, &pb, starts), rules: (ra, rb), members: ma.zip(mb) }
@@ -586,6 +587,7 @@ impl Lerp {
                         *o = lerp_affine(*x, *y, t)
                     }
                     (NodeKind::Image(o), NodeKind::Image(x), NodeKind::Image(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
+                    (NodeKind::PlacedDocument(o), NodeKind::PlacedDocument(x), NodeKind::PlacedDocument(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
                     _ => {}
                 }
                 n.mask = None;

crates/doc/src/hit.rs

@@ -199,9 +199,12 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
             n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p))?;
             on_type_path(n, t, p, opt.tol).then_some(HitKind::Outline)
         }
-        NodeKind::Text(_) | NodeKind::Image(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
-            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
-        }
+        NodeKind::Text(_)
+        | NodeKind::Image(_)
+        | NodeKind::PlacedDocument(_)
+        | NodeKind::SymbolInstance { .. }
+        | NodeKind::Blend { .. }
+        | NodeKind::Envelope { .. } => n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
         NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt)),
         NodeKind::Mesh(m) => {
             let bp = m.outline().to_bezpath();

crates/doc/src/lib.rs

@@ -24,6 +24,7 @@ pub mod overprint;
 pub mod pattern;
 pub mod perspective;
 mod pixels;
+pub mod placed_document;
 pub mod profiles;
 pub mod puppet;
 pub mod range;
@@ -72,6 +73,7 @@ pub use node::{ImageObject, LAYER_COLORS, LayerColor, LiveShape, Node, NodeId, N
 pub use orient::OrientedBox;
 pub use pattern::{Overlap, PatternDef, PatternEdit, RepeatKind, RepeatSpec, TileType};
 pub use perspective::PerspectiveAttachment;
+pub use placed_document::PlacedDocument;
 pub use profiles::ColorProfiles;
 pub use puppet::{PuppetPin, PuppetPins};
 pub use rastersettings::{RasterColorModel, RasterEffectsSettings};
@@ -80,8 +82,8 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, FirstBaseline, Justify, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign,
-    PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, WrapShape,
+    AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, FirstBaseline, Justify, LeadingModel, Mojikumi, ParaDirection, ParaStyle,
+    PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
 };
 pub use vectorcraft_color as color;
 pub use vectorcraft_geom as geom;

crates/doc/src/links.rs

@@ -137,7 +137,7 @@ impl Document {
         }
     }
 
-    /// The keys of image blobs only linked images show: what a save writes as their preview.
+    /// The keys of image blobs only linked images (or placed documents, always linked) show: what a save writes as their preview.
     pub fn linked_only_images(&self) -> BTreeSet<String> {
         if self.images.values().all(|b| b.proxy.is_none()) {
             return BTreeSet::new();
@@ -152,6 +152,8 @@ impl Document {
                 u.1 = true;
             }
         });
+        // A placed document saves its file's preview the same way.
+        self.visit_placed(|_, p| uses.entry(p.key.as_str()).or_default().0 = true);
         uses.into_iter().filter(|(_, (linked, embedded))| *linked && !embedded).map(|(k, _)| k.to_string()).collect()
     }
 }

crates/doc/src/live.rs

@@ -1447,6 +1447,8 @@ fn map_node(n: &Node, w: &Warper) -> Node {
             let im = im.clone();
             return warp_image(&out, &im, w);
         }
+        // Its art is plain, so it warps at this depth.
+        NodeKind::PlacedDocument(_) => return map_node(&expanded_group_hooks(n, w.hooks), w),
     }
     out
 }
@@ -1607,7 +1609,7 @@ pub fn envelope_bounds(content: &[Arc<Node>], kind: &EnvelopeKind, frame: Affine
 
 /// Is this one of the live kinds?
 pub fn is_live(n: &Node) -> bool {
-    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_))
+    matches!(n.kind, NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_))
 }
 
 /// Mesh tessellation as filled quad paths (no stroke), `n`×`n` per patch.
@@ -1641,6 +1643,7 @@ pub fn expand_live_hooks(n: &Node, hooks: Hooks) -> Vec<Node> {
         NodeKind::Envelope { content, kind, fidelity, options, frame, .. } => expand_envelope(content, kind, *fidelity, *options, *frame, hooks),
         NodeKind::Mesh(m) => mesh_quad_nodes(m, 8),
         NodeKind::Repeat(r) => r.expand(),
+        NodeKind::PlacedDocument(p) => p.art(n),
         _ => vec![n.clone()],
     }
 }

crates/doc/src/node.rs

@@ -423,6 +423,9 @@ pub enum NodeKind {
     Mesh(GradientMesh),
     /// Live Repeat (radial / grid / mirror) of source art.
     Repeat(RepeatSpec),
+    /// A placed document: an artboard of another VectorCraft file, linked and locked (see
+    /// [`crate::placed_document`]).
+    PlacedDocument(Box<crate::placed_document::PlacedDocument>),
 }
 
 fn yes() -> bool {
@@ -642,6 +645,7 @@ impl Node {
             NodeKind::Envelope { .. } => "Envelope",
             NodeKind::Mesh(_) => "Mesh",
             NodeKind::Repeat(r) => r.kind.label(),
+            NodeKind::PlacedDocument(_) => "Placed Document",
         }
     }
     /// Name shown in the Layers panel: explicit name or `<Kind>`.
@@ -715,6 +719,7 @@ impl Node {
             NodeKind::Envelope { content, kind, frame, .. } => crate::live::envelope_bounds(content, kind, *frame),
             NodeKind::Mesh(m) => m.bounds(),
             NodeKind::Repeat(r) => r.bounds(),
+            NodeKind::PlacedDocument(p) => Some(p.bounds()),
         }
     }
     /// Visual bounds: what the object paints, its strokes included (paths and compound paths
@@ -810,6 +815,7 @@ impl Node {
                 }
             }
             NodeKind::Image(im) => im.xf = a * im.xf,
+            NodeKind::PlacedDocument(p) => p.xf = a * p.xf,
             NodeKind::SymbolInstance { xf, .. } => *xf = a * *xf,
             NodeKind::Blend { children, spec } => {
                 for c in children.iter_mut() {
@@ -972,6 +978,10 @@ impl Node {
                 let frame = shapes::rectangle(Rect::new(0.0, 0.0, im.width as f64, im.height as f64)).transformed(im.xf);
                 out.push((frame.to_bezpath(), FillRule::NonZero));
             }
+            NodeKind::PlacedDocument(p) => {
+                let frame = shapes::rectangle(p.natural()).transformed(p.xf);
+                out.push((frame.to_bezpath(), FillRule::NonZero));
+            }
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
                 crate::live::expand_deep(self, text).push_clip_shapes(text, out);
             }
@@ -1204,6 +1214,10 @@ pub struct ObjectAttributes {
     /// The note shown in the Attributes panel.
     #[serde(default, skip_serializing_if = "String::is_empty")]
     pub note: String,
+    /// The object's own data, in order: SVG's `data-*` attributes (`data-pivot="100,180"` is
+    /// `("pivot", "100,180")`), kept from import to export (`object.setProps {data}`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub data: Vec<(String, String)>,
 }
 
 /// The Attributes panel's Image Map shapes.

crates/doc/src/placed_document.rs

@@ -0,0 +1,684 @@
+//! Placed documents: another VectorCraft file placed linked ([`PlacedDocument`]).
+//!
+//! The object keeps the link to the file and the file's bytes, stored like image data in
+//! [`Document::images`] (with a small preview a save writes instead, as for linked images), so the
+//! document shows correctly without the file. The art it shows is read from those bytes and never
+//! joins the object tree, so editing can't reach it: it is locked by design. Drawing and exporting
+//! expand it like a live object ([`crate::live::expanded`]).
+//!
+//! The file is read by the native format's loader, which lives above this crate and registers
+//! itself ([`set_loader`]); the art read is kept in a small cache by content. Before exporting,
+//! every exporter calls [`Document::with_placed_art`], which adds the resources the art uses
+//! (images, symbols, patterns) under names of their own ([`RESOURCE_PREFIX`]) to a temporary copy
+//! of the document, so they never meet the user's or show in panels. Placed documents inside a
+//! placed document are read the same way, up to [`MAX_DEPTH`] deep (documents that place each
+//! other stop there, showing their previews).
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+use std::sync::{Arc, Mutex, MutexGuard, OnceLock, PoisonError};
+
+use serde::{Deserialize, Serialize};
+use vectorcraft_geom::{Affine, Rect};
+
+use vectorcraft_color::Paint;
+
+use crate::{AppearanceItem, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeKind, PatternDef, PlacementOptions, Symbol};
+
+/// A placed document: an artboard of another VectorCraft file, shown as one locked object.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PlacedDocument {
+    /// The file (its `page` is the artboard shown, 1-based).
+    pub link: LinkInfo,
+    /// Key into [`Document::images`]: the file's bytes (see [`key_for`]).
+    pub key: String,
+    /// The art's bounds rather than the artboard (File › Place's `crop: "bounding"`).
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub bounding: bool,
+    /// The artboard's size (or the art's) at 100% (pt).
+    pub width: f64,
+    pub height: f64,
+    /// Maps the box (0..width, 0..height) into the document.
+    pub xf: Affine,
+    /// Links panel → Placement Options: how the file read again takes this object's place.
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub placement: PlacementOptions,
+}
+
+/// The images key of a file's bytes (`hash`, [`crate::links::hash_bytes`]) placed showing
+/// artboard `page` (`bounding`: its art's bounds): objects showing the same thing share a blob and
+/// its preview.
+pub fn key_for(hash: &str, page: u32, bounding: bool) -> String {
+    format!("{hash}-{page}{}", if bounding { "b" } else { "" })
+}
+
+impl PlacedDocument {
+    /// The artboard shown (1-based).
+    pub fn page(&self) -> u32 {
+        self.link.page.unwrap_or(1)
+    }
+
+    /// The box at 100%.
+    pub fn natural(&self) -> Rect {
+        Rect::new(0.0, 0.0, self.width, self.height)
+    }
+
+    /// The four corners of the box in the document.
+    pub fn corners(&self) -> [vectorcraft_geom::Point; 4] {
+        let r = self.natural();
+        [(r.x0, r.y0), (r.x1, r.y0), (r.x1, r.y1), (r.x0, r.y1)].map(|(x, y)| self.xf * vectorcraft_geom::Point::new(x, y))
+    }
+
+    /// The box in the document (axis-aligned).
+    pub fn bounds(&self) -> Rect {
+        self.xf.transform_rect_bbox(self.natural())
+    }
+
+    /// The transform from the file's coordinates (its artboard or art bounds `frame`) to the
+    /// document; `None` when either size is empty.
+    pub fn art_xf(&self, frame: Rect) -> Option<Affine> {
+        let ok = self.width > 0.0 && self.height > 0.0 && frame.width() > 0.0 && frame.height() > 0.0;
+        ok.then(|| {
+            self.xf * Affine::scale_non_uniform(self.width / frame.width(), self.height / frame.height()) * Affine::translate((-frame.x0, -frame.y0))
+        })
+    }
+
+    /// The art the object shows, as plain objects with `n`'s id: one group, its resources named
+    /// as [`Document::with_placed_art`] adds them (nothing until that has read it).
+    pub fn art(&self, n: &Node) -> Vec<Node> {
+        let prefix = prefix(&self.key);
+        read_cached(self).and_then(|e| self.art_node(n, &e, &prefix)).into_iter().collect()
+    }
+
+    /// Read `e`'s art placed as this object `n` shows it (`n`'s id), its resources renamed with
+    /// `prefix`.
+    fn art_node(&self, n: &Node, e: &ReadDocument, prefix: &str) -> Option<Node> {
+        let m = self.art_xf(e.frame)?;
+        let mut g = (*e.art).clone();
+        rename(&mut g, prefix);
+        g.transform(m, true);
+        each_mut(&mut g, &mut |c| crate::pattern::transform_pattern_paints(c, m));
+        g.id = n.id;
+        Some(g)
+    }
+
+    /// An image object showing preview `bytes` (stored under this object's key) in this object's
+    /// box: what it shows and outputs as when the file can't be read.
+    pub fn preview_image(&self, bytes: &[u8]) -> Option<ImageObject> {
+        let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+        let px = Affine::scale_non_uniform(self.width / w as f64, self.height / h as f64);
+        Some(ImageObject { key: self.key.clone(), width: w, height: h, xf: self.xf * px, link: None, placement: Default::default() })
+    }
+}
+
+/// The names the resources of the art stored under `key` take in a prepared document.
+fn prefix(key: &str) -> String {
+    format!("{RESOURCE_PREFIX}{key}/")
+}
+
+/// `n` and every descendant, opacity-mask art included.
+fn walk_all<'a>(n: &'a Node, f: &mut impl FnMut(&'a Node)) {
+    f(n);
+    if let Some(m) = &n.mask {
+        walk_all(&m.art, f);
+    }
+    for c in n.children().into_iter().flatten() {
+        walk_all(c, f);
+    }
+}
+
+/// The roots of `d`'s art: layers, symbol definitions and pattern swatches.
+fn roots(d: &Document) -> impl Iterator<Item = &Arc<Node>> {
+    d.layers.iter().chain(d.symbols.iter().map(|s| &s.art)).chain(d.patterns.iter().flat_map(|p| &p.art))
+}
+
+fn roots_mut(d: &mut Document) -> impl Iterator<Item = &mut Arc<Node>> {
+    d.layers.iter_mut().chain(d.symbols.iter_mut().map(|s| &mut s.art)).chain(d.patterns.iter_mut().flat_map(|p| &mut p.art))
+}
+
+impl Document {
+    /// Visit every placed document: in the layers, then in symbol definitions and pattern
+    /// swatches, opacity-mask art included.
+    pub fn visit_placed<'a>(&'a self, mut f: impl FnMut(&'a Node, &'a PlacedDocument)) {
+        for root in roots(self) {
+            walk_all(root, &mut |n| {
+                if let NodeKind::PlacedDocument(p) = &n.kind {
+                    f(n, p);
+                }
+            });
+        }
+    }
+
+    /// Does the document hold a placed document anywhere?
+    pub fn has_placed(&self) -> bool {
+        let mut any = false;
+        self.visit_placed(|_, _| any = true);
+        any
+    }
+
+    /// Every placed document (those in the art they show too) replaced by a plain group of that
+    /// art, for apps that don't know them: call it on [`Self::with_placed_art`]'s copy. Only the
+    /// subtrees holding one are copied.
+    pub fn placed_as_groups(&mut self) {
+        fn holds(n: &Node) -> bool {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(c.kind, NodeKind::PlacedDocument(_)));
+            hit
+        }
+        fn update(n: &mut Arc<Node>) {
+            if !holds(n) {
+                return;
+            }
+            if matches!(n.kind, NodeKind::PlacedDocument(_)) {
+                let mut g = crate::live::expanded_group(n, None);
+                g.appearance = n.appearance.clone();
+                *n = Arc::new(g);
+            }
+            // The art shown may hold placed documents too.
+            let n = Arc::make_mut(n);
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c);
+            }
+        }
+        for root in roots_mut(self) {
+            update(root);
+        }
+    }
+
+    /// Placed documents whose key is in `keys` replaced by images of their previews (for output
+    /// when their files can't be read).
+    pub fn placed_as_previews(&mut self, keys: &BTreeSet<String>) {
+        fn update(n: &mut Arc<Node>, keys: &BTreeSet<String>, images: &std::collections::BTreeMap<String, ImageBlob>) {
+            let mut hit = false;
+            walk_all(n, &mut |c| hit |= matches!(&c.kind, NodeKind::PlacedDocument(p) if keys.contains(&p.key)));
+            if !hit {
+                return;
+            }
+            let n = Arc::make_mut(n);
+            if let NodeKind::PlacedDocument(p) = &n.kind
+                && keys.contains(&p.key)
+            {
+                if let Some(im) = images.get(&p.key).and_then(|b| p.preview_image(&b.bytes)) {
+                    n.kind = NodeKind::Image(im);
+                }
+                return;
+            }
+            if let Some(m) = &mut n.mask {
+                update(&mut m.art, keys, images);
+            }
+            for c in n.children_mut().into_iter().flatten() {
+                update(c, keys, images);
+            }
+        }
+        let images = self.images.clone();
+        for root in roots_mut(self) {
+            update(root, keys, &images);
+        }
+    }
+}
+
+// ---------- previews and the files' bytes ----------
+
+/// A placed document's preview: this many pixels per point of its box…
+pub const PREVIEW_PX_PER_PT: f64 = 1.0;
+/// …and at most this many on its longer side.
+pub const PREVIEW_MAX: u32 = 1024;
+/// How deep placed documents inside placed documents are read; deeper ones show their previews.
+pub const MAX_DEPTH: usize = 8;
+
+/// Reads `p`'s file again (`None`: not found, or changed since it was read). The engine registers
+/// one with [`set_file_reader`].
+pub type FileReader = fn(&PlacedDocument) -> Option<Vec<u8>>;
+
+static FILE_READER: OnceLock<FileReader> = OnceLock::new();
+
+/// Register how files are read again (the first registration stays).
+pub fn set_file_reader(f: FileReader) {
+    // Already set: the same engine, registered by another session.
+    let _ = FILE_READER.set(f);
+}
+
+/// The most bytes of files read again kept.
+const FULL_BYTES: usize = 512 << 20;
+
+/// Files read again, by key, the most recently read last.
+type FullFiles = Vec<(String, Arc<Vec<u8>>)>;
+
+static FULL: Mutex<FullFiles> = Mutex::new(Vec::new());
+
+fn full() -> MutexGuard<'static, FullFiles> {
+    // Entries are only pushed and removed: a panic while held leaves it whole.
+    FULL.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// The file's bytes when they are at hand: stored (`blob` isn't just the preview) or read again
+/// already. Never reads it.
+pub fn full_bytes_cached(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if !blob.is_proxy() {
+        return Some(blob.bytes.clone());
+    }
+    full().iter().rev().find(|(k, _)| *k == p.key).map(|(_, b)| b.clone())
+}
+
+/// The file's bytes: stored, read again already, or read again now ([`set_file_reader`]). `None`
+/// when only the preview can be had.
+pub fn full_bytes(p: &PlacedDocument, blob: &ImageBlob) -> Option<Arc<Vec<u8>>> {
+    if let Some(b) = full_bytes_cached(p, blob) {
+        return Some(b);
+    }
+    let b = Arc::new(FILE_READER.get()?(p)?);
+    let mut c = full();
+    c.push((p.key.clone(), b.clone()));
+    let mut total: usize = c.iter().map(|(_, b)| b.len()).sum();
+    while total > FULL_BYTES && c.len() > 1 {
+        total = total.saturating_sub(c.remove(0).1.len());
+    }
+    Some(b)
+}
+
+/// The size in pixels of image bytes `bytes` (a preview), read from its header.
+pub fn image_size(bytes: &[u8]) -> Option<(u32, u32)> {
+    image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()
+}
+
+// ---------- reading files ----------
+
+/// The prefix of the names the resources of placed documents' art take in a prepared document:
+/// `placed:<key>/<name>`.
+pub const RESOURCE_PREFIX: &str = "placed:";
+
+/// Reads a placed document's file (its bytes) into what it shows: a document holding the
+/// resources (no layers), the art as one group in the file's coordinates, and the frame shown
+/// (the artboard, or the art's bounds). The native format lives above this crate, so the engine
+/// registers one with [`set_loader`].
+pub type Loader = fn(&PlacedDocument, &[u8]) -> Option<(Document, Node, Rect)>;
+
+static LOADER: OnceLock<Loader> = OnceLock::new();
+
+/// Register how files are read (the first registration stays).
+pub fn set_loader(l: Loader) {
+    // Already set: the same loader, registered by another session.
+    let _ = LOADER.set(l);
+}
+
+/// The most files kept read whatever their size.
+const CACHE_SIZE: usize = 64;
+/// Past [`CACHE_SIZE`], the most bytes of files kept read (their own sizes, standing for what
+/// reading them holds).
+const CACHE_BYTES: usize = 256 << 20;
+
+/// A placed document's file read: the art it shows, ready to draw with its own resources.
+pub struct ReadDocument {
+    key: String,
+    /// Read from the preview, not the file.
+    preview: bool,
+    /// The bytes read (what tells a cached read is still the one shown).
+    bytes: Arc<Vec<u8>>,
+    /// The artboard (or art bounds) shown: what the object's box shows.
+    pub frame: Rect,
+    /// The art as one group, in the file's coordinates. Its images, symbols and patterns are
+    /// `doc`'s, under their own names.
+    pub art: Arc<Node>,
+    /// The file's resources and setup (no layers: the art is `art`).
+    pub doc: Arc<Document>,
+}
+
+struct Entry {
+    e: Arc<ReadDocument>,
+    used: u64,
+}
+
+#[derive(Default)]
+struct Cache {
+    entries: std::collections::HashMap<(String, bool), Entry>,
+    clock: u64,
+}
+
+static CACHE: std::sync::LazyLock<Mutex<Cache>> = std::sync::LazyLock::new(Default::default);
+
+fn cache() -> MutexGuard<'static, Cache> {
+    // A panic while the cache was held leaves it whole (entries are only inserted and removed).
+    CACHE.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+impl Cache {
+    /// The read of `key` (its preview's when `preview`; made from `bytes` when given), marked used.
+    fn get(&mut self, key: &str, preview: bool, bytes: Option<&Arc<Vec<u8>>>) -> Option<Arc<ReadDocument>> {
+        self.clock += 1;
+        let clock = self.clock;
+        let e = self.entries.get_mut(&(key.to_string(), preview))?;
+        if bytes.is_some_and(|b| !Arc::ptr_eq(&e.e.bytes, b)) {
+            return None;
+        }
+        e.used = clock;
+        Some(e.e.clone())
+    }
+
+    fn insert(&mut self, e: Arc<ReadDocument>) {
+        self.clock += 1;
+        self.entries.insert((e.key.clone(), e.preview), Entry { e, used: self.clock });
+        // The least recently used go while over both limits.
+        let mut total: usize = self.entries.values().map(|x| x.e.bytes.len()).sum();
+        while self.entries.len() > CACHE_SIZE && total > CACHE_BYTES {
+            let Some(k) = self.entries.iter().min_by_key(|(_, x)| x.used).map(|(k, _)| k.clone()) else { break };
+            if let Some(x) = self.entries.remove(&k) {
+                total = total.saturating_sub(x.e.bytes.len());
+            }
+        }
+    }
+}
+
+/// `p`'s file (`bytes`) read, from the cache when it was read already: what the renderer draws a
+/// placed document from. `None` when it can't be read (or no loader is registered).
+pub fn read(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, false, Some(bytes)) {
+        return Some(e);
+    }
+    let loader = LOADER.get()?;
+    let (doc, art, frame) = loader(p, bytes)?;
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s preview (`bytes`) read as art: one image filling the box.
+fn read_preview(p: &PlacedDocument, bytes: &Arc<Vec<u8>>) -> Option<Arc<ReadDocument>> {
+    if let Some(e) = cache().get(&p.key, true, Some(bytes)) {
+        return Some(e);
+    }
+    let (w, h) = image_size(bytes).filter(|(w, h)| *w > 0 && *h > 0)?;
+    let frame = p.natural();
+    let mut doc = Document::new(frame.width().max(1.0), frame.height().max(1.0));
+    doc.layers.clear();
+    doc.swatches.clear();
+    let mime = if bytes.starts_with(&[0xff, 0xd8]) { "image/jpeg" } else { "image/png" };
+    doc.images.insert("preview".into(), ImageBlob { mime: mime.into(), bytes: bytes.clone(), proxy: None });
+    let xf = Affine::scale_non_uniform(frame.width() / w as f64, frame.height() / h as f64);
+    let im = ImageObject { key: "preview".into(), width: w, height: h, xf, link: None, placement: Default::default() };
+    let art = Node::new(art_id(), NodeKind::Group { children: vec![Arc::new(Node::new(art_id(), NodeKind::Image(im)))], clip: false });
+    let e = Arc::new(ReadDocument { key: p.key.clone(), preview: true, bytes: bytes.clone(), frame, art: Arc::new(art), doc: Arc::new(doc) });
+    cache().insert(e.clone());
+    Some(e)
+}
+
+/// `p`'s file as read already (else its preview's), without reading it.
+pub fn read_cached(p: &PlacedDocument) -> Option<Arc<ReadDocument>> {
+    let mut c = cache();
+    c.get(&p.key, false, None).or_else(|| c.get(&p.key, true, None))
+}
+
+/// Keep `read` (what [`Loader`] gives), just read from `bytes` for `p` (when it was placed), so
+/// drawing it doesn't read it again.
+pub fn prime(p: &PlacedDocument, bytes: Arc<Vec<u8>>, (doc, art, frame): (Document, Node, Rect)) {
+    cache().insert(Arc::new(ReadDocument { key: p.key.clone(), preview: false, bytes, frame, art: Arc::new(art), doc: Arc::new(doc) }));
+}
+
+/// The id the read art's own nodes take (their object's, once expanded).
+fn art_id() -> crate::NodeId {
+    crate::NodeId(0)
+}
+
+/// Visit `n` and every descendant (opacity-mask art included) mutably.
+fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
+    f(n);
+    if let Some(m) = &mut n.mask {
+        each_mut(Arc::make_mut(&mut m.art), f);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        each_mut(Arc::make_mut(c), f);
+    }
+}
+
+/// `n`'s references to images, symbols, patterns and placed files prefixed with `prefix`. Colours
+/// keep their swatch links (a spot colour stays a plate, one with the parent's spot of that name).
+fn rename(n: &mut Node, prefix: &str) {
+    let paint = |p: &mut Paint| {
+        if let Paint::Pattern { pattern, .. } = p {
+            *pattern = format!("{prefix}{pattern}");
+        }
+    };
+    each_mut(n, &mut |n| {
+        for it in &mut n.appearance.items {
+            match it {
+                AppearanceItem::Fill(f) => paint(&mut f.paint),
+                AppearanceItem::Stroke(s) => paint(&mut s.paint),
+            }
+        }
+        match &mut n.kind {
+            NodeKind::Text(t) => {
+                for r in &mut t.runs {
+                    paint(&mut r.style.fill);
+                    paint(&mut r.style.stroke);
+                }
+            }
+            NodeKind::Image(im) => im.key = format!("{prefix}{}", im.key),
+            NodeKind::PlacedDocument(p) => p.key = format!("{prefix}{}", p.key),
+            NodeKind::SymbolInstance { symbol, .. } => *symbol = format!("{prefix}{symbol}"),
+            _ => {}
+        }
+    });
+}
+
+impl Document {
+    /// This document ready to export its placed documents: their files read (the file read again
+    /// when only the preview is stored, else the preview), and the resources their art uses added
+    /// under names of their own ([`RESOURCE_PREFIX`]); the same for the placed documents in that
+    /// art, up to [`MAX_DEPTH`] deep. Borrowed when there is none. (The renderer draws them from
+    /// [`read`] instead.)
+    pub fn with_placed_art(&self) -> Cow<'_, Document> {
+        let mut queue: Vec<(PlacedDocument, usize)> = vec![];
+        let mut seen = BTreeSet::new();
+        self.visit_placed(|_, p| {
+            if seen.insert(p.key.clone()) {
+                queue.push((p.clone(), 0));
+            }
+        });
+        if queue.is_empty() {
+            return Cow::Borrowed(self);
+        }
+        let mut d = self.clone();
+        let mut found: Vec<Arc<ReadDocument>> = vec![];
+        while let Some((p, depth)) = queue.pop() {
+            let Some(blob) = d.images.get(&p.key).cloned() else { continue };
+            let full = if depth < MAX_DEPTH { full_bytes(&p, &blob) } else { None };
+            if full.and_then(|b| read(&p, &b)).is_none() {
+                let preview = if blob.is_proxy() { Some(blob.bytes.clone()) } else { blob.proxy.clone() };
+                if let Some(bytes) = preview {
+                    read_preview(&p, &bytes);
+                }
+            }
+            // What the art (`PlacedDocument::art`) will show.
+            let Some(e) = read_cached(&p) else { continue };
+            let prefix = prefix(&p.key);
+            add_resources(&mut d, &e.doc, &prefix);
+            // The placed documents in that art, under their names here.
+            let inner = std::iter::once(&e.art).chain(e.doc.symbols.iter().map(|s| &s.art)).chain(e.doc.patterns.iter().flat_map(|p| &p.art));
+            for root in inner {
+                walk_all(root, &mut |n| {
+                    if let NodeKind::PlacedDocument(q) = &n.kind {
+                        let key = format!("{prefix}{}", q.key);
+                        if seen.insert(key.clone()) {
+                            queue.push((PlacedDocument { key, ..(**q).clone() }, depth + 1));
+                        }
+                    }
+                });
+            }
+            found.push(e);
+        }
+        // Read last, so all stay read while the art is made (see `PlacedDocument::art`).
+        {
+            let mut c = cache();
+            for e in &found {
+                c.get(&e.key, e.preview, None);
+            }
+        }
+        Cow::Owned(d)
+    }
+
+    /// Drop the resources [`Self::with_placed_art`] added under its names (what a save leaves out).
+    pub fn drop_placed_resources(&mut self) {
+        self.symbols.retain(|s| !s.name.starts_with(RESOURCE_PREFIX));
+        self.patterns.retain(|p| !p.name.starts_with(RESOURCE_PREFIX));
+        self.images.retain(|k, _| !k.starts_with(RESOURCE_PREFIX));
+    }
+}
+
+/// The resources of `src` (a read file's) added to `d` under `prefix`: symbols, patterns, images;
+/// swatches by name, when `d` has none of that name.
+fn add_resources(d: &mut Document, src: &Document, prefix: &str) {
+    for s in &src.symbols {
+        let name = format!("{prefix}{}", s.name);
+        if !d.symbols.iter().any(|x| x.name == name) {
+            let mut s = s.clone();
+            rename(Arc::make_mut(&mut s.art), prefix);
+            d.symbols.push(Symbol { name, ..s });
+        }
+    }
+    for p in &src.patterns {
+        let name = format!("{prefix}{}", p.name);
+        if d.pattern(&name).is_none() {
+            let mut p = p.clone();
+            p.art.iter_mut().for_each(|a| rename(Arc::make_mut(a), prefix));
+            d.patterns.push(PatternDef { name, ..p });
+        }
+    }
+    for (k, b) in &src.images {
+        d.images.entry(format!("{prefix}{k}")).or_insert_with(|| b.clone());
+    }
+    for w in &src.swatches {
+        if d.swatch(&w.name).is_none() {
+            d.swatches.push(w.clone());
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::NodeId;
+
+    fn placed(key: &str) -> PlacedDocument {
+        PlacedDocument {
+            link: LinkInfo::new("/art/logo.vectorcraft"),
+            key: key.into(),
+            bounding: false,
+            width: 80.0,
+            height: 40.0,
+            xf: Affine::translate((10.0, 10.0)),
+            placement: Default::default(),
+        }
+    }
+
+    /// Whatever the bytes: a 40×20 artboard showing a symbol instance and, when the bytes say
+    /// `nest`, a placed document of key `inner`.
+    fn stub_loader(_: &PlacedDocument, bytes: &[u8]) -> Option<(Document, Node, Rect)> {
+        let mut d = Document::new(40.0, 20.0);
+        d.layers.clear();
+        let art = Node::new(
+            NodeId(50),
+            NodeKind::Image(ImageObject { key: "pic".into(), width: 1, height: 1, xf: Affine::IDENTITY, link: None, placement: Default::default() }),
+        );
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(art) });
+        d.images.insert("pic".into(), ImageBlob::new("image/png", vec![1, 2, 3]));
+        let mut children = vec![Arc::new(Node::new(NodeId(51), NodeKind::SymbolInstance { symbol: "Star".into(), xf: Affine::IDENTITY }))];
+        if bytes.starts_with(b"nest") {
+            d.images.insert("inner".into(), ImageBlob::new("application/json", b"leaf".to_vec()));
+            let inner = PlacedDocument { key: "inner".into(), width: 10.0, height: 10.0, xf: Affine::IDENTITY, ..placed("inner") };
+            children.push(Arc::new(Node::new(NodeId(52), NodeKind::PlacedDocument(Box::new(inner)))));
+        }
+        Some((d, Node::new(NodeId(0), NodeKind::Group { children, clip: false }), Rect::new(0.0, 0.0, 40.0, 20.0)))
+    }
+
+    #[test]
+    fn round_trips_through_json() {
+        let n = Node::new(NodeId(3), NodeKind::PlacedDocument(Box::new(placed("doc1-1"))));
+        let v = serde_json::to_value(&n).unwrap();
+        assert_eq!(v["kind"]["type"], "placeddocument");
+        assert_eq!(v["kind"]["link"]["path"], "/art/logo.vectorcraft");
+        let back: Node = serde_json::from_value(v).unwrap();
+        assert_eq!(back, n);
+        assert_eq!(key_for("img00", 2, true), "img00-2b");
+    }
+
+    #[test]
+    fn the_art_and_its_resources_join_only_a_prepared_copy_under_their_own_names() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        d.symbols.push(Symbol { name: "Star".into(), art: Arc::new(Node::new(NodeId(60), NodeKind::Group { children: vec![], clip: false })) });
+        d.images.insert("doc1-1".into(), ImageBlob::new("application/json", b"nest".to_vec()));
+        let p = placed("doc1-1");
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(p.clone())))).unwrap();
+        assert!(d.has_placed());
+        let prepared = d.with_placed_art();
+        let names: Vec<&str> = prepared.symbols.iter().map(|s| s.name.as_str()).collect();
+        // The placed document inside is read too, its resources under its own names.
+        assert_eq!(names, ["Star", "placed:doc1-1/Star", "placed:placed:doc1-1/inner/Star"]);
+        assert!(prepared.images.contains_key("placed:doc1-1/pic"));
+        assert_eq!(d.symbols.len(), 1, "the document itself is unchanged");
+        // The art: a group of the drawing, its resources renamed.
+        let n = d.node(NodeId(7)).unwrap();
+        let art = p.art(n);
+        let [g] = &art[..] else { panic!("{art:?}") };
+        let mut refs = vec![];
+        g.walk(&mut |c| match &c.kind {
+            NodeKind::SymbolInstance { symbol, .. } => refs.push(symbol.clone()),
+            NodeKind::PlacedDocument(q) => {
+                // Its 10×10 box at the file's origin, scaled ×2 into the box at (10, 10).
+                assert_eq!(q.bounds(), Rect::new(10.0, 10.0, 30.0, 30.0));
+                refs.push(q.key.clone())
+            }
+            _ => {}
+        });
+        assert_eq!(refs, ["placed:doc1-1/Star", "placed:doc1-1/inner"]);
+        // For older apps: plain groups all the way down.
+        let mut older = prepared.clone().into_owned();
+        older.placed_as_groups();
+        assert!(!older.has_placed());
+        let mut saved = prepared.into_owned();
+        saved.drop_placed_resources();
+        assert_eq!((saved.symbols.len(), saved.images.len()), (1, 1));
+    }
+
+    #[test]
+    fn more_files_than_the_cache_holds_all_draw() {
+        set_loader(stub_loader);
+        let mut d = Document::new(200.0, 200.0);
+        let layer = d.layers[0].id;
+        let n = CACHE_SIZE + 10;
+        for i in 0..n {
+            let key = format!("many{i}-1");
+            d.images.insert(key.clone(), ImageBlob::new("application/json", format!("doc {i}").into_bytes()));
+            d.insert(Some(layer), i, Node::new(NodeId(100 + i as u64), NodeKind::PlacedDocument(Box::new(placed(&key))))).unwrap();
+        }
+        let _prepared = d.with_placed_art();
+        let mut empty = 0;
+        d.visit_placed(|n, p| empty += usize::from(p.art(n).is_empty()));
+        assert_eq!(empty, 0, "every file of the document is kept read");
+    }
+
+    #[test]
+    fn a_file_that_cant_be_read_shows_its_preview() {
+        set_loader(stub_loader);
+        let mut png = vec![];
+        image::RgbaImage::from_pixel(8, 4, image::Rgba([0, 200, 0, 255]))
+            .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+            .unwrap();
+        let mut blob = ImageBlob::new("image/png", png);
+        blob.proxy = Some(blob.bytes.clone());
+        let mut d = Document::new(200.0, 200.0);
+        d.images.insert("gone-1".into(), blob);
+        let layer = d.layers[0].id;
+        d.insert(Some(layer), 0, Node::new(NodeId(7), NodeKind::PlacedDocument(Box::new(placed("gone-1"))))).unwrap();
+        // No file reader: only the preview can be had.
+        let prepared = d.with_placed_art();
+        assert!(prepared.images.contains_key("placed:gone-1/preview"));
+        let n = d.node(NodeId(7)).unwrap();
+        let NodeKind::PlacedDocument(p) = &n.kind else { panic!("not a placed document") };
+        let art = p.art(n);
+        assert_eq!(art.first().and_then(Node::geometric_bounds), Some(Rect::new(10.0, 10.0, 90.0, 50.0)));
+    }
+}

crates/doc/src/text.rs

@@ -285,6 +285,24 @@ fn default_align_on() -> char {
 /// Distance between default tab stops when no explicit stop applies (½ inch).
 pub const DEFAULT_TAB_INTERVAL: f64 = 36.0;
 
+/// Paragraph composer (Paragraph panel menu): how lines are broken.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Composer {
+    /// Break each line as soon as it is full.
+    SingleLine,
+    /// Total fit over the whole paragraph (Illustrator's default): justified lines get even word
+    /// spacing, ragged lines an even rag.
+    #[default]
+    EveryLine,
+}
+
+impl Composer {
+    fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+}
+
 /// Paragraph attributes (the Paragraph panel).
 ///
 /// Saved through [`ParaStyleFile`], which keeps files with text openable by builds from before
@@ -299,6 +317,8 @@ pub struct ParaStyle {
     pub space_before: f64,
     pub space_after: f64,
     pub hyphenate: bool,
+    /// Line breaking: Single-line or Every-line Composer.
+    pub composer: Composer,
     /// Tab stops (Tabs panel), sorted by position.
     pub tabs: Vec<TabStop>,
     /// Paragraph style (Paragraph Styles panel) these attributes come from; None = Normal.
@@ -341,6 +361,8 @@ struct ParaStyleFile {
     space_after: f64,
     #[serde(default)]
     hyphenate: bool,
+    #[serde(default, skip_serializing_if = "Composer::is_default")]
+    composer: Composer,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     tabs: Vec<TabStop>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -370,6 +392,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_before,
             space_after,
             hyphenate,
+            composer,
             tabs,
             style_name,
             mojikumi,
@@ -387,6 +410,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_before,
             space_after,
             hyphenate,
+            composer,
             tabs,
             style_name,
             mojikumi,
@@ -407,6 +431,7 @@ impl From<ParaStyleFile> for ParaStyle {
             space_before,
             space_after,
             hyphenate,
+            composer,
             tabs,
             style_name,
             mojikumi,
@@ -423,6 +448,7 @@ impl From<ParaStyleFile> for ParaStyle {
             space_before,
             space_after,
             hyphenate,
+            composer,
             tabs,
             style_name,
             mojikumi,
@@ -506,6 +532,34 @@ pub enum FirstBaseline {
     Fixed,
 }
 
+/// Area Type Options "Align" (vertical): where the lines of each row/column sit in it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum VerticalAlign {
+    /// Lines start at the top of the cell (the default).
+    #[default]
+    Top,
+    /// The block of lines is centred in the cell.
+    Center,
+    /// The last line's descent touches the cell bottom.
+    Bottom,
+    /// The first line stays at the top, the last one moves to the bottom and the space left over
+    /// is shared equally between the lines (no paragraph spacing limit).
+    Justify,
+}
+
+impl VerticalAlign {
+    pub const ALL: [VerticalAlign; 4] = [VerticalAlign::Top, VerticalAlign::Center, VerticalAlign::Bottom, VerticalAlign::Justify];
+    pub fn id(self) -> &'static str {
+        match self {
+            VerticalAlign::Top => "top",
+            VerticalAlign::Center => "center",
+            VerticalAlign::Bottom => "bottom",
+            VerticalAlign::Justify => "justify",
+        }
+    }
+}
+
 /// Text Wrap Options of a wrap object (Object → Text Wrap).
 #[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
@@ -608,11 +662,21 @@ pub struct AreaOptions {
     pub first_baseline: FirstBaseline,
     /// Minimum first-baseline offset in points.
     pub first_baseline_min: f64,
+    /// Vertical alignment of the lines in each row/column.
+    pub vertical_align: VerticalAlign,
 }
 
 impl Default for AreaOptions {
     fn default() -> Self {
-        Self { rows: 1, columns: 1, gutter: 18.0, inset: 0.0, first_baseline: FirstBaseline::Ascent, first_baseline_min: 0.0 }
+        Self {
+            rows: 1,
+            columns: 1,
+            gutter: 18.0,
+            inset: 0.0,
+            first_baseline: FirstBaseline::Ascent,
+            first_baseline_min: 0.0,
+            vertical_align: VerticalAlign::Top,
+        }
     }
 }
 

crates/effects/src/bake.rs

@@ -324,14 +324,19 @@ pub fn bake_appearance(n: &Node) -> Option<Node> {
     Some(m)
 }
 
-/// A copy of `doc` with every live geometry effect baked into plain paths, or `None` when the
-/// document has none (export it as is).
+/// A copy of `doc` ready to export: every live geometry effect baked into plain paths, and the
+/// resources of its placed documents' art added ([`Document::with_placed_art`]); `None` when
+/// there is nothing to do (export it as is).
 pub fn bake_document(doc: &Document) -> Option<Document> {
-    if !doc.layers.iter().any(|l| needs_bake(l)) {
-        return None;
+    let placed = doc.with_placed_art();
+    if !placed.layers.iter().any(|l| needs_bake(l)) {
+        return match placed {
+            std::borrow::Cow::Owned(d) => Some(d),
+            std::borrow::Cow::Borrowed(_) => None,
+        };
     }
-    let mut d = doc.clone();
-    let layers = doc.layers.clone();
+    let mut d = placed.into_owned();
+    let layers = d.layers.clone();
     d.layers = layers.iter().map(|l| bake_node(&mut d, l).map(Arc::new).unwrap_or_else(|| l.clone())).collect();
     Some(d)
 }

crates/effects/src/reshape.rs

@@ -26,6 +26,7 @@ pub fn needs_outline(n: &Node) -> bool {
             | NodeKind::Envelope { .. }
             | NodeKind::Mesh(_)
             | NodeKind::Repeat(_)
+            | NodeKind::PlacedDocument(_)
     )
 }
 

crates/engine/src/cmd/buildcmds.rs

@@ -250,7 +250,8 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
         // Edges come back from the planar map within a few hundredths of the outlines they follow.
         let cut_tol = step * 0.2;
         let picked: Vec<&po::Region> = touched.regions.iter().filter_map(|&i| map.regions.get(i).map(|r| &r.0)).collect();
-        let union = if picked.is_empty() { PathData::default() } else { po::merge_regions(&picked) };
+        let faces = po::FaceMerger::new(&map.shapes);
+        let union = if picked.is_empty() { PathData::default() } else { faces.merge(&picked) };
         // The merged shape takes the look of the front-most object over the first region, or (for an
         // area only lines enclose) of the front-most object and the current fill.
         let covered = picked.iter().find_map(|r| r.top());
@@ -278,7 +279,17 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
                 // its outline, shared edges from every shape along them).
                 let in_union = picked.iter().any(|r| r.sources.contains(&i));
                 let mut rest = if in_union {
-                    po::boolean(&sh.path, sh.rule, &union, FillRule::NonZero, po::BoolOp::Difference)
+                    // What is left of it: its faces not merged or deleted, united. They share their
+                    // edges with the merged faces exactly, where subtracting the merged shape left
+                    // slivers of the outline along them (#569).
+                    let kept: Vec<&po::Region> = map
+                        .regions
+                        .iter()
+                        .enumerate()
+                        .filter(|(k, (r, ..))| r.sources.contains(&i) && !touched.regions.contains(k))
+                        .map(|(_, (r, ..))| r)
+                        .collect();
+                    if kept.is_empty() { PathData::default() } else { faces.merge(&kept) }
                 } else {
                     b::node_outline(leaf).map_or_else(|| sh.path.clone(), |o| o.0)
                 };
@@ -640,6 +651,11 @@ fn trace_params(p: &Value) -> Result<tr::TraceParams> {
     serde_json::from_value(v).map_err(|e| bad("imageTrace.make", e.to_string()))
 }
 
+/// The most anchor points an Image Trace may make: a photo traced at high fidelity can make
+/// millions, more than the canvas draws smoothly or a laptop has memory for, so the trace is
+/// refused with advice instead (#525).
+pub const MAX_TRACE_ANCHORS: usize = 2_000_000;
+
 fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     const C: &str = "imageTrace.make";
     let params = trace_params(p)?;
@@ -671,7 +687,7 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     };
     let blob = s.doc()?.doc.images.get(&img.key).ok_or_else(|| EngineError::Other(format!("image data `{}` is missing", img.key)))?;
     let raster = tr::Raster::decode(&blob.bytes).map_err(|e| EngineError::Other(e.to_string()))?;
-    let res = tr::trace(&raster, &params);
+    let res = tr::trace_within(&raster, &params, MAX_TRACE_ANCHORS).map_err(|e| EngineError::Other(e.to_string()))?;
     // Pixel space of the decoded raster → the image object's pixel space → document.
     let sx = img.width.max(1) as f64 / raster.width.max(1) as f64;
     let sy = img.height.max(1) as f64 / raster.height.max(1) as f64;

crates/engine/src/cmd/clipboard/resources.rs

@@ -127,6 +127,7 @@ fn node_refs(n: &Node, f: Visit) {
                 }
             }
             NodeKind::Image(im) => f(Ref::Name(Res::Image, &im.key)),
+            NodeKind::PlacedDocument(pl) => f(Ref::Name(Res::Image, &pl.key)),
             NodeKind::SymbolInstance { symbol, .. } => f(Ref::Name(Res::Symbol, symbol)),
             _ => {}
         }
@@ -444,6 +445,7 @@ impl Relink {
                 }
             }
             NodeKind::Image(im) => self.name(Res::Image, &mut im.key),
+            NodeKind::PlacedDocument(pl) => self.name(Res::Image, &mut pl.key),
             NodeKind::SymbolInstance { symbol, .. } => self.name(Res::Symbol, symbol),
             _ => {}
         }

crates/engine/src/cmd/distortcmds.rs

@@ -418,6 +418,7 @@ fn not_liquified(n: &Node) -> Option<&'static str> {
         NodeKind::Mesh(_) => "meshes",
         NodeKind::Envelope { .. } => "envelopes",
         NodeKind::Repeat(_) => "repeats",
+        NodeKind::PlacedDocument(_) => "placed documents",
         NodeKind::Blend { .. } => "blends",
         _ => return None,
     })

crates/engine/src/cmd/docinfo.rs

@@ -49,13 +49,14 @@ pub const CATEGORIES: [(&str, &str); 11] = [
 ];
 
 /// The object counts of `document.info` and their labels.
-const OBJECT_LABELS: [(&str, &str); 16] = [
+const OBJECT_LABELS: [(&str, &str); 17] = [
     ("paths", "Paths"),
     ("compoundPaths", "Compound Paths"),
     ("groups", "Groups"),
     ("clipGroups", "Clipping Masks"),
     ("textObjects", "Text Objects"),
     ("images", "Images"),
+    ("placedDocuments", "Placed Documents"),
     ("symbolInstances", "Symbol Instances"),
     ("gradients", "Gradient Objects"),
     ("patterns", "Pattern Objects"),
@@ -252,6 +253,7 @@ fn info(s: &mut Session, p: &Value) -> Result<Value> {
                 NodeKind::Envelope { .. } => Some("envelopes"),
                 NodeKind::Mesh(_) => Some("meshes"),
                 NodeKind::Repeat(_) => Some("repeats"),
+                NodeKind::PlacedDocument(_) => Some("placedDocuments"),
             };
             if let Some(k) = k {
                 *counts.entry(k).or_default() += 1;

crates/engine/src/cmd/expand.rs

@@ -1,6 +1,7 @@
 //! Object → Expand: live shapes, type and effects (Object), strokes (Stroke) and gradient fills
-//! (Fill) into plain art in one undo step. A linear or radial gradient fill becomes a gradient mesh,
-//! or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
+//! (Fill) into plain art in one undo step. Placed documents (Object) become editable copies of the
+//! art they show, their resources joining the document. A linear or radial gradient fill becomes a
+//! gradient mesh, or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
 //! gradient becomes a mesh shaped like the object. Create Gradient Mesh shares the sampling.
 
 use std::sync::Arc;
@@ -36,7 +37,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand…",
             ["Object"],
             None,
-            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, envelopes → their distorted content), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh), both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
+            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh), both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
             has_selection,
             expand
         ),
@@ -55,6 +56,21 @@ pub fn specs() -> Vec<CommandSpec> {
     ]
 }
 
+/// Every placed document in `roots` of `d` (at any depth) replaced by an editable copy of the art it
+/// shows, keeping its id and place; the resources the art uses join `d` (a name `d` uses for
+/// something else gets a free variant).
+fn expand_placed_under(d: &mut Document, roots: &[NodeId]) -> Result<()> {
+    let mut ids = vec![];
+    for n in roots.iter().filter_map(|r| d.node(*r)) {
+        n.walk(&mut |c| {
+            if matches!(c.kind, NodeKind::PlacedDocument(_)) {
+                ids.push(c.id);
+            }
+        });
+    }
+    ids.into_iter().try_for_each(|id| super::place::document::expand(d, id, C))
+}
+
 /// Expand Gradient To.
 #[derive(Clone, Copy, Debug, PartialEq)]
 enum GradientTo {
@@ -88,6 +104,8 @@ struct Expandable {
     envelope: bool,
     /// Live blends (Object expands them into groups of their steps).
     blends: bool,
+    /// Placed documents (Object expands them into the art they show).
+    placed: bool,
 }
 
 impl Expandable {
@@ -101,6 +119,7 @@ impl Expandable {
                 e.effects |= !c.appearance.effects.is_empty();
                 e.envelope |= matches!(c.kind, NodeKind::Envelope { .. });
                 e.blends |= matches!(c.kind, NodeKind::Blend { .. });
+                e.placed |= matches!(c.kind, NodeKind::PlacedDocument(_));
                 e.stroke |= shape && !c.appearance.stroke_paint().is_none();
                 e.fill |= match &c.kind {
                     NodeKind::Text(t) => t.runs.iter().any(|r| matches!(r.style.fill, Paint::Gradient(_))),
@@ -112,7 +131,7 @@ impl Expandable {
     }
 
     fn object(&self) -> bool {
-        self.text || self.live || self.effects || self.envelope || self.blends
+        self.text || self.live || self.effects || self.envelope || self.blends || self.placed
     }
 }
 
@@ -135,6 +154,11 @@ fn expand(s: &mut Session, p: &Value) -> Result<Value> {
     let from = s.doc()?.history.undo.len();
     let rev0 = s.doc()?.revision;
     let e = Expandable::of(&s.doc()?.doc, &selected_roots(s)?);
+    // Placed documents first: their art (type, strokes, gradients) expands below.
+    if object && e.placed {
+        let roots = selected_roots(s)?;
+        s.edit("Expand", |d, _| expand_placed_under(d, &roots))?;
+    }
     // Blends first: what their steps hold (type, effects, strokes, gradients) expands below.
     if object && e.blends {
         let roots = selected_roots(s)?;

crates/engine/src/cmd/fileio/encode.rs

@@ -364,6 +364,22 @@ pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(
 
 /// [`encode`], with every file the export writes.
 pub fn encode_all(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
+    // Placed documents output their files' art (a native file keeps what it keeps: see
+    // `native::encode`).
+    if !matches!(format, "vectorcraft" | "template") {
+        let (full, warnings) = crate::cmd::place::document::full_documents(doc);
+        if !warnings.is_empty() {
+            let mut enc = encode_all_of(&full, format, p)?;
+            enc.warnings.extend(warnings);
+            return Ok(enc);
+        }
+        return encode_all_of(&full, format, p);
+    }
+    encode_all_of(doc, format, p)
+}
+
+/// [`encode_all`] of `doc` as it is.
+fn encode_all_of(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
     let f = super::writable(C, Some(format), None)?;
     let mut enc = encode_files(doc, f, p)?;
     // Formats that draw type: missing fonts come out in the fallback font (PDF and SVG say so
@@ -401,6 +417,12 @@ fn encode_files(doc: &Document, f: &Format, p: &Value) -> Result<Encoded> {
         "txt" => super::text::encode(doc, p)?,
         "svg" | "svgz" => return super::svg::encode(doc, p, f.id == "svgz").map_err(|e| bad(C, e)),
         "dxf" => return super::dxf::encode(doc, p, use_artboards),
+        // As Save As writes it (a PDF of every artboard carrying the native document).
+        "ai" => {
+            let mut q = p.clone();
+            super::save::ai_params(&mut q);
+            return super::save::encode_ai(C, f, doc, &q);
+        }
         // EPS reads its own `useArtboards` (the art's bounds unless asked).
         "eps" => return super::eps::encode(doc, p),
         "emf" => return super::metafile::encode(doc, p, use_artboards, vectorcraft_metafile::Kind::Emf),

crates/engine/src/cmd/fileio/mod.rs

@@ -465,8 +465,8 @@ pub const FORMATS: &[Format] = &[
         extensions: &["ai"],
         mime: "application/pdf",
         read: true,
-        // Saved (Save As), not exported.
-        write: false,
+        // Save As writes it; exports write the same file.
+        write: true,
         raster: false,
         options: native::AI_OPTIONS,
     },

crates/engine/src/cmd/fileio/native.rs

@@ -127,6 +127,13 @@ pub(super) fn save_options(cmd: &str, f: &Format, doc: &Document, p: &Value) ->
 /// The `.vectorcraft` file of `doc` with the options in `p`.
 pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Vec<u8>> {
     let (mut so, extras) = save_options(cmd, f, doc, p)?;
+    // Include Linked Files keeps placed documents' files; older versions get their art.
+    let full = if so.include_linked || so.version < vectorcraft_format::VERSION {
+        crate::cmd::place::document::full_documents(doc).0
+    } else {
+        std::borrow::Cow::Borrowed(doc)
+    };
+    let doc = &*full;
     if extras.preview {
         so.preview = preview_png(doc)?;
     }

crates/engine/src/cmd/fileio/pdf.rs

@@ -86,7 +86,7 @@ pub(super) const OPTIONS: &[FormatOption] = &[
         name: "createLayers",
         ty: "boolean",
         default: "false",
-        description: "top-level layers as PDF layers (optional content groups with their visibility, print state and lock; PDF 1.5 or later)",
+        description: "layers and sublayers as PDF layers (optional content groups with their visibility, print state and lock, sublayers listed under their layers; PDF 1.5 or later)",
     },
     FormatOption {
         name: "flattenerPreset",
@@ -109,7 +109,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export PDF",
             [],
             None,
-            "{path?, preset?: \"VectorCraft Default\" (built-in or saved: pdf.preset.list), artboard? | artboards?: [i…] | range?: \"1-3, 5\" (1-based; default all, one page each), standard?: none|pdfA2b|pdfX1a (CMYK, grey and spot colours only: colours and images converted to output.destination or the CMYK output intent, untagged; transparency flattened with flattenerPreset; PDF 1.3)|pdfX3 (colours ICC-tagged; transparency flattened; PDF 1.3)|pdfX4 (transparency and layers kept; colours ICC-tagged; PDF 1.6 at most) (PDF/X: a /GTS_PDFX output intent, by default the CMYK profile in effect, embedded; TrimBox, Trapped, GTS_PDFXVersion, title and dates; fonts embedded or outlined), compatibility?: 1.3 (no transparency: it is flattened with flattenerPreset; images keep no see-through pixels)|1.4|1.5|1.6|1.7 (default)|2.0 (choosing a standard sets its version: 1.7 for pdfA2b, 1.6 for pdfX4, 1.3 for pdfX1a and pdfX3, which write 1.4 as 1.3 too; pdfA2b refuses 1.3), preserveEditing? (on in VectorCraft Default: the native document as an embedded file, which document.open restores; choosing a standard turns it off, a standard refuses it), thumbnails? (each page drawn as a /Thumb image, 106 px on its long side), fastWebView? (a linearised file: the first page shows while the rest downloads; it stays linearised when encrypted), viewAfterSaving? (the app opens the written file), createLayers? (each top-level layer but template layers as a PDF layer, an optional content group: hidden layers off, non-printing ones /PrintState /OFF, locked ones locked; needs 1.5 or later; they reopen as layers; choosing pdfX1a or pdfX3 turns it off; they refuse it), includeNonPrinting? (keep layers whose Print option is off; left out by default unless createLayers), flattenerPreset?: \"\" (High Resolution) | high | medium | low | a saved preset (flattener.presets.list): what PDF 1.3 files flatten transparency with, flattener?: {object.flattenTransparency options over it}, compression?: {color?, gray?: {downsample: none|average|subsample|bicubic, ppi: 300, abovePpi: 450, compression: none|zip|jpeg|jpeg2000|auto, quality: minimum|low|medium|high|maximum}, mono?: {downsample, ppi: 1200, abovePpi: 1800, compression: none|ccittG3|ccittG4|zip|runLength} (black-and-white images), compressText?: true} (images above abovePpi are resampled to ppi; auto keeps JPEGs JPEG, the others lossless; JPEG needs opaque images; none, jpeg2000, CCITT and runLength are written as ZIP with a warning), marks?: {trim, registration, colorBars, pageInfo, kind: roman|japanese, weight: 0.25 (trim marks and targets), offset: 6 (pt from the artboard, at least the bleed)} (printer's marks in [Registration], every plate: trim marks, registration targets mid-side, CMYK/spot/black-tint colour bars on top, page information (title, artboard, date UTC) below), bleed?: {useDocument (the document's bleed, document.setup), top, bottom, left, right} (pt; art in the bleed is kept). Each page: TrimBox = artboard, BleedBox = artboard + bleed, MediaBox = that + the marks' room (art clipped to the BleedBox), output?: {conversion: none (default)|destination (every colour into the destination profile's model, CMYK or RGB, also colours of that model in another profile)|preserveNumbers (only colours of the other model and Lab; those in the destination's model keep their numbers) (grey stays grey; images are converted too, printer's marks are not), destination: profile name (edit.colorSettings lists them; default: the document's profile for its colour mode), profiles: none (device colours)|all|destination|taggedSource (documents assigned a profile: edit.assignProfile) (ICC-based colours: CMYK with the destination or document CMYK profile, RGB as sRGB, grey with the sRGB tone curve; PDF/A always), outputIntent: profile name (embedded as the catalog's /GTS_PDFX output intent; a name that isn't a profile is only named, which pdfX1a and pdfX3 allow only with a registry and pdfX4 refuses; pdfX1a needs a CMYK one), outputCondition, outputConditionId (default: outputIntent), registry, trapped (/Trapped /True; /False when an output intent is written)} (PDF/A files keep their own output intent), advanced?: {fontSubsetPercent: 100 (below 100 is accepted with a warning: fonts are always embedded as subsets), outlineText: true (false: type as real, selectable and searchable text in embedded subset fonts with a ToUnicode map; fonts whose licence forbids embedding, or allows only whole fonts, stay outlines with a warning), overprint: preserve (overprinting fills and strokes set /OP /op true, /OPM 1; white ones knock out with document.setup discardWhiteOverprint)|discard (they knock out)}, security?: {openPassword, permissionsPassword, printing: none|low|high, changes: none|pages|forms|comments|any, copy, screenReader, plaintextMetadata}} → {path, bytes, warnings}; no path → {dataBase64, bytes, warnings}. The options apply over the preset (null keeps its value); options accepted but not applied yet c
Line truncated
+            "{path?, preset?: \"VectorCraft Default\" (built-in or saved: pdf.preset.list), artboard? | artboards?: [i…] | range?: \"1-3, 5\" (1-based; default all, one page each), standard?: none|pdfA2b|pdfX1a (CMYK, grey and spot colours only: colours and images converted to output.destination or the CMYK output intent, untagged; transparency flattened with flattenerPreset; PDF 1.3)|pdfX3 (colours ICC-tagged; transparency flattened; PDF 1.3)|pdfX4 (transparency and layers kept; colours ICC-tagged; PDF 1.6 at most) (PDF/X: a /GTS_PDFX output intent, by default the CMYK profile in effect, embedded; TrimBox, Trapped, GTS_PDFXVersion, title and dates; fonts embedded or outlined), compatibility?: 1.3 (no transparency: it is flattened with flattenerPreset; images keep no see-through pixels)|1.4|1.5|1.6|1.7 (default)|2.0 (choosing a standard sets its version: 1.7 for pdfA2b, 1.6 for pdfX4, 1.3 for pdfX1a and pdfX3, which write 1.4 as 1.3 too; pdfA2b refuses 1.3), preserveEditing? (on in VectorCraft Default: the native document as an embedded file, which document.open restores; choosing a standard turns it off, a standard refuses it), thumbnails? (each page drawn as a /Thumb image, 106 px on its long side), fastWebView? (a linearised file: the first page shows while the rest downloads; it stays linearised when encrypted), viewAfterSaving? (the app opens the written file), createLayers? (each layer and sublayer but template layers as a PDF layer, an optional content group listed under its layer's: hidden layers off, non-printing ones /PrintState /OFF, locked ones locked; needs 1.5 or later; they reopen as layers; choosing pdfX1a or pdfX3 turns it off; they refuse it), includeNonPrinting? (keep layers whose Print option is off; left out by default unless createLayers), flattenerPreset?: \"\" (High Resolution) | high | medium | low | a saved preset (flattener.presets.list): what PDF 1.3 files flatten transparency with, flattener?: {object.flattenTransparency options over it}, compression?: {color?, gray?: {downsample: none|average|subsample|bicubic, ppi: 300, abovePpi: 450, compression: none|zip|jpeg|jpeg2000|auto, quality: minimum|low|medium|high|maximum}, mono?: {downsample, ppi: 1200, abovePpi: 1800, compression: none|ccittG3|ccittG4|zip|runLength} (black-and-white images), compressText?: true} (images above abovePpi are resampled to ppi; auto keeps JPEGs JPEG, the others lossless; JPEG needs opaque images; none, jpeg2000, CCITT and runLength are written as ZIP with a warning), marks?: {trim, registration, colorBars, pageInfo, kind: roman|japanese, weight: 0.25 (trim marks and targets), offset: 6 (pt from the artboard, at least the bleed)} (printer's marks in [Registration], every plate: trim marks, registration targets mid-side, CMYK/spot/black-tint colour bars on top, page information (title, artboard, date UTC) below), bleed?: {useDocument (the document's bleed, document.setup), top, bottom, left, right} (pt; art in the bleed is kept). Each page: TrimBox = artboard, BleedBox = artboard + bleed, MediaBox = that + the marks' room (art clipped to the BleedBox), output?: {conversion: none (default)|destination (every colour into the destination profile's model, CMYK or RGB, also colours of that model in another profile)|preserveNumbers (only colours of the other model and Lab; those in the destination's model keep their numbers) (grey stays grey; images are converted too, printer's marks are not), destination: profile name (edit.colorSettings lists them; default: the document's profile for its colour mode), profiles: none (device colours)|all|destination|taggedSource (documents assigned a profile: edit.assignProfile) (ICC-based colours: CMYK with the destination or document CMYK profile, RGB as sRGB, grey with the sRGB tone curve; PDF/A always), outputIntent: profile name (embedded as the catalog's /GTS_PDFX output intent; a name that isn't a profile is only named, which pdfX1a and pdfX3 allow only with a registry and pdfX4 refuses; pdfX1a needs a CMYK one), outputCondition, outputConditionId (default: outputIntent), registry, trapped (/Trapped /True; /False when an output intent is written)} (PDF/A files keep their own output intent), advanced?: {fontSubsetPercent: 100 (below 100 is accepted with a warning: fonts are always embedded as subsets), outlineText: true (false: type as real, selectable and searchable text in embedded subset fonts with a ToUnicode map; fonts whose licence forbids embedding, or allows only whole fonts, stay outlines with a warning), overprint: preserve (overprinting fills and strokes set /OP /op true, /OPM 1; white ones knock out with document.setup discardWhiteOverprint)|discard (they knock out)}, security?: {openPassword, permissionsPassword, printing: none|low|high, changes: none|pages|forms|comments|any, copy, screenReader, plaintextMetadata}} → {path, bytes, warnings}; no path → {dataBase64, bytes, warnings}. The options apply over the preset (null keeps its value); options ac
Line truncated
             has_doc,
             export_pdf
         ),

crates/engine/src/cmd/fileio/save.rs

@@ -305,6 +305,40 @@ fn blank_pages(doc: &Document) -> Document {
 /// Why a `.ai` file saved without PDF content looks empty elsewhere.
 const NOT_PDF_COMPATIBLE: &str = "saved without PDF content: VectorCraft opens it as before, other apps show empty pages";
 
+/// The encoder's params for a `.ai` file, from a save's or an export's: a PDF of every artboard
+/// with the PDF options, always carrying the native document, its layers and sublayers PDF layers
+/// (hidden ones off) unless asked otherwise; Use Compression compresses the PDF's content.
+pub(super) fn ai_params(params: &mut Value) {
+    let Some(o) = params.as_object_mut() else { return };
+    o.extend([("preserveEditing".into(), json!(true)), ("range".into(), json!("all"))]);
+    // Apps that read the PDF part (not the native document) then find the layers, the hidden ones
+    // with their art (#372); a PDF standard decides for itself.
+    if o.get("standard").is_none_or(Value::is_null) {
+        o.entry("createLayers").or_insert(json!(true));
+    }
+    if let Some(c) = o.get("compress").and_then(Value::as_bool) {
+        let compression = o.entry("compression").or_insert_with(|| json!({}));
+        if let Some(m) = compression.as_object_mut() {
+            m.insert("compressText".into(), json!(c));
+        }
+    }
+}
+
+/// Encode `doc` as a PDF-compatible `.ai` file (`params` as [`ai_params`] makes them) for command
+/// `cmd`: its pages (blank with `pdfCompatible: false`, which it then notes), carrying the native
+/// document. File › Save As writes it, and so do the exports (`document.export`, the CLI).
+pub(super) fn encode_ai(cmd: &str, f: &Format, doc: &Document, params: &Value) -> Result<Encoded> {
+    let compatible = bool_or(params, "pdfCompatible", true);
+    let pages = doc.without_edit_modes();
+    let pages = if compatible { pages } else { std::borrow::Cow::Owned(blank_pages(&pages)) };
+    let native = || super::native::ai_native(cmd, f, doc, params);
+    let (bytes, mut warnings) = super::pdf::encode_carrying(cmd, &pages, params, native)?;
+    if !compatible {
+        warnings.insert(0, NOT_PDF_COMPATIBLE.to_string());
+    }
+    Ok(Encoded { warnings, ..Encoded::one(bytes) })
+}
+
 /// Snapshot the active document for `plan` (stamping File Info's dates when the file becomes the
 /// document's own). Bad options fail here, before anything is encoded.
 pub fn save_job(s: &mut Session, plan: SavePlan) -> Result<SaveJob> {
@@ -339,16 +373,8 @@ pub(crate) fn job_for(s: &Session, st: &DocState, plan: SavePlan) -> Result<Save
     }
     let boards = separate_boards(cmd, plan.format, &doc, &params)?;
     let mut params = super::pdf::expand_preset(s, cmd, &params)?.into_owned();
-    if let (Some(o), "ai") = (params.as_object_mut(), plan.format.id) {
-        // A PDF of every artboard with the PDF options, always carrying the native document.
-        o.extend([("preserveEditing".into(), json!(true)), ("range".into(), json!("all"))]);
-        // Use Compression compresses the PDF's content.
-        if let Some(c) = o.get("compress").and_then(Value::as_bool) {
-            let compression = o.entry("compression").or_insert_with(|| json!({}));
-            if let Some(m) = compression.as_object_mut() {
-                m.insert("compressText".into(), json!(c));
-            }
-        }
+    if plan.format.id == "ai" {
+        ai_params(&mut params);
     }
     Ok(SaveJob { plan, doc, params, snapshot: st.doc.clone(), boards })
 }
@@ -372,25 +398,14 @@ impl SaveJob {
             let one = self.encode_one(&artboard_doc(&self.doc, b))?;
             enc.files.extend(one.files.into_iter().map(|(_, bytes)| (Some(b), bytes)));
         }
-        let pdf_less = self.plan.format.id == "ai" && !bool_or(&self.params, "pdfCompatible", true);
-        let notes = fidelity_warning(self.plan.format).into_iter().chain(pdf_less.then(|| NOT_PDF_COMPATIBLE.to_string()));
-        enc.warnings.splice(0..0, notes);
+        enc.warnings.splice(0..0, fidelity_warning(self.plan.format));
         Ok(enc)
     }
 
     /// Encode one file of `doc` in the job's format.
     fn encode_one(&self, doc: &Document) -> Result<Encoded> {
         let (cmd, f) = (self.plan.mode.command(), self.plan.format);
-        let enc = if f.id == "ai" {
-            // The pages (blank without PDF content), carrying the native document.
-            let pages = doc.without_edit_modes();
-            let pages = if bool_or(&self.params, "pdfCompatible", true) { pages } else { std::borrow::Cow::Owned(blank_pages(&pages)) };
-            let native = || super::native::ai_native(cmd, f, doc, &self.params);
-            let (bytes, warnings) = super::pdf::encode_carrying(cmd, &pages, &self.params, native)?;
-            Encoded { warnings, ..Encoded::one(bytes) }
-        } else {
-            encode_all(doc, f.id, &self.params)?
-        };
+        let enc = if f.id == "ai" { encode_ai(cmd, f, doc, &self.params)? } else { encode_all(doc, f.id, &self.params)? };
         if enc.files.len() != 1 {
             return Err(bad(cmd, "Save writes one artboard: name one, or export several with document.export"));
         }
@@ -450,12 +465,17 @@ impl SaveJob {
     /// its own also ends its Data Recovery copy.
     pub fn complete(self, s: &mut Session, uid: u64) {
         let saved = self.plan.retargets() && self.plan.path.is_some();
+        // The other open documents that place this one show the new version.
+        let written = self.plan.path.clone().filter(|_| matches!(self.plan.format.id, "vectorcraft" | "template"));
         if let Some(st) = s.document_mut(uid) {
             self.finish(st);
         }
         if saved {
             crate::cmd::recovery::forget(s, uid);
         }
+        if let Some(path) = written {
+            crate::cmd::links::refresh_placed(s, uid, &path);
+        }
     }
 }
 

crates/engine/src/cmd/fileio/screens.rs

@@ -161,7 +161,7 @@ impl Row {
             return Err(bad(C, "each format is an object {format, scale?, suffix?}"));
         }
         let format = writable(C, Some(str_param(row, "format").unwrap_or("png")), None)?;
-        if matches!(format.id, "vectorcraft" | "template" | "txt" | "dxf" | "eps" | "emf" | "wmf") {
+        if matches!(format.id, "vectorcraft" | "template" | "ai" | "txt" | "dxf" | "eps" | "emf" | "wmf") {
             return Err(bad(C, "Export for Screens writes png, png8, jpg, webp, gif, svg, svgz or pdf"));
         }
         // Vector formats have no pixel size: it doesn't apply and adds no @2x suffix (not even one

crates/engine/src/cmd/fileio/svg.rs

@@ -70,7 +70,7 @@ pub const OPTIONS: &[FormatOption] = &[
         name: "hiddenLayers",
         ty: "boolean",
         default: "false",
-        description: "keep hidden layers, not displayed (display:none); document.save sets it unless given",
+        description: "keep hidden layers and objects, not displayed (display=\"none\"); document.save sets it unless given",
     },
     FormatOption {
         name: "encoding",

crates/engine/src/cmd/fileio/tests.rs

@@ -173,6 +173,7 @@ fn export_extensions_name_every_writable_format() {
             "svg",
             "svgz",
             "pdf",
+            "ai",
             "png",
             "jpg",
             "gif",
@@ -206,6 +207,7 @@ fn formats_query_lists_readers_writers_and_options() {
             "svg",
             "svgz",
             "pdf",
+            "ai",
             "png",
             "jpg",
             "gif",

crates/engine/src/cmd/fileio/tests_pdfedit.rs

@@ -118,6 +118,27 @@ fn ai_files_are_pdfs_that_save_and_reopen_editable() {
     assert_eq!(s.doc().unwrap().path, None);
 }
 
+/// #526: the exports (`document.export`, the CLI's `--export` and `convert`) write `.ai` as Save
+/// As does, leaving the document's own path alone.
+#[test]
+fn exports_write_ai_as_save_as_does() {
+    let mut s = rich();
+    let before = comparable(&s.doc().unwrap().doc);
+    let path = tmp("exported.ai");
+    let r = s.execute("document.export", &json!({"path": path})).unwrap();
+    assert_eq!(r["format"], "ai", "{r}");
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(bytes.starts_with(b"%PDF") && vectorcraft_pdf::editing(&bytes).is_some_and(|e| e.intact), "PDF-compatible, carrying the document");
+    assert_eq!(s.doc().unwrap().path, None, "an export doesn't give the document a path");
+    let r = s.execute("document.open", &json!({"path": path})).unwrap();
+    assert_eq!((&r["format"], &r["restored"]), (&json!("ai"), &json!(true)), "{r}");
+    assert_eq!(comparable(&s.doc().unwrap().doc), before);
+    // Its options as Save As takes them; no path gives the bytes.
+    let r = s.execute("document.export", &json!({"format": "ai", "pdfCompatible": false})).unwrap();
+    assert!(r["warnings"].as_array().unwrap().iter().any(|w| w.as_str().is_some_and(|w| w.contains("without PDF content"))), "{r}");
+    assert!(b64(&r).starts_with(b"%PDF"));
+}
+
 #[test]
 fn ait_templates_open_their_document_untitled() {
     let mut s = rich();

crates/engine/src/cmd/fileio/tests_pdflayers.rs

@@ -59,3 +59,35 @@ fn export_pdf_overprint_is_preserved_or_discarded() {
     assert_eq!(overprints(&mut s, json!({"compression": {"compressText": false}})), 1);
     assert_eq!(overprints(&mut s, json!({"advanced": {"overprint": "discard"}})), 0);
 }
+
+/// A `.ai` file's PDF part, which apps that don't read the native document open, has the layers
+/// and sublayers as PDF layers, the hidden ones with their art (#372).
+#[test]
+fn ai_files_write_their_layers_and_sublayers_as_pdf_layers() {
+    let mut s = session();
+    let layer1 = s.execute("document.inspect", &json!({})).unwrap()["layers"][1]["id"].as_u64().unwrap();
+    let sub = s.execute("layer.newSublayer", &json!({"parent": layer1, "name": "Sketch"})).unwrap()["id"].as_u64().unwrap();
+    s.execute("layer.setCurrent", &json!({"id": sub})).unwrap();
+    s.execute("shape.ellipse", &json!({"x": 10, "y": 40, "width": 20, "height": 20})).unwrap();
+    s.execute("layer.setProps", &json!({"id": sub, "visible": false})).unwrap();
+    // Name, shown and what it holds (sublayers by name), top-level layers in paint order.
+    fn rows(layers: &[std::sync::Arc<vectorcraft_doc::Node>]) -> Vec<(String, bool, Vec<String>)> {
+        layers
+            .iter()
+            .map(|l| {
+                let held =
+                    l.children().into_iter().flatten().map(|c| c.name.clone().filter(|_| c.is_layer()).unwrap_or_else(|| "art".into())).collect();
+                (l.name.clone().unwrap_or_default(), l.visible, held)
+            })
+            .collect()
+    }
+    let v = s.execute("document.export", &json!({"format": "ai"})).unwrap();
+    let back = vectorcraft_pdf::import(&b64(&v)).unwrap();
+    let art = || "art".to_string();
+    assert_eq!(rows(&back.layers), [("Layer 1".to_string(), true, vec![art(), "Sketch".into()]), ("Notes".to_string(), false, vec![art()])]);
+    let sketch = back.layers.first().and_then(|l| l.children()?.last().cloned()).unwrap();
+    assert_eq!(rows(&[sketch]), [("Sketch".to_string(), false, vec![art()])]);
+    // Asked not to, it writes none.
+    let v = s.execute("document.export", &json!({"format": "ai", "createLayers": false})).unwrap();
+    assert_eq!(vectorcraft_pdf::import(&b64(&v)).unwrap().layers.len(), 1);
+}

crates/engine/src/cmd/flatten.rs

@@ -1185,6 +1185,8 @@ impl Scratch {
                 let art = self.doc.symbols.iter().find(|s| &s.name == symbol).map(|s| vectorcraft_render::instance_art(&s.art, n));
                 art.and_then(|a| effects::outline_art(n, Some(&a))).map(|g| carry(n, g))
             }
+            // A placed document stays one: its art's resources aren't the document's.
+            NodeKind::PlacedDocument(_) => None,
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Repeat(_) => {
                 let hook: &dyn Fn(&Node) -> Option<Node> = &effects::outline_text;
                 Some(carry(n, vectorcraft_doc::live::expanded_group(n, Some(hook))))

crates/engine/src/cmd/links.rs

@@ -16,13 +16,17 @@
 //! selects one (`links.goTo`), Embed keeps a linked file's pixels in the document
 //! (`links.embed`) and Unembed writes an embedded image to a file it then links to
 //! (`links.unembed`).
+//!
+//! Placed documents ([`PlacedDocument`], VectorCraft documents placed with Link) link to their
+//! files the same way: checking, updating, relinking and finding them on open work alike, and they
+//! are listed. Embed (Break Link) turns one into an editable copy of its art.
 
 use std::collections::BTreeMap;
 use std::path::{Component, Path};
 
 use serde_json::{Value, json};
 use vectorcraft_doc::links::{Align, Preserve, hash_bytes};
-use vectorcraft_doc::{Appearance, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeId, NodeKind, PlacementOptions};
+use vectorcraft_doc::{Appearance, Document, ImageBlob, ImageObject, LinkInfo, Node, NodeId, NodeKind, PlacedDocument, PlacementOptions};
 use vectorcraft_geom::{Affine, Rect, shapes};
 
 use super::fileio::{self, RasterImage, absolute_path, file_created, file_stamp, read_file, write_file};
@@ -35,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Check Links",
             [],
             None,
-            "{ids?: [image ids] (default: every linked image)} where each linked file is and whether it changed since it was read → {links: [{name, path, status: ok|modified|missing, ids, found?: path (found away from its path: relative to the document, or by name in its folder), preview: true (showing the low-resolution preview, not the file)}], missing, modified}",
+            "{ids?: [image or placed document ids] (default: every linked image and placed document)} where each linked file is and whether it changed since it was read → {links: [{name, path, status: ok|modified|missing, ids, found?: path (found away from its path: relative to the document, or by name in its folder), preview: true (showing the low-resolution preview, not the file)}], missing, modified}",
             has_doc,
             check
         ),
@@ -44,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Update Links",
             [],
             None,
-            "{ids?: [image ids] (default: the linked images whose file was modified or is showing its preview)} read their linked files again; each image keeps its bounds. One undo step → {updated: [ids], missing: [ids]}",
+            "{ids?: [image or placed document ids] (default: the linked images whose file was modified or is showing its preview, and placed documents whose file was modified)} read their linked files again; each keeps its bounds. One undo step → {updated: [ids], missing: [ids]}",
             has_doc,
             update
         ),
@@ -53,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Relink",
             [],
             None,
-            "{ids?: [image ids] (default: the selected images; with folder and nothing selected, every missing link), path | folder} link images to the file at path, or each to the file of its link's name in folder; embedded images become linked; each keeps its bounds. One undo step → {relinked: [ids], notFound: [file names]}",
+            "{ids?: [image or placed document ids] (default: the selected ones; with folder and nothing selected, every missing link), path | folder} link images (or placed documents, each showing the same artboard of the new file) to the file at path, or each to the file of its link's name in folder; embedded images become linked; each keeps its bounds. One undo step → {relinked: [ids], notFound: [file names]}",
             has_doc,
             relink
         ),
@@ -62,7 +66,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Links",
             [],
             None,
-            "{show?: all (default)|missing|modified|embedded, sort?: name|kind (file format)|status (missing, modified, ok, embedded); default: stacking order, top first} every image object in the layers, as the Links panel lists them → {links: [{id, name, linked, status: ok|modified|missing|embedded, format, pixelWidth, pixelHeight, path?, found?: path (found away from its path), page?, preview?: true (showing the saved preview)}], missing, modified, embedded}",
+            "{show?: all (default)|missing|modified|embedded, sort?: name|kind (file format)|status (missing, modified, ok, embedded); default: stacking order, top first} every image object and placed document in the layers, as the Links panel lists them → {links: [{id, name, linked, status: ok|modified|missing|embedded, format, pixelWidth, pixelHeight, path?, found?: path (found away from its path), page?, preview?: true (showing the saved preview), document?: true (a placed document: pageWidth and pageHeight in pt instead of pixels)}], missing, modified, embedded}",
             has_doc,
             list
         ),
@@ -71,7 +75,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Go To Link",
             [],
             None,
-            "{id?} select image `id` (default: the first selected image); the Links panel scrolls it into view → {id, bounds: [x0, y0, x1, y1]}",
+            "{id?} select image or placed document `id` (default: the first selected one); the Links panel scrolls it into view → {id, bounds: [x0, y0, x1, y1]}",
             has_doc,
             go_to
         ),
@@ -80,7 +84,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Embed Image",
             [],
             None,
-            "{ids?: [image ids] (default: the selected linked images)} keep the linked files' pixels in the document and drop the links (an image whose file can't be found and that shows the saved preview stays linked: relink it first). One undo step → {embedded: [ids], missing: [ids]}",
+            "{ids?: [image or placed document ids] (default: the selected linked ones)} break the links (the Links panel's Break Link): images keep the linked files' pixels in the document; a placed document becomes an editable copy of its art, as placing its file without link gives (its symbols, patterns, swatches and images joining the document). An image whose file can't be found and that shows the saved preview, or a placed document whose file can't be read or changed, stays linked: relink or update it first. One undo step → {embedded: [ids], missing: [ids]}",
             has_doc,
             embed
         ),
@@ -98,7 +102,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Link Info",
             [],
             None,
-            "{id?} an image's Link Info (default: the one selected) → image.info's fields (id, name, linked, link, colorMode, pixelWidth, pixelHeight, width, height) and status: ok|modified|missing|embedded, format, ppi: [x, y] (the file's), effectivePpi: [x, y] (at its placed size), scale: [x%, y%] (of its 100% size), rotation (degrees, counter-clockwise), placement: {preserve, align, clip}; linked images also fileName, location (its folder), page?, fileSize? (bytes), modified?, created? (ms since the Unix epoch)",
+            "{id?} an image's or placed document's Link Info (default: the one selected) → image.info's fields (id, name, linked, link, colorMode, pixelWidth, pixelHeight, width, height) and status: ok|modified|missing|embedded, format, ppi: [x, y] (the file's), effectivePpi: [x, y] (at its placed size), scale: [x%, y%] (of its 100% size), rotation (degrees, counter-clockwise), placement: {preserve, align, clip}; linked images also fileName, location (its folder), page?, fileSize? (bytes), modified?, created? (ms since the Unix epoch); a placed document has document: true, pageWidth and pageHeight (pt) instead of pixels, ppi and colorMode, and its scale is of its artboard's 100% size",
             has_doc,
             info
         ),
@@ -107,7 +111,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Placement Options",
             [],
             None,
-            "{ids?: [image ids] (default: the selected images), preserve?: transforms|bounds (default)|fileDimensions|fit|fill, align?: topLeft|top|topRight|left|center (default)|right|bottomLeft|bottom|bottomRight (where the new art sits; not for bounds), clip?: false (clip it to the old bounds where it is larger)} how a file read again (links.relink, links.update) takes each image's place: transforms keeps its scale (relative to each file's 100% size), rotation and position; bounds stretches it into the old bounds; fileDimensions puts it at 100%, unrotated; fit and fill scale it proportionally to fit inside or cover the old bounds. Without options → {placement} of the first image; else one undo step → {ids, placement}",
+            "{ids?: [image or placed document ids] (default: the selected ones), preserve?: transforms|bounds (default)|fileDimensions|fit|fill, align?: topLeft|top|topRight|left|center (default)|right|bottomLeft|bottom|bottomRight (where the new art sits; not for bounds), clip?: false (clip it to the old bounds where it is larger)} how a file read again (links.relink, links.update) takes each image's place: transforms keeps its scale (relative to each file's 100% size), rotation and position; bounds stretches it into the old bounds; fileDimensions puts it at 100%, unrotated; fit and fill scale it proportionally to fit inside or cover the old bounds. Without options → {placement} of the first image; else one undo step → {ids, placement}",
             has_doc,
             placement_options
         ),
@@ -134,22 +138,34 @@ impl Status {
     }
 }
 
-/// The image objects that show one linked file as one content (same path, same image).
+/// The image objects that show one linked file as one content (same path, same image), or the
+/// placed documents that show one artboard of it.
 struct Group {
     link: LinkInfo,
     key: String,
     /// The objects in the layers (images in symbols and patterns share the content, not an id).
     ids: Vec<NodeId>,
+    /// Placed documents: whether the art's bounds (not the artboard) are shown.
+    document: Option<bool>,
 }
 
-/// The linked images of `d` by file and content: those in the layers (only `ids` when given), then,
-/// without `ids`, the ones only symbols and patterns show.
+/// The linked object `n` as (link, content key, placed document's bounding).
+fn linked(n: &Node) -> Option<(&LinkInfo, &str, Option<bool>)> {
+    match &n.kind {
+        NodeKind::Image(im) => Some((im.link.as_ref()?, &im.key, None)),
+        NodeKind::PlacedDocument(p) => Some((&p.link, &p.key, Some(p.bounding))),
+        _ => None,
+    }
+}
+
+/// The linked images and placed documents of `d` by file and content: those in the layers (only `ids` when
+/// given), then, without `ids`, the ones only symbols and patterns show.
 fn groups(d: &Document, ids: Option<&[NodeId]>) -> Vec<Group> {
     let mut out: Vec<Group> = vec![];
-    let mut index: BTreeMap<(String, String), usize> = BTreeMap::new();
-    let mut add = |link: &LinkInfo, key: &str, id: Option<NodeId>| {
-        let i = *index.entry((link.path.clone(), key.to_string())).or_insert_with(|| {
-            out.push(Group { link: link.clone(), key: key.to_string(), ids: vec![] });
+    let mut index: BTreeMap<(String, String, bool), usize> = BTreeMap::new();
+    let mut add = |link: &LinkInfo, key: &str, document: Option<bool>, id: Option<NodeId>| {
+        let i = *index.entry((link.path.clone(), key.to_string(), document.is_some())).or_insert_with(|| {
+            out.push(Group { link: link.clone(), key: key.to_string(), ids: vec![], document });
             out.len() - 1
         });
         if let (Some(id), Some(g)) = (id, out.get_mut(i)) {
@@ -157,19 +173,19 @@ fn groups(d: &Document, ids: Option<&[NodeId]>) -> Vec<Group> {
         }
     };
     d.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind
-            && let Some(l) = &im.link
+        if let Some((l, key, document)) = linked(n)
             && ids.is_none_or(|ids| ids.contains(&n.id))
         {
-            add(l, &im.key, Some(n.id));
+            add(l, key, document, Some(n.id));
         }
     });
     if ids.is_none() {
         d.visit_images(|_, im| {
             if let Some(l) = &im.link {
-                add(l, &im.key, None);
+                add(l, &im.key, None, None);
             }
         });
+        d.visit_placed(|_, p| add(&p.link, &p.key, Some(p.bounding), None));
     }
     out
 }
@@ -238,7 +254,7 @@ fn probe(g: &Group, dir: Option<&Path>) -> (Status, Option<Found>) {
     let same = match &l.hash {
         Some(h) => *h == hash_bytes(&bytes),
         // Linked before links kept a hash: the image the file decodes to.
-        None => fileio::raster_image(&bytes).is_ok_and(|img| img.key == g.key),
+        None => g.document.is_none() && fileio::raster_image(&bytes).is_ok_and(|img| img.key == g.key),
     };
     f.bytes = Some(bytes);
     (if same { Status::Ok } else { Status::Modified }, Some(f))
@@ -254,6 +270,15 @@ fn previewing(d: &Document, key: &str) -> bool {
     d.images.get(key).is_none_or(ImageBlob::is_proxy)
 }
 
+/// Does group `g` of `d` show something other than its file: an image its preview, a placed
+/// document nothing (its file's bytes are gone)?
+fn stale(d: &Document, g: &Group) -> bool {
+    match g.document {
+        None => previewing(d, &g.key),
+        Some(_) => !d.images.contains_key(&g.key),
+    }
+}
+
 /// A linked file of a document (File → Package): its path, name and bytes.
 pub(crate) struct LinkedFile {
     pub path: String,
@@ -301,6 +326,51 @@ fn read_image(f: &mut Found, base: &LinkInfo) -> Result<FileRead> {
     Ok((f.link(&bytes, base), fileio::raster_image(&bytes)?))
 }
 
+/// A linked file read for the objects that show it.
+enum Read {
+    Image(FileRead),
+    /// A VectorCraft document read for placed documents: the link to it and what they show.
+    Document(LinkInfo, super::place::document::Source),
+}
+
+/// The file at `f` read for group `g`: its image, or the artboard `g` shows.
+fn read_for(f: &mut Found, g: &Group, cmd: &str) -> Result<Read> {
+    let Some(bounding) = g.document else { return read_image(f, &g.link).map(Read::Image) };
+    let bytes = f.read()?;
+    let page = g.link.page.unwrap_or(1);
+    let src = super::place::document::source(&f.path, &bytes, Some(&f.path), page, bounding, cmd)?;
+    Ok(Read::Document(f.link(&bytes, &g.link), src))
+}
+
+/// Objects `ids` show what was read (see [`install`], [`install_document`]).
+fn install_read(d: &mut Document, ids: &[NodeId], read: Read, keep_bounds: bool) -> Result<()> {
+    match read {
+        Read::Image(r) => install(d, ids, r, keep_bounds),
+        Read::Document(link, src) => install_document(d, ids, &link, &src, keep_bounds),
+    }
+}
+
+/// Placed documents `ids` show `src`, read from the file `link` points at, each placed as its
+/// Placement Options say (`keep_bounds`: in its bounds, whatever they say).
+fn install_document(d: &mut Document, ids: &[NodeId], link: &LinkInfo, src: &super::place::document::Source, keep_bounds: bool) -> Result<()> {
+    let mut clips = vec![];
+    let (w, h) = (src.frame.width(), src.frame.height());
+    for id in ids {
+        let Some(NodeKind::PlacedDocument(p)) = d.node(*id).map(|n| &n.kind) else { continue };
+        let o = if keep_bounds { PlacementOptions { preserve: Preserve::Bounds, ..p.placement } } else { p.placement };
+        let (xf, clip) = placed_xf(p.xf, (p.width, p.height), (1.0, 1.0), (w, h), (1.0, 1.0), o);
+        if let Some(n) = d.node_mut(*id)
+            && let NodeKind::PlacedDocument(p) = &mut n.kind
+        {
+            let p: &mut PlacedDocument = p;
+            (p.key, p.width, p.height, p.xf, p.link) = (src.key.clone(), w, h, xf, link.clone());
+        }
+        clips.extend(clip.map(|c| (*id, c)));
+    }
+    super::place::document::store(d, src);
+    clips.into_iter().try_for_each(|(id, clip)| clip_image(d, id, clip))
+}
+
 /// Points per pixel of the file image `key` of `d` shows, at the resolution it declares (72 ppi
 /// when it declares none, or when only its preview is loaded).
 fn file_pt(d: &Document, key: &str) -> (f64, f64) {
@@ -318,9 +388,10 @@ type Clip = (Affine, (f64, f64));
 
 /// The transform an image placed with `xf` showing `old` pixels (`old_pt`: points per pixel at
 /// 100%) gives a new file of `new` pixels (`new_pt`), as Placement Options `o` say; and the clip
-/// when `o.clip` and the new art overflows the old bounds.
-fn placed_xf(xf: Affine, old: (u32, u32), old_pt: (f64, f64), new: (u32, u32), new_pt: (f64, f64), o: PlacementOptions) -> (Affine, Option<Clip>) {
-    let (ow, oh, nw, nh) = (old.0 as f64, old.1 as f64, new.0.max(1) as f64, new.1.max(1) as f64);
+/// when `o.clip` and the new art overflows the old bounds. (A placed document's "pixels" are points,
+/// one point each.)
+fn placed_xf(xf: Affine, old: (f64, f64), old_pt: (f64, f64), new: (f64, f64), new_pt: (f64, f64), o: PlacementOptions) -> (Affine, Option<Clip>) {
+    let (ow, oh, nw, nh) = (old.0, old.1, new.0.max(1e-9), new.1.max(1e-9));
     let [a, b, c, d, ..] = xf.as_coeffs();
     // The bounds' frame: the transform without its scale (rotation, reflection and position).
     let (su, sv) = (a.hypot(b), c.hypot(d));
@@ -388,7 +459,8 @@ fn install(d: &mut Document, ids: &[NodeId], (link, img): FileRead, keep_bounds:
     for id in ids {
         let Some(NodeKind::Image(im)) = d.node(*id).map(|n| &n.kind) else { continue };
         let o = if keep_bounds { PlacementOptions { preserve: Preserve::Bounds, ..im.placement } } else { im.placement };
-        let (xf, clip) = placed_xf(im.xf, (im.width, im.height), file_pt(d, &im.key), (img.width, img.height), new_pt, o);
+        let size = |w: u32, h: u32| (w as f64, h as f64);
+        let (xf, clip) = placed_xf(im.xf, size(im.width, im.height), file_pt(d, &im.key), size(img.width, img.height), new_pt, o);
         if let Some(n) = d.node_mut(*id)
             && let NodeKind::Image(im) = &mut n.kind
         {
@@ -436,11 +508,34 @@ pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool) -> Resolv
         let row = rows(std::iter::once(&g));
         match probe(&g, folder(doc_path)) {
             (Status::Missing, _) => out.missing.extend(row),
-            (Status::Modified, Some(mut f)) if update => match read_image(&mut f, &g.link).and_then(|read| install(d, &g.ids, read, false)) {
-                Ok(()) => out.updated.extend(row),
-                Err(_) => out.missing.extend(row),
-            },
+            (Status::Modified, Some(mut f)) if update => {
+                match read_for(&mut f, &g, "document.open").and_then(|read| install_read(d, &g.ids, read, false)) {
+                    Ok(()) => out.updated.extend(row),
+                    Err(_) => out.missing.extend(row),
+                }
+            }
             (Status::Modified, _) => out.modified.extend(row),
+            // A placed document keeps its file's bytes: only lost ones are read again.
+            (Status::Ok, Some(mut f)) if g.document.is_some() => {
+                let read = if stale(d, &g) { Some(read_for(&mut f, &g, "document.open")) } else { None };
+                match read {
+                    Some(Ok(read)) => {
+                        if install_read(d, &g.ids, read, true).is_err() {
+                            out.missing.extend(row);
+                        }
+                    }
+                    Some(Err(_)) => out.missing.extend(row),
+                    None => {
+                        let link = match f.bytes.take() {
+                            Some(b) => f.link(&b, &g.link),
+                            None => LinkInfo { path: f.path.clone(), ..g.link.clone() },
+                        };
+                        if link != g.link {
+                            set_links(d, &g.ids, &link);
+                        }
+                    }
+                }
+            }
             (Status::Ok, Some(mut f)) => {
                 let preview = previewing(d, &g.key);
                 // Read when the images show the preview, or when the file's details changed.
@@ -471,17 +566,58 @@ pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool) -> Resolv
     out
 }
 
-/// Image objects `ids` link to `link`.
+/// The link of linked object `n` (a linked image or a placed document) to change.
+fn link_mut(n: &mut Node) -> Option<&mut LinkInfo> {
+    match &mut n.kind {
+        NodeKind::Image(im) => im.link.as_mut(),
+        NodeKind::PlacedDocument(p) => Some(&mut p.link),
+        _ => None,
+    }
+}
+
+/// Linked image objects (or placed documents) `ids` link to `link`.
 fn set_links(d: &mut Document, ids: &[NodeId], link: &LinkInfo) {
     for id in ids {
-        if let Some(n) = d.node_mut(*id)
-            && let NodeKind::Image(im) = &mut n.kind
-        {
-            im.link = Some(link.clone());
+        if let Some(l) = d.node_mut(*id).and_then(link_mut) {
+            *l = link.clone();
         }
     }
 }
 
+/// Placed documents of the document saved at `path` (document `saved` of `s`) in the other open
+/// documents: read again from the new file, each as one Update Links step of its document.
+pub(crate) fn refresh_placed(s: &mut Session, saved: u64, path: &str) {
+    let path = absolute_path(path);
+    let targets: Vec<(usize, Vec<u64>)> = s
+        .documents()
+        .iter()
+        .enumerate()
+        .filter(|(_, st)| st.uid != saved)
+        .filter_map(|(i, st)| {
+            let mut ids = vec![];
+            st.doc.walk(|n| {
+                if let NodeKind::PlacedDocument(p) = &n.kind
+                    && p.link.path == path
+                {
+                    ids.push(n.id.0);
+                }
+            });
+            (!ids.is_empty()).then_some((i, ids))
+        })
+        .collect();
+    if targets.is_empty() {
+        return;
+    }
+    // Each document is updated as the active one, without switching tools.
+    let back = s.active;
+    for (i, ids) in targets {
+        s.active = Some(i);
+        // A file that can't be read leaves what its objects show: links.check reports it.
+        let _ = update(s, &json!({ "ids": ids }));
+    }
+    s.active = back;
+}
+
 // ---------- relative paths ----------
 
 /// `target` relative to folder `base` with `/` separators; `None` when they share no root (another
@@ -509,9 +645,7 @@ pub fn with_relative_paths(d: &Document, dest: &str) -> Option<Document> {
     let dir = Path::new(&dest).parent()?;
     let mut changes = vec![];
     d.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind
-            && let Some(l) = &im.link
-        {
+        if let Some((l, _, _)) = linked(n) {
             let r = relative_path(Path::new(&l.path), dir);
             if r != l.relative {
                 changes.push((n.id, r));
@@ -523,10 +657,7 @@ pub fn with_relative_paths(d: &Document, dest: &str) -> Option<Document> {
     }
     let mut d = d.clone();
     for (id, r) in changes {
-        if let Some(n) = d.node_mut(id)
-            && let NodeKind::Image(im) = &mut n.kind
-            && let Some(l) = &mut im.link
-        {
+        if let Some(l) = d.node_mut(id).and_then(link_mut) {
             l.relative = r;
         }
     }
@@ -548,7 +679,7 @@ fn check(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(f) = found.filter(|f| f.path != g.link.path) {
             row["found"] = json!(f.path);
         }
-        if previewing(&st.doc, &g.key) {
+        if stale(&st.doc, g) {
             row["preview"] = json!(true);
         }
         links.push(row);
@@ -564,9 +695,9 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
         match probe(&g, folder(st.path.as_deref())) {
             (Status::Missing, _) | (_, None) => missing.extend(ids_json(&g.ids)),
             // Unchanged and showing the file: nothing to read unless asked for by id.
-            (Status::Ok, Some(_)) if ids.is_none() && !previewing(&st.doc, &g.key) => {}
-            // Unreadable as an image counts as missing.
-            (_, Some(mut f)) => match read_image(&mut f, &g.link) {
+            (Status::Ok, Some(_)) if ids.is_none() && !stale(&st.doc, &g) => {}
+            // Unreadable as an image (or a document) counts as missing.
+            (_, Some(mut f)) => match read_for(&mut f, &g, "links.update") {
                 Ok(read) => reads.push((g.ids, read)),
                 Err(_) => missing.extend(ids_json(&g.ids)),
             },
@@ -574,7 +705,7 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let updated: Vec<u64> = reads.iter().flat_map(|(ids, _)| ids_json(ids)).collect();
     if !reads.is_empty() {
-        s.edit("Update Links", |d, _| reads.into_iter().try_for_each(|(ids, read)| install(d, &ids, read, false)))?;
+        s.edit("Update Links", |d, _| reads.into_iter().try_for_each(|(ids, read)| install_read(d, &ids, read, false)))?;
     }
     Ok(json!({ "updated": updated, "missing": missing }))
 }
@@ -583,7 +714,14 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.relink";
     let st = s.doc()?;
     let folder_param = str_param(p, "folder");
-    let image = |id: &NodeId| st.doc.node(*id).and_then(|n| if let NodeKind::Image(im) = &n.kind { Some(im) } else { None });
+    // An image or a placed document, with its link.
+    let image = |id: &NodeId| {
+        st.doc.node(*id).and_then(|n| match &n.kind {
+            NodeKind::Image(im) => Some(im.link.as_ref()),
+            NodeKind::PlacedDocument(p) => Some(Some(&p.link)),
+            _ => None,
+        })
+    };
     let ids: Vec<NodeId> = match ids_param(p, "ids") {
         Some(ids) => ids,
         None => {
@@ -599,7 +737,7 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
         }
     };
     if let Some(id) = ids.iter().find(|id| image(id).is_none()) {
-        return Err(bad(C, format!("object {} is not an image", id.0)));
+        return Err(bad(C, format!("object {} is not an image or a linked file", id.0)));
     }
     if ids.is_empty() {
         return Err(bad(C, "select the images to relink, or pass ids"));
@@ -611,7 +749,7 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
         (Some(path), _) => files.push((ids, absolute_path(path))),
         (None, Some(dir)) => {
             for id in ids {
-                let Some(link) = image(&id).and_then(|im| im.link.as_ref()) else { continue };
+                let Some(link) = image(&id).flatten() else { continue };
                 let path = absolute_path(&Path::new(dir).join(link.name()).to_string_lossy());
                 match files.iter_mut().find(|(_, p)| *p == path) {
                     Some((ids, _)) => ids.push(id),
@@ -625,12 +763,34 @@ fn relink(s: &mut Session, p: &Value) -> Result<Value> {
     let mut reads = vec![];
     for (ids, path) in files {
         let bytes = read_file(&path)?;
-        let img = fileio::raster_image(&bytes).map_err(|e| bad(C, format!("{path}: {e}")))?;
-        reads.push((ids, (link_info(&path, &bytes), img)));
+        let link = link_info(&path, &bytes);
+        // Images show the file; placed documents each show their artboard of it.
+        let mut images = vec![];
+        let mut documents: Vec<((u32, bool), Vec<NodeId>)> = vec![];
+        for id in ids {
+            match st.doc.node(id).map(|n| &n.kind) {
+                Some(NodeKind::PlacedDocument(pl)) => {
+                    let k = (pl.page(), pl.bounding);
+                    match documents.iter_mut().find(|(e, _)| *e == k) {
+                        Some((_, ids)) => ids.push(id),
+                        None => documents.push((k, vec![id])),
+                    }
+                }
+                _ => images.push(id),
+            }
+        }
+        if !images.is_empty() {
+            let img = fileio::raster_image(&bytes).map_err(|e| bad(C, format!("{path}: {e}")))?;
+            reads.push((images, Read::Image((link.clone(), img))));
+        }
+        for ((page, bounding), ids) in documents {
+            let src = super::place::document::source(&path, &bytes, Some(&path), page, bounding, C)?;
+            reads.push((ids, Read::Document(LinkInfo { page: Some(page), ..link.clone() }, src)));
+        }
     }
     let relinked: Vec<u64> = reads.iter().flat_map(|(ids, _)| ids_json(ids)).collect();
     if !reads.is_empty() {
-        s.edit("Relink", |d, _| reads.into_iter().try_for_each(|(ids, read)| install(d, &ids, read, false)))?;
+        s.edit("Relink", |d, _| reads.into_iter().try_for_each(|(ids, read)| install_read(d, &ids, read, false)))?;
     }
     not_found.sort();
     not_found.dedup();
@@ -652,18 +812,6 @@ fn selected_images(st: &crate::DocState, keep: impl Fn(&ImageObject) -> bool) ->
     st.selection.objects.iter().copied().filter(|id| image_of(&st.doc, *id).is_some_and(&keep)).collect()
 }
 
-/// `ids` (else the selected images `keep` accepts), checked to be images; an error when none.
-fn images_param(st: &crate::DocState, p: &Value, cmd: &str, keep: impl Fn(&ImageObject) -> bool) -> Result<Vec<NodeId>> {
-    let ids = ids_param(p, "ids").unwrap_or_else(|| selected_images(st, keep));
-    if let Some(id) = ids.iter().find(|id| image_of(&st.doc, **id).is_none()) {
-        return Err(bad(cmd, format!("object {} is not an image", id.0)));
-    }
-    if ids.is_empty() {
-        return Err(bad(cmd, "select the images, or pass ids"));
-    }
-    Ok(ids)
-}
-
 /// `id`, else the first selected image.
 fn image_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
     let id = id_param(p, "id").or_else(|| selected_images(st, |_| true).first().copied()).ok_or_else(|| bad(cmd, "select an image, or pass id"))?;
@@ -674,6 +822,35 @@ fn image_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
     }
 }
 
+/// The Placement Options of image or placed document `n`.
+fn placement_mut(n: &mut Node) -> Option<&mut PlacementOptions> {
+    match &mut n.kind {
+        NodeKind::Image(im) => Some(&mut im.placement),
+        NodeKind::PlacedDocument(p) => Some(&mut p.placement),
+        _ => None,
+    }
+}
+
+/// The Placement Options of image or placed document `id` of `d`.
+fn placement_of(d: &Document, id: NodeId) -> Option<PlacementOptions> {
+    match &d.node(id)?.kind {
+        NodeKind::Image(im) => Some(im.placement),
+        NodeKind::PlacedDocument(p) => Some(p.placement),
+        _ => None,
+    }
+}
+
+/// `id`, else the first selected image or placed document.
+fn linked_param(st: &crate::DocState, p: &Value, cmd: &str) -> Result<NodeId> {
+    let first = || st.selection.objects.iter().copied().find(|id| placement_of(&st.doc, *id).is_some());
+    let id = id_param(p, "id").or_else(first).ok_or_else(|| bad(cmd, "select an image, or pass id"))?;
+    match placement_of(&st.doc, id) {
+        Some(_) => Ok(id),
+        None if st.doc.node(id).is_none() => Err(crate::EngineError::NoNode(id)),
+        None => Err(bad(cmd, format!("object {} is not an image or a linked file", id.0))),
+    }
+}
+
 /// Per linked image in the layers of `st`: its file's status, where it was found when away from
 /// its path, and whether the image shows its preview (each file probed once).
 fn statuses(st: &crate::DocState) -> BTreeMap<NodeId, (Status, Option<String>, bool)> {
@@ -681,7 +858,7 @@ fn statuses(st: &crate::DocState) -> BTreeMap<NodeId, (Status, Option<String>, b
     for g in groups(&st.doc, None).iter().filter(|g| !g.ids.is_empty()) {
         let (status, found) = probe(g, folder(st.path.as_deref()));
         let found = found.map(|f| f.path).filter(|p| *p != g.link.path);
-        let preview = previewing(&st.doc, &g.key);
+        let preview = stale(&st.doc, g);
         out.extend(g.ids.iter().map(|id| (*id, (status, found.clone(), preview))));
     }
     out
@@ -696,6 +873,12 @@ fn format_label(d: &Document, im: &ImageObject) -> &'static str {
         .map_or("Image", |f| f.label)
 }
 
+/// A placed document's `links.list` fields: `format`, `document: true` and its artboard's size
+/// (`pageWidth`, `pageHeight`, pt) instead of pixels.
+fn document_row(p: &PlacedDocument) -> Value {
+    json!({ "format": "VectorCraft", "document": true, "pageWidth": p.width, "pageHeight": p.height })
+}
+
 /// Sort rank of a `links.list` status: missing, modified, ok, embedded.
 fn status_rank(status: &str) -> usize {
     ["missing", "modified", "ok", "embedded"].iter().position(|s| *s == status).unwrap_or(4)
@@ -709,17 +892,17 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, format!("show `{show}`: all, missing, modified or embedded")));
     }
     let statuses = statuses(st);
-    let mut images = vec![];
+    let mut objects = vec![];
     st.doc.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind {
-            images.push((n, im));
+        if matches!(n.kind, NodeKind::Image(_) | NodeKind::PlacedDocument(_)) {
+            objects.push(n);
         }
     });
     // Top first, as the Layers panel lists them.
-    images.reverse();
+    objects.reverse();
     let mut counts: BTreeMap<&str, usize> = BTreeMap::new();
     let mut rows = vec![];
-    for (n, im) in images {
+    for n in objects {
         let (status, found, preview) = match statuses.get(&n.id) {
             Some((s, f, p)) => (s.as_str(), f.as_deref(), *p),
             None => ("embedded", None, false),
@@ -728,17 +911,21 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
         if show != "all" && show != status {
             continue;
         }
-        let name = im.link.as_ref().map_or_else(|| n.display_name(), |l| l.name().to_string());
-        let mut row = json!({
-            "id": n.id.0,
-            "name": name,
-            "linked": im.link.is_some(),
-            "status": status,
-            "format": format_label(&st.doc, im),
-            "pixelWidth": im.width,
-            "pixelHeight": im.height,
-        });
-        if let Some(l) = &im.link {
+        let (link, mut row) = match &n.kind {
+            NodeKind::Image(im) => {
+                (im.link.as_ref(), json!({ "format": format_label(&st.doc, im), "pixelWidth": im.width, "pixelHeight": im.height }))
+            }
+            NodeKind::PlacedDocument(p) => (Some(&p.link), document_row(p)),
+            _ => continue,
+        };
+        let name = link.map_or_else(|| n.display_name(), |l| l.name().to_string());
+        if let Some(o) = row.as_object_mut() {
+            o.insert("id".into(), json!(n.id.0));
+            o.insert("name".into(), json!(name));
+            o.insert("linked".into(), json!(link.is_some()));
+            o.insert("status".into(), json!(status));
+        }
+        if let Some(l) = link {
             row["path"] = json!(l.path);
             if let Some(page) = l.page {
                 row["page"] = json!(page);
@@ -766,7 +953,7 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn go_to(s: &mut Session, p: &Value) -> Result<Value> {
     let st = s.doc()?;
-    let id = image_param(st, p, "links.goTo")?;
+    let id = linked_param(st, p, "links.goTo")?;
     let b = st.doc.node(id).and_then(Node::geometric_bounds).unwrap_or_default();
     s.select(|_, sel| sel.set([id]))?;
     Ok(json!({ "id": id.0, "bounds": [b.x0, b.y0, b.x1, b.y1] }))
@@ -775,9 +962,29 @@ fn go_to(s: &mut Session, p: &Value) -> Result<Value> {
 fn embed(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.embed";
     let st = s.doc()?;
-    let ids = images_param(st, p, C, |im| im.link.is_some())?;
+    let kind = |id: &NodeId| st.doc.node(*id).map(|n| &n.kind);
+    let linked = |id: &NodeId| match kind(id) {
+        Some(NodeKind::Image(im)) => im.link.is_some(),
+        Some(NodeKind::PlacedDocument(_)) => true,
+        _ => false,
+    };
+    let ids = ids_param(p, "ids").unwrap_or_else(|| st.selection.objects.iter().copied().filter(linked).collect());
+    if let Some(id) = ids.iter().find(|id| !matches!(kind(id), Some(NodeKind::Image(_) | NodeKind::PlacedDocument(_)))) {
+        return Err(bad(C, format!("object {} is not an image or a placed document", id.0)));
+    }
+    if ids.is_empty() {
+        return Err(bad(C, "select the linked images or placed documents, or pass ids"));
+    }
+    // Placed documents become editable copies of their art: those whose file can be read.
+    let (mut documents, mut missing) = (vec![], vec![]);
+    for id in ids.iter().copied() {
+        let Some(NodeKind::PlacedDocument(p)) = kind(&id) else { continue };
+        let readable = st.doc.images.get(&p.key).is_some_and(|b| vectorcraft_doc::placed_document::full_bytes(p, b).is_some());
+        if readable { documents.push(id) } else { missing.push(id) }
+    }
+    let ids: Vec<NodeId> = ids.into_iter().filter(|id| matches!(kind(id), Some(NodeKind::Image(_)))).collect();
     // Images showing their preview take their file's pixels first.
-    let (mut done, mut missing, mut reads) = (vec![], vec![], vec![]);
+    let (mut done, mut reads) = (vec![], vec![]);
     for g in groups(&st.doc, Some(&ids)) {
         if !previewing(&st.doc, &g.key) {
             done.extend(g.ids);
@@ -794,21 +1001,20 @@ fn embed(s: &mut Session, p: &Value) -> Result<Value> {
             _ => missing.extend(g.ids),
         }
     }
-    if !done.is_empty() {
+    if !done.is_empty() || !documents.is_empty() {
         s.edit("Embed", |d, _| {
             for (ids, read) in reads {
                 install(d, &ids, read, true)?;
             }
             for id in &done {
-                if let Some(n) = d.node_mut(*id)
-                    && let NodeKind::Image(im) = &mut n.kind
-                {
+                if let Some(Node { kind: NodeKind::Image(im), .. }) = d.node_mut(*id) {
                     im.link = None;
                 }
             }
-            Ok(())
+            documents.iter().try_for_each(|id| super::place::document::expand(d, *id, C))
         })?;
     }
+    done.extend(documents);
     Ok(json!({ "embedded": ids_json(&done), "missing": ids_json(&missing) }))
 }
 
@@ -862,41 +1068,77 @@ fn placement_json(o: PlacementOptions) -> Value {
     json!({ "preserve": o.preserve.id(), "align": o.align.id(), "clip": o.clip })
 }
 
+/// Link Info's fields of the linked file `l` (of object `id` of `st`) into `out`.
+fn file_fields(st: &crate::DocState, id: NodeId, l: &LinkInfo, out: &mut Value) {
+    let status = groups(&st.doc, Some(&[id])).first().map_or(Status::Missing, |g| probe(g, folder(st.path.as_deref())).0);
+    let stamp = file_stamp(&l.path);
+    let folder_len = l.path.len().saturating_sub(l.name().len());
+    out["status"] = json!(status.as_str());
+    out["path"] = json!(l.path);
+    out["fileName"] = json!(l.name());
+    out["location"] = json!(l.path.get(..folder_len).unwrap_or_default().trim_end_matches(['/', '\\']));
+    for (k, v) in [
+        ("page", l.page.map(u64::from)),
+        ("fileSize", stamp.map(|s| s.0).or(l.size)),
+        ("modified", stamp.and_then(|s| s.1).or(l.modified)),
+        ("created", file_created(&l.path)),
+    ] {
+        if let Some(v) = v {
+            out[k] = json!(v);
+        }
+    }
+}
+
+/// Scale (% of 100%, given points per unit at 100%) and counter-clockwise rotation of `xf`.
+fn scale_rotation(xf: Affine, (px, py): (f64, f64)) -> (Value, Value) {
+    let [a, b, c, d, ..] = xf.as_coeffs();
+    // Counter-clockwise on the page (y points down). Adding 0 turns -0 into 0.
+    (json!([a.hypot(b) / px * 100.0, c.hypot(d) / py * 100.0]), json!((-b).atan2(a).to_degrees() + 0.0))
+}
+
+/// Link Info of placed document `id`.
+fn placed_info(st: &crate::DocState, id: NodeId) -> Result<Value> {
+    let n = st.doc.node(id).ok_or(crate::EngineError::NoNode(id))?;
+    let NodeKind::PlacedDocument(pl) = &n.kind else { return Err(bad("links.info", format!("object {} is not a placed document", id.0))) };
+    let size = n.geometric_bounds().unwrap_or_default();
+    let (scale, rotation) = scale_rotation(pl.xf, (1.0, 1.0));
+    let mut out = document_row(pl);
+    let fields = [
+        ("id", json!(id.0)),
+        ("name", json!(n.display_name())),
+        ("linked", json!(true)),
+        ("link", json!(pl.link.path)),
+        ("width", json!(size.width())),
+        ("height", json!(size.height())),
+        ("scale", scale),
+        ("rotation", rotation),
+        ("placement", placement_json(pl.placement)),
+    ];
+    if let Some(o) = out.as_object_mut() {
+        o.extend(fields.into_iter().map(|(k, v)| (k.to_string(), v)));
+    }
+    file_fields(st, id, &pl.link, &mut out);
+    Ok(out)
+}
+
 fn info(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.info";
-    let id = image_param(s.doc()?, p, C)?;
+    let id = linked_param(s.doc()?, p, C)?;
+    if image_of(&s.doc()?.doc, id).is_none() {
+        return placed_info(s.doc()?, id);
+    }
     let mut out = super::place::image_info(s, &json!({ "id": id.0 }))?;
     let st = s.doc()?;
     let im = image_of(&st.doc, id).ok_or_else(|| bad(C, format!("object {} is not an image", id.0)))?;
     let (px, py) = file_pt(&st.doc, &im.key);
-    let [a, b, c, d, ..] = im.xf.as_coeffs();
     out["effectivePpi"] = out["ppi"].take();
     out["ppi"] = json!([72.0 / px, 72.0 / py]);
-    out["scale"] = json!([a.hypot(b) / px * 100.0, c.hypot(d) / py * 100.0]);
-    // Counter-clockwise on the page (y points down).
-    // Adding 0 turns -0 into 0.
-    out["rotation"] = json!((-b).atan2(a).to_degrees() + 0.0);
+    (out["scale"], out["rotation"]) = scale_rotation(im.xf, (px, py));
     out["format"] = json!(format_label(&st.doc, im));
     out["placement"] = placement_json(im.placement);
     out["status"] = json!("embedded");
     if let Some(l) = &im.link {
-        let status = groups(&st.doc, Some(&[id])).first().map_or(Status::Missing, |g| probe(g, folder(st.path.as_deref())).0);
-        let stamp = file_stamp(&l.path);
-        let folder_len = l.path.len().saturating_sub(l.name().len());
-        out["status"] = json!(status.as_str());
-        out["path"] = json!(l.path);
-        out["fileName"] = json!(l.name());
-        out["location"] = json!(l.path.get(..folder_len).unwrap_or_default().trim_end_matches(['/', '\\']));
-        for (k, v) in [
-            ("page", l.page.map(u64::from)),
-            ("fileSize", stamp.map(|s| s.0).or(l.size)),
-            ("modified", stamp.and_then(|s| s.1).or(l.modified)),
-            ("created", file_created(&l.path)),
-        ] {
-            if let Some(v) = v {
-                out[k] = json!(v);
-            }
-        }
+        file_fields(st, id, l, &mut out);
     }
     Ok(out)
 }
@@ -904,7 +1146,13 @@ fn info(s: &mut Session, p: &Value) -> Result<Value> {
 fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "links.placementOptions";
     let st = s.doc()?;
-    let ids = images_param(st, p, C, |_| true)?;
+    let ids = ids_param(p, "ids").unwrap_or_else(|| st.selection.objects.iter().copied().filter(|id| placement_of(&st.doc, *id).is_some()).collect());
+    if let Some(id) = ids.iter().find(|id| placement_of(&st.doc, **id).is_none()) {
+        return Err(bad(C, format!("object {} is not an image or a linked file", id.0)));
+    }
+    if ids.is_empty() {
+        return Err(bad(C, "select the images, or pass ids"));
+    }
     let choice = |k: &str| -> Result<Option<&str>> {
         match p.get(k) {
             None | Some(Value::Null) => Ok(None),
@@ -918,7 +1166,7 @@ fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
         None | Some(Value::Null) => None,
         Some(v) => Some(v.as_bool().ok_or_else(|| bad(C, "clip must be true or false"))?),
     };
-    let first = ids.first().and_then(|id| image_of(&st.doc, *id)).map(|im| im.placement).unwrap_or_default();
+    let first = ids.first().and_then(|id| placement_of(&st.doc, *id)).unwrap_or_default();
     if preserve.is_none() && align.is_none() && clip.is_none() {
         return Ok(json!({ "placement": placement_json(first) }));
     }
@@ -929,10 +1177,8 @@ fn placement_options(s: &mut Session, p: &Value) -> Result<Value> {
     };
     s.edit("Placement Options", |d, _| {
         for id in &ids {
-            if let Some(n) = d.node_mut(*id)
-                && let NodeKind::Image(im) = &mut n.kind
-            {
-                set(&mut im.placement);
+            if let Some(o) = d.node_mut(*id).and_then(placement_mut) {
+                set(o);
             }
         }
         Ok(())

crates/engine/src/cmd/mod.rs

@@ -48,7 +48,7 @@ mod pathops;
 mod patterncmds;
 pub mod pdfcmds;
 pub mod perspgrid;
-mod place;
+pub(crate) mod place;
 pub mod plugin;
 pub mod prefscmds;
 pub mod print;

crates/engine/src/cmd/object.rs

@@ -150,7 +150,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Object Properties",
             [],
             None,
-            "{ids?|id?, name?, visible?, locked?, opacity?: 0..100, blend?: \"Multiply\"…, isolate?, knockout?: \"on\"|\"off\"|\"neutral\"|bool (true = on, false = neutral), knockoutShape?: bool}",
+            "{ids?|id?, name?, visible?, locked?, opacity?: 0..100, blend?: \"Multiply\"…, isolate?, knockout?: \"on\"|\"off\"|\"neutral\"|bool (true = on, false = neutral), knockoutShape?: bool, data?: {key: \"value\" | null (removes it)} (the object's own data, SVG data-* attributes: {pivot: \"100,180\"} is data-pivot; document.node → attrs.data)}",
             has_doc,
             set_props
         ),
@@ -159,7 +159,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Align",
             ["Window", "Align"],
             None,
-            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", to?: \"selection\"|\"artboard\"|\"key\", bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
+            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", to?: \"selection\"|\"artboard\"|\"key\" (default: the key object when the selection has one, select.key, else the selection), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
             has_selection,
             align
         ),
@@ -177,7 +177,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Distribute Spacing",
             ["Window", "Align"],
             None,
-            "{axis: \"horizontal\"|\"vertical\", spacing?: pt, bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
+            "{axis: \"horizontal\"|\"vertical\", spacing?: pt (the key object, select.key, stays put and the others are spaced from it), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes)}",
             has_multi,
             distribute_spacing
         ),
@@ -738,6 +738,32 @@ fn exit_isolation(s: &mut Session, _: &Value) -> Result<Value> {
     ok()
 }
 
+/// The most data entries `object.setProps` takes at once.
+const MAX_DATA: usize = 256;
+
+/// `object.setProps`'s `data`: each key (a data-* attribute's name: letters, digits, `-`, `_`,
+/// `.`) with its value, or `None` to remove it.
+fn data_param(m: &serde_json::Map<String, Value>) -> Result<Vec<(String, Option<String>)>> {
+    const C: &str = "object.setProps";
+    if m.len() > MAX_DATA {
+        return Err(bad(C, format!("data takes at most {MAX_DATA} keys at once")));
+    }
+    m.iter()
+        .map(|(k, v)| {
+            let k = k.strip_prefix("data-").unwrap_or(k);
+            if k.is_empty() || !k.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.')) || k == "name" || k.starts_with("vc-") {
+                return Err(bad(C, format!("data key `{k}`: letters, digits, -, _ and . (not name or vc-…)")));
+            }
+            let v = match v {
+                Value::Null => None,
+                Value::String(s) => Some(s.clone()),
+                other => Some(other.to_string()),
+            };
+            Ok((k.to_string(), v))
+        })
+        .collect()
+}
+
 fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = targets(s, p)?;
     let opacity = p.get("opacity").and_then(Value::as_f64).map(percent);
@@ -745,6 +771,11 @@ fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
         Some(b) => Some(BlendMode::parse(b).ok_or_else(|| bad("object.setProps", format!("unknown blend mode `{b}`")))?),
         None => None,
     };
+    let data = match p.get("data") {
+        None | Some(Value::Null) => None,
+        Some(Value::Object(m)) => Some(data_param(m)?),
+        Some(v) => return Err(bad("object.setProps", format!("data must be an object of key: value, not {v}"))),
+    };
     let knockout = match p.get("knockout") {
         Some(v) => Some(
             Knockout::from_value(v)
@@ -779,6 +810,24 @@ fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = p.get("knockoutShape").and_then(Value::as_bool) {
                 n.knockout_shape = v;
             }
+            if let Some(changes) = &data {
+                n.edit_attrs(|a| {
+                    for (k, v) in changes {
+                        match (a.data.iter().position(|(key, _)| key == k), v) {
+                            (Some(i), Some(v)) => {
+                                if let Some(e) = a.data.get_mut(i) {
+                                    e.1 = v.clone();
+                                }
+                            }
+                            (Some(i), None) => {
+                                a.data.remove(i);
+                            }
+                            (None, Some(v)) => a.data.push((k.clone(), v.clone())),
+                            (None, None) => {}
+                        }
+                    }
+                });
+            }
         }
         Ok(())
     })?;
@@ -813,9 +862,15 @@ fn items_bounds(d: &Document, ids: &[NodeId], preview: bool) -> Vec<(NodeId, Rec
     ids.iter().filter_map(|id| Some((*id, d.bounds_of(&[*id], preview)?))).collect()
 }
 
+/// What `object.align` aligns to: `to`, else the key object when there is one, else the
+/// selection.
+fn align_to<'a>(s: &Session, p: &'a Value) -> Option<&'a str> {
+    str_param(p, "to").or_else(|| s.doc().ok()?.selection.key.map(|_| "key"))
+}
+
 fn reference_rect(s: &Session, p: &Value, ids: &[NodeId], preview: bool) -> Result<Rect> {
     let st = s.doc()?;
-    match str_param(p, "to") {
+    match align_to(s, p) {
         Some("artboard") => {
             let b = st.doc.bounds_of(ids, preview).unwrap_or_default();
             let i = st.doc.artboard_at(b.center()).unwrap_or(0);
@@ -840,7 +895,7 @@ fn align(s: &mut Session, p: &Value) -> Result<Value> {
         let d = &s.doc()?.doc;
         items_bounds(d, &ids, preview)
             .into_iter()
-            .filter(|(id, _)| Some(*id) != key || str_param(p, "to") != Some("key"))
+            .filter(|(id, _)| Some(*id) != key || align_to(s, p) != Some("key"))
             .map(|(id, b)| {
                 let dx = match h {
                     Some("left") => r.x0 - b.x0,
@@ -926,22 +981,31 @@ fn distribute_spacing(s: &mut Session, p: &Value) -> Result<Value> {
     let mut items = items_bounds(&s.doc()?.doc, &ids, preview);
     items.sort_by(|a, b| if horiz { a.1.x0.total_cmp(&b.1.x0) } else { a.1.y0.total_cmp(&b.1.y0) });
     let n = items.len();
+    let &[(_, first), .., (_, last)] = items.as_slice() else {
+        return Err(EngineError::Other("select two or more objects to distribute".into()));
+    };
     let size = |r: &Rect| if horiz { r.width() } else { r.height() };
     let start = |r: &Rect| if horiz { r.x0 } else { r.y0 };
-    let gap = match p.get("spacing").and_then(Value::as_f64) {
+    let spacing = p.get("spacing").and_then(Value::as_f64).filter(|g| g.is_finite());
+    let gap = match spacing {
         Some(g) => g,
         None => {
-            let span = if horiz { items[n - 1].1.x1 - items[0].1.x0 } else { items[n - 1].1.y1 - items[0].1.y0 };
+            let span = if horiz { last.x1 - first.x0 } else { last.y1 - first.y0 };
             (span - items.iter().map(|i| size(&i.1)).sum::<f64>()) / (n - 1) as f64
         }
     };
-    let mut pos = start(&items[0].1);
-    let mut moves = vec![];
+    let mut pos = start(&first);
+    let mut deltas = vec![];
     for (id, r) in &items {
-        let delta = pos - start(r);
-        moves.push((*id, if horiz { Vec2::new(delta, 0.0) } else { Vec2::new(0.0, delta) }));
+        deltas.push((*id, pos - start(r)));
         pos += size(r) + gap;
     }
+    // With a spacing (aligning to a key object) the key object stays where it is: the others
+    // are spaced from it.
+    let key = s.doc()?.selection.key;
+    let fixed = spacing.and_then(|_| deltas.iter().find(|(id, _)| Some(*id) == key)).map_or(0.0, |k| k.1);
+    let moves: Vec<(NodeId, Vec2)> =
+        deltas.into_iter().map(|(id, d)| (id, if horiz { Vec2::new(d - fixed, 0.0) } else { Vec2::new(0.0, d - fixed) })).collect();
     s.edit("Distribute Spacing", |d, _| {
         for (id, dv) in &moves {
             if let Some(n) = d.node_mut(*id) {

crates/engine/src/cmd/panelcmds.rs

@@ -2,7 +2,7 @@
 //! Character/Paragraph attributes.
 
 use serde_json::{Value, json};
-use vectorcraft_doc::NodeKind;
+use vectorcraft_doc::{Composer, NodeKind};
 use vectorcraft_geom::{Rect, Vec2};
 
 use super::*;
@@ -43,7 +43,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character / Paragraph",
             [],
             None,
-            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\" (where characters smaller than the largest on their line line up with it), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\")}",
+            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt, hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\" (where characters smaller than the largest on their line line up with it), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\"), composer?: \"singleLine\"|\"everyLine\" (line breaking, Every-line by default)}",
             has_doc,
             set_format
         ),
@@ -219,10 +219,19 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
         "leadingModel",
         "charAlign",
         "burasagari",
+        "composer",
     ];
     if !keys.iter().any(|k| p.get(*k).is_some()) {
         return Err(bad(C, "nothing to change"));
     }
+    let composer = match p.get("composer") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(match v.as_str() {
+            Some("singleLine") => Composer::SingleLine,
+            Some("everyLine") => Composer::EveryLine,
+            _ => return Err(bad(C, "composer must be \"singleLine\" or \"everyLine\"")),
+        }),
+    };
     let (position, small_caps) = super::docsetup::script_params(p, &s.doc()?.doc.setup, C)?;
     let char_align = super::textedit::char_align_param(p, C)?;
     let mojikumi = match p.get("mojikumi") {
@@ -329,6 +338,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = burasagari {
                 para.burasagari = v;
             }
+            if let Some(v) = composer {
+                para.composer = v;
+            }
             super::typecmd::refresh_bounds(t);
         }
         Ok(())

crates/engine/src/cmd/place/adopt.rs

@@ -67,6 +67,7 @@ fn refs(n: &mut Node, f: &mut impl FnMut(Ref)) {
                 }
             }
             NodeKind::Image(im) => f(Ref::Image(&mut im.key)),
+            NodeKind::PlacedDocument(pl) => f(Ref::Image(&mut pl.key)),
             NodeKind::SymbolInstance { symbol, .. } => f(Ref::Symbol(symbol)),
             _ => {}
         }
@@ -129,7 +130,7 @@ fn copies(m: &Renames) -> Vec<(&str, &str)> {
 
 /// Bring the resources `nodes` (art from `src`) use into `dst`, renaming on conflict, and point
 /// `nodes` at the names they got.
-pub(super) fn adopt(dst: &mut Document, src: &Document, nodes: &mut [Node]) {
+pub(crate) fn adopt(dst: &mut Document, src: &Document, nodes: &mut [Node]) {
     let mut used = Used::default();
     for n in nodes.iter_mut() {
         refs(n, &mut |r| used.note(r));

crates/engine/src/cmd/place/document.rs

@@ -0,0 +1,273 @@
+//! Placed documents (`file.place` of a VectorCraft document from a file, with `link`): one
+//! locked object showing an artboard of the document, a [`PlacedDocument`].
+//!
+//! The object keeps the file's bytes (in the document's images, like image data) and the link; the
+//! art it shows is read from them the way placing the file without Link reads it
+//! ([`document_art`]: the artboard's art, with the file's own linked images found), so Break Link
+//! and Object › Expand ([`expand`]) give exactly that editable copy. The Links commands
+//! ([`super::super::links`]) tell when the file changed and read it again.
+//!
+//! Each placed file also gets a preview ([`PREVIEW_PX_PER_PT`]; JPEG when opaque, else PNG), kept
+//! as the blob's [`ImageBlob::proxy`]: a save writes only the preview (unless Include Linked
+//! Files), as for linked images. The file is read again when it is needed ([`read_file_again`]:
+//! output, or the screen zoomed past the preview), while it is unchanged, and output falls back to
+//! the preview with a warning when it can't be ([`full_documents`]).
+
+use std::borrow::Cow;
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+use vectorcraft_doc::links::hash_bytes;
+use vectorcraft_doc::placed_document::{PREVIEW_MAX, PREVIEW_PX_PER_PT, key_for};
+use vectorcraft_doc::{Document, ImageBlob, LinkInfo, Node, NodeKind, PlacedDocument, PlacementOptions};
+use vectorcraft_geom::{Affine, Rect};
+
+use super::super::fileio;
+use super::super::*;
+
+/// The largest file placed (bytes).
+pub(crate) const MAX_FILE: usize = 256 << 20;
+/// The format ids of VectorCraft documents.
+const NATIVE: [&str; 2] = ["vectorcraft", "template"];
+/// The type a placed file's bytes are stored with.
+const MIME: &str = "application/json";
+
+/// Is `name` with `bytes` a VectorCraft document?
+pub(crate) fn is_native(name: &str, bytes: &[u8]) -> bool {
+    fileio::detect(name, bytes).is_some_and(|f| NATIVE.contains(&f.id))
+}
+
+/// An artboard of a VectorCraft document, read as art to place.
+pub(crate) struct DocumentArt {
+    /// The document, its layers taken: the art's resources.
+    pub doc: Document,
+    /// The art on the artboard (guides, hidden and template layers left out).
+    pub nodes: Vec<Node>,
+    /// The artboard the art is clipped to (`None`: the art's bounds are shown).
+    pub clip: Option<Rect>,
+    /// What is shown: the artboard, or the art's bounds.
+    pub frame: Rect,
+    pub warnings: Vec<String>,
+}
+
+/// Artboard `page` (1-based) of the VectorCraft document `name` (`bytes`, read from `path` when
+/// there is one, so its linked images are found), clipped to the artboard unless `bounding`.
+pub(crate) fn document_art(name: &str, bytes: &[u8], path: Option<&str>, page: u32, bounding: bool, cmd: &str) -> Result<DocumentArt> {
+    let file = fileio::file_name(name);
+    if !is_native(name, bytes) {
+        return Err(bad(cmd, format!("`{file}` isn't a VectorCraft document")));
+    }
+    if bytes.len() > MAX_FILE {
+        return Err(bad(cmd, format!("`{file}` is over {} MB", MAX_FILE >> 20)));
+    }
+    let mut l = fileio::load(name, bytes)?;
+    // Its linked images show their files; its placed documents stay as they are.
+    super::super::links::resolve(&mut l.doc, path, false);
+    l.doc.drop_edit_modes();
+    let n = l.doc.artboards.len();
+    let board = (page as usize).checked_sub(1).and_then(|i| l.doc.artboards.get(i)).map(|a| a.rect);
+    let board = board.ok_or_else(|| bad(cmd, format!("page {page}: `{file}` has {n} artboard(s)")))?;
+    let layers = std::mem::take(&mut l.doc.layers);
+    let nodes = super::on_artboard(&layers, board);
+    let frame = if bounding { nodes.iter().fold(None, |acc, n| vectorcraft_geom::union_opt(acc, n.visual_bounds())) } else { Some(board) };
+    let frame = frame.filter(|r| r.width() > 0.0 || r.height() > 0.0).ok_or_else(|| bad(cmd, format!("`{file}` has no art to place")))?;
+    Ok(DocumentArt { doc: l.doc, nodes, clip: (!bounding).then_some(board), frame, warnings: l.warnings })
+}
+
+/// `nodes` as one group, clipped to `clip` (its own ids: what drawing reads).
+fn group(nodes: Vec<Node>, clip: Option<Rect>) -> Node {
+    let mut children: Vec<Arc<Node>> = nodes.into_iter().map(Arc::new).collect();
+    if let Some(r) = clip {
+        children.insert(0, Arc::new(super::clip_path(NodeId(0), r)));
+    }
+    Node::new(NodeId(0), NodeKind::Group { children, clip: clip.is_some() })
+}
+
+/// `p`'s file (`bytes`) read as the art it shows: how the document model reads placed documents
+/// ([`vectorcraft_doc::placed_document::set_loader`]).
+pub(crate) fn read_document(p: &PlacedDocument, bytes: &[u8]) -> Option<(Document, Node, Rect)> {
+    let a = document_art(p.link.name(), bytes, Some(&p.link.path), p.page(), p.bounding, "draw").ok()?;
+    Some((a.doc, group(a.nodes, a.clip), a.frame))
+}
+
+/// `p`'s file read again, while it is the file it was read from (how the document model gets it
+/// when only the preview is stored, [`vectorcraft_doc::placed_document::set_file_reader`]).
+pub(crate) fn read_file_again(p: &PlacedDocument) -> Option<Vec<u8>> {
+    let bytes = fileio::read_file(&p.link.path).ok()?;
+    if p.link.hash.as_ref().is_some_and(|h| *h != hash_bytes(&bytes)) {
+        return None;
+    }
+    Some(bytes)
+}
+
+/// A VectorCraft document read for placing linked.
+#[derive(Clone)]
+pub(crate) struct Source {
+    /// The file's bytes, with their preview.
+    pub blob: ImageBlob,
+    /// The blob's key ([`key_for`]).
+    pub key: String,
+    /// What is shown, in the file's coordinates: the artboard or the art's bounds.
+    pub frame: Rect,
+    pub warnings: Vec<String>,
+}
+
+/// The VectorCraft document `name` (`bytes`, from `path` when there is one) read for showing
+/// artboard `page` (its art's bounds when `bounding`).
+pub(crate) fn source(name: &str, bytes: &[u8], path: Option<&str>, page: u32, bounding: bool, cmd: &str) -> Result<Source> {
+    // The same document placed the same way is read once (placing it again is free).
+    let key = key_for(&hash_bytes(bytes), page, bounding);
+    if let Some(s) = lock_memo().iter().find(|s| s.key == key).cloned() {
+        return Ok(s);
+    }
+    let a = document_art(name, bytes, path, page, bounding, cmd)?;
+    let mut blob = ImageBlob::new(MIME, bytes.to_vec());
+    let shown = PlacedDocument {
+        link: LinkInfo { page: Some(page), ..LinkInfo::new(path.unwrap_or(name)) },
+        key: key.clone(),
+        bounding,
+        width: a.frame.width(),
+        height: a.frame.height(),
+        xf: Affine::IDENTITY,
+        placement: PlacementOptions::default(),
+    };
+    let art = group(a.nodes, a.clip);
+    blob.proxy = preview(&a.doc, &art, a.frame).map(Arc::new);
+    // Drawing it needn't read it again.
+    vectorcraft_doc::placed_document::prime(&shown, blob.bytes.clone(), (a.doc, art, a.frame));
+    let s = Source { blob, key, frame: a.frame, warnings: a.warnings };
+    let mut m = lock_memo();
+    if m.len() >= MEMO_SIZE {
+        m.remove(0);
+    }
+    m.push(s.clone());
+    Ok(s)
+}
+
+/// The most files remembered.
+const MEMO_SIZE: usize = 32;
+
+/// Files read lately for placing, by key.
+static MEMO: std::sync::Mutex<Vec<Source>> = std::sync::Mutex::new(Vec::new());
+
+fn lock_memo() -> std::sync::MutexGuard<'static, Vec<Source>> {
+    // Entries are only pushed and removed: a panic while held leaves it whole.
+    MEMO.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+/// The preview of `art` (of document `doc`, showing `frame`): [`PREVIEW_PX_PER_PT`], at most
+/// [`PREVIEW_MAX`] pixels a side; JPEG when opaque (inside its outer pixels), else PNG.
+fn preview(doc: &Document, art: &Node, frame: Rect) -> Option<Vec<u8>> {
+    let k = PREVIEW_PX_PER_PT.min(PREVIEW_MAX as f64 / frame.width().max(frame.height()).max(1e-9));
+    let side = |v: f64| (v * k).round().clamp(1.0, PREVIEW_MAX as f64) as u32;
+    let (w, h) = (side(frame.width()), side(frame.height()));
+    let view = Affine::scale_non_uniform(w as f64 / frame.width().max(1e-9), h as f64 / frame.height().max(1e-9))
+        * Affine::translate((-frame.x0, -frame.y0));
+    let mut r = vectorcraft_render::Renderer::new();
+    let img = vectorcraft_render::placed_document::render_inside(&mut r, doc, &Arc::new(art.clone()), w as u16, h as u16, view)?;
+    // Premultiplied → straight.
+    let px = img
+        .pixels
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .flat_map(|&[r, g, b, a]| {
+            let un = |c: u8| if a == 0 { 0 } else { ((c as u32 * 255 + a as u32 / 2) / a as u32).min(255) as u8 };
+            [un(r), un(g), un(b), a]
+        })
+        .collect();
+    let rgba = image::RgbaImage::from_raw(w, h, px)?;
+    let mut out = vec![];
+    // Opaque but for the edge's anti-aliasing (an artboard drawn to whole pixels) and compositing's
+    // rounding: JPEG.
+    let inner = |x: u32, y: u32| x > 0 && y > 0 && x + 1 < w && y + 1 < h;
+    if rgba.enumerate_pixels().all(|(x, y, p)| p[3] >= 250 || !inner(x, y)) {
+        let rgb = image::DynamicImage::ImageRgba8(rgba).to_rgb8();
+        image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, 80).encode_image(&rgb).ok()?;
+    } else {
+        rgba.write_to(&mut std::io::Cursor::new(&mut out), image::ImageFormat::Png).ok()?;
+    }
+    Some(out)
+}
+
+/// `s` stored in `d` (objects showing the same thing share one blob).
+pub(crate) fn store(d: &mut Document, s: &Source) {
+    d.images.entry(s.key.clone()).or_insert_with(|| s.blob.clone());
+}
+
+/// A new placed document of `d` showing `s` at 100%, where its art lies in the file.
+pub(crate) fn node(d: &mut Document, s: &Source, link: LinkInfo, bounding: bool) -> Node {
+    store(d, s);
+    let placed = PlacedDocument {
+        link,
+        key: s.key.clone(),
+        bounding,
+        width: s.frame.width(),
+        height: s.frame.height(),
+        xf: Affine::translate((s.frame.x0, s.frame.y0)),
+        placement: PlacementOptions::default(),
+    };
+    Node::new(d.alloc_id(), NodeKind::PlacedDocument(Box::new(placed)))
+}
+
+/// `d` for output: the placed documents that keep only their previews get their files back,
+/// else (their files gone or changed) output as their previews, with a warning.
+pub(crate) fn full_documents(d: &Document) -> (Cow<'_, Document>, Vec<String>) {
+    let mut need: Vec<PlacedDocument> = vec![];
+    d.visit_placed(|_, p| {
+        if d.images.get(&p.key).is_some_and(ImageBlob::is_proxy) && !need.iter().any(|n| n.key == p.key) {
+            need.push(p.clone());
+        }
+    });
+    if need.is_empty() {
+        return (Cow::Borrowed(d), vec![]);
+    }
+    let mut out = d.clone();
+    let mut previews = BTreeSet::new();
+    for p in need {
+        let Some(blob) = d.images.get(&p.key) else { continue };
+        match vectorcraft_doc::placed_document::full_bytes(&p, blob) {
+            Some(bytes) => {
+                out.images.insert(p.key.clone(), ImageBlob { mime: MIME.into(), bytes, proxy: blob.proxy.clone() });
+            }
+            None => {
+                previews.insert(p.key);
+            }
+        }
+    }
+    let mut warnings = vec![];
+    if !previews.is_empty() {
+        warnings.push(format!(
+            "{} placed document(s) output as their previews: their files can't be found, or changed since they were read (relink or update them)",
+            previews.len()
+        ));
+        out.placed_as_previews(&previews);
+    }
+    (Cow::Owned(out), warnings)
+}
+
+/// Placed document `id` of `d` replaced by an editable copy of its art, as placing its file
+/// without Link gives (its resources joining `d`, renamed where `d` uses a name for something
+/// else), keeping the object's id, place, name and transparency: Break Link and Object › Expand.
+pub(crate) fn expand(d: &mut Document, id: NodeId, cmd: &str) -> Result<()> {
+    let n = d.node(id).cloned().ok_or(EngineError::NoNode(id))?;
+    let NodeKind::PlacedDocument(p) = &n.kind else { return Err(bad(cmd, format!("object {} is not a placed document", id.0))) };
+    let blob = d.images.get(&p.key).ok_or_else(|| bad(cmd, format!("object {} has lost its file's contents: relink it", id.0)))?;
+    let bytes = vectorcraft_doc::placed_document::full_bytes(p, blob)
+        .ok_or_else(|| bad(cmd, format!("{} can't be read, or changed since it was read: relink or update it first", p.link.path)))?;
+    let a = document_art(p.link.name(), &bytes, Some(&p.link.path), p.page(), p.bounding, cmd)?;
+    let m = p.art_xf(a.frame).ok_or_else(|| bad(cmd, format!("object {} has no size", id.0)))?;
+    let mut nodes = a.nodes;
+    super::adopt::adopt(d, &a.doc, &mut nodes);
+    let mut children: Vec<Arc<Node>> = nodes.iter().map(|n| Arc::new(d.reid(n))).collect();
+    if let Some(r) = a.clip {
+        children.insert(0, Arc::new(super::clip_path(d.alloc_id(), r)));
+    }
+    let art = super::transformed(Node::new(d.alloc_id(), NodeKind::Group { children, clip: a.clip.is_some() }), m);
+    let mut out = n.clone();
+    out.kind = art.kind;
+    let (par, index, _) = d.position(id).ok_or(EngineError::NoNode(id))?;
+    d.remove(id)?;
+    d.insert(par, index, out)?;
+    Ok(())
+}

crates/engine/src/cmd/place/mod.rs

@@ -16,13 +16,17 @@
 //!   (`crop: "bounding"`).
 //! - A text file becomes area type, decoded and cleaned up with the Text Import Options (`text`,
 //!   [`text`]).
+//! - A VectorCraft document placed from a file with Link (the default) becomes a placed document:
+//!   one locked object showing the artboard `page`, linked to the file and read again when it
+//!   changes ([`document`]); without Link, an editable copy of its art.
 //!
 //! The art lands centred on `at`, fitted into `rect`, or (Replace) where the replaced object was,
 //! with its transform; Template puts it on a new template layer. The images, symbols, patterns and
 //! swatches it uses join the document ([`adopt`]). `file.place.queue` loads the place cursor (the
 //! `place` tool) with several files, which emits one `file.place` per click or drag.
 
-mod adopt;
+pub(crate) mod adopt;
+pub(crate) mod document;
 mod text;
 
 use std::sync::Arc;
@@ -53,7 +57,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Place…",
             ["File"],
             Some("Cmd+Shift+P"),
-            "{path | name+dataBase64, link?: true (a raster image keeps its file's path; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside, aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default) | \"bounding\" (the art's bounds) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it) and native documents as one group, with the images, symbols, patterns and swatches they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard",
+            "{path | name+dataBase64, link?: true (a raster image keeps its file's path; a VectorCraft document at path becomes one locked placed document showing artboard `page`, linked to the file and read again when it changes (links.update; saving it in this app updates it at once), drawn as vectors in every output; false: an editable copy of its art, as from dataBase64; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside, aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default) | \"bounding\" (the art's bounds) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it) and native documents as one group, with the images, symbols, patterns and swatches they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard",
             has_doc,
             place
         ),
@@ -94,6 +98,9 @@ enum Art {
     Image(RasterImage),
     /// A text file's text, placed as area type filling the natural box.
     Text(String),
+    /// A VectorCraft document placed linked: the file read, the link, and whether the art's
+    /// bounds (not the artboard) are shown.
+    Document(document::Source, LinkInfo, bool),
     Vector {
         /// The loaded document: the source of the art's resources.
         src: Box<Document>,
@@ -157,6 +164,19 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
         ));
     }
     let crop = opts.crop != CropTo::Bounding;
+    // A VectorCraft document: placed linked from its file, else as an editable copy.
+    if matches!(format.id, "vectorcraft" | "template") {
+        let page = page as u32;
+        if let Some(path) = src.path.filter(|_| bool_or(p, "link", true)) {
+            let s = document::source(src.name, &src.bytes, Some(path), page, !crop, cmd)?;
+            let link = LinkInfo { page: Some(page), ..super::links::link_info(path, &src.bytes) };
+            let (natural, warnings) = (s.frame, s.warnings.clone());
+            return Ok(Loaded { name, format, art: Art::Document(s, link.clone(), !crop), natural, warnings, link: Some(link), board: None });
+        }
+        let a = document::document_art(src.name, &src.bytes, src.path, page, !crop, cmd)?;
+        let art = Art::Vector { src: Box::new(a.doc), nodes: a.nodes, clip: a.clip };
+        return Ok(Loaded { name, format, art, natural: a.frame, warnings: a.warnings, link: None, board: None });
+    }
     if format.raster {
         let img = fileio::raster_image(&src.bytes)?;
         let (sx, sy) = pt_per_px(img.ppi);
@@ -176,7 +196,7 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
             // Of the open options, only a DXF drawing's apply (the colour mode stays the file's).
             let o = fileio::LoadOptions { dxf: opts.dxf, ..Default::default() };
             let mut l = fileio::load_with(src.name, &src.bytes, &o)?;
-            // Linked images (a native document's) show their files, found from its folder.
+            // Linked images show their files, found from its folder.
             super::links::resolve(&mut l.doc, src.path, false);
             (l.doc, l.warnings)
         }
@@ -190,22 +210,31 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
         // The page placed is a PDF import's only one.
         let index = if pdf { 0 } else { page - 1 };
         let n = doc.artboards.len();
-        let board = doc.artboards.get(index).map(|a| a.rect).ok_or_else(|| {
-            let what = if matches!(format.id, "vectorcraft" | "template") { "artboard" } else { "page" };
-            bad(cmd, format!("page {page}: `{name}` has {n} {what}(s)"))
-        })?;
-        // A PDF import has one layer per page; a native document's (or an EPS file's) art is
-        // whatever lies on the artboard.
-        let pages: Vec<&Arc<Node>> = if pdf { layers.get(index).into_iter().collect() } else { layers.iter().collect() };
-        let on_board = |c: &&Arc<Node>| c.visual_bounds().is_some_and(|b| b.intersect(board).area() > 0.0 || board.contains(b.origin()));
-        let nodes = art_of(pages.into_iter().filter(|l| placeable(l)).flat_map(|l| l.children().into_iter().flatten()).filter(on_board));
-        (nodes, crop.then_some(board))
+        let board = doc.artboards.get(index).map(|a| a.rect).ok_or_else(|| bad(cmd, format!("page {page}: `{name}` has {n} page(s)")))?;
+        // A PDF import has one layer per page; an EPS file's art is whatever lies on the artboard.
+        let pages = if pdf { layers.get(index..=index).unwrap_or_default() } else { &layers[..] };
+        (on_artboard(pages, board), crop.then_some(board))
     };
     let natural = clip.or_else(|| nodes.iter().fold(None, |acc, n| vectorcraft_geom::union_opt(acc, n.visual_bounds())));
     let natural = natural.filter(|r| r.width() > 0.0 || r.height() > 0.0).ok_or_else(|| bad(cmd, format!("`{name}` has no art to place")))?;
     Ok(Loaded { name, format, art: Art::Vector { src: Box::new(doc), nodes, clip }, natural, warnings, link: None, board })
 }
 
+/// The placeable art of `layers` that lies on `board`.
+fn on_artboard(layers: &[Arc<Node>], board: Rect) -> Vec<Node> {
+    let on_board = |c: &&Arc<Node>| c.visual_bounds().is_some_and(|b| b.intersect(board).area() > 0.0 || board.contains(b.origin()));
+    art_of(layers.iter().filter(|l| placeable(l)).flat_map(|l| l.children().into_iter().flatten()).filter(on_board))
+}
+
+/// A clipping path of rectangle `r`, with id `id`.
+fn clip_path(id: NodeId, r: Rect) -> Node {
+    let mut c = Node::path(id, shapes::rectangle(r), Appearance::basic(Paint::None, Paint::None, 0.0));
+    if let NodeKind::Path { clipping, .. } = &mut c.kind {
+        *clipping = true;
+    }
+    c
+}
+
 /// A visible, non-template layer.
 fn placeable(l: &Node) -> bool {
     l.visible && !matches!(l.kind, NodeKind::Layer { template: true, .. })
@@ -243,15 +272,12 @@ fn build(d: &mut Document, l: Loaded, link: Option<LinkInfo>) -> Node {
             Node::new(d.alloc_id(), NodeKind::Image(im))
         }
         Art::Text(t) => Node::new(d.alloc_id(), NodeKind::Text(Box::new(text::area_text(t, l.natural)))),
+        Art::Document(s, link, bounding) => document::node(d, &s, link, bounding),
         Art::Vector { src, mut nodes, clip } => {
             adopt::adopt(d, &src, &mut nodes);
             let mut children: Vec<Arc<Node>> = nodes.iter().map(|n| Arc::new(d.reid(n))).collect();
             if let Some(r) = clip {
-                let mut c = Node::path(d.alloc_id(), shapes::rectangle(r), Appearance::basic(Paint::None, Paint::None, 0.0));
-                if let NodeKind::Path { clipping, .. } = &mut c.kind {
-                    *clipping = true;
-                }
-                children.insert(0, Arc::new(c));
+                children.insert(0, Arc::new(clip_path(d.alloc_id(), r)));
             }
             Node::new(d.alloc_id(), NodeKind::Group { children, clip: clip.is_some() })
         }

crates/engine/src/cmd/print.rs

@@ -118,6 +118,9 @@ fn print(s: &mut Session, p: &Value) -> Result<Value> {
         let preset = given.or(Some(set.advanced.flattener_preset.as_str()).filter(|n| !n.trim().is_empty())).unwrap_or("medium");
         set.advanced.flattener_preset = preset.to_string();
     }
+    // Placed documents print their files' art.
+    let (full, _) = super::place::document::full_documents(doc);
+    let doc = &*full;
     // Raster effects print as images at the document's raster effects resolution.
     let flat = super::rasterfx::flatten_raster_effects(doc);
     let doc = flat.as_ref().unwrap_or(doc);

crates/engine/src/cmd/select.rs

@@ -36,7 +36,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             toggle
         ),
-        cmd!("select.key", "Set Key Object", [], None, "{id?} (none clears)", has_doc, key),
+        cmd!(
+            "select.key",
+            "Set Key Object",
+            [],
+            None,
+            "{id?: a selected object (the Selection tool: a click on one object of a selection of several; on the key again: none)} the key object Align aligns to and Distribute Spacing spaces from; none clears it",
+            has_doc,
+            key
+        ),
         cmd!("select.anchors", "Select Anchors", [], None, "{id, anchors: [[subpath, anchor]…], mode: \"set\"|\"add\"|\"toggle\"}", has_doc, anchors),
         cmd!(
             "select.anchorsMany",

crates/engine/src/cmd/typecmd.rs

@@ -48,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Area Type Options…",
             ["Type"],
             None,
-            "{ids?, width?: pt, height?: pt, rows?, columns?, gutter?: pt, inset?: pt, firstBaseline?: ascent|capHeight|xHeight|leading|fixed, firstBaselineMin?: pt} set the selected area type's options; width and height size the type area from its top-left corner, along the type's own axes, and the text reflows at its size (none given: query) → the first object's options",
+            "{ids?, width?: pt, height?: pt, rows?, columns?, gutter?: pt, inset?: pt, firstBaseline?: ascent|capHeight|xHeight|leading|fixed, firstBaselineMin?: pt, verticalAlign?: top|center|bottom|justify} set the selected area type's options; width and height size the type area from its top-left corner, along the type's own axes, and the text reflows at its size (none given: query) → the first object's options",
             has_selection,
             area_options
         ),
@@ -530,7 +530,10 @@ mod area_tests {
         s.execute("text.setFormat", &json!({"leadingModel": "emBoxTop"})).unwrap();
         let t = text(&s);
         assert_eq!(t.para.leading_model, LeadingModel::EmBoxTop);
-        assert_ne!(t.cached_bounds, before, "the first line moves up to the frame's top");
+        // The fallback used without craft-fonts has no glyph metrics to move the first line.
+        if !vectorcraft_text::CRAFT_FONTS.is_empty() {
+            assert_ne!(t.cached_bounds, before, "the first line moves up to the frame's top");
+        }
         assert_eq!(serde_json::to_value(&t.para).unwrap()["leading_model"], "emBoxTop");
         s.execute("edit.undo", &json!({})).unwrap();
         assert!(serde_json::to_value(&text(&s).para).unwrap().get("leading_model").is_none());

crates/engine/src/lib.rs

@@ -801,6 +801,9 @@ impl Default for Session {
 
 impl Session {
     pub fn new() -> Self {
+        // Placed documents are read by the native format's loader.
+        vectorcraft_doc::placed_document::set_loader(cmd::place::document::read_document);
+        vectorcraft_doc::placed_document::set_file_reader(cmd::place::document::read_file_again);
         Self {
             docs: vec![],
             active: None,
@@ -1450,6 +1453,8 @@ mod tests_perspgrid;
 #[cfg(test)]
 mod tests_place;
 #[cfg(test)]
+mod tests_placed_document;
+#[cfg(test)]
 mod tests_plugins;
 #[cfg(test)]
 mod tests_prefs;

crates/engine/src/tests.rs

@@ -198,6 +198,37 @@ fn align_left() {
     assert_eq!(s.doc().unwrap().doc.node(b).unwrap().geometric_bounds().unwrap().x0, 0.0);
 }
 
+/// #541: with the Selection tool, a click on one object of the selection makes it the key object:
+/// aligning to the key moves the others to it, Distribute Spacing spaces them from it, and a click
+/// on the key again lets it go.
+#[test]
+fn a_click_sets_the_key_object_that_align_and_spacing_keep_still() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    let b = rect(&mut s, 100.0, 30.0, 20.0, 20.0);
+    let c = rect(&mut s, 300.0, 60.0, 10.0, 10.0);
+    s.execute("select.set", &json!({"ids": [a.0, b.0, c.0]})).unwrap();
+    let v = ViewInfo::default();
+    s.select_tool("selection", v).unwrap();
+    let click = |s: &mut Session| {
+        for kind in [PointerKind::Down, PointerKind::Up] {
+            s.pointer(&PointerEvent::new(kind, 110.0, 40.0), v).unwrap();
+        }
+    };
+    click(&mut s);
+    assert_eq!(s.doc().unwrap().selection.key, Some(b));
+    assert_eq!(s.doc().unwrap().selection.objects.len(), 3, "the selection stays");
+    let x0 = |s: &Session, id| s.doc().unwrap().doc.node(id).unwrap().geometric_bounds().unwrap().x0;
+    // With a key object, aligning aligns to it (the Control bar and Properties name no target).
+    s.execute("object.align", &json!({"horizontal": "left", "bounds": "geometric"})).unwrap();
+    assert_eq!((x0(&s, a), x0(&s, b), x0(&s, c)), (100.0, 100.0, 100.0), "the others moved to the key");
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("object.distributeSpacing", &json!({"axis": "horizontal", "spacing": 5, "bounds": "geometric"})).unwrap();
+    assert_eq!((x0(&s, a), x0(&s, b), x0(&s, c)), (85.0, 100.0, 125.0), "5 pt apart, the key still");
+    click(&mut s);
+    assert_eq!(s.doc().unwrap().selection.key, None, "a click on the key again lets it go");
+}
+
 #[test]
 fn selection_tool_drag_is_one_undo_step() {
     let mut s = session();

crates/engine/src/tests_attributes.rs

@@ -190,3 +190,27 @@ fn svg_export_links_objects_and_import_reads_the_links_back() {
     });
     assert_eq!(urls, [Some("https://example.com/?a=1&b=2".to_string()), None], "the link wraps the path alone");
 }
+
+/// #522: an object's own data (SVG `data-*` attributes) is set with `object.setProps {data}`,
+/// undone in one step, written to SVG and kept by the native format.
+#[test]
+fn object_data_is_set_saved_and_written_to_svg() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let data = |s: &Session| s.doc().unwrap().doc.node(a).unwrap().attrs.as_deref().map(|x| x.data.clone()).unwrap_or_default();
+    let pair = |k: &str, v: &str| (k.to_string(), v.to_string());
+    run(&mut s, "object.setProps", json!({"data": {"pivot": "60,100", "z": 3}}));
+    assert_eq!(data(&s), [pair("pivot", "60,100"), pair("z", "3")], "values are text");
+    run(&mut s, "object.setProps", json!({"data": {"data-pivot": "1,2", "z": null}}));
+    assert_eq!(data(&s), [pair("pivot", "1,2")], "a data- prefix is optional; null removes a key");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(data(&s).len(), 2, "one step");
+    for bad in [json!({"data": {"vc-x": "1"}}), json!({"data": {"name": "x"}}), json!({"data": {"a b": "1"}}), json!({"data": "pivot"})] {
+        assert!(s.execute("object.setProps", &bad).is_err(), "{bad}");
+    }
+    let svg = run(&mut s, "document.serialize", json!({"format": "svg"}))["text"].as_str().unwrap().to_string();
+    assert!(svg.contains("data-pivot=\"60,100\" data-z=\"3\""), "{svg}");
+    let native = vectorcraft_format::save(&s.doc().unwrap().doc, false);
+    let back = vectorcraft_format::load(&native).unwrap();
+    assert_eq!(back.node(a).unwrap().attrs, s.doc().unwrap().doc.node(a).unwrap().attrs);
+}

crates/engine/src/tests_build.rs

@@ -704,3 +704,67 @@ fn image_trace_object_remembers_its_settings() {
     let id = st.selection.in_paint_order(&st.doc)[0];
     assert!(st.doc.node(id).unwrap().trace.is_none());
 }
+
+/// #569: merging the regions of a rosette of unfilled ellipses (each off the centre, petals
+/// overlapping) merges every region the drags touch into one shape whose outline is only the
+/// merged area's border: no edge between merged regions stays in, as a stray line or a spur.
+#[test]
+fn shape_builder_merges_rosette_rings_cleanly() {
+    let mut s = session();
+    s.execute("paint.setFill", &json!({"none": true})).unwrap();
+    let c = [400.0, 320.0];
+    let mut petals = vec![];
+    for k in 0..8 {
+        let id =
+            s.execute("shape.ellipse", &json!({"x": c[0] - 60.0, "y": c[1] - 172.0, "width": 120, "height": 324})).unwrap()["id"].as_u64().unwrap();
+        s.execute("select.set", &json!({"ids": [id]})).unwrap();
+        s.execute("object.rotate", &json!({"angle": 45.0 * f64::from(k), "origin": c})).unwrap();
+        petals.push(id);
+    }
+    s.execute("select.set", &json!({"ids": petals})).unwrap();
+    // Drags around the ring of petals, from its inside out; the outer ones miss the petals.
+    let mut merged = None;
+    for radius in [110.0, 150.0, 190.0, 230.0] {
+        let pts: Vec<[f64; 2]> = (0..=120)
+            .map(|i| {
+                let a = std::f64::consts::TAU * f64::from(i) / 120.0;
+                [c[0] + radius * a.cos(), c[1] + radius * a.sin()]
+            })
+            .collect();
+        if let Ok(r) = s.execute("shapeBuilder.merge", &json!({"points": pts})) {
+            merged = r["merged"].as_u64().map(NodeId);
+        }
+    }
+    let (ring, rule) = outline(&node(&s, merged.expect("the drags merged")));
+    let inside = |p: kurbo::Point| kurbo::Shape::winding(&ring.to_bezpath(), p) != 0;
+    for k in 0..8 {
+        let a = std::f64::consts::FRAC_PI_4 * f64::from(k) - std::f64::consts::FRAC_PI_2;
+        let tip = kurbo::Point::new(c[0] + 165.0 * a.cos(), c[1] + 165.0 * a.sin());
+        assert!(inside(tip), "petal {k}'s tip at {tip:?} is in the merged shape");
+    }
+    // What is left of the petals stays out of the merged area (a piece left over it is a stray
+    // outline inside it).
+    let merged = merged.unwrap();
+    for id in s.doc().unwrap().selection.objects.clone().into_iter().filter(|id| *id != merged) {
+        let (p, r) = outline(&node(&s, id));
+        let over = vectorcraft_pathops::boolean(&p, r, &ring, rule, vectorcraft_pathops::BoolOp::Intersect);
+        let a = vectorcraft_pathops::area(&over, FillRule::NonZero);
+        assert!(a < 1.0, "{id:?} overlaps the merged shape by {a} pt²");
+    }
+    // No outline is a sliver or carries a spur (2 × area / length: its mean width).
+    for id in s.doc().unwrap().selection.objects.clone() {
+        let (p, r) = outline(&node(&s, id));
+        for sp in &p.subpaths {
+            let one = PathData::new(vec![sp.clone()]);
+            let width = 2.0 * vectorcraft_pathops::area(&one, r) / one.length();
+            assert!(width > 1.0, "{id:?} has an outline {width:.3} pt wide on average, {:.1} pt long", one.length());
+        }
+    }
+    // The ring is one outline around the centre (the regions the drags missed aside): the
+    // petals' tips are no outlines of their own beside it, apart by a hairline.
+    let big = ring.subpaths.iter().filter(|sp| vectorcraft_pathops::area(&PathData::new(vec![(*sp).clone()]), rule) > 100.0).count();
+    assert_eq!(big, 2, "{:?}", ring.subpaths.iter().map(|sp| vectorcraft_pathops::area(&PathData::new(vec![sp.clone()]), rule)).collect::<Vec<_>>());
+    // An inner edge would be a second outline over the merged area: normalising would drop it.
+    let clean = vectorcraft_pathops::normalize(&ring, rule);
+    assert!((ring.length() - clean.length()).abs() < 1.0, "{} pt of outline, {} without inner edges", ring.length(), clean.length());
+}

crates/engine/src/tests_links.rs

@@ -320,7 +320,8 @@ fn a_placed_document_brings_its_links_with_the_files_pixels() {
     let doc_path = dir.file("part.vectorcraft");
     save(&mut s, &doc_path);
     let mut s = session();
-    s.execute("file.place", &json!({"path": doc_path})).unwrap();
+    // As an editable copy (placed linked, it stays one locked object).
+    s.execute("file.place", &json!({"path": doc_path, "link": false})).unwrap();
     let doc = &s.doc().unwrap().doc;
     let mut placed = vec![];
     doc.visit_images(|_, im| placed.push(im.clone()));

crates/engine/src/tests_panelcmds.rs

@@ -248,6 +248,16 @@ fn text_set_format() {
     let NodeKind::Text(t) = node(&s, id).kind else { panic!() };
     assert_eq!(t.first_style().kerning, None);
     assert!(s.execute("text.setFormat", &json!({"ids": [id.0]})).is_err());
+    // Paragraph composer: Every-line by default, undoable.
+    assert_eq!(t.para.composer, vectorcraft_doc::Composer::EveryLine);
+    s.execute("text.setFormat", &json!({"ids": [id.0], "composer": "singleLine"})).unwrap();
+    let NodeKind::Text(t) = node(&s, id).kind else { panic!() };
+    assert_eq!(t.para.composer, vectorcraft_doc::Composer::SingleLine);
+    assert!(s.execute("text.setFormat", &json!({"ids": [id.0], "composer": "best"})).is_err());
+    assert!(s.execute("text.setFormat", &json!({"ids": [id.0], "composer": 1})).is_err());
+    s.execute("edit.undo", &json!({})).unwrap();
+    let NodeKind::Text(t) = node(&s, id).kind else { panic!() };
+    assert_eq!(t.para.composer, vectorcraft_doc::Composer::EveryLine);
 }
 
 #[test]

crates/engine/src/tests_placed_document.rs

@@ -0,0 +1,481 @@
+//! Placed documents: a VectorCraft document placed linked (`file.place`'s default for one read
+//! from a file), drawn and output as vectors, saved with its preview, checked, updated and
+//! relinked when the file changes, and turned into an editable copy (Break Link, Expand).
+
+use serde_json::{Value, json};
+use vectorcraft_color::{Color, Paint};
+use vectorcraft_doc::{Appearance, Document, Node, NodeKind, PlacedDocument};
+use vectorcraft_geom::{Rect, shapes};
+
+use super::tests_links::{BLUE, Folder, RED, centre_colour, near, open, save, session, write};
+use super::*;
+
+/// A VectorCraft document at `path`: one `w`×`h` artboard filled with `rgb` (and `extra` more
+/// rectangles, which change the file's size).
+fn source(path: &str, w: f64, h: f64, rgb: [u8; 3], extra: usize) {
+    let mut d = Document::new(w, h);
+    let layer = d.layers[0].id;
+    let [r, g, b] = rgb;
+    for i in 0..=extra {
+        let id = d.alloc_id();
+        let look = Appearance::basic(Paint::solid(Color::rgb8(r, g, b)), Paint::None, 0.0);
+        d.insert(Some(layer), i, Node::path(id, shapes::rectangle(Rect::new(0.0, 0.0, w, h)), look)).unwrap();
+    }
+    write(path, &vectorcraft_format::save_file(&d));
+}
+
+/// A document drawing symbol `Star` (a blue 100×50 rectangle) at `path`, titled `title` (tests
+/// that remove the file give it content of its own: files read are cached by content).
+fn star_source(path: &str, title: &str) {
+    let mut d = Document::new(100.0, 50.0);
+    d.title = title.into();
+    let layer = d.layers[0].id;
+    let art = Node::path(vectorcraft_doc::NodeId(900), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)), look(BLUE));
+    d.symbols.push(vectorcraft_doc::Symbol { name: "Star".into(), art: std::sync::Arc::new(art) });
+    let id = d.alloc_id();
+    d.insert(Some(layer), 0, Node::new(id, NodeKind::SymbolInstance { symbol: "Star".into(), xf: vectorcraft_geom::Affine::IDENTITY })).unwrap();
+    write(path, &vectorcraft_format::save_file(&d));
+}
+
+fn look(c: [u8; 3]) -> Appearance {
+    Appearance::basic(Paint::solid(Color::rgb8(c[0], c[1], c[2])), Paint::None, 0.0)
+}
+
+/// The active document gets a red symbol named `Star` of its own.
+fn parent_star(s: &mut Session) {
+    let star = Node::path(vectorcraft_doc::NodeId(901), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), look(RED));
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc)
+        .symbols
+        .push(vectorcraft_doc::Symbol { name: "Star".into(), art: std::sync::Arc::new(star) });
+}
+
+/// Place `path` (linked: the default), centred on the artboard → its id.
+fn place(s: &mut Session, path: &str) -> NodeId {
+    let r = s.execute("file.place", &json!({"path": path, "at": [200, 150]})).unwrap();
+    assert_eq!(r["linked"], true, "{r}");
+    NodeId(r["ids"][0].as_u64().unwrap())
+}
+
+fn placed(s: &Session, id: NodeId) -> PlacedDocument {
+    match &s.doc().unwrap().doc.node(id).unwrap().kind {
+        NodeKind::PlacedDocument(p) => (**p).clone(),
+        k => panic!("not a placed document: {k:?}"),
+    }
+}
+
+fn bounds(s: &Session, id: NodeId) -> Rect {
+    s.doc().unwrap().doc.node(id).unwrap().geometric_bounds().unwrap()
+}
+
+fn decode(v: &Value) -> Vec<u8> {
+    vectorcraft_format::base64_decode(v["dataBase64"].as_str().unwrap()).unwrap()
+}
+
+/// Images and paths in `bytes`, a PDF, read back.
+fn pdf_contents(bytes: &[u8]) -> (usize, usize) {
+    // The page as drawn (not the VectorCraft document the PDF carries).
+    let (doc, _) = super::cmd::fileio::page_document(bytes, 0, &Default::default()).unwrap();
+    let (mut images, mut paths) = (0, 0);
+    doc.walk(|n| match n.kind {
+        NodeKind::Image(_) => images += 1,
+        NodeKind::Path { .. } | NodeKind::Compound { .. } => paths += 1,
+        _ => {}
+    });
+    (images, paths)
+}
+
+/// The JSON of a `.vectorcraft` file (the data after it left out).
+fn file_json(bytes: &[u8]) -> Value {
+    let end = bytes.windows(vectorcraft_format::BLOB_MAGIC.len()).position(|w| w == vectorcraft_format::BLOB_MAGIC).unwrap_or(bytes.len());
+    serde_json::from_slice(&bytes[..end]).unwrap()
+}
+
+#[test]
+fn a_document_places_linked_by_default_at_its_artboard_size() {
+    let dir = Folder::new("placed-basic");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    let p = placed(&s, id);
+    assert!((p.width - 100.0).abs() < 1e-6 && (p.height - 50.0).abs() < 1e-6, "{p:?}");
+    assert_eq!(bounds(&s, id), Rect::new(150.0, 125.0, 250.0, 175.0));
+    assert_eq!((p.link.path.as_str(), p.link.page), (src.as_str(), Some(1)));
+    let n = s.doc().unwrap().doc.node(id).unwrap();
+    assert_eq!((n.name.as_deref(), n.kind_label()), (Some("logo.vectorcraft"), "Placed Document"));
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    // It moves and scales like any object.
+    s.execute("object.move", &json!({"dx": 10, "dy": 0})).unwrap();
+    assert_eq!(bounds(&s, id), Rect::new(160.0, 125.0, 260.0, 175.0));
+    // Its art's bounds instead of the artboard.
+    let mut d = Document::new(100.0, 50.0);
+    let layer = d.layers[0].id;
+    let id2 = d.alloc_id();
+    d.insert(Some(layer), 0, Node::path(id2, shapes::rectangle(Rect::new(10.0, 10.0, 40.0, 30.0)), look(RED))).unwrap();
+    let small = dir.file("small.vectorcraft");
+    write(&small, &vectorcraft_format::save_file(&d));
+    let r = s.execute("file.place", &json!({"path": small, "crop": "bounding", "at": [200, 150]})).unwrap();
+    let p = placed(&s, NodeId(r["ids"][0].as_u64().unwrap()));
+    assert!(p.bounding && (p.width - 30.0).abs() < 1e-6 && (p.height - 20.0).abs() < 1e-6, "{p:?}");
+}
+
+#[test]
+fn without_link_or_a_file_a_document_places_as_an_editable_copy() {
+    let dir = Folder::new("placed-copy");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let data = vectorcraft_format::base64_encode(&std::fs::read(&src).unwrap());
+    for p in [json!({"path": src, "link": false}), json!({"name": "logo.vectorcraft", "dataBase64": data})] {
+        let r = s.execute("file.place", &p).unwrap();
+        assert_eq!(r["linked"], false, "{r}");
+        let n = s.doc().unwrap().doc.node(NodeId(r["ids"][0].as_u64().unwrap())).unwrap();
+        assert_eq!(n.kind_label(), "Clip Group", "{p}");
+    }
+    assert!(!s.doc().unwrap().doc.has_placed());
+}
+
+#[test]
+fn a_placed_document_is_vectors_in_every_output() {
+    let dir = Folder::new("placed-outputs");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    place(&mut s, &src);
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
+    let text = svg["text"].as_str().unwrap();
+    assert!(!text.contains("<image") && (text.contains("<path") || text.contains("<rect")), "drawn as paths: {text}");
+    let (images, paths) = pdf_contents(&decode(&s.execute("document.serialize", &json!({"format": "pdf"})).unwrap()));
+    assert_eq!(images, 0, "no image in the PDF");
+    assert!(paths > 0);
+    let png = decode(&s.execute("document.serialize", &json!({"format": "png"})).unwrap());
+    let [r, g, b, _] = image::load_from_memory(&png).unwrap().to_rgba8().get_pixel(200, 150).0;
+    assert!(near([r, g, b], RED), "{:?}", [r, g, b]);
+    for format in ["eps", "emf", "dxf"] {
+        let out = s.execute("document.serialize", &json!({"format": format})).unwrap();
+        assert!(out.to_string().len() > 200, "{format}: {out}");
+    }
+    let info = s.execute("document.info", &json!({})).unwrap();
+    assert!(info.to_string().contains("\"placedDocuments\""), "{info}");
+}
+
+#[test]
+fn the_preview_is_saved_so_the_document_shows_it_without_its_file() {
+    let dir = Folder::new("placed-saved");
+    let src = dir.file("logo.vectorcraft");
+    // Content of its own: files read are cached by content, and this one is removed.
+    source(&src, 100.0, 50.0, RED, 2);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    let doc_path = dir.file("poster/poster.vectorcraft");
+    std::fs::create_dir_all(dir.file("poster")).unwrap();
+    save(&mut s, &doc_path);
+    let saved: Value = serde_json::from_slice(&std::fs::read(&doc_path).unwrap()).unwrap();
+    let kind = &saved["document"]["layers"][0]["kind"]["children"][0]["kind"];
+    assert_eq!(kind["type"], "placeddocument");
+    assert_eq!(kind["link"]["relative"], "../logo.vectorcraft");
+    let key = kind["key"].as_str().unwrap();
+    let entry = &saved["images"][key];
+    assert_eq!((entry["proxy"].as_bool(), entry["mime"].as_str()), (Some(true), Some("image/jpeg")), "the preview, as JPEG (opaque)");
+    // Include Linked Files keeps the file itself.
+    let full = file_json(&decode(&s.execute("document.serialize", &json!({"format": "vectorcraft", "includeLinked": true})).unwrap()));
+    assert_eq!((full["images"][key]["proxy"].clone(), full["images"][key]["mime"].as_str()), (Value::Null, Some("application/json")));
+    std::fs::remove_file(&src).unwrap();
+    let r = open(&mut s, &doc_path);
+    assert_eq!(r["missingLinks"].as_array().map(Vec::len), Some(1), "{r}");
+    assert_eq!(placed(&s, id).link.path, src);
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED), "shown from the saved preview");
+    assert_eq!(s.execute("links.check", &json!({})).unwrap()["missing"], 1);
+    // Output with the file gone: the preview, with a warning.
+    let png = s.execute("document.serialize", &json!({"format": "png"})).unwrap();
+    assert!(png["warnings"].to_string().contains("output as their previews"), "{png}");
+    let [r, g, b, _] = image::load_from_memory(&decode(&png)).unwrap().to_rgba8().get_pixel(200, 150).0;
+    assert!(near([r, g, b], RED), "{:?}", [r, g, b]);
+    // Saved for older apps: the art it shows (here its preview), as plain objects.
+    let old: Value =
+        serde_json::from_slice(&decode(&s.execute("document.serialize", &json!({"format": "vectorcraft", "version": 2})).unwrap())).unwrap();
+    let old = old["document"]["layers"][0]["kind"]["children"][0].to_string();
+    assert!(old.contains("\"image\"") && !old.contains("placeddocument"), "{old}");
+}
+
+#[test]
+fn a_document_saved_with_previews_outputs_its_files_art() {
+    let dir = Folder::new("placed-preview-output");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    let doc_path = dir.file("poster.vectorcraft");
+    save(&mut s, &doc_path);
+    open(&mut s, &doc_path);
+    let key = placed(&s, id).key;
+    assert!(s.doc().unwrap().doc.images[&key].is_proxy(), "opened with the preview only");
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    // Output reads the file again: vectors, no warning.
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
+    assert_eq!(svg["warnings"], json!([]), "{}", svg["warnings"]);
+    let text = svg["text"].as_str().unwrap();
+    assert!(!text.contains("<image") && (text.contains("<path") || text.contains("<rect")), "vectors");
+    // So does saving with Include Linked Files, and the document stays as it was.
+    let full = file_json(&decode(&s.execute("document.serialize", &json!({"format": "vectorcraft", "includeLinked": true})).unwrap()));
+    assert_eq!(full["images"][&key]["mime"], "application/json");
+    assert!(s.doc().unwrap().doc.images[&key].is_proxy());
+}
+
+#[test]
+fn a_changed_file_is_modified_and_update_links_reads_it_again() {
+    let dir = Folder::new("placed-update");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    s.execute("object.scale", &json!({"sx": 200})).unwrap();
+    let before = bounds(&s, id);
+    let c = s.execute("links.check", &json!({})).unwrap();
+    assert_eq!((c["modified"].as_u64(), c["links"][0]["status"].as_str()), (Some(0), Some("ok")), "{c}");
+    let list = s.execute("links.list", &json!({})).unwrap();
+    let row = &list["links"][0];
+    assert_eq!((row["format"].as_str(), row["document"].as_bool(), row["status"].as_str()), (Some("VectorCraft"), Some(true), Some("ok")), "{row}");
+    // A blue document, wider, and a different file size.
+    source(&src, 200.0, 50.0, BLUE, 1);
+    assert_eq!(s.execute("links.check", &json!({})).unwrap()["links"][0]["status"], "modified");
+    // Until updated, it shows (and outputs) the file as it read it.
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
+    assert_eq!(svg["warnings"], json!([]));
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    let u = s.execute("links.update", &json!({})).unwrap();
+    assert_eq!(u["updated"], json!([id.0]), "{u}");
+    assert_eq!(placed(&s, id).width, 200.0);
+    assert_eq!(bounds(&s, id), before, "keeps its bounds");
+    assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
+    assert_eq!(s.execute("links.check", &json!({})).unwrap()["modified"], 0);
+    // One undo step.
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+}
+
+#[test]
+fn update_links_on_open_reads_a_modified_file_again() {
+    let dir = Folder::new("placed-open");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    place(&mut s, &src);
+    let doc_path = dir.file("poster.vectorcraft");
+    save(&mut s, &doc_path);
+    source(&src, 100.0, 50.0, BLUE, 1);
+    // Ask When Modified (the default): reported, left as it was.
+    let r = open(&mut s, &doc_path);
+    assert_eq!(r["modifiedLinks"].as_array().map(Vec::len), Some(1), "{r}");
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    // Automatically: read again as the document opens.
+    s.execute("prefs.set", &json!({"key": "updateLinks", "value": "automatically"})).unwrap();
+    let r = open(&mut s, &doc_path);
+    assert_eq!(r["updatedLinks"].as_array().map(Vec::len), Some(1), "{r}");
+    assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
+}
+
+#[test]
+fn relink_points_a_placed_document_at_another_file() {
+    let dir = Folder::new("placed-relink");
+    let (a, b) = (dir.file("a.vectorcraft"), dir.file("b.vectorcraft"));
+    source(&a, 100.0, 50.0, RED, 0);
+    source(&b, 100.0, 50.0, BLUE, 0);
+    let mut s = session();
+    let id = place(&mut s, &a);
+    let r = s.execute("links.relink", &json!({"ids": [id.0], "path": b})).unwrap();
+    assert_eq!(r["relinked"], json!([id.0]), "{r}");
+    assert_eq!(placed(&s, id).link.path, b);
+    assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
+}
+
+#[test]
+fn a_placed_document_inside_a_placed_document_outputs_from_its_own_file() {
+    let dir = Folder::new("placed-nested");
+    let (logo, card) = (dir.file("logo.vectorcraft"), dir.file("card.vectorcraft"));
+    source(&logo, 100.0, 50.0, RED, 0);
+    // The card places the logo, and is saved with the logo's preview only.
+    let mut s = session();
+    place(&mut s, &logo);
+    save(&mut s, &card);
+    s.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+    place(&mut s, &card);
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    // The logo inside is read from its file: vectors, not its preview.
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
+    let text = svg["text"].as_str().unwrap();
+    assert!(!text.contains("<image"), "the logo's file, not its preview: {text}");
+    assert_eq!(pdf_contents(&decode(&s.execute("document.serialize", &json!({"format": "pdf"})).unwrap())).0, 0);
+}
+
+#[test]
+fn documents_that_place_each_other_dont_loop() {
+    let dir = Folder::new("placed-loop");
+    let (a, b) = (dir.file("a.vectorcraft"), dir.file("b.vectorcraft"));
+    source(&a, 100.0, 50.0, RED, 0);
+    // B places A; A then places B.
+    let mut s = session();
+    place(&mut s, &a);
+    save(&mut s, &b);
+    s.execute("document.open", &json!({"path": a})).unwrap();
+    place(&mut s, &b);
+    save(&mut s, &a);
+    s.execute("document.open", &json!({"path": b})).unwrap();
+    let u = s.execute("links.update", &json!({})).unwrap();
+    assert_eq!(u["updated"].as_array().map(Vec::len), Some(1), "{u}");
+    // Drawn and output a few levels deep, then their previews.
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    for format in ["svg", "pdf", "png"] {
+        s.execute("document.serialize", &json!({"format": format})).unwrap();
+    }
+}
+
+#[test]
+fn what_cant_be_placed_linked_is_an_error() {
+    let dir = Folder::new("placed-errors");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let place = |s: &mut Session, p: Value| s.execute("file.place", &p).unwrap_err().to_string();
+    let e = place(&mut s, json!({"path": src, "page": 2}));
+    assert!(e.contains("page 2") && e.contains("1 artboard"), "{e}");
+    let e = place(&mut s, json!({"path": src, "crop": "art"}));
+    assert!(e.contains("crop"), "{e}");
+    let empty = dir.file("empty.vectorcraft");
+    write(&empty, &vectorcraft_format::save_file(&Document::new(100.0, 50.0)));
+    let e = place(&mut s, json!({"path": empty, "crop": "bounding"}));
+    assert!(e.contains("no art to place"), "{e}");
+    // Junk params are errors, not crashes.
+    for v in [json!(null), json!(true), json!(-1), json!(1e308), json!("x"), json!([1, 2]), json!({"a": {"b": []}})] {
+        for k in ["link", "page", "crop", "at", "rect"] {
+            let _ = s.execute("file.place", &json!({"path": src, k: v}));
+        }
+    }
+}
+
+#[test]
+fn a_placed_documents_resources_stay_its_own() {
+    let dir = Folder::new("placed-symbols");
+    let src = dir.file("badge.vectorcraft");
+    star_source(&src, "star");
+    let mut s = session();
+    parent_star(&mut s);
+    place(&mut s, &src);
+    assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE), "the file's own Star");
+    let doc = &s.doc().unwrap().doc;
+    assert_eq!(doc.symbols.len(), 1, "nothing joins the document");
+    let prefix = vectorcraft_doc::placed_document::RESOURCE_PREFIX;
+    assert!(doc.images.keys().all(|k| !k.starts_with(prefix)));
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
+    assert!(!svg["text"].as_str().unwrap().contains("<image"));
+    // Nor its saves.
+    let saved = String::from_utf8(decode(&s.execute("document.serialize", &json!({"format": "vectorcraft"})).unwrap())).unwrap();
+    assert!(!saved.contains(prefix), "{saved}");
+    // Saved for older apps: the art and its resources, as plain objects.
+    let old = vectorcraft_format::load(&decode(&s.execute("document.serialize", &json!({"format": "vectorcraft", "version": 2})).unwrap())).unwrap();
+    assert!(!old.has_placed());
+    assert!(near(centre_colour(&old), BLUE));
+}
+
+#[test]
+fn break_link_gives_the_editable_copy_placing_without_link_gives() {
+    let dir = Folder::new("placed-break");
+    let src = dir.file("badge.vectorcraft");
+    star_source(&src, "break");
+    let mut s = session();
+    parent_star(&mut s);
+    // The copy placing without Link gives.
+    let r = s.execute("file.place", &json!({"path": src, "link": false, "at": [200, 150]})).unwrap();
+    let copy = s.doc().unwrap().doc.node(NodeId(r["ids"][0].as_u64().unwrap())).unwrap().clone();
+    s.execute("edit.undo", &json!({})).unwrap();
+    let id = place(&mut s, &src);
+    let r = s.execute("links.embed", &json!({"ids": [id.0]})).unwrap();
+    assert_eq!(r["embedded"], json!([id.0]), "{r}");
+    let doc = &s.doc().unwrap().doc;
+    let n = doc.node(id).unwrap();
+    assert!(!doc.has_placed() && n.kind_label() == "Clip Group", "{}", n.kind_label());
+    assert_eq!((n.name.as_deref(), n.geometric_bounds()), (copy.name.as_deref(), copy.geometric_bounds()));
+    let kinds = |n: &Node| {
+        let mut k = vec![];
+        n.walk(&mut |c| k.push(c.kind_label()));
+        k
+    };
+    assert_eq!(kinds(n), kinds(&copy));
+    assert!(near(centre_colour(doc), BLUE), "the art as it showed");
+    let names: Vec<&str> = doc.symbols.iter().map(|s| s.name.as_str()).collect();
+    assert_eq!(names.len(), 2, "the file's Star joined, renamed: {names:?}");
+    assert_eq!(s.execute("links.list", &json!({})).unwrap()["links"], json!([]));
+    assert_eq!(s.doc().unwrap().history.undo.last().unwrap().label, "Embed");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(s.doc().unwrap().doc.has_placed());
+    // A file that can't be read stays linked.
+    std::fs::remove_file(&src).unwrap();
+    let doc_path = dir.file("poster.vectorcraft");
+    save(&mut s, &doc_path);
+    open(&mut s, &doc_path);
+    let r = s.execute("links.embed", &json!({"ids": [id.0]})).unwrap();
+    assert_eq!((r["embedded"].clone(), r["missing"].clone()), (json!([]), json!([id.0])), "{r}");
+}
+
+#[test]
+fn expand_turns_a_placed_document_into_editable_art_with_its_resources() {
+    let dir = Folder::new("placed-expand");
+    let src = dir.file("badge.vectorcraft");
+    star_source(&src, "star");
+    let mut s = session();
+    parent_star(&mut s);
+    let id = place(&mut s, &src);
+    s.execute("object.scale", &json!({"sx": 200})).unwrap();
+    let before = bounds(&s, id);
+    s.execute("object.expand", &json!({})).unwrap();
+    let doc = &s.doc().unwrap().doc;
+    let n = doc.node(id).unwrap();
+    assert!(n.is_container() && !doc.has_placed(), "{:?}", n.kind_label());
+    let after = n.geometric_bounds().unwrap();
+    assert!((after.width() - before.width()).abs() < 0.5 && (after.height() - before.height()).abs() < 0.5, "{after:?} vs {before:?}");
+    assert!(near(centre_colour(doc), BLUE));
+    let saved = vectorcraft_format::save_file(doc);
+    assert!(near(centre_colour(&vectorcraft_format::load(&saved).unwrap()), BLUE), "saved with its resources");
+    let info = s.execute("object.expand.info", &json!({})).unwrap();
+    assert_eq!(info["object"], false, "nothing left to expand: {info}");
+}
+
+#[test]
+fn saving_a_document_refreshes_the_open_documents_that_place_it() {
+    let dir = Folder::new("placed-refresh");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    let parent = s.active_index().unwrap();
+    // Open the file, recolour it and save it.
+    s.execute("document.open", &json!({"path": src})).unwrap();
+    s.execute("select.all", &json!({})).unwrap();
+    s.execute("paint.setFill", &json!({"color": "#1414e6"})).unwrap();
+    s.execute("document.save", &json!({})).unwrap();
+    let child = s.active_index().unwrap();
+    assert_ne!(parent, child);
+    let doc = &s.documents()[parent];
+    assert_eq!(doc.history.undo.last().unwrap().label, "Update Links");
+    assert!(near(centre_colour(&doc.doc), BLUE), "shows the saved version");
+    assert!(matches!(doc.doc.node(id).map(|n| &n.kind), Some(NodeKind::PlacedDocument(_))));
+    assert_eq!(s.active_index(), Some(child), "the saved document stays active");
+}
+
+#[test]
+fn link_info_gives_the_artboards_size_not_pixels() {
+    let dir = Folder::new("placed-info");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    s.execute("object.scale", &json!({"sx": 200})).unwrap();
+    let i = s.execute("links.info", &json!({"id": id.0})).unwrap();
+    assert_eq!((i["pageWidth"].as_f64(), i["pageHeight"].as_f64(), i["document"].as_bool()), (Some(100.0), Some(50.0), Some(true)), "{i}");
+    assert!(i.get("pixelWidth").is_none() && i.get("ppi").is_none(), "no pixels: {i}");
+    assert_eq!(
+        (i["status"].as_str(), i["fileName"].as_str(), i["scale"].clone()),
+        (Some("ok"), Some("logo.vectorcraft"), json!([200.0, 200.0])),
+        "{i}"
+    );
+}

crates/engine/src/tests_typearea.rs

@@ -339,3 +339,38 @@ fn the_type_widget_converts_point_and_area_type() {
     s.execute("edit.undo", &json!({})).unwrap();
     assert_eq!(text(&s, id), before);
 }
+
+#[test]
+fn area_type_options_align_the_lines_vertically() {
+    use vectorcraft_doc::VerticalAlign;
+    let mut s = session();
+    let id = area(&mut s, 40.0, 40.0, 200.0, 300.0, "Short story");
+    sel(&mut s, &[id]);
+    assert_eq!(s.execute("text.areaOptions", &json!({})).unwrap()["verticalAlign"], "top");
+    let top = layout(&s, id).lines[0].baseline;
+    let before = text(&s, id).cached_bounds;
+    let n = undo_len(&s);
+    let r = s.execute("text.areaOptions", &json!({"verticalAlign": "bottom"})).unwrap();
+    assert_eq!(r["verticalAlign"], "bottom");
+    assert_eq!(text(&s, id).area.vertical_align, VerticalAlign::Bottom);
+    let l = layout(&s, id);
+    let last = l.lines.last().unwrap();
+    assert!((last.baseline + last.descent - 300.0).abs() < 1e-6);
+    assert!(l.lines[0].baseline > top + 200.0);
+    assert_ne!(text(&s, id).cached_bounds, before, "the cached bounds follow the text");
+    assert_eq!((undo_len(&s), last_step(&s).as_str()), (n + 1, "Area Type Options"));
+    s.execute("text.areaOptions", &json!({"verticalAlign": "center"})).unwrap();
+    assert_eq!(text(&s, id).area.vertical_align, VerticalAlign::Center);
+    // Unknown values are refused and change nothing.
+    for bad in [json!({"verticalAlign": "middle"}), json!({"verticalAlign": 3}), json!({"verticalAlign": null})] {
+        assert!(s.execute("text.areaOptions", &bad).is_err(), "{bad}");
+    }
+    assert_eq!(undo_len(&s), n + 2);
+    assert_eq!(text(&s, id).area.vertical_align, VerticalAlign::Center);
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(text(&s, id).area.vertical_align, VerticalAlign::Top);
+    assert_eq!(layout(&s, id).lines[0].baseline, top);
+    assert_eq!(text(&s, id).cached_bounds, before);
+    assert!(cmd::find_command("text.areaOptions").unwrap().params.contains("verticalAlign?: top|center|bottom|justify"));
+}

crates/engine/src/tooling.rs

@@ -205,6 +205,7 @@ impl Session {
             slices_locked: self.menu.slices_locked,
             auto_add_delete: !self.prefs.disable_auto_add_delete,
             selection_tolerance: self.prefs.selection_tolerance,
+            anchor_size: self.prefs.anchor_size,
             path_only: self.prefs.object_selection_by_path_only,
             type_path_only: self.prefs.type_selection_by_path_only,
             double_click_isolate: self.prefs.double_click_to_isolate,

crates/eps/src/scene.rs

@@ -291,7 +291,7 @@ impl<'a> Scene<'a> {
                 }
             }
             // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(c, false);

crates/format/src/lib.rs

@@ -23,7 +23,10 @@
 //! Versions: v1 wrote anchors as `{p: {x, y}, in: {x, y}, out: {x, y}, kind}`; v2 as
 //! `{p: [x, y], in?, out?, kind?}` with default-valued fields left out; v3 keeps the assigned colour
 //! profiles in `document.color_profiles` (before: `document.unknown.colorProfiles`) and may be
-//! compressed. Every version loads, and [`save_with`] writes any of them for older apps (under the
+//! compressed; v4 may keep large data (images, placed documents, the PDF, profiles of at least
+//! [`INLINE_MAX`] bytes) after the JSON instead of in it: the JSON is followed by [`BLOB_MAGIC`] and
+//! the bytes, and such an entry says where they are (`"blob": [offset, length]`) instead of giving
+//! `data`. Every version loads, and [`save_with`] writes any of them for older apps (under the
 //! format name `drawcraft`, which every version reads). Readers reject files whose `version` is
 //! newer than they support.
 #![forbid(unsafe_code)]
@@ -42,8 +45,12 @@ use vectorcraft_doc::{Document, ImageBlob};
 #[cfg(not(target_arch = "wasm32"))]
 pub use atomic::{write_atomic, write_atomic_with};
 
-/// v3: colour profiles as a document field, optional compression and preview (v1 and v2 files still load).
-pub const VERSION: u32 = 3;
+/// v4: large data after the JSON (v1 to v3 files still load).
+pub const VERSION: u32 = 4;
+/// Data this large or larger goes after the JSON (v4), not into it as base64.
+pub const INLINE_MAX: usize = 8 << 10;
+/// What separates the JSON from the data after it (v4).
+pub const BLOB_MAGIC: &[u8] = b"\n\0VCBLOBS\0";
 /// The oldest version [`save_with`] writes.
 pub const MIN_VERSION: u32 = 1;
 /// The first version whose readers open compressed files.
@@ -87,12 +94,69 @@ pub enum FormatError {
 #[derive(Serialize, Deserialize)]
 struct Image {
     mime: String,
+    /// The bytes as base64, unless they come after the JSON (`blob`).
+    #[serde(default, skip_serializing_if = "String::is_empty")]
     data: String,
+    /// Where the bytes are in the data after the JSON (v4): `[offset, length]`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    blob: Option<[u64; 2]>,
     /// `data` is a linked image's preview ([`ImageBlob::proxy`]), not the file's bytes.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     proxy: bool,
 }
 
+impl Image {
+    /// Its bytes: the base64 `data`, or its part of `tail` (the data after the JSON).
+    fn bytes(&self, tail: &[u8]) -> Option<Vec<u8>> {
+        match self.blob {
+            Some([offset, len]) => {
+                let start = usize::try_from(offset).ok()?;
+                let end = start.checked_add(usize::try_from(len).ok()?)?;
+                tail.get(start..end).map(<[u8]>::to_vec)
+            }
+            None => base64_decode(&self.data),
+        }
+    }
+}
+
+/// Entries written for one file: large bytes go to the data after the JSON when the version keeps
+/// them there.
+struct Blobs {
+    tail: Vec<u8>,
+    outside: bool,
+}
+
+impl Blobs {
+    fn image(&mut self, mime: &str, bytes: &[u8], proxy: bool) -> Image {
+        if self.outside && bytes.len() >= INLINE_MAX {
+            let at = self.tail.len() as u64;
+            self.tail.extend_from_slice(bytes);
+            return Image { mime: mime.into(), data: String::new(), blob: Some([at, bytes.len() as u64]), proxy };
+        }
+        Image { mime: mime.into(), data: base64_encode(bytes), blob: None, proxy }
+    }
+}
+
+/// The MIME type of a preview's bytes (JPEG or PNG).
+fn preview_mime(bytes: &[u8]) -> &'static str {
+    if bytes.starts_with(&[0xff, 0xd8]) { "image/jpeg" } else { vectorcraft_doc::links::PROXY_MIME }
+}
+
+/// The JSON of a file and the data after it (v4), split at [`BLOB_MAGIC`] after the first JSON
+/// value.
+fn split_tail(text: &[u8]) -> (&[u8], &[u8]) {
+    let mut values = serde_json::Deserializer::from_slice(text).into_iter::<serde::de::IgnoredAny>();
+    if values.next().is_some_and(|v| v.is_ok()) {
+        let end = values.byte_offset();
+        if let Some(rest) = text.get(end..)
+            && rest.starts_with(BLOB_MAGIC)
+        {
+            return (text.get(..end).unwrap_or(text), rest.get(BLOB_MAGIC.len()..).unwrap_or_default());
+        }
+    }
+    (text, &[])
+}
+
 #[derive(Deserialize)]
 struct File {
     format: String,
@@ -173,6 +237,14 @@ pub fn save_with(doc: &Document, o: &SaveOptions) -> Result<Vec<u8>, FormatError
     o.check()?;
     let pretty = o.pretty && !o.compress;
     let mut d = doc.without_edit_modes().into_owned();
+    // Older apps don't know placed documents: they get the art the objects show, with its
+    // resources. Otherwise resources only exporting adds are never saved.
+    if o.version < VERSION && d.has_placed() {
+        d = d.with_placed_art().into_owned();
+        d.placed_as_groups();
+    } else {
+        d.drop_placed_resources();
+    }
     let linked = d.linked_only_images();
     // The blobs go in the file's `images` (only those the document uses).
     let blobs = std::mem::take(&mut d.images);
@@ -189,6 +261,7 @@ pub fn save_with(doc: &Document, o: &SaveOptions) -> Result<Vec<u8>, FormatError
     // Images are only referenced by image objects' `key` (wherever the objects are: layers,
     // symbols, patterns, masks, or foreign data).
     let used = if blobs.is_empty() { HashSet::new() } else { string_members(&body, "key") };
+    let mut out_blobs = Blobs { tail: vec![], outside: o.version >= 4 };
     let images: BTreeMap<&str, Image> = blobs
         .iter()
         .filter(|(k, _)| used.contains(k.as_str()))
@@ -196,20 +269,20 @@ pub fn save_with(doc: &Document, o: &SaveOptions) -> Result<Vec<u8>, FormatError
             // Include Linked Files keeps the file's bytes whenever they are loaded.
             let preview_only = linked.contains(k) && (!o.include_linked || b.is_proxy());
             let image = match b.proxy.as_ref().filter(|_| preview_only) {
-                Some(p) => Image { mime: vectorcraft_doc::links::PROXY_MIME.into(), data: base64_encode(p), proxy: true },
-                None => Image { mime: b.mime.clone(), data: base64_encode(&b.bytes), proxy: false },
+                Some(p) => out_blobs.image(preview_mime(p), p, true),
+                None => out_blobs.image(&b.mime, &b.bytes, false),
             };
             (k.as_str(), image)
         })
         .collect();
-    let blob = |mime: &str, bytes: &[u8]| Image { mime: mime.into(), data: base64_encode(bytes), proxy: false };
-    let profiles: BTreeMap<&str, Image> = o.profiles.iter().map(|(name, icc)| (name.as_str(), blob(ICC_MIME, icc))).collect();
-    let pdf = o.pdf.as_deref().map(|p| blob("application/pdf", p));
+    let profiles: BTreeMap<&str, Image> = o.profiles.iter().map(|(name, icc)| (name.as_str(), out_blobs.image(ICC_MIME, icc, false))).collect();
+    let pdf = o.pdf.as_deref().map(|p| out_blobs.image("application/pdf", p, false));
+    let blob = |mime: &str, bytes: &[u8]| Image { mime: mime.into(), data: base64_encode(bytes), blob: None, proxy: false };
     let carried = profiles.values().chain(&pdf).map(|i| i.data.len()).sum::<usize>();
     let size = body.len() + images.values().map(|i| i.data.len()).sum::<usize>() + carried + 256;
     let mut w = Envelope { out: Vec::with_capacity(size), pretty };
     // Older apps only know the name from before the rename.
-    w.field("format", &if o.version < VERSION { LEGACY_EXTENSION } else { EXTENSION })?;
+    w.field("format", &if o.version < 3 { LEGACY_EXTENSION } else { EXTENSION })?;
     w.field("version", &o.version)?;
     w.field("generator", &format!("VectorCraft {}", env!("CARGO_PKG_VERSION")))?;
     if let Some(png) = &o.preview {
@@ -223,7 +296,11 @@ pub fn save_with(doc: &Document, o: &SaveOptions) -> Result<Vec<u8>, FormatError
     }
     w.raw("document", &body);
     w.field("images", &images)?;
-    let out = w.finish();
+    let mut out = w.finish();
+    if !out_blobs.tail.is_empty() {
+        out.extend_from_slice(BLOB_MAGIC);
+        out.extend_from_slice(&out_blobs.tail);
+    }
     if !o.compress {
         return Ok(out);
     }
@@ -356,7 +433,8 @@ pub fn load_info(bytes: &[u8]) -> Result<(Document, FileInfo), FormatError> {
 /// [`load`], with everything else the file carries.
 pub fn load_file(bytes: &[u8]) -> Result<NativeFile, FormatError> {
     let text = unpack(bytes)?;
-    let f: File = serde_json::from_slice(&text).map_err(|e| FormatError::NotVectorcraft(e.to_string()))?;
+    let (json, tail) = split_tail(&text);
+    let f: File = serde_json::from_slice(json).map_err(|e| FormatError::NotVectorcraft(e.to_string()))?;
     if f.format != EXTENSION && f.format != LEGACY_EXTENSION {
         return Err(FormatError::NotVectorcraft(format!("format is `{}`", f.format)));
     }
@@ -365,7 +443,7 @@ pub fn load_file(bytes: &[u8]) -> Result<NativeFile, FormatError> {
     }
     let mut doc = f.document;
     for (k, img) in f.images {
-        let bytes = base64_decode(&img.data).ok_or_else(|| FormatError::BadImage(k.clone()))?;
+        let bytes = img.bytes(tail).ok_or_else(|| FormatError::BadImage(k.clone()))?;
         let mut blob = ImageBlob::new(img.mime, bytes);
         // Until the linked file is read, the preview stands in for it.
         if img.proxy {
@@ -382,7 +460,7 @@ pub fn load_file(bytes: &[u8]) -> Result<NativeFile, FormatError> {
     doc.fix_next_id();
     // Untrusted: capped, named and pointing at objects the file has.
     doc.tidy_saved_selections();
-    let profiles = f.profiles.into_iter().filter_map(|(name, icc)| Some((name, base64_decode(&icc.data)?))).collect();
+    let profiles = f.profiles.into_iter().filter_map(|(name, icc)| Some((name, icc.bytes(tail)?))).collect();
     Ok(NativeFile { doc, info: FileInfo { version: f.version, legacy: f.format == LEGACY_EXTENSION }, profiles })
 }
 
@@ -393,19 +471,24 @@ struct Head {
     pdf: Option<Image>,
 }
 
-fn head(bytes: &[u8]) -> Option<Head> {
-    serde_json::from_slice(&unpack(bytes).ok()?).ok()
+/// The file's head and the data after its JSON.
+fn head(bytes: &[u8]) -> Option<(Head, Vec<u8>)> {
+    let text = unpack(bytes).ok()?;
+    let (json, tail) = split_tail(&text);
+    Some((serde_json::from_slice(json).ok()?, tail.to_vec()))
 }
 
 /// The preview PNG embedded in a native file (`None`: it has none, or isn't a native file).
 pub fn preview(bytes: &[u8]) -> Option<Vec<u8>> {
-    base64_decode(&head(bytes)?.preview?.data)
+    let (h, tail) = head(bytes)?;
+    h.preview?.bytes(&tail)
 }
 
 /// The PDF a native file saved with Create PDF-Compatible File carries (`None`: it has none, or
 /// isn't a native file).
 pub fn pdf_content(bytes: &[u8]) -> Option<Vec<u8>> {
-    base64_decode(&head(bytes)?.pdf?.data)
+    let (h, tail) = head(bytes)?;
+    h.pdf?.bytes(&tail)
 }
 
 /// Does this look like a `.vectorcraft` file (compressed or not)?

crates/format/tests/native_v3.rs

@@ -7,7 +7,7 @@ use std::io::Write as _;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{ColorProfiles, Document, ImageBlob, ImageObject, Node, NodeKind, OpacityMask, Symbol};
+use vectorcraft_doc::{ColorProfiles, Composer, Document, ImageBlob, ImageObject, Node, NodeKind, OpacityMask, Symbol};
 use vectorcraft_format::{FormatError, SaveOptions, VERSION, is_compressed, load, preview, save, save_with, sniff};
 use vectorcraft_geom::Affine;
 use vectorcraft_testkit::fixtures;
@@ -43,6 +43,31 @@ fn opts(version: u32, compress: bool) -> SaveOptions {
     SaveOptions { version, compress, ..SaveOptions::default() }
 }
 
+#[test]
+fn area_type_vertical_alignment_round_trips() {
+    let d = rich_doc();
+    let text = String::from_utf8(save(&d, false)).unwrap();
+    assert!(text.contains("\"verticalAlign\":\"center\""), "the fixture's area type is centred");
+    let back = load(text.as_bytes()).unwrap();
+    assert_eq!(doc_json(&back), doc_json(&d));
+    let area = |d: &Document| {
+        let mut found = None;
+        d.walk(|n| {
+            if let NodeKind::Text(t) = &n.kind
+                && matches!(t.kind, vectorcraft_doc::TextKind::Area { .. })
+            {
+                found = Some(t.area.vertical_align);
+            }
+        });
+        found.unwrap()
+    };
+    assert_eq!(area(&back), vectorcraft_doc::VerticalAlign::Center);
+    // Files from before the option open top-aligned.
+    let old = text.replacen("\"verticalAlign\":\"center\",", "", 1).replacen(",\"verticalAlign\":\"center\"", "", 1);
+    assert!(!old.contains("verticalAlign"));
+    assert_eq!(area(&load(old.as_bytes()).unwrap()), vectorcraft_doc::VerticalAlign::Top);
+}
+
 #[test]
 fn compressed_files_load() {
     let d = rich_doc();
@@ -55,7 +80,7 @@ fn compressed_files_load() {
     assert!(!flate2_unpack(&packed).contains(&b'\n'));
     // A legacy (v2, pre-rename) file compressed by hand opens too.
     let text = String::from_utf8(plain.clone()).unwrap();
-    let legacy = text.replacen("\"format\":\"vectorcraft\",\"version\":3", "\"format\":\"drawcraft\",\"version\":2", 1);
+    let legacy = text.replacen(&format!("\"format\":\"vectorcraft\",\"version\":{VERSION}"), "\"format\":\"drawcraft\",\"version\":2", 1);
     assert_ne!(legacy, text);
     let legacy = gzip(legacy.as_bytes());
     assert!(sniff(&legacy));
@@ -111,6 +136,42 @@ fn keys_from_newer_versions_round_trip() {
     check_native_roundtrip(&d).unwrap();
 }
 
+/// The paragraph composer is saved only when it isn't the default (Every-line) and reads back.
+#[test]
+fn text_composer_round_trips() {
+    let d = rich_doc();
+    let composers = |d: &Document| {
+        let mut v = vec![];
+        d.walk(|n| {
+            if let NodeKind::Text(t) = &n.kind {
+                v.push(t.para.composer);
+            }
+        });
+        v
+    };
+    // The point type set to Single-line, then the area type left at the default.
+    assert_eq!(composers(&d), [Composer::SingleLine, Composer::EveryLine]);
+    let bytes = save(&d, false);
+    assert!(String::from_utf8_lossy(&bytes).contains("\"composer\":\"singleLine\""));
+    assert_eq!(composers(&load(&bytes).unwrap()), [Composer::SingleLine, Composer::EveryLine]);
+    // Files without the key (older files, Every-line text) read as Every-line.
+    fn strip(v: &mut Value) {
+        match v {
+            Value::Object(m) => {
+                m.remove("composer");
+                m.values_mut().for_each(strip);
+            }
+            Value::Array(a) => a.iter_mut().for_each(strip),
+            _ => {}
+        }
+    }
+    let mut v = json_of(&bytes);
+    strip(&mut v);
+    let d2 = load(&serde_json::to_vec(&v).unwrap()).unwrap();
+    assert_eq!(composers(&d2), [Composer::EveryLine, Composer::EveryLine]);
+    assert!(!String::from_utf8_lossy(&save(&d2, false)).contains("composer"));
+}
+
 /// A document as the first version wrote it (format name `drawcraft`, anchors as maps).
 const V1_FILE: &str = r#"{"format":"drawcraft","version":1,"generator":"DrawCraft 0.1.0","document":{"version":1,"title":"Old","artboards":[{"id":1,"name":"Artboard 1","rect":{"x0":0.0,"y0":0.0,"x1":100.0,"y1":80.0}}],
 "layers":[{"id":1,"name":"Layer 1","visible":true,"locked":false,"opacity":1.0,"kind":{"type":"layer","children":[

crates/format/tests/native_v4.rs

@@ -0,0 +1,78 @@
+//! `.vectorcraft` v4: large data after the JSON (images, the PDF, profiles), small files still plain
+//! JSON, older versions inline, damaged offsets refused.
+// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::sync::Arc;
+
+use serde_json::Value;
+use vectorcraft_doc::{Document, ImageBlob, ImageObject, Node, NodeKind};
+use vectorcraft_format::{BLOB_MAGIC, FormatError, INLINE_MAX, SaveOptions, load, load_file, pdf_content, save_with};
+use vectorcraft_geom::Affine;
+
+/// A document showing image `key` of `len` bytes.
+fn doc_with_image(key: &str, len: usize) -> Document {
+    let mut d = Document::new(100.0, 100.0);
+    let bytes: Vec<u8> = (0..len).map(|i| (i * 7 % 251) as u8).collect();
+    d.images.insert(key.into(), ImageBlob::new("image/png", bytes));
+    let l = d.layers[0].id;
+    let id = d.alloc_id();
+    let im = ImageObject { key: key.into(), width: 10, height: 10, xf: Affine::IDENTITY, link: None, placement: Default::default() };
+    d.insert(Some(l), 0, Node::new(id, NodeKind::Image(im))).unwrap();
+    d
+}
+
+fn has_tail(bytes: &[u8]) -> bool {
+    bytes.windows(BLOB_MAGIC.len()).any(|w| w == BLOB_MAGIC)
+}
+
+#[test]
+fn large_data_goes_after_the_json_and_reads_back() {
+    let d = doc_with_image("big", INLINE_MAX + 10);
+    let pdf = vec![b'%'; INLINE_MAX * 2];
+    for compress in [false, true] {
+        let o = SaveOptions { compress, pdf: Some(pdf.clone()), ..SaveOptions::default() };
+        let bytes = save_with(&d, &o).unwrap();
+        if !compress {
+            assert!(has_tail(&bytes), "a binary section");
+            // The JSON before it holds no base64 copy of the image.
+            assert!(bytes.len() < INLINE_MAX + 10 + pdf.len() + (32 << 10), "{} bytes", bytes.len());
+        }
+        let back = load(&bytes).unwrap();
+        assert_eq!(back.images["big"].bytes, d.images["big"].bytes, "compress {compress}");
+        assert_eq!(pdf_content(&bytes).unwrap(), pdf);
+    }
+}
+
+#[test]
+fn small_files_stay_plain_json_and_older_versions_inline() {
+    let small = save_with(&doc_with_image("small", 100), &SaveOptions::default()).unwrap();
+    assert!(!has_tail(&small));
+    let v: Value = serde_json::from_slice(&small).unwrap();
+    assert_eq!(v["version"], 4);
+    let big = doc_with_image("big", INLINE_MAX + 10);
+    let v3 = save_with(&big, &SaveOptions { version: 3, ..SaveOptions::default() }).unwrap();
+    assert!(!has_tail(&v3), "version 3 keeps everything in the JSON");
+    let v: Value = serde_json::from_slice(&v3).unwrap();
+    assert_eq!((v["format"].as_str(), v["version"].as_u64()), (Some("vectorcraft"), Some(3)));
+    assert_eq!(load(&v3).unwrap().images["big"].bytes, big.images["big"].bytes);
+}
+
+#[test]
+fn damaged_offsets_are_refused_not_a_crash() {
+    let d = doc_with_image("big", INLINE_MAX + 10);
+    let bytes = save_with(&d, &SaveOptions::default()).unwrap();
+    // The data cut short.
+    let cut = &bytes[..bytes.len() - 100];
+    assert!(matches!(load_file(cut), Err(FormatError::BadImage(_))));
+    // An offset past the end.
+    let text = String::from_utf8_lossy(&bytes);
+    let at = text.find("\"blob\":[").unwrap();
+    let mut damaged = bytes.clone();
+    damaged.splice(at..at + 8, b"\"blob\":[9".iter().copied());
+    assert!(load_file(&damaged).is_err());
+    // A missing section.
+    let json_only = &bytes[..bytes.windows(BLOB_MAGIC.len()).position(|w| w == BLOB_MAGIC).unwrap()];
+    assert!(load_file(json_only).is_err());
+    let _ = Arc::new(());
+}

crates/mcp/src/tests_fileio.rs

@@ -62,6 +62,7 @@ fn export_tool_lists_engine_formats_and_options() {
             "svg",
             "svgz",
             "pdf",
+            "ai",
             "png",
             "jpg",
             "gif",

crates/metafile/src/scene.rs

@@ -189,7 +189,7 @@ impl<'a> Scene<'a> {
                 }
             }
             // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(c, false);

crates/pathops/src/lib.rs

@@ -19,7 +19,7 @@ pub use edit::{
     split_into_grid,
 };
 pub use offset::{Cap, Join, offset_path, outline_stroke, stroke_region};
-pub use pathfinder::{PathfinderOp, Region, Shape, merge_regions, pathfinder, region_at, regions};
+pub use pathfinder::{FaceMerger, PathfinderOp, Region, Shape, merge_regions, pathfinder, region_at, regions};
 pub use planar::{BuilderArrangement, SHAPE_BUILDER_MAX_SEGMENTS, cut_out, encloses_area, interior_point, live_paint, shape_builder};
 
 /// Errors from fallible operations.

crates/pathops/src/pathfinder.rs

@@ -7,7 +7,7 @@ use kurbo::{BezPath, ParamCurve, ParamCurveNearest, Point, Shape as _};
 use linesweeper::topology::ContourIdx;
 use vectorcraft_geom::{FillRule, PathData};
 
-use crate::boolean::{Arrangement, Multi, Seg, all_contours_to_path, contours_to_path, fill_bezpath, segs_to_subpath, unite_all};
+use crate::boolean::{Arrangement, Multi, Seg, all_contours_to_path, contours_to_path, fill_bezpath, normalize_bez, segs_to_subpath, unite_all};
 
 /// A filled shape in a Pathfinder stack. `key` identifies its paint (e.g. a hashed fill colour);
 /// results carry the key of the object whose paint they keep.
@@ -264,6 +264,63 @@ pub fn merge_regions(regions: &[&Region]) -> PathData {
     unite_all(&v)
 }
 
+/// Merges faces of the planar arrangement of a set of shapes (as [`regions`] gives them) into one
+/// path, from the arrangement itself, made once for every merge of the set: the faces' contours
+/// share their edges exactly, so the edges between merged faces vanish. Uniting the faces' tidied
+/// outlines ([`merge_regions`]) could leave those edges in, as a hairline gap or a spur, where
+/// neighbouring faces' outlines had been refit apart. Shapes with open paths (faces lines cut)
+/// fall back to [`merge_regions`].
+pub struct FaceMerger {
+    /// The arrangement (`None`: open paths, or the sweep failed) and the number of shapes.
+    arr: Option<Arrangement>,
+    shapes: usize,
+}
+
+impl FaceMerger {
+    pub fn new(shapes: &[Shape]) -> Self {
+        let has_open = shapes.iter().flat_map(|s| &s.path.subpaths).any(|sp| !sp.closed && sp.anchors.len() >= 2);
+        Self { arr: if has_open { None } else { arrangement(shapes) }, shapes: shapes.len() }
+    }
+
+    /// The union of `faces`.
+    pub fn merge(&self, faces: &[&Region]) -> PathData {
+        self.exact(faces).filter(|p| !p.is_empty()).unwrap_or_else(|| merge_regions(faces))
+    }
+
+    fn exact(&self, faces: &[&Region]) -> Option<PathData> {
+        let arr = self.arr.as_ref()?;
+        // Each face by its coverage and a point inside it.
+        let mut picks: Vec<(Vec<bool>, Point)> = Vec::with_capacity(faces.len());
+        for r in faces {
+            let mut mask = vec![false; self.shapes];
+            for &s in &r.sources {
+                *mask.get_mut(s)? = true;
+            }
+            picks.push((mask, crate::planar::interior_point(&r.path)?));
+        }
+        let mut raw = BezPath::new();
+        let mut done: Vec<&[bool]> = vec![];
+        for (mask, _) in &picks {
+            if done.contains(&mask.as_slice()) {
+                continue;
+            }
+            done.push(mask);
+            let c = arr.contours(|k| k == mask.as_slice());
+            for group in c.grouped() {
+                let mut face = BezPath::new();
+                for i in group {
+                    face.extend(c[i].path.iter());
+                }
+                if picks.iter().any(|(m, p)| m == mask && face.winding(*p) != 0) {
+                    raw.extend(face.iter());
+                }
+            }
+        }
+        let merged = normalize_bez(&raw, FillRule::NonZero).ok()?;
+        Some(all_contours_to_path(&merged, &arr.tidy))
+    }
+}
+
 /// Pathfinder Outline: split every shape's boundary at junctions of the arrangement.
 fn outline_edges(arr: &Arrangement, shapes: &[Shape]) -> Vec<Shape> {
     let junctions = arr.junctions();

crates/pdf/src/export.rs

@@ -453,11 +453,13 @@ pub(crate) struct Exporter<'a> {
     /// The fonts real text is written in, by face id, with their units per em; `None` for faces
     /// that can't be embedded.
     fonts: HashMap<u32, Option<(krilla::text::Font, f64)>>,
-    /// Top-level layers are drawn as forms marked for their optional content groups
+    /// Layers and sublayers are drawn as forms marked for their optional content groups
     /// ([`crate::forms`]).
     pub layers: bool,
-    /// A top-level layer's form is being drawn.
-    in_layer: bool,
+    /// Each layer's index in [`crate::forms::pdf_layers`], by address.
+    layer_index: HashMap<usize, usize>,
+    /// The address of the layer whose form is being drawn.
+    in_layer: usize,
     /// Overprinting fills and strokes are drawn as forms marked to overprint.
     pub overprint: bool,
     /// An overprinting fill or stroke was drawn so.
@@ -485,7 +487,8 @@ impl<'a> Exporter<'a> {
             outline_text: set.advanced.outline_text,
             fonts: HashMap::new(),
             layers: false,
-            in_layer: false,
+            layer_index: crate::forms::pdf_layers(doc).iter().enumerate().map(|(i, l)| (address(l.node), i)).collect(),
+            in_layer: 0,
             overprint: false,
             overprinted: false,
         }
@@ -601,6 +604,11 @@ fn constant_mask(s: &mut Surface, page: Rect, alpha: f32) -> krilla::mask::Mask
     krilla::mask::Mask::new(sb.finish(), krilla::mask::MaskType::Alpha)
 }
 
+/// A node's address, to tell the very node apart from equal ones.
+fn address(n: &Node) -> usize {
+    std::ptr::from_ref(n).addr()
+}
+
 fn rects_overlap(a: Rect, b: Rect) -> bool {
     a.x0 <= b.x1 && b.x0 <= a.x1 && a.y0 <= b.y1 && b.y0 <= a.y1
 }
@@ -885,15 +893,15 @@ impl Exporter<'_> {
 
     fn node(&mut self, s: &mut Surface, n: &Node, page: Rect, force: bool) {
         if self.layers
-            && !self.in_layer
-            && let NodeKind::Layer { template: false, printable, .. } = n.kind
+            && self.in_layer != address(n)
+            && let NodeKind::Layer { printable, .. } = n.kind
             && (printable || self.non_printing)
-            && let Some(i) = self.doc.layers.iter().position(|l| std::ptr::eq(&**l, n))
+            && let Some(&i) = self.layer_index.get(&address(n))
         {
-            // A PDF layer: hidden layers are written too (their group is off).
-            self.in_layer = true;
+            // A PDF layer: hidden layers and sublayers are written too (their group is off).
+            let enclosing = std::mem::replace(&mut self.in_layer, address(n));
             crate::forms::form(s, Mark::Layer(i), |s| self.node(s, n, page, true));
-            self.in_layer = false;
+            self.in_layer = enclosing;
             return;
         }
         if !force && !n.visible {
@@ -982,7 +990,7 @@ impl Exporter<'_> {
                 }
             }
             // Live blends/envelopes/meshes export their evaluated (expanded) form.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 for c in g.children().into_iter().flatten() {
                     self.node(s, c, page, false);

crates/pdf/src/forms.rs

@@ -11,7 +11,9 @@ use std::io::Read;
 use krilla::geom::PathBuilder;
 use krilla::graphic::Graphic;
 use krilla::surface::Surface;
-use vectorcraft_doc::{Document, NodeKind};
+use std::sync::Arc;
+
+use vectorcraft_doc::{Document, Node, NodeKind};
 
 use crate::encrypt::{Lexer, Obj, StreamSpans, Tok, int, stream_spans};
 use crate::output::{deflate, text_string};
@@ -21,12 +23,36 @@ use crate::{PdfError, PdfSettings, Standard};
 /// What a marked form is.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Mark {
-    /// The art of top-level layer `i` (`Document::layers`).
+    /// The art of layer `i` of [`pdf_layers`].
     Layer(usize),
     /// A fill or stroke that overprints.
     Overprint,
 }
 
+/// A layer written as a PDF layer (an optional content group).
+pub(crate) struct PdfLayer<'a> {
+    pub node: &'a Node,
+    /// Its parent layer's index in [`pdf_layers`] (none for a top-level layer).
+    pub parent: Option<usize>,
+}
+
+/// The layers written as PDF layers: the top-level layers and their sublayers, but template layers
+/// (and what they hold), each before its sublayers, in paint order (bottom first).
+pub(crate) fn pdf_layers(doc: &Document) -> Vec<PdfLayer<'_>> {
+    fn add<'a>(nodes: &'a [Arc<Node>], parent: Option<usize>, out: &mut Vec<PdfLayer<'a>>) {
+        for n in nodes {
+            if let NodeKind::Layer { template: false, children, .. } = &n.kind {
+                let i = out.len();
+                out.push(PdfLayer { node: n, parent });
+                add(children, Some(i), out);
+            }
+        }
+    }
+    let mut out = vec![];
+    add(&doc.layers, None, &mut out);
+    out
+}
+
 /// The x coordinate of a layer mark's first point (its y is the layer index).
 const LAYER_X: i32 = -32000;
 /// The x coordinate of an overprint mark's first point.
@@ -199,7 +225,7 @@ fn mark_layers(content: &[u8], forms: &HashMap<&[u8], usize>) -> Option<(Vec<u8>
 }
 
 /// Finish the marked forms of `pdf` (as [`crate::export`] writes `doc` with `set`): with
-/// `layers`, each top-level layer (but template layers) becomes an optional content group —
+/// `layers`, each layer and sublayer (but template layers) becomes an optional content group —
 /// named as the layer, off when it is hidden, not printed (`/PrintState /OFF`) when its Print
 /// option is off, locked when it is locked — and the uses of its forms its optional content;
 /// with `overprint`, the overprinting forms get a graphics state that overprints (`/OP`, `/op`,
@@ -228,6 +254,11 @@ pub(crate) fn finish(pdf: Vec<u8>, doc: &Document, set: &PdfSettings, layers: bo
     }
     if layers {
         write_layers(&pdf, &xref, &objects, &marks, &mut patch, doc, set)?;
+        for (n, _) in marks.iter().filter(|(_, m)| matches!(m, Mark::Layer(_))) {
+            if let Some(o) = objects.get(n) {
+                unbox(&pdf, o, &mut patch)?;
+            }
+        }
     }
     let pdf = patch.apply(&pdf, &xref)?;
     // The file still is what its standard says.
@@ -235,8 +266,9 @@ pub(crate) fn finish(pdf: Vec<u8>, doc: &Document, set: &PdfSettings, layers: bo
     Ok(pdf)
 }
 
-/// The optional content groups of `doc`'s top-level layers, the uses of their forms marked as
-/// their content, and the catalog's `/OCProperties`.
+/// The optional content groups of `doc`'s layers and sublayers ([`pdf_layers`]), the uses of their
+/// forms marked as their content, and the catalog's `/OCProperties`, listing sublayers under their
+/// layers.
 fn write_layers(
     pdf: &[u8],
     xref: &Xref,
@@ -247,11 +279,16 @@ fn write_layers(
     set: &PdfSettings,
 ) -> Result<(), PdfError> {
     // One group per layer, in paint order (bottom first).
+    let layers = pdf_layers(doc);
     let mut groups: HashMap<usize, u32> = HashMap::new();
     let (mut all, mut off, mut locked) = (vec![], vec![], vec![]);
-    for (i, l) in doc.layers.iter().enumerate() {
-        let NodeKind::Layer { template: false, printable, .. } = l.kind else { continue };
-        let name = l.name.clone().unwrap_or_else(|| format!("Layer {}", i + 1));
+    // Each layer's sublayers, and the top-level layers, in paint order.
+    let mut children: HashMap<Option<usize>, Vec<usize>> = HashMap::new();
+    for (i, PdfLayer { node: l, parent }) in layers.iter().enumerate() {
+        let siblings = children.entry(*parent).or_default();
+        siblings.push(i);
+        let name = l.name.clone().unwrap_or_else(|| format!("Layer {}", siblings.len()));
+        let printable = matches!(l.kind, NodeKind::Layer { printable: true, .. });
         let on = |b: bool| if b { "ON" } else { "OFF" };
         let g = patch.add_object(
             format!("<</Type/OCG/Name{}/Usage<</View<</ViewState/{}>>/Print<</PrintState/{}>>>>>>", text_string(&name), on(l.visible), on(printable))
@@ -295,9 +332,7 @@ fn write_layers(
         add_resources(patch, res, "Properties", &entries)?;
     }
     let refs = |v: &[u32]| v.iter().map(|g| format!("{g} 0 R")).collect::<Vec<_>>().join(" ");
-    // Layers panels list the top layer first.
-    let order: Vec<u32> = all.iter().rev().copied().collect();
-    let mut config = format!("/Name(Layers)/Order[{}]", refs(&order));
+    let mut config = format!("/Name(Layers)/Order[{}]", order(&children, &groups, None));
     if !off.is_empty() {
         config.push_str(&format!("/OFF[{}]", refs(&off)));
     }
@@ -313,3 +348,35 @@ fn write_layers(
     patch.replace(start + 2, start + 2, format!("/OCProperties<</OCGs[{}]/D<<{config}>>>>", refs(&all)).into_bytes());
     Ok(())
 }
+
+/// A form's box as large as a page can be: the box of a layer's form is only the bounds of its
+/// art, and a reader that makes a clipping group of a form's box (as importers do) would gather a
+/// layer's art and its sublayers' in one group, which no layer can hold. A box round the whole
+/// page clips nothing.
+const UNBOXED: &[u8] = b"[-32767 -32767 32767 32767]";
+
+/// Give the layer's form `o` the [`UNBOXED`] box.
+fn unbox(pdf: &[u8], o: &Object<'_>, patch: &mut Patch) -> Result<(), PdfError> {
+    let Obj::Dict { start, end, .. } = o.dict else { return Err(bad("a layer's form has no dictionary")) };
+    let dict = pdf.get(start..end).ok_or_else(|| bad("a layer's form can't be read"))?;
+    // The writer writes the box as an array of numbers.
+    let at = dict.windows(5).position(|w| w == b"/BBox").ok_or_else(|| bad("a layer's form has no box"))? + 5;
+    let open = at + dict.get(at..).and_then(|d| d.iter().position(|&c| c == b'[')).ok_or_else(|| bad("a layer's form box isn't an array"))?;
+    let close = open + dict.get(open..).and_then(|d| d.iter().position(|&c| c == b']')).ok_or_else(|| bad("a layer's form box isn't an array"))? + 1;
+    patch.replace(start + open, start + close, UNBOXED.to_vec());
+    Ok(())
+}
+
+/// The `/Order` entries of `parent`'s sublayers (the top-level layers for none), the top one first
+/// as Layers panels list them, each followed by an array of its own sublayers when it has some.
+fn order(children: &HashMap<Option<usize>, Vec<usize>>, groups: &HashMap<usize, u32>, parent: Option<usize>) -> String {
+    let mut out = vec![];
+    for &i in children.get(&parent).into_iter().flatten().rev() {
+        let Some(g) = groups.get(&i) else { continue };
+        out.push(format!("{g} 0 R"));
+        if children.contains_key(&Some(i)) {
+            out.push(format!("[{}]", order(children, groups, Some(i))));
+        }
+    }
+    out.join(" ")
+}

crates/pdf/src/import.rs

@@ -537,14 +537,23 @@ struct Frame {
     children: Vec<Arc<Node>>,
     /// The first optional content group entered inside (where the frame's art goes).
     group: Option<usize>,
+    /// The group each child was drawn in, where the frame's art goes when the frame dissolves
+    /// into its parent (a layer's form drawing its sublayers' forms).
+    child_groups: Vec<Option<usize>>,
 }
 
 impl Frame {
     fn new(kind: FrameKind) -> Self {
-        Self { kind, children: vec![], group: None }
+        Self { kind, children: vec![], group: None, child_groups: vec![] }
     }
 }
 
+/// A dissolving frame's `children`, each with the group it was drawn in (`groups`, else the
+/// frame's `group`).
+fn grouped(children: Vec<Arc<Node>>, groups: Vec<Option<usize>>, group: Option<usize>) -> impl Iterator<Item = (Arc<Node>, Option<usize>)> {
+    children.into_iter().zip(groups.into_iter().map(move |g| g.or(group)).chain(std::iter::repeat(group)))
+}
+
 /// Glyphs drawn consecutively with the same paint, merged into one path.
 struct GlyphRun {
     path: BezPath,
@@ -846,8 +855,11 @@ impl<'p> Builder<'p> {
         // A frame's art goes where its first art was drawn (a clip can end in a later group).
         if root {
             self.root_groups.push(group.or(current));
-        } else if f.group.is_none() {
-            f.group = group.or(current);
+        } else {
+            f.child_groups.push(group.or(current));
+            if f.group.is_none() {
+                f.group = group.or(current);
+            }
         }
     }
 
@@ -925,7 +937,7 @@ impl<'p> Builder<'p> {
         let node = match f.kind {
             FrameKind::Root => None,
             FrameKind::Skip => {
-                f.children.into_iter().for_each(|c| self.emit(c, group));
+                grouped(f.children, f.child_groups, group).for_each(|(c, g)| self.emit(c, g));
                 None
             }
             FrameKind::Clip(clip) => {
@@ -934,7 +946,7 @@ impl<'p> Builder<'p> {
                     None
                 } else if noop.is_some_and(|r| bounds(&f.children).is_some_and(|b| contains(r, b))) {
                     // A rectangle around all of its art (a form's box) clips nothing.
-                    f.children.into_iter().for_each(|c| self.emit(c, group));
+                    grouped(f.children, f.child_groups, group).for_each(|(c, g)| self.emit(c, g));
                     None
                 } else {
                     let mut ch = vec![Arc::new(*clip)];
@@ -957,7 +969,7 @@ impl<'p> Builder<'p> {
                 if children.is_empty() {
                     None
                 } else if plain {
-                    children.into_iter().for_each(|c| self.emit(c, group));
+                    grouped(children, f.child_groups, group).for_each(|(c, g)| self.emit(c, g));
                     None
                 } else if let [only] = children.as_slice()
                     && !only.is_container()

crates/pdf/src/lib.rs

@@ -10,7 +10,7 @@
 //!   text in embedded subset fonts (Advanced). Colours are converted, tagged with ICC profiles and
 //!   given an output intent as the Output settings say. Hidden objects,
 //!   guides and template layers are skipped, and so are non-printing layers unless asked for.
-//!   Top-level layers can be PDF layers (optional content groups with their visibility, print
+//!   Layers and sublayers can be PDF layers (optional content groups with their visibility, print
 //!   state and lock), and overprinting fills and strokes overprint (Advanced).
 //!   Each page is its artboard (the trim box) grown by the bleed (the bleed box) and by the
 //!   printer's marks around it (the media box), drawn in Registration. [`PdfSettings`] is the Save PDF

crates/pdf/src/settings.rs

@@ -226,7 +226,7 @@ pub struct PdfSettings {
     pub fast_web_view: bool,
     /// The app opens the written file (frontends only; the writer ignores it).
     pub view_after_saving: bool,
-    /// Write top-level layers as PDF layers (optional content).
+    /// Write layers and sublayers as PDF layers (optional content).
     pub create_layers: bool,
     /// Keep the layers whose Print option is off (they are left out otherwise, unless
     /// `create_layers` is on).
@@ -449,7 +449,7 @@ impl PdfSettings {
         within("advanced.fontSubsetPercent", self.advanced.font_subset_percent, 0.0, 100.0, "%")
     }
 
-    /// Top-level layers are written as PDF layers: asked for, at a version that has them.
+    /// Layers and sublayers are written as PDF layers: asked for, at a version that has them.
     pub fn writes_layers(&self) -> bool {
         self.create_layers && self.compatibility.has_layers()
     }

crates/pdf/src/tests_layers.rs

@@ -131,6 +131,57 @@ fn pdf_layers_import_back_as_layers() {
     }
 }
 
+/// The rows of `nodes` in paint order, depth first: `depth name visible` for layers, `depth fill`
+/// for art.
+fn tree(nodes: &[std::sync::Arc<Node>], depth: usize, out: &mut Vec<String>) {
+    for n in nodes {
+        match &n.kind {
+            NodeKind::Layer { children, .. } => {
+                out.push(format!("{depth} {} {}", n.name.clone().unwrap_or_default(), n.visible));
+                tree(children, depth + 1, out);
+            }
+            _ => out.push(format!("{depth} {:?}", n.appearance.fill().and_then(|f| f.paint.color()))),
+        }
+    }
+}
+
+/// Sublayers are PDF layers listed under their layer's, hidden ones off with their art, and they
+/// import back as sublayers (#372: other apps read a `.ai` file's PDF part).
+#[test]
+fn sublayers_are_nested_pdf_layers_and_import_back() {
+    let mut d = Document::new(200.0, 100.0);
+    d.layers.clear();
+    let layer = |d: &mut Document, name: &str, visible: bool, children: Vec<Node>| {
+        let mut l = Node::layer(d.alloc_id(), name, LayerColor::Preset(0));
+        l.visible = visible;
+        if let NodeKind::Layer { children: c, .. } = &mut l.kind {
+            c.extend(children.into_iter().map(std::sync::Arc::new));
+        }
+        l
+    };
+    let deep = vec![rect(&mut d, 90.0, GREEN)];
+    let deep = layer(&mut d, "Deep", true, deep);
+    let sub = vec![rect(&mut d, 50.0, BLUE), deep];
+    let sub = layer(&mut d, "Sub", false, sub);
+    let main = vec![rect(&mut d, 10.0, RED), sub];
+    let main = layer(&mut d, "Main", true, main);
+    d.layers.push(main.into());
+    let r = export(&d, json!({"createLayers": true, "compression": {"compressText": false}}));
+    oc_properties(&r.bytes, None, |props, xref| {
+        let props = props.expect("/OCProperties");
+        assert_eq!(names(xref, props.get(b"OCGs")), ["Main", "Sub", "Deep"]);
+        assert_eq!(names(xref, props.get::<Dict<'_>>(b"D").unwrap().get(b"OFF")), ["Sub"]);
+    });
+    let text = String::from_utf8_lossy(&r.bytes);
+    let order = text.split("/Order").nth(1).and_then(|o| o.split("]/").next()).unwrap().to_string();
+    assert_eq!(order.matches('[').count(), 3, "each layer's sublayers in an array after it: {order}");
+    let mut got = vec![];
+    tree(&import(&r.bytes).unwrap().layers, 0, &mut got);
+    // Paint order, as it was.
+    let fill = |depth, c: Color| format!("{depth} {:?}", Some(c));
+    assert_eq!(got, ["0 Main true".to_string(), fill(1, RED), "1 Sub false".into(), fill(2, BLUE), "2 Deep true".into(), fill(3, GREEN)]);
+}
+
 #[test]
 fn identical_layers_stay_apart() {
     let mut d = Document::new(200.0, 100.0);

crates/plugins/src/manifest.rs

@@ -139,10 +139,8 @@ impl Manifest {
                 return Err(Error::Manifest(format!("invalid parameter name {k:?}")));
             }
             match spec {
-                ParamSpec::Number { min, max, default } => {
-                    if !(min.is_finite() && max.is_finite() && default.is_finite()) || min > max {
-                        return Err(Error::Manifest(format!("parameter `{k}`: bad range")));
-                    }
+                ParamSpec::Number { min, max, default } if !(min.is_finite() && max.is_finite() && default.is_finite()) || min > max => {
+                    return Err(Error::Manifest(format!("parameter `{k}`: bad range")));
                 }
                 ParamSpec::Int { min, max, .. } if min > max => return Err(Error::Manifest(format!("parameter `{k}`: bad range"))),
                 ParamSpec::Choice { options, default } => {

crates/render/src/lib.rs

@@ -15,6 +15,7 @@ mod ink;
 mod live;
 mod paint;
 mod pattern;
+pub mod placed_document;
 pub mod proof;
 
 use std::collections::HashMap;
@@ -96,6 +97,9 @@ pub struct RenderOptions {
     pub highlight_substitutions: bool,
     /// Edge smoothing (raster export option).
     pub anti_alias: AntiAlias,
+    /// Screen view: placed documents draw from cached bitmaps made in the background (see
+    /// [`placed_document`]); off, they draw exactly, read when needed.
+    pub progressive_placed: bool,
 }
 
 /// How edges are rasterized (raster export option).
@@ -160,6 +164,7 @@ impl Default for RenderOptions {
             mask_view: None,
             highlight_substitutions: false,
             anti_alias: AntiAlias::Art,
+            progressive_placed: false,
         }
     }
 }
@@ -580,6 +585,23 @@ impl Renderer {
         self.render_node_thumbnail(doc, doc.node(id)?, size, None)
     }
 
+    /// Render node `n` of `doc` (its resources) into `w`×`h` transparent pixels through `view`.
+    pub fn render_node(&mut self, doc: &Document, n: &Arc<Node>, w: u16, h: u16, view: Affine) -> Option<Rendered> {
+        let inv = view.inverse();
+        let visible = inv.transform_rect_bbox(Rect::new(0.0, 0.0, w as f64, h as f64));
+        let px = 1.0 / view.determinant().abs().sqrt().max(1e-12);
+        let mut ctx = single_threaded_context(w, h);
+        let opts = RenderOptions::default();
+        let frame = Frame { mt: false, doc, view, visible, px, opts: &opts, ink: Ink::Display };
+        (self.knockout, self.nested, self.backdrop) = (false, 0, None);
+        self.clip_paths.clear();
+        self.draw_arc(&mut ctx, &frame, n);
+        ctx.flush();
+        let mut pm = Pixmap::new(w, h);
+        ctx.render(&mut pm, &mut self.resources);
+        Some(Rendered { width: w as u32, height: h as u32, pixels: pm.data_as_u8_slice().to_vec() })
+    }
+
     /// Render any node (also one outside the tree, e.g. opacity-mask art) fitted into
     /// `size`×`size` pixels, optionally over a solid premultiplied background.
     pub fn render_node_thumbnail(&mut self, doc: &Document, n: &Node, size: u32, background: Option<[u8; 4]>) -> Option<Rendered> {
@@ -916,7 +938,9 @@ impl Renderer {
                     self.draw_node(ctx, f, &art, true);
                 }
             }
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => self.draw_live_node(ctx, f, n),
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
+                self.draw_live_node(ctx, f, n)
+            }
         }
     }
 
@@ -1649,6 +1673,8 @@ mod tests_layeropts;
 #[cfg(test)]
 mod tests_objectfx;
 #[cfg(test)]
+mod tests_placed_document;
+#[cfg(test)]
 mod tests_setup;
 #[cfg(test)]
 mod tests_strokegradient;

crates/render/src/live.rs

@@ -143,6 +143,7 @@ impl Renderer {
     /// Draw the evaluated content of a live node (no transparency group).
     pub(crate) fn draw_live_body(&mut self, ctx: &mut RenderContext, f: &Frame, a: &Arc<Node>, cache: bool) {
         match &a.kind {
+            NodeKind::PlacedDocument(p) => self.draw_placed(ctx, f, p),
             NodeKind::Mesh(m) => self.draw_mesh(ctx, f, a, m, cache),
             NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Repeat(_) | NodeKind::Group { .. } | NodeKind::Layer { .. } => {
                 let items = self.live_expanded(f.doc, a, cache);

crates/render/src/paint.rs

@@ -52,7 +52,22 @@ pub(crate) fn set_paint(ctx: &mut RenderContext, p: &Paint, bounds: Rect, f: &Fr
 
 /// Decode encoded image bytes into a premultiplied pixmap.
 pub fn decode_pixmap(bytes: &[u8]) -> Option<vello_cpu::Pixmap> {
-    let img = image::load_from_memory(bytes).ok()?.to_rgba8();
+    pixmap_of(image::load_from_memory(bytes).ok()?.to_rgba8())
+}
+
+/// [`decode_pixmap`] shrunk to `w`×`h` pixels when the image is larger (never enlarged).
+pub fn decode_pixmap_fit(bytes: &[u8], w: u16, h: u16) -> Option<vello_cpu::Pixmap> {
+    let img = image::load_from_memory(bytes).ok()?;
+    let img = if img.width() > w as u32 || img.height() > h as u32 {
+        img.resize_exact(w as u32, h as u32, image::imageops::FilterType::Triangle)
+    } else {
+        img
+    };
+    pixmap_of(img.to_rgba8())
+}
+
+/// An RGBA image as a premultiplied pixmap.
+fn pixmap_of(img: image::RgbaImage) -> Option<vello_cpu::Pixmap> {
     let (w, h) = img.dimensions();
     if w == 0 || h == 0 || w > u16::MAX as u32 || h > u16::MAX as u32 {
         return None;

crates/render/src/placed_document.rs

@@ -0,0 +1,359 @@
+//! Drawing placed documents ([`PlacedDocument`]).
+//!
+//! Exactly: the art read from the file ([`vectorcraft_doc::placed_document::read`]) drawn with its
+//! own resources, through a view that maps its artboard into the object's box (nothing is copied
+//! into the document).
+//!
+//! On screen ([`RenderOptions::progressive_placed`]): a placed document can't be edited, so what
+//! it shows is cached as a bitmap per file and zoom step (a power of two, in device pixels per
+//! point), shared by every object showing that file. A bitmap not made yet is made on a
+//! background worker while the frame shows another step's bitmap, or a light placeholder;
+//! [`generation`] changes when one is ready and [`busy`] says whether any is coming, so the screen
+//! can draw again. Past [`MAX_SIDE`] pixels, and in outline, proofing and ink frames, it is drawn
+//! exactly.
+//!
+//! A document opened with only its placed documents' previews ([`ImageBlob::is_proxy`]) shows them
+//! up to their resolution; past it the file is read again in the background
+//! ([`vectorcraft_doc::placed_document::full_bytes`]), the preview standing in until then (and for
+//! good when the file can't be found). Placed documents inside a placed document are drawn the
+//! same way, up to [`MAX_DEPTH`] deep; deeper ones show their previews.
+
+use std::cell::Cell;
+use std::collections::{HashMap, HashSet};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, LazyLock, Mutex, MutexGuard, PoisonError};
+
+use vectorcraft_doc::placed_document::MAX_DEPTH;
+use vectorcraft_doc::{ImageBlob, Node, PlacedDocument};
+use vectorcraft_geom::{Affine, Rect};
+use vello_cpu::{Pixmap, RenderContext, kurbo, peniko};
+
+use crate::ink::Ink;
+use crate::{Frame, Renderer};
+
+/// The longest side of a cached bitmap (pixels); larger steps draw exactly.
+pub const MAX_SIDE: f64 = 4096.0;
+/// The most bytes of bitmaps kept.
+const BUDGET: usize = 512 << 20;
+/// The smallest zoom step (device pixels per point).
+const MIN_STEP: f64 = 1.0 / 64.0;
+
+/// A bitmap's identity: the file shown (its key) and the zoom step's bits.
+type BitmapKey = (String, u64);
+
+struct Bitmap {
+    pm: Arc<Pixmap>,
+    step: f64,
+    used: u64,
+}
+
+#[derive(Default)]
+struct Bitmaps {
+    map: HashMap<BitmapKey, Bitmap>,
+    clock: u64,
+    bytes: usize,
+}
+
+static BITMAPS: LazyLock<Mutex<Bitmaps>> = LazyLock::new(Default::default);
+/// Bitmaps being made.
+static PENDING: LazyLock<Mutex<HashSet<BitmapKey>>> = LazyLock::new(Default::default);
+static GENERATION: AtomicU64 = AtomicU64::new(0);
+
+fn lock<T>(m: &Mutex<T>) -> MutexGuard<'_, T> {
+    // The caches stay whole if a holder panicked (entries are only inserted and removed).
+    m.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// Changes whenever a bitmap made in the background is ready: a screen showing placed documents
+/// draws again when it does.
+pub fn generation() -> u64 {
+    GENERATION.load(Ordering::Relaxed)
+}
+
+/// Are bitmaps being made in the background?
+pub fn busy() -> bool {
+    !lock(&PENDING).is_empty()
+}
+
+/// Is a bitmap of file `key` being made?
+#[cfg(test)]
+pub(crate) fn pending_for(key: &str) -> bool {
+    lock(&PENDING).iter().any(|k| k.0 == key)
+}
+
+/// The zoom step for `scale` device pixels per point: the power of two at or above it.
+pub(crate) fn step(scale: f64) -> Option<f64> {
+    (scale.is_finite() && scale > 0.0).then(|| 2f64.powf(scale.log2().ceil()).max(MIN_STEP))
+}
+
+impl Bitmaps {
+    fn get(&mut self, k: &BitmapKey) -> Option<Arc<Pixmap>> {
+        self.clock += 1;
+        let clock = self.clock;
+        let b = self.map.get_mut(k)?;
+        b.used = clock;
+        Some(b.pm.clone())
+    }
+
+    /// The bitmap of another step of the same file, the nearest to `step`.
+    fn nearest(&self, key: &str, step: f64) -> Option<(Arc<Pixmap>, f64)> {
+        self.map
+            .iter()
+            .filter(|((k, _), _)| k == key)
+            .min_by(|a, b| (a.1.step / step).log2().abs().total_cmp(&(b.1.step / step).log2().abs()))
+            .map(|(_, b)| (b.pm.clone(), b.step))
+    }
+
+    fn insert(&mut self, k: BitmapKey, pm: Pixmap, step: f64) {
+        self.clock += 1;
+        let size = pm.width() as usize * pm.height() as usize * 4;
+        self.bytes += size;
+        if let Some(old) = self.map.insert(k, Bitmap { pm: Arc::new(pm), step, used: self.clock }) {
+            self.bytes = self.bytes.saturating_sub(old.pm.width() as usize * old.pm.height() as usize * 4);
+        }
+        while self.bytes > BUDGET && self.map.len() > 1 {
+            let Some(k) = self.map.iter().min_by_key(|(_, b)| b.used).map(|(k, _)| k.clone()) else { break };
+            if let Some(b) = self.map.remove(&k) {
+                self.bytes = self.bytes.saturating_sub(b.pm.width() as usize * b.pm.height() as usize * 4);
+            }
+        }
+    }
+}
+
+/// What a bitmap is made from.
+struct Job {
+    key: BitmapKey,
+    object: PlacedDocument,
+    blob: ImageBlob,
+    step: f64,
+}
+
+/// Device pixels per point of `object`'s box its preview `bytes` have.
+fn preview_density(object: &PlacedDocument, bytes: &[u8]) -> f64 {
+    vectorcraft_doc::placed_document::image_size(bytes).map_or(0.0, |(w, _)| w as f64 / object.width.max(1e-9))
+}
+
+thread_local! {
+    /// How deep inside placed documents this thread is drawing.
+    static DEPTH: Cell<usize> = const { Cell::new(0) };
+}
+
+/// While alive: drawing inside a placed document, one level deeper.
+struct Inside;
+
+impl Inside {
+    fn enter() -> Self {
+        DEPTH.with(|d| d.set(d.get() + 1));
+        Inside
+    }
+}
+
+impl Drop for Inside {
+    fn drop(&mut self) {
+        DEPTH.with(|d| d.set(d.get().saturating_sub(1)));
+    }
+}
+
+fn depth() -> usize {
+    DEPTH.with(Cell::get)
+}
+
+/// Render `art` of a placed document's file (`doc`, its resources) into `w`×`h` transparent
+/// pixels through `view`, the placed documents inside it one level deeper.
+pub fn render_inside(r: &mut Renderer, doc: &vectorcraft_doc::Document, art: &Arc<Node>, w: u16, h: u16, view: Affine) -> Option<crate::Rendered> {
+    let _inside = Inside::enter();
+    r.render_node(doc, art, w, h, view)
+}
+
+/// `object`'s file (`blob`) as a bitmap of `step` device pixels per point of its box: from its
+/// preview when that is all there is and is fine enough, else from the file (read again when
+/// needed; the preview when it can't be).
+fn make(r: &mut Renderer, object: &PlacedDocument, blob: &ImageBlob, step: f64) -> Option<Pixmap> {
+    let (w, h) = (pixels(object.width * step), pixels(object.height * step));
+    let preview = if blob.is_proxy() { Some(blob.bytes.clone()) } else { blob.proxy.clone() };
+    let full = match blob.is_proxy() {
+        true if step <= preview_density(object, &blob.bytes) * 1.01 => None,
+        true => vectorcraft_doc::placed_document::full_bytes(object, blob),
+        false => Some(blob.bytes.clone()),
+    };
+    let read = full.and_then(|bytes| vectorcraft_doc::placed_document::read(object, &bytes));
+    let Some(e) = read else { return crate::paint::decode_pixmap_fit(&preview?, w, h) };
+    let f = e.frame;
+    let (sx, sy) = (w as f64 / f.width(), h as f64 / f.height());
+    let view = Affine::scale_non_uniform(sx, sy) * Affine::translate((-f.x0, -f.y0));
+    let img = render_inside(r, &e.doc, &e.art, w, h, view)?;
+    let data = img.pixels.as_chunks::<4>().0.iter().map(|&[r, g, b, a]| vello_cpu::color::PremulRgba8 { r, g, b, a }).collect();
+    Some(Pixmap::from_parts(data, w, h))
+}
+
+/// A bitmap side for `v` pixels (at least 1).
+fn pixels(v: f64) -> u16 {
+    v.round().clamp(1.0, MAX_SIDE) as u16
+}
+
+/// Make `job`'s bitmap and keep it.
+fn run(r: &mut Renderer, job: Job) {
+    if let Some(pm) = make(r, &job.object, &job.blob, job.step) {
+        lock(&BITMAPS).insert(job.key.clone(), pm, job.step);
+    }
+    lock(&PENDING).remove(&job.key);
+    GENERATION.fetch_add(1, Ordering::Relaxed);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+mod workers {
+    use std::sync::mpsc::{Sender, channel};
+    use std::sync::{Arc, LazyLock, Mutex};
+
+    use super::Job;
+
+    /// The queue the workers take jobs from; `None` when no worker could start.
+    static QUEUE: LazyLock<Option<Mutex<Sender<Box<Job>>>>> = LazyLock::new(|| {
+        let (tx, rx) = channel::<Box<Job>>();
+        let rx = Arc::new(Mutex::new(rx));
+        let n = std::thread::available_parallelism().map_or(2, |n| (n.get() / 2).clamp(1, 4));
+        let mut started = 0;
+        for i in 0..n {
+            let rx = rx.clone();
+            let spawned = std::thread::Builder::new().name(format!("vectorcraft-placed-{i}")).spawn(move || {
+                let mut r = crate::Renderer::new();
+                r.threads = 0;
+                loop {
+                    let job = super::lock(&rx).recv();
+                    let Ok(job) = job else { break };
+                    // A panic loses this bitmap, not the worker.
+                    let key = job.key.clone();
+                    if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| super::run(&mut r, *job))).is_err() {
+                        super::lock(&super::PENDING).remove(&key);
+                    }
+                }
+            });
+            started += usize::from(spawned.is_ok());
+        }
+        (started > 0).then(|| Mutex::new(tx))
+    });
+
+    /// Hand `job` to a worker; back when there is none.
+    pub(super) fn submit(job: Box<Job>) -> Result<(), Box<Job>> {
+        match QUEUE.as_ref() {
+            Some(q) => super::lock(q).send(job).map_err(|e| e.0),
+            None => Err(job),
+        }
+    }
+}
+
+/// Make `job`'s bitmap in the background (here and now where there are no threads).
+fn schedule(job: Job) {
+    if !lock(&PENDING).insert(job.key.clone()) {
+        return;
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    let job = match workers::submit(Box::new(job)) {
+        Ok(()) => return,
+        Err(job) => *job,
+    };
+    run(&mut Renderer::new(), job);
+}
+
+/// The mean scale of `a`.
+fn mean_scale(a: Affine) -> f64 {
+    a.determinant().abs().sqrt()
+}
+
+impl Renderer {
+    /// Draw placed document `p` in frame `f`: from a cached bitmap on screen, else exactly.
+    pub(crate) fn draw_placed(&mut self, ctx: &mut RenderContext, f: &Frame, p: &PlacedDocument) {
+        let plain = f.ink == Ink::Display && !f.opts.outline && f.opts.proof.is_none() && !f.opts.overprint_preview;
+        if f.opts.progressive_placed && plain && depth() == 0 && self.draw_placed_bitmap(ctx, f, p) {
+            return;
+        }
+        let Some(blob) = f.doc.images.get(&p.key) else { return };
+        // The file's bytes: stored, read again already, or (inside another placed document, while
+        // not too deep) read again now.
+        let full = match depth() {
+            0 => vectorcraft_doc::placed_document::full_bytes_cached(p, blob),
+            d if d < MAX_DEPTH => vectorcraft_doc::placed_document::full_bytes(p, blob),
+            _ => None,
+        };
+        let read = full.and_then(|bytes| vectorcraft_doc::placed_document::read(p, &bytes));
+        let Some(e) = read else {
+            // Only the preview: drawn scaled into the box.
+            if blob.is_proxy()
+                && let Some(im) = p.preview_image(&blob.bytes)
+            {
+                self.draw_image(ctx, f, &im);
+            }
+            return;
+        };
+        let Some(m) = p.art_xf(e.frame) else { return };
+        let k = mean_scale(m);
+        if !k.is_finite() || k <= 1e-12 {
+            return;
+        }
+        // The art in its own coordinates, with its own resources.
+        let inner = Frame { doc: &e.doc, view: f.view * m, visible: m.inverse().transform_rect_bbox(f.visible), px: f.px / k, ..*f };
+        let _inside = Inside::enter();
+        self.draw_arc(ctx, &inner, &e.art);
+    }
+
+    /// Draw `p` from its bitmap at this zoom step, or (while that is made) another step's, or a
+    /// placeholder. False when bitmaps don't suit (too large).
+    fn draw_placed_bitmap(&mut self, ctx: &mut RenderContext, f: &Frame, p: &PlacedDocument) -> bool {
+        let m = f.view * p.xf;
+        let Some(step) = step(mean_scale(m)) else { return false };
+        if p.width * step > MAX_SIDE || p.height * step > MAX_SIDE {
+            return false;
+        }
+        let Some(blob) = f.doc.images.get(&p.key).cloned() else { return true };
+        let key = (p.key.clone(), step.to_bits());
+        let (found, nearest) = {
+            let mut b = lock(&BITMAPS);
+            let found = b.get(&key);
+            let nearest = if found.is_none() { b.nearest(&p.key, step) } else { None };
+            (found, nearest)
+        };
+        let shown = match found {
+            Some(pm) => Some(pm),
+            None => {
+                schedule(Job { key, object: p.clone(), blob, step });
+                // Made here and now (no threads) or meanwhile another step's.
+                let mut b = lock(&BITMAPS);
+                b.get(&(p.key.clone(), step.to_bits())).or(nearest.map(|n| n.0))
+            }
+        };
+        let rect = Rect::new(0.0, 0.0, p.width, p.height);
+        match shown {
+            Some(pm) => {
+                let (sx, sy) = (p.width / pm.width().max(1) as f64, p.height / pm.height().max(1) as f64);
+                ctx.set_paint(vello_cpu::Image { image: vello_cpu::ImageSource::Pixmap(pm), sampler: peniko::ImageSampler::default() });
+                ctx.set_transform(m);
+                ctx.set_paint_transform(Affine::scale_non_uniform(sx, sy));
+                ctx.fill_rect(&kurbo::Rect::new(rect.x0, rect.y0, rect.x1, rect.y1));
+                ctx.reset_paint_transform();
+            }
+            None => {
+                // Coming: a light box where it will be.
+                ctx.set_transform(m);
+                ctx.set_paint(peniko::Color::from_rgba8(128, 128, 128, 40));
+                ctx.fill_rect(&kurbo::Rect::new(rect.x0, rect.y0, rect.x1, rect.y1));
+            }
+        }
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn zoom_steps_are_powers_of_two_at_or_above_the_scale() {
+        assert_eq!(step(1.0), Some(1.0));
+        assert_eq!(step(1.2), Some(2.0));
+        assert_eq!(step(0.3), Some(0.5));
+        assert_eq!(step(5.0), Some(8.0));
+        assert_eq!(step(1e-9), Some(MIN_STEP));
+        assert_eq!(step(f64::NAN), None);
+        assert_eq!(step(0.0), None);
+    }
+}

crates/render/src/tests_placed_document.rs

@@ -0,0 +1,136 @@
+//! Placed documents on screen: drawn from bitmaps made in the background (a placeholder until
+//! then), the same as drawn exactly; exports draw them exactly at once.
+
+use vectorcraft_color::{Color, Paint};
+use vectorcraft_doc::{Appearance, ImageBlob, LinkInfo, Node, NodeId, NodeKind, PlacedDocument};
+use vectorcraft_geom::shapes;
+
+use super::*;
+
+/// Every file reads as a 40×20 artboard filled blue; a file whose bytes start with `loop` also
+/// places itself (the same key) in its middle.
+fn blue_page(p: &PlacedDocument, bytes: &[u8]) -> Option<(Document, Node, Rect)> {
+    let mut d = Document::new(40.0, 20.0);
+    d.layers.clear();
+    let blue = Appearance::basic(Paint::solid(Color::rgb(0.0, 0.0, 1.0)), Paint::None, 0.0);
+    let mut children = vec![Arc::new(Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 40.0, 20.0)), blue))];
+    if bytes.starts_with(b"loop") {
+        d.images.insert(p.key.clone(), ImageBlob::new("application/json", bytes.to_vec()));
+        let me = PlacedDocument { xf: Affine::translate((10.0, 5.0)) * Affine::scale(0.5), ..p.clone() };
+        children.push(Arc::new(Node::new(NodeId(2), NodeKind::PlacedDocument(Box::new(me)))));
+    }
+    Some((d, Node::new(NodeId(0), NodeKind::Group { children, clip: false }), Rect::new(0.0, 0.0, 40.0, 20.0)))
+}
+
+/// A 100×100 document showing one placed file (`bytes` under `key`) in the box (10, 10)–(90, 50).
+fn doc_with(key: &str, bytes: &[u8]) -> Document {
+    vectorcraft_doc::placed_document::set_loader(blue_page);
+    let mut d = Document::new(100.0, 100.0);
+    d.images.insert(key.into(), ImageBlob::new("application/json", bytes.to_vec()));
+    let p = PlacedDocument {
+        link: LinkInfo::new("/art/card.vectorcraft"),
+        key: key.into(),
+        bounding: false,
+        width: 40.0,
+        height: 20.0,
+        xf: Affine::translate((10.0, 10.0)) * Affine::scale(2.0),
+        placement: Default::default(),
+    };
+    let l = d.layers[0].id;
+    d.insert(Some(l), 0, Node::new(NodeId(50), NodeKind::PlacedDocument(Box::new(p)))).unwrap();
+    d
+}
+
+fn doc(key: &str) -> Document {
+    doc_with(key, format!("{{\"doc\": \"{key}\"}}").as_bytes())
+}
+
+fn render(d: &Document, progressive: bool) -> Rendered {
+    let opts = RenderOptions { background: Some([255, 255, 255, 255]), progressive_placed: progressive, ..Default::default() };
+    Renderer::new().render(d, 100, 100, Affine::IDENTITY, &opts)
+}
+
+/// Wait for the background bitmaps (at most 10 s).
+fn settle() {
+    let t = std::time::Instant::now();
+    while placed_document::busy() && t.elapsed().as_secs() < 10 {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!placed_document::busy(), "bitmaps still coming");
+}
+
+#[test]
+fn a_placed_document_draws_exactly_with_its_own_art() {
+    let d = doc("exact-1");
+    let r = render(&d, false);
+    assert_eq!(&r.pixel(50, 30)[..3], &[0, 0, 255], "blue inside the box");
+    assert_eq!(&r.pixel(95, 95)[..3], &[255, 255, 255], "nothing outside");
+}
+
+#[test]
+fn on_screen_a_placed_document_shows_a_placeholder_then_its_bitmap() {
+    let d = doc("progressive-1");
+    let generation = placed_document::generation();
+    let first = render(&d, true);
+    let shown = &first.pixel(50, 30)[..3];
+    assert!(shown == [0, 0, 255] || shown != [255, 255, 255], "a placeholder or the art: {shown:?}");
+    settle();
+    assert!(placed_document::generation() > generation || shown == [0, 0, 255], "a bitmap was made");
+    let later = render(&d, true);
+    let exact = render(&d, false);
+    assert_eq!(&later.pixel(50, 30)[..3], &[0, 0, 255]);
+    for (x, y) in [(12, 12), (50, 30), (88, 48), (95, 95), (5, 5)] {
+        let (a, b) = (later.pixel(x, y), exact.pixel(x, y));
+        assert!(a.iter().zip(b).all(|(a, b)| a.abs_diff(b) <= 24), "at ({x}, {y}): {a:?} vs {b:?}");
+    }
+}
+
+#[test]
+fn copies_of_one_placed_document_share_its_bitmap() {
+    let mut d = doc("shared-1");
+    let n = d.node(NodeId(50)).unwrap().clone();
+    let l = d.layers[0].id;
+    let mut copy = n.clone();
+    copy.id = NodeId(51);
+    copy.transform(Affine::translate((0.0, 45.0)), false);
+    d.insert(Some(l), 1, copy).unwrap();
+    render(&d, true);
+    settle();
+    let r = render(&d, true);
+    assert!(!placed_document::pending_for("shared-1"), "nothing more to make");
+    assert_eq!(&r.pixel(50, 30)[..3], &[0, 0, 255]);
+    assert_eq!(&r.pixel(50, 75)[..3], &[0, 0, 255]);
+}
+
+#[test]
+fn a_placed_document_kept_as_its_preview_draws_the_preview() {
+    let mut d = doc("preview-1");
+    // Only the preview (a 20×10 green PNG) is there, and the file can't be read here.
+    let img = image::RgbaImage::from_pixel(20, 10, image::Rgba([0, 200, 0, 255]));
+    let mut png = vec![];
+    img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut blob = ImageBlob::new("image/png", png);
+    blob.proxy = Some(blob.bytes.clone());
+    d.images.insert("preview-1".into(), blob);
+    let exact = render(&d, false);
+    assert_eq!(&exact.pixel(50, 30)[..3], &[0, 200, 0], "the preview, in the box");
+    assert_eq!(&exact.pixel(95, 95)[..3], &[255, 255, 255]);
+    // On screen past the preview's resolution (it has 0.5 px a point; this is 2): still the preview.
+    render(&d, true);
+    settle();
+    let shown = render(&d, true);
+    assert_eq!(&shown.pixel(50, 30)[..3], &[0, 200, 0]);
+}
+
+#[test]
+fn a_document_that_places_itself_draws_a_few_levels_deep_then_stops() {
+    let d = doc_with("loop-1", b"loop");
+    let t = std::time::Instant::now();
+    let r = render(&d, false);
+    assert!(t.elapsed().as_secs() < 10);
+    assert_eq!(&r.pixel(50, 30)[..3], &[0, 0, 255]);
+    // On screen too.
+    render(&d, true);
+    settle();
+    assert_eq!(&render(&d, true).pixel(50, 30)[..3], &[0, 0, 255]);
+}

crates/svg/src/css.rs

@@ -50,9 +50,13 @@ pub(crate) fn blend_css(b: BlendMode) -> &'static str {
     }
 }
 
-/// An object's opacity, blend mode and isolation.
+/// An object's opacity, blend mode and isolation, and `display: none` when it is hidden (written
+/// only when hidden objects are kept).
 pub(crate) fn transparency(n: &Node) -> Props {
     let mut p = Props::new();
+    if !n.visible {
+        p.push(("display", "none".into()));
+    }
     if n.opacity < 1.0 {
         p.push(("opacity", fmt_num(n.opacity as f64, 3)));
     }

crates/svg/src/export.rs

@@ -343,7 +343,7 @@ impl Reuse {
             }
         }
         match &n.kind {
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 (self.turns, self.scales) = (false, false)
             }
             NodeKind::SymbolInstance { symbol, .. } => {
@@ -545,15 +545,25 @@ impl Writer<'_> {
     }
     /// ` id="…"` for a named object, plus ` data-name="…"` with the name itself when the id had to
     /// differ from it (spaces, punctuation, duplicates, the unique prefix).
+    /// The id of `n`'s element (with its name when the id isn't it), then the object's own data
+    /// as `data-*` attributes.
     fn id_attr(&self, n: &Node) -> String {
         if self.anonymous {
             return String::new();
         }
-        let Some(id) = self.names.get(&n.id) else { return String::new() };
-        match n.name.as_deref() {
-            Some(name) if name != id => format!(" id=\"{}\" data-name=\"{}\"", xml_escape(id), xml_escape(name)),
-            _ => format!(" id=\"{}\"", xml_escape(id)),
+        let mut out = match (self.names.get(&n.id), n.name.as_deref()) {
+            (Some(id), Some(name)) if name != id => format!(" id=\"{}\" data-name=\"{}\"", xml_escape(id), xml_escape(name)),
+            (Some(id), _) => format!(" id=\"{}\"", xml_escape(id)),
+            (None, _) => String::new(),
+        };
+        for (k, v) in n.attrs.as_deref().map_or(&[][..], |a| a.data.as_slice()) {
+            // Names as XML takes them; ours (`name`, `vc-…`) are written by the export itself.
+            let valid = k.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.')) && k != "name" && !k.starts_with("vc-");
+            if valid && !k.is_empty() {
+                out.push_str(&format!(" data-{k}=\"{}\"", xml_escape(v)));
+            }
         }
+        out
     }
     fn matrix(&self, m: Affine) -> String {
         let c = m.as_coeffs();
@@ -1130,15 +1140,12 @@ impl Writer<'_> {
         std::mem::replace(&mut self.body, body)
     }
 
-    /// Props of a group (or layer): a knockout group is isolated, a hidden layer not displayed.
+    /// Props of a group (or layer): a knockout group is isolated, a hidden one not displayed.
     fn group_props(&self, n: &Node) -> Props {
         let mut p = css::transparency(n);
         if !n.isolate && n.knocks_out(self.knockout) {
             p.push(("isolation", "isolate".into()));
         }
-        if !n.visible {
-            p.push(("display", "none".into()));
-        }
         p
     }
 
@@ -1221,9 +1228,9 @@ impl Writer<'_> {
     }
 
     fn node_body(&mut self, n: &Node) {
-        // Hidden objects are left out; hidden layers too, unless the options keep them (hidden).
-        let kept = self.opts.hidden_layers && matches!(n.kind, NodeKind::Layer { template: false, .. });
-        if !(n.visible || kept) {
+        // Hidden layers and objects are left out, unless the options keep them (hidden). Template
+        // layers never print.
+        if !(n.visible || self.opts.hidden_layers) {
             return;
         }
         if has_raster(&n.appearance.effects) {
@@ -1357,7 +1364,7 @@ impl Writer<'_> {
                 (self.xf, self.instance_xf) = saved;
             }
             // Live blends/envelopes/meshes export their evaluated (expanded) form.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
                 let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                 self.share_images(&g);
                 self.node_body(&g);

crates/svg/src/import.rs

@@ -64,6 +64,7 @@ pub(crate) fn import(svg: &str, opts: &ImportOptions) -> Result<(Document, Vec<S
         blends: fx::blends(&xml),
         files,
         non_scaling: found.non_scaling,
+        data: found.data,
         screen: (kx * ky).sqrt(),
     };
     if im.files.nested_text() {
@@ -124,6 +125,7 @@ pub(crate) fn import(svg: &str, opts: &ImportOptions) -> Result<(Document, Vec<S
             }
             im.add_unclipped(&mut l, 0, std::mem::take(&mut loose));
             l.visible = !im.hidden.contains(g.id());
+            im.keep_data(g.id(), &mut l);
             im.doc.layers.push(Arc::new(l));
         }
     } else {
@@ -210,6 +212,8 @@ struct Importer {
     files: files::Files,
     /// Ids of the shapes whose strokes don't scale ([`vector_effect`]).
     non_scaling: HashSet<String>,
+    /// The `data-*` attributes of elements, by id ([`user_data`]).
+    data: HashMap<String, Vec<(String, String)>>,
     /// Points per screen pixel (the root's user unit before its `viewBox`): what a non-scaling
     /// stroke's width is measured in.
     screen: f64,
@@ -320,6 +324,8 @@ struct Found {
     files: files::Files,
     /// Ids of the shapes whose strokes don't scale ([`vector_effect`]).
     non_scaling: HashSet<String>,
+    /// The `data-*` attributes of elements, by id ([`user_data`]).
+    data: HashMap<String, Vec<(String, String)>>,
     warnings: Vec<String>,
 }
 
@@ -390,7 +396,7 @@ impl Edits {
 fn prepass<'s>(svg: &'s str, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
     let mut found = Found::default();
     // (`:` for prefixed elements such as `<svg:image>`.)
-    if !["<a", "display", "<use", ":use", "<image", ":image", vector_effect::NON_SCALING].iter().any(|t| svg.contains(t)) {
+    if !["<a", "display", "<use", ":use", "<image", ":image", vector_effect::NON_SCALING, "data-"].iter().any(|t| svg.contains(t)) {
         return (svg.into(), found);
     }
     let Ok(xml) = roxmltree::Document::parse_with_options(svg, roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() }) else {
@@ -403,6 +409,14 @@ fn prepass<'s>(svg: &'s str, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
             found.links.insert(edits.id(svg, a), url.to_string());
         }
     }
+    if svg.contains("data-") {
+        for e in elements().filter(|e| OBJECT_ELEMENTS.contains(&e.tag_name().name())) {
+            let data = user_data(e);
+            if !data.is_empty() {
+                found.data.insert(edits.id(svg, e), data);
+            }
+        }
+    }
     let symbols: HashSet<&str> = elements().filter(|n| n.tag_name().name() == "symbol").filter_map(|n| n.attribute("id")).collect();
     for u in elements().filter(|n| n.tag_name().name() == "use") {
         if let Some(sym) = href(u).and_then(|h| h.strip_prefix('#')).filter(|s| symbols.contains(s)) {
@@ -456,6 +470,24 @@ fn tag_name_end(svg: &str, n: XNode) -> usize {
     svg.get(start + 1..).and_then(|s| s.find(|c: char| c.is_whitespace() || c == '/' || c == '>')).map_or(start + 2, |i| start + 1 + i)
 }
 
+/// The elements that become objects, whose `data-*` attributes are kept.
+const OBJECT_ELEMENTS: &[&str] = &["g", "a", "use", "path", "rect", "circle", "ellipse", "line", "polyline", "polygon", "image"];
+
+/// The most `data-*` attributes kept per element (the file is untrusted).
+const MAX_DATA: usize = 64;
+
+/// The `data-*` attributes of element `e`, in order, without the `data-` (ours, `data-name` and
+/// `data-vc-*`, aside).
+fn user_data(e: XNode) -> Vec<(String, String)> {
+    e.attributes()
+        .filter(|a| a.namespace().is_none())
+        .filter_map(|a| Some((a.name().strip_prefix("data-")?, a.value())))
+        .filter(|(k, _)| !k.is_empty() && *k != "name" && !k.starts_with("vc-"))
+        .take(MAX_DATA)
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect()
+}
+
 /// Make `n` link to `url`, unless it links somewhere already (an inner link wins).
 fn link(n: &mut Node, url: &str) {
     if n.url().is_none() {
@@ -592,9 +624,18 @@ impl Importer {
         if self.hidden.contains(n.id()) {
             out.visible = false;
         }
+        self.keep_data(n.id(), &mut out);
         Some(out)
     }
 
+    /// Give `n` the `data-*` attributes of element `id`, unless it has data already (what an
+    /// inner element made of it keeps).
+    fn keep_data(&self, id: &str, n: &mut Node) {
+        if let Some(data) = self.data.get(id).filter(|_| n.attrs.as_ref().is_none_or(|a| a.data.is_empty())) {
+            n.edit_attrs(|a| a.data = data.clone());
+        }
+    }
+
     /// A gradient's stops, midpoints restored.
     fn stops(&self, g: &usvg::BaseGradient) -> Vec<GradientStop> {
         gradient_stops(g, self.midpoints.get(g.id()).map(Vec::as_slice))
@@ -1114,9 +1155,10 @@ impl Importer {
             std::mem::take(&mut self.uses),
             std::mem::take(&mut self.labels),
             std::mem::take(&mut self.non_scaling),
+            std::mem::take(&mut self.data),
         );
         let art = self.group_node(tree.root(), acc);
-        (self.links, self.hidden, self.uses, self.labels, self.non_scaling) = outer;
+        (self.links, self.hidden, self.uses, self.labels, self.non_scaling, self.data) = outer;
         art
     }
 }

crates/svg/src/lib.rs

@@ -208,7 +208,8 @@ pub struct ExportOptions {
     /// One positioned `<tspan>` per line of type instead of one per style run, tab stop and
     /// justified word (smaller; viewers then space the line with their own font metrics).
     pub fewer_tspans: bool,
-    /// Keep hidden layers, written hidden (`display:none`), as Save does; exports leave them out.
+    /// Keep hidden layers and objects, written hidden (`display="none"`), as Save does; exports
+    /// leave them out unless asked.
     pub hidden_layers: bool,
     /// The file's character encoding (see [`Output::bytes`]).
     pub encoding: Encoding,

crates/svg/tests/symbols_layers.rs

@@ -1,6 +1,7 @@
 //! Symbols export as one `<symbol>` def and a `<use>` per instance (instances the def can't stand
-//! for get their own art), hidden layers are kept hidden when asked and come back hidden, clipped
-//! layers come in as clipping layers, and the editing data notices edits made elsewhere.
+//! for get their own art), hidden layers and objects are kept hidden when asked and come back
+//! hidden with their `data-*` attributes, clipped layers come in as clipping layers, and the
+//! editing data notices edits made elsewhere.
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
@@ -205,6 +206,61 @@ fn hidden_layers_are_kept_hidden_when_asked() {
     }
 }
 
+/// An animation rig (#522): hidden alternates (a group and a lone path) and rotation pivots kept as
+/// `data-*` attributes.
+const RIG: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" width="200" height="200">
+  <g id="character" data-pivot="100,180">
+    <g id="arm" data-pivot="60,100" data-z-order="2"><path d="M40 100 L60 90 L80 110 Z" fill="#b5835a"/></g>
+    <g id="arm-raised" data-pivot="60,100" display="none"><path d="M40 100 L50 60 L70 70 Z" fill="#b5835a"/></g>
+    <path id="eye-closed" d="M90 80 L110 80 L100 95 Z" fill="#000" style="display:none" data-blink="1"/>
+  </g>
+</svg>"##;
+
+/// The `data-*` attributes of the object named `name`.
+fn data_of(d: &Document, name: &str) -> Vec<(String, String)> {
+    let mut found = vec![];
+    d.walk(|n| {
+        if n.name.as_deref() == Some(name) {
+            found = n.attrs.as_deref().map(|a| a.data.clone()).unwrap_or_default();
+        }
+    });
+    found
+}
+
+#[test]
+fn hidden_objects_and_data_attributes_round_trip() {
+    let d = import(RIG).unwrap();
+    let pivot = |v: &str| vec![("pivot".to_string(), v.to_string())];
+    assert_eq!(data_of(&d, "character"), pivot("100,180"));
+    assert_eq!(data_of(&d, "arm"), [("pivot".to_string(), "60,100".to_string()), ("z-order".to_string(), "2".to_string())]);
+    assert_eq!(data_of(&d, "arm-raised"), pivot("60,100"));
+    let hidden = |d: &Document| {
+        let mut v = vec![];
+        d.walk(|n| {
+            if !n.visible {
+                v.push(n.name.clone().unwrap_or_default());
+            }
+        });
+        v
+    };
+    assert_eq!(hidden(&d), ["arm-raised", "eye-closed"]);
+    // An export leaves the hidden objects out, their data with them; the others keep theirs.
+    let plain = export(&d, &ExportOptions::default());
+    assert!(!plain.contains("arm-raised") && !plain.contains("eye-closed") && plain.contains("data-pivot=\"60,100\""), "{plain}");
+    let styles = [vectorcraft_svg::Styling::PresentationAttributes, vectorcraft_svg::Styling::InlineStyle, vectorcraft_svg::Styling::InternalCss];
+    for styling in styles {
+        // Kept (Save, or asked), they are written hidden and come back hidden, with every attribute.
+        let kept = export(&d, &ExportOptions { hidden_layers: true, styling, ..Default::default() });
+        assert!(kept.contains("data-pivot=\"100,180\"") && kept.contains("data-z-order=\"2\"") && kept.contains("data-blink=\"1\""), "{kept}");
+        assert_eq!(resvg_render(&kept, 200, 200).pixel(100, 85), [255, 255, 255, 255], "hidden, not drawn: {kept}");
+        let back = import(&kept).unwrap();
+        assert_eq!(hidden(&back), ["arm-raised", "eye-closed"], "{kept}");
+        for name in ["character", "arm", "arm-raised", "eye-closed"] {
+            assert_eq!(data_of(&back, name), data_of(&d, name), "{name}: {kept}");
+        }
+    }
+}
+
 /// Each layer's art: clipping layer or not, and the kinds of its children.
 fn layer_art(d: &Document) -> Vec<(String, bool, Vec<&'static str>)> {
     d.layers.iter().map(|l| (l.name.clone().unwrap_or_default(), l.clips(), l.children().unwrap().iter().map(|c| c.kind_label()).collect())).collect()

crates/svg/tests/text_layout.rs

@@ -68,6 +68,20 @@ fn wrapped_lines_get_one_tspan_each() {
     assert!(!export(&d, &ExportOptions::default()).contains("text-anchor"));
 }
 
+#[test]
+fn vertically_aligned_area_type_exports_where_it_is_drawn() {
+    let top = area_doc(vec![run("alpha beta", style(12.0))], 200.0, Justify::Left);
+    let mut centred = top.clone();
+    let id = centred.layers[0].children().unwrap()[0].id;
+    if let Some(NodeKind::Text(t)) = centred.node_mut(id).map(|n| &mut n.kind) {
+        t.area.vertical_align = vectorcraft_doc::VerticalAlign::Center;
+    }
+    let y = |d: &Document| attr(tspans(&export(d, &ExportOptions::default()))[0], "y").unwrap();
+    let (yt, yc) = (y(&top), y(&centred));
+    // The 160 pt frame holds one 12 pt line: centring moves it down about (160 - 14.4) / 2.
+    assert!(yc - yt > 60.0 && yc - yt < 80.0, "{yt} → {yc}");
+}
+
 #[test]
 fn rich_text_writes_spacing_shift_and_scale() {
     let shifted = CharStyle { baseline_shift: 4.0, ..style(12.0) };

crates/testkit/src/fixtures.rs

@@ -112,7 +112,17 @@ pub fn rich_session() -> Session {
     exec(&mut s, "effect.apply", json!({"effect": "distort.roughen", "params": {"size": 3, "detail": 5, "seed": 7}}));
     let l = id_of(&exec(&mut s, "shape.line", json!({"x1": 20, "y1": 300, "x2": 200, "y2": 350})));
     exec(&mut s, "stroke.set", json!({"weight": 3, "endArrow": "Arrow"}));
-    let _ = id_of(&exec(&mut s, "text.create", json!({"x": 250, "y": 300, "text": "VectorCraft", "size": 30})));
+    let tx = id_of(&exec(&mut s, "text.create", json!({"x": 250, "y": 300, "text": "VectorCraft", "size": 30})));
+    // A non-default paragraph composer, so format round trips cover it.
+    exec(&mut s, "text.setFormat", json!({"ids": [tx.0], "composer": "singleLine"}));
+    // Area type with non-default Area Type Options (vertical alignment, inset).
+    let area = id_of(&exec(
+        &mut s,
+        "text.create",
+        json!({"x": 250, "y": 340, "text": "Centred area type", "size": 12, "area": {"width": 120, "height": 50}}),
+    ));
+    select(&mut s, &[area]);
+    exec(&mut s, "text.areaOptions", json!({"verticalAlign": "center", "inset": 2}));
     exec(&mut s, "layer.new", json!({"name": "Top"}));
     let d = rect(&mut s, 350.0, 200.0, 80.0, 80.0);
     let e = ellipse(&mut s, 380.0, 230.0, 80.0, 80.0);

crates/testkit/src/invariants.rs

@@ -98,11 +98,16 @@ fn native_roundtrip(doc: &Document) -> Result<(Value, Value), String> {
     }
     let mut lost = None;
     back.walk(|n| {
-        if let NodeKind::Image(im) = &n.kind
-            && doc.images.contains_key(&im.key)
-            && !back.images.contains_key(&im.key)
+        let key = match &n.kind {
+            NodeKind::Image(im) => Some(&im.key),
+            NodeKind::PlacedDocument(p) => Some(&p.key),
+            _ => None,
+        };
+        if let Some(key) = key
+            && doc.images.contains_key(key)
+            && !back.images.contains_key(key)
         {
-            lost = Some(im.key.clone());
+            lost = Some(key.clone());
         }
     });
     if let Some(k) = lost {

crates/text/src/composer.rs

@@ -1,9 +1,17 @@
-//! Every-line composer: a Knuth–Plass style total-fit line breaker for justified paragraphs.
+//! Every-line composer: a Knuth–Plass style total-fit line breaker.
 //!
-//! Boxes are the paragraph's glyphs, glue is its spaces (word spacing may stretch to 150% and
-//! shrink to 80%), and penalties are break opportunities after hyphens/dashes/CJK and at
-//! hyphenation points. The breaks minimise the sum of squared (badness + penalty) demerits over
-//! the whole paragraph, so loose lines are traded for evenly spaced ones.
+//! Boxes are the paragraph's glyphs, glue is its spaces, and penalties are break opportunities
+//! after hyphens/dashes/CJK and at hyphenation points. The breaks minimise the sum of squared
+//! (badness + penalty) demerits over the whole paragraph, plus a demerit when neighbouring lines
+//! fall in fitness classes more than one apart (a tight line next to a loose one).
+//!
+//! - **Justified** lines: word spacing may stretch to 150% and shrink to 80%; the badness comes
+//!   from the stretch/shrink ratio, so loose lines are traded for evenly spaced ones.
+//! - **Ragged** lines (left/centre/right aligned): spaces keep their width, so a line never
+//!   shrinks (it must fit). The badness comes from the line's leftover space measured against a
+//!   rag zone of a sixth of the line width, so the rag is even rather than full lines followed by
+//!   a short one, and hyphenating costs less. The last line costs nothing unless it is shorter
+//!   than a third of the width (a word or two left dangling).
 
 use crate::shape::SGlyph;
 
@@ -12,6 +20,21 @@ const SHRINK: f64 = 0.2;
 const HYPHEN_PENALTY: f64 = 50.0;
 const DOUBLE_HYPHEN_DEMERITS: f64 = 3000.0;
 const LINE_PENALTY: f64 = 10.0;
+/// Demerits for adjacent lines whose fitness classes differ by more than one.
+const ADJ_DEMERITS_JUSTIFIED: f64 = 10_000.0;
+const ADJ_DEMERITS_RAGGED: f64 = 1_000.0;
+/// Ragged lines only gain from hyphenation by filling the rag, so it costs less than in
+/// justified text (where it also evens the word spacing).
+const HYPHEN_PENALTY_RAGGED: f64 = 25.0;
+/// Ragged text: leftover space is measured in units of this fraction of the line width.
+const RAG_ZONE: f64 = 1.0 / 6.0;
+/// Ragged text: a last line shorter than this fraction of the width is penalised, by how much
+/// shorter it is in units of `SHORT_LAST_ZONE` of the width.
+const SHORT_LAST: f64 = 1.0 / 3.0;
+const SHORT_LAST_ZONE: f64 = 1.0 / 3.0;
+/// Give up (fall back to the single-line composer) beyond this many active breakpoints.
+const MAX_ACTIVE: usize = 4096;
+const EPS: f64 = 1e-6;
 
 /// A place a line may end: glyph index `end` (exclusive), plus the width of the hyphen that is
 /// added when breaking there (0 = no hyphen).
@@ -21,24 +44,56 @@ pub(crate) struct Breakpoint {
     pub hyphen: f64,
 }
 
+/// How a paragraph is composed.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Params {
+    /// The last line is justified too (Justify All).
+    pub justify_last: bool,
+    /// Left/centre/right aligned text: spaces keep their width and lines are scored by their rag.
+    pub ragged: bool,
+    /// Maximum stretch ratio (justified) or leftover space in rag zones (ragged) of a line.
+    pub tolerance: f64,
+    /// Lines from this index on all have the same width, so their line numbers are interchangeable
+    /// (keeps the number of active breakpoints small).
+    pub uniform_from: usize,
+}
+
 struct Node {
     pos: usize,
+    /// Line number of the next line, clamped to `uniform_from`.
     line: usize,
+    fitness: u8,
     demerits: f64,
     hyphenated: bool,
     prev: Option<usize>,
 }
 
+/// Fitness class 0 (tight) … 3 (very loose) of a line with adjustment ratio `r`.
+fn fitness(r: f64, ragged: bool) -> u8 {
+    let bounds = if ragged { [0.15, 0.4, 0.75] } else { [-0.5, 0.5, 1.0] };
+    if r < bounds[0] {
+        0
+    } else if r <= bounds[1] {
+        1
+    } else if r <= bounds[2] {
+        2
+    } else {
+        3
+    }
+}
+
 /// Compose the paragraph `g` into lines. `width(k)` is the available width of line `k`;
-/// `cands` are the break opportunities in increasing order (the paragraph end is added).
-/// `justify_last`: the last line is justified too (Justify All). Returns `(end, hyphen)` per line,
-/// or `None` if no set of breaks fits within `tolerance` (maximum stretch ratio).
+/// `start_credit(i)` is the width a wrapped line starting at glyph `i` gives back (Mojikumi sets
+/// an opening bracket there flush with the line's start); `cands` are the break opportunities
+/// in increasing order (the paragraph end is added).
+/// Returns `(end, hyphen)` per line, or `None` if no set of breaks fits within the tolerance
+/// (the caller then falls back to single-line breaking).
 pub(crate) fn compose(
     g: &[SGlyph],
     width: &dyn Fn(usize) -> f64,
+    start_credit: &dyn Fn(usize) -> f64,
     cands: &[Breakpoint],
-    justify_last: bool,
-    tolerance: f64,
+    p: &Params,
 ) -> Option<Vec<(usize, bool)>> {
     let n = g.len();
     if n == 0 {
@@ -51,68 +106,93 @@ pub(crate) fn compose(
         w[i + 1] = w[i] + gl.adv;
         sp[i + 1] = sp[i] + if gl.is_space() { gl.adv } else { 0.0 };
     }
+    if !w[n].is_finite() {
+        return None;
+    }
     // Trailing spaces are dropped at a break.
     let trim = |mut b: usize, a: usize| {
-        while b > a && g[b - 1].is_space() {
+        while b > a && g.get(b - 1).is_some_and(SGlyph::is_space) {
             b -= 1;
         }
         b
     };
     let mut all: Vec<Breakpoint> = cands.iter().copied().filter(|c| c.end > 0 && c.end < n).collect();
     all.push(Breakpoint { end: n, hyphen: 0.0 });
-    let mut nodes = vec![Node { pos: 0, line: 0, demerits: 0.0, hyphenated: false, prev: None }];
+    let (adj_demerits, hyphen_penalty) =
+        if p.ragged { (ADJ_DEMERITS_RAGGED, HYPHEN_PENALTY_RAGGED) } else { (ADJ_DEMERITS_JUSTIFIED, HYPHEN_PENALTY) };
+    let mut nodes = vec![Node { pos: 0, line: 0, fitness: 1, demerits: 0.0, hyphenated: false, prev: None }];
     let mut active: Vec<usize> = vec![0];
     for bp in &all {
         let last = bp.end == n;
-        let mut best: Vec<(usize, f64, usize)> = vec![]; // (line, demerits, from)
+        let mut best: Vec<(usize, u8, f64, usize)> = vec![]; // (line, fitness, demerits, from)
         let mut keep = Vec::with_capacity(active.len());
         for &ai in &active {
-            let a = &nodes[ai];
+            let Some(a) = nodes.get(ai) else { continue };
             let t = trim(bp.end, a.pos);
-            let natural = w[t] - w[a.pos] + bp.hyphen;
-            let spaces = sp[t] - sp[a.pos];
+            let credit = if a.pos > 0 { start_credit(a.pos) } else { 0.0 };
+            let natural = w[t] - w[a.pos] - credit + bp.hyphen;
             let lw = width(a.line);
-            let ratio = if natural < lw {
-                if last && !justify_last {
-                    0.0
-                } else if spaces > 0.0 {
-                    (lw - natural) / (spaces * STRETCH)
+            // Adjustment ratio, badness and whether the line ends the active node's reach.
+            let ratio = if p.ragged {
+                if natural > lw + EPS {
+                    // Ragged lines never shrink; longer lines from this node only get worse.
+                    continue;
+                }
+                if last && !p.justify_last {
+                    ((lw * SHORT_LAST - natural) / (lw * SHORT_LAST_ZONE).max(1.0)).max(0.0)
                 } else {
-                    f64::INFINITY
+                    (lw - natural).max(0.0) / (lw * RAG_ZONE).max(1.0)
                 }
-            } else if natural > lw {
-                if spaces > 0.0 { (lw - natural) / (spaces * SHRINK) } else { f64::NEG_INFINITY }
             } else {
-                0.0
+                let spaces = sp[t] - sp[a.pos];
+                if natural < lw {
+                    if last && !p.justify_last {
+                        0.0
+                    } else if spaces > 0.0 {
+                        (lw - natural) / (spaces * STRETCH)
+                    } else {
+                        f64::INFINITY
+                    }
+                } else if natural > lw {
+                    if spaces > 0.0 { (lw - natural) / (spaces * SHRINK) } else { f64::NEG_INFINITY }
+                } else {
+                    0.0
+                }
             };
             if ratio < -1.0 {
                 // Too long already; longer lines from this node only get worse.
                 continue;
             }
             keep.push(ai);
-            if ratio > tolerance && !(last && ratio.is_infinite() && justify_last) {
+            let free_last = last && (p.ragged || !p.justify_last);
+            if ratio > p.tolerance && !(last && (p.ragged || (ratio.is_infinite() && p.justify_last))) {
                 continue;
             }
             let badness = if ratio.is_finite() { (100.0 * ratio.abs().powi(3)).min(10_000.0) } else { 10_000.0 };
-            let penalty = if bp.hyphen > 0.0 { HYPHEN_PENALTY } else { 0.0 };
+            let penalty = if bp.hyphen > 0.0 { hyphen_penalty } else { 0.0 };
             let mut d = (LINE_PENALTY + badness).powi(2) + penalty * penalty;
             if bp.hyphen > 0.0 && a.hyphenated {
                 d += DOUBLE_HYPHEN_DEMERITS;
             }
+            // A ragged last line's length says nothing about the rag: it keeps its neighbour's class.
+            let fit = if p.ragged && free_last { a.fitness } else { fitness(ratio, p.ragged) };
+            if a.prev.is_some() && fit.abs_diff(a.fitness) > 1 {
+                d += adj_demerits;
+            }
             let total = a.demerits + d;
-            let line = a.line + 1;
-            match best.iter_mut().find(|b| b.0 == line) {
-                Some(b) if b.1 <= total => {}
-                Some(b) => *b = (line, total, ai),
-                None => best.push((line, total, ai)),
+            let line = (a.line + 1).min(p.uniform_from);
+            match best.iter_mut().find(|b| b.0 == line && b.1 == fit) {
+                Some(b) if b.2 <= total => {}
+                Some(b) => *b = (line, fit, total, ai),
+                None => best.push((line, fit, total, ai)),
             }
         }
         active = keep;
-        for (line, demerits, from) in best {
-            nodes.push(Node { pos: bp.end, line, demerits, hyphenated: bp.hyphen > 0.0, prev: Some(from) });
+        for (line, fitness, demerits, from) in best {
+            nodes.push(Node { pos: bp.end, line, fitness, demerits, hyphenated: bp.hyphen > 0.0, prev: Some(from) });
             active.push(nodes.len() - 1);
         }
-        if active.is_empty() {
+        if active.is_empty() || active.len() > MAX_ACTIVE {
             return None;
         }
     }
@@ -120,10 +200,14 @@ pub(crate) fn compose(
     let mut out = vec![];
     let mut cur = Some(end);
     while let Some(i) = cur {
-        if nodes[i].prev.is_some() {
-            out.push((nodes[i].pos, nodes[i].hyphenated));
+        let nd = nodes.get(i)?;
+        if nd.prev.is_some() {
+            out.push((nd.pos, nd.hyphenated));
+        }
+        cur = nd.prev;
+        if out.len() > n {
+            return None;
         }
-        cur = nodes[i].prev;
     }
     out.reverse();
     Some(out)

crates/text/src/features.rs

@@ -3,13 +3,27 @@
 use harfrust::{Feature, Tag};
 use vectorcraft_doc::CharStyle;
 
+/// Tracking (in 1/1000 em) outside which standard ligatures are dropped automatically: tighter
+/// than the first, looser than the second.
+///
+/// Letterspaced type should not ligate: an `fi` glyph keeps its letters tight while everything
+/// around it opens up (or stays open while it closes up), which reads as a blot. Small tracking
+/// adjustments made to fit a line are not letterspacing and keep the ligatures. The limits are
+/// about −8% and +22% of a typical word space (250/1000 em), the thresholds Adobe's composers are
+/// described as using (John Hudson, www-style, 2012-07): condensing shows the fixed ligature
+/// sooner than expanding. An explicit `liga` / `clig` in the character's own features always wins.
+pub const LIGATURE_TRACKING_LIMITS: (f64, f64) = (-20.0, 55.0);
+
 /// OpenType features applied during shaping. Kerning, `case` and ligature suppression are driven
 /// by the character style (`kerning`, `all_caps`, `tracking`); the rest are layout-wide options.
+/// Standard ligatures are dropped when tracking is outside [`LIGATURE_TRACKING_LIMITS`], unless
+/// the character's features turn `liga` (or `clig`) on explicitly.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct OtFeatures {
     /// Vertical glyph alternates (`vert`), set by the writing direction.
     pub vertical: bool,
-    /// Standard ligatures (`liga`, `clig`). Suppressed automatically when tracking is non-zero.
+    /// Standard ligatures (`liga`, `clig`). Suppressed automatically when tracking is outside
+    /// [`LIGATURE_TRACKING_LIMITS`], unless the character turns them on explicitly.
     pub ligatures: bool,
     /// Contextual alternates (`calt`).
     pub contextual: bool,
@@ -117,7 +131,7 @@ impl OtFeatures {
         if st.kerning.is_some() {
             v.push(f(b"kern", false));
         }
-        let liga = s.ligatures && st.tracking.abs() < 1e-9;
+        let liga = s.ligatures && (!ligatures_suppressed_by(st.tracking) || explicit_ligatures(&st.features));
         if !liga {
             v.push(f(b"liga", false));
             v.push(f(b"clig", false));
@@ -150,6 +164,28 @@ impl OtFeatures {
     }
 }
 
+/// Does `tracking` (1/1000 em) count as letterspacing that drops standard ligatures?
+pub fn ligatures_suppressed_by(tracking: f64) -> bool {
+    // A non-finite value is not a real letterspacing request; keep the default.
+    let (tight, loose) = LIGATURE_TRACKING_LIMITS;
+    tracking.is_finite() && (tracking < tight || tracking > loose)
+}
+
+/// Do `features` turn standard ligatures on explicitly (`liga`, `+liga`, `clig`, `+clig`)? The last
+/// ligature tag wins, matching [`OtFeatures::with_tags`]. Absence of a tag means "default", which
+/// [`OtFeatures::to_tags`] never writes, so this is distinguishable from an explicit request.
+pub fn explicit_ligatures<S: AsRef<str>>(features: &[S]) -> bool {
+    features
+        .iter()
+        .rev()
+        .find_map(|t| match t.as_ref() {
+            "liga" | "+liga" | "clig" | "+clig" => Some(true),
+            "-liga" | "-clig" => Some(false),
+            _ => None,
+        })
+        .unwrap_or(false)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/text/src/fontdb.rs

@@ -782,8 +782,29 @@ pub(crate) fn sfnt_of(tables: &[(&[u8; 4], &[u8])]) -> Option<Vec<u8>> {
     Some(font)
 }
 
-/// The platform's font folders (the system's and the user's) and, on Windows, the font files
-/// registered with it outside them, scanned by [`FontDb::global`].
+/// Lists the font files the platform's font service knows, for [`set_platform_font_files`].
+pub type PlatformFontFiles = fn() -> Vec<String>;
+
+/// What lists the platform's font files, set by the app ([`set_platform_font_files`]).
+#[cfg(not(target_arch = "wasm32"))]
+static PLATFORM_FONT_FILES: std::sync::OnceLock<PlatformFontFiles> = std::sync::OnceLock::new();
+
+/// Have [`system_font_dirs`] add the font files `list` gives (full paths) outside the font
+/// folders, asked again by each scan and each check for installed fonts
+/// ([`FontDb::installed_fonts_changed`]). The desktop app lists DirectWrite's system font
+/// collection on Windows: fonts a font service such as Adobe Fonts loads in place, from files
+/// outside the font folders and unknown to the registry (#579). Only the first call counts.
+pub fn set_platform_font_files(list: PlatformFontFiles) {
+    #[cfg(not(target_arch = "wasm32"))]
+    // A second call keeps the first lister, as documented.
+    let _ = PLATFORM_FONT_FILES.set(list);
+    #[cfg(target_arch = "wasm32")]
+    let _ = list;
+}
+
+/// The platform's font folders (the system's and the user's) and the font files known to it
+/// outside them (on Windows those registered with it, and those [`set_platform_font_files`]
+/// lists), scanned by [`FontDb::global`].
 pub fn system_font_dirs() -> Vec<PathBuf> {
     let mut dirs: Vec<PathBuf> = Vec::new();
     if cfg!(target_arch = "wasm32") {
@@ -824,6 +845,11 @@ pub fn system_font_dirs() -> Vec<PathBuf> {
         // In a Flatpak sandbox, the host's fonts (system, local and the user's).
         dirs.extend(["/run/host/fonts", "/run/host/local-fonts", "/run/host/user-fonts"].map(Into::into));
     }
+    #[cfg(not(target_arch = "wasm32"))]
+    if let Some(list) = PLATFORM_FONT_FILES.get() {
+        let files = fonts_outside(list(), &dirs);
+        dirs.extend(files);
+    }
     dirs
 }
 
@@ -848,7 +874,7 @@ fn registered_font_files(font_dirs: &[PathBuf]) -> Vec<PathBuf> {
 /// The full paths among `registered` (font registrations' data) that aren't in `font_dirs`
 /// (ignoring case, as Windows paths do), sorted and deduplicated. File names alone are files in
 /// the Windows font folder, which is scanned anyway. The count is capped.
-#[cfg(any(windows, test))]
+#[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn fonts_outside(registered: impl IntoIterator<Item = String>, font_dirs: &[PathBuf]) -> Vec<PathBuf> {
     const MAX_REGISTERED: usize = 1 << 16;
     let lower = |p: &Path| PathBuf::from(p.to_string_lossy().to_lowercase());
@@ -1154,6 +1180,7 @@ impl FontDb {
         let mut n = 0;
         let paths = self.font_paths.get();
         let mut modified_at = Vec::new();
+        // Each file with whether it was named by itself rather than found in a folder.
         let mut files = Vec::new();
         let mut stack = paths.clone();
         // Each folder once, however links lead back to it.
@@ -1166,7 +1193,7 @@ impl FontDb {
             modified_at.push((d.clone(), modified(&d)));
             // Not a folder: a font file named by itself (or nothing, yet).
             let Ok(rd) = std::fs::read_dir(&d) else {
-                files.push(d);
+                files.push((d, true));
                 continue;
             };
             for e in rd.flatten() {
@@ -1174,13 +1201,15 @@ impl FontDb {
                 if p.is_dir() {
                     stack.push(p);
                 } else {
-                    files.push(p);
+                    files.push((p, false));
                 }
             }
         }
-        for p in files {
+        for (p, named) in files {
+            // A file named by itself is a font whatever its name (font services keep fonts in
+            // files without an extension); one of a folder's only with a font's extension.
             let ext = p.extension().and_then(|e| e.to_str()).map(|e| e.to_ascii_lowercase());
-            if !matches!(ext.as_deref(), Some("ttf" | "otf" | "ttc" | "otc")) {
+            if !named && !matches!(ext.as_deref(), Some("ttf" | "otf" | "ttc" | "otc")) {
                 continue;
             }
             for FaceStyle { family, style, keys, weight, italic, traits, .. } in file_face_names(&p) {

crates/text/src/layout.rs

@@ -9,11 +9,11 @@ use vectorcraft_doc::{
 };
 use vectorcraft_geom::{ArcPath, PathData};
 
-use crate::composer::{Breakpoint, compose};
+use crate::composer::{Breakpoint, Params, compose};
 use crate::fontdb::FontDb;
 use crate::hyphen::hyphen_points;
 use crate::shape::{Punct, SGlyph, Tcy, cap_x_heights, hyphen_glyph, is_cjk, no_line_end, no_line_start, punct, shape_range, style_metrics};
-use crate::{Composer, FirstBaseline, LayoutOptions, LineInfo, OtFeatures, PositionedGlyph, TextLayout};
+use crate::{Composer, FirstBaseline, LayoutOptions, LineInfo, OtFeatures, PositionedGlyph, TextLayout, VerticalAlign};
 
 const EPS: f64 = 1e-6;
 
@@ -127,6 +127,7 @@ pub fn layout(db: &FontDb, t: &TextObject) -> TextLayout {
         inset: a.inset,
         first_baseline: a.first_baseline,
         first_baseline_min: a.first_baseline_min,
+        vertical_align: a.vertical_align,
         ..LayoutOptions::default()
     };
     layout_with(db, t, &opts)
@@ -183,9 +184,12 @@ pub fn layout_with(db: &FontDb, t: &TextObject, opts: &LayoutOptions) -> TextLay
             } else {
                 t.wrap.clone()
             };
-            let regions = Region::cells(&(to_lines * frame.to_bezpath()), opts, &wrap);
+            let mut regions = Region::cells(&(to_lines * frame.to_bezpath()), opts, &wrap);
             cx.out.frames = regions.iter().map(|r| line_xf.transform_rect_bbox(r.cell)).collect();
             flow(&mut cx, &paras, &t.para, Some(&regions));
+            if opts.vertical_align != VerticalAlign::Top {
+                align_vertically(&mut cx, &paras, &t.para, &mut regions);
+            }
         }
         TextKind::OnPath { path, .. } => on_path(&mut cx, &paras, t, path),
     }
@@ -416,6 +420,125 @@ fn finish_bounds(out: &mut TextLayout) {
     out.bounds = b.unwrap_or_default();
 }
 
+/// Space left in each cell after flowing top-aligned: (space above the first line's ascent, space
+/// below the last line's descent, number of distinct baselines). Cells without lines are `None`.
+fn cell_space(out: &TextLayout, regions: &[Region]) -> Vec<Option<(f64, f64, usize)>> {
+    regions
+        .iter()
+        .enumerate()
+        .map(|(ri, r)| {
+            let mut top = f64::INFINITY;
+            let mut bottom = f64::NEG_INFINITY;
+            let mut baselines: Vec<f64> = vec![];
+            for l in out.lines.iter().filter(|l| l.region == ri) {
+                top = top.min(l.baseline - l.ascent);
+                bottom = bottom.max(l.baseline + l.descent);
+                if !baselines.iter().any(|b| (b - l.baseline).abs() < 1e-6) {
+                    baselines.push(l.baseline);
+                }
+            }
+            if baselines.is_empty() || !top.is_finite() || !bottom.is_finite() {
+                return None;
+            }
+            // Never negative: a full (or overflowing) cell stays where top alignment put it.
+            Some(((top - r.top()).max(0.0), (r.bottom() - bottom).max(0.0), baselines.len()))
+        })
+        .collect()
+}
+
+/// Area Type Options "Align" other than Top: move each cell's lines down. Rectangular cells
+/// without text wrap shift their lines (centre: half the space left below the last line;
+/// bottom: all of it; justify: the first line stays, each further line gets an equal share of it).
+/// Other frames give lines different widths at different heights, so the text flows again with
+/// each cell's lines started lower (or spaced wider) until it settles, at most eight passes; a
+/// pass that would push text out of the frame is undone and retried with half the step.
+fn align_vertically(cx: &mut Ctx<'_>, paras: &[Range<usize>], para: &ParaStyle, regions: &mut [Region]) {
+    let align = cx.opts.vertical_align;
+    let plain = regions.iter().all(|r| (r.rect || r.polys.is_empty()) && r.wraps.is_empty());
+    if plain {
+        let space = cell_space(&cx.out, regions);
+        // Each distinct baseline's index within its cell, for justify.
+        let mut seen: Vec<Vec<f64>> = vec![vec![]; regions.len()];
+        let offs: Vec<f64> = cx
+            .out
+            .lines
+            .iter()
+            .map(|l| {
+                let Some(Some((_, below, n))) = space.get(l.region).copied() else { return 0.0 };
+                match align {
+                    VerticalAlign::Top => 0.0,
+                    VerticalAlign::Center => below * 0.5,
+                    VerticalAlign::Bottom => below,
+                    VerticalAlign::Justify => {
+                        let Some(s) = seen.get_mut(l.region) else { return 0.0 };
+                        let k = s.iter().position(|b| (b - l.baseline).abs() < 1e-6).unwrap_or_else(|| {
+                            s.push(l.baseline);
+                            s.len() - 1
+                        });
+                        if n > 1 { below * k as f64 / (n - 1) as f64 } else { 0.0 }
+                    }
+                }
+            })
+            .collect();
+        for (l, d) in cx.out.lines.iter_mut().zip(&offs) {
+            l.baseline += d;
+        }
+        for g in &mut cx.out.glyphs {
+            let d = offs.get(g.line).copied().unwrap_or(0.0);
+            if d != 0.0 {
+                let m = Affine::translate((0.0, d));
+                g.outline.apply_affine(m);
+                g.xf = m * g.xf;
+                g.origin.y += d;
+            }
+        }
+        return;
+    }
+    let laid_out = |out: &TextLayout| out.lines.last().map_or(0, |l| l.end);
+    // How much of the measured space a pass takes up: halved after a pass that lost text.
+    let mut step = 1.0;
+    for _ in 0..8 {
+        let space = cell_space(&cx.out, regions);
+        let mut moved = false;
+        let saved: Vec<(f64, f64)> = regions.iter().map(|r| (r.shift, r.gap)).collect();
+        for (r, s) in regions.iter_mut().zip(&space) {
+            let Some((above, below, n)) = *s else { continue };
+            let (shift, gap) = match align {
+                VerticalAlign::Top => (r.shift, r.gap),
+                VerticalAlign::Center => (r.shift + (below - above) * 0.5 * step, r.gap),
+                VerticalAlign::Bottom => (r.shift + below * step, r.gap),
+                VerticalAlign::Justify if n > 1 => (r.shift, r.gap + below * step / (n - 1) as f64),
+                VerticalAlign::Justify => (r.shift, r.gap),
+            };
+            let (shift, gap) = (shift.clamp(0.0, r.cell.height().max(0.0)), gap.clamp(0.0, r.cell.height().max(0.0)));
+            if (shift - r.shift).abs() > 0.25 || (gap - r.gap).abs() > 0.01 {
+                moved = true;
+            }
+            r.shift = shift;
+            r.gap = gap;
+        }
+        if !moved {
+            return;
+        }
+        let before = laid_out(&cx.out);
+        let prev = (std::mem::take(&mut cx.out.glyphs), std::mem::take(&mut cx.out.lines), std::mem::replace(&mut cx.out.overflow, false));
+        flow(cx, paras, para, Some(regions));
+        if laid_out(&cx.out) < before {
+            // Text no longer fits (lines got narrower, or flow around a wrap object): undo the
+            // pass and try a smaller step.
+            (cx.out.glyphs, cx.out.lines, cx.out.overflow) = prev;
+            for (r, (shift, gap)) in regions.iter_mut().zip(saved) {
+                r.shift = shift;
+                r.gap = gap;
+            }
+            step *= 0.5;
+            if step < 0.1 {
+                return;
+            }
+        }
+    }
+}
+
 /// One cell of a flattened area-type frame (the whole frame, or one row/column of it).
 struct Region {
     /// The cell (frame bounds, or a grid cell of them).
@@ -427,6 +550,10 @@ struct Region {
     rect: bool,
     /// Text Wrap shapes: (polygons, offset, invert).
     wraps: Vec<(Vec<Vec<Point>>, f64, bool)>,
+    /// Vertical alignment: how far below the top-aligned position the first line starts.
+    shift: f64,
+    /// Vertical justification: extra space added between consecutive lines.
+    gap: f64,
 }
 
 /// Flattened closed polygons of a path.
@@ -529,7 +656,7 @@ impl Region {
                 let x0 = bbox.x0 + c as f64 * (cw + gutter);
                 let y0 = bbox.y0 + r as f64 * (rh + gutter);
                 let cell = if rows * cols == 1 { bbox } else { Rect::new(x0, y0, x0 + cw, y0 + rh) };
-                out.push(Region { cell, inset: opts.inset.max(0.0), polys: polys.clone(), rect, wraps: wraps.clone() });
+                out.push(Region { cell, inset: opts.inset.max(0.0), polys: polys.clone(), rect, wraps: wraps.clone(), shift: 0.0, gap: 0.0 });
             }
         }
         out
@@ -674,9 +801,9 @@ impl Pen<'_> {
         loop {
             let r = regions.get(self.ri)?;
             let mut baseline = match self.prev {
-                None if self.model == LeadingModel::EmBoxTop => r.top() + est.top.max(self.fb_min),
-                None => r.top() + est.first_baseline(self.fb, self.fb_min),
-                Some(b) => self.next_baseline(b, est),
+                None if self.model == LeadingModel::EmBoxTop => r.top() + r.shift + est.top.max(self.fb_min),
+                None => r.top() + r.shift + est.first_baseline(self.fb, self.fb_min),
+                Some(b) => self.next_baseline(b, est) + r.gap,
             };
             loop {
                 if baseline + est.desc > r.bottom() + 0.01 {
@@ -761,10 +888,15 @@ fn break_line(text: &str, g: &[SGlyph], i: usize, width: f64, hyphenate: bool, b
     let mut j = i;
     while j < g.len() {
         let gl = &g[j];
-        if j > i && !gl.is_space() && x + gl.adv > width + EPS {
+        let mut cluster_end = j + 1;
+        while g.get(cluster_end).is_some_and(|next| next.byte == gl.byte) {
+            cluster_end += 1;
+        }
+        let cluster_width: f64 = g[j..cluster_end].iter().map(|glyph| glyph.adv).sum();
+        if j > i && !gl.is_space() && x + cluster_width > width + EPS {
             // It ends the line with the spaces after it.
-            if burasagari != Burasagari::None && hangs(gl) && kinsoku_allows(g, j) && g.get(j + 1).is_none_or(|n| n.byte != gl.byte) {
-                let mut end = j + 1;
+            if burasagari != Burasagari::None && hangs(gl) && kinsoku_allows(g, cluster_end - 1) {
+                let mut end = cluster_end;
                 while g.get(end).is_some_and(SGlyph::is_space) {
                     end += 1;
                 }
@@ -772,17 +904,18 @@ fn break_line(text: &str, g: &[SGlyph], i: usize, width: f64, hyphenate: bool, b
             }
             break;
         }
-        x += gl.adv;
-        if gl.break_after() && kinsoku_allows(g, j) {
-            if gl.is_soft_hyphen() {
-                if x + hyphen_glyph(gl).adv <= width + EPS {
-                    last_break = Some((j + 1, true));
+        x += cluster_width;
+        let last = &g[cluster_end - 1];
+        if last.break_after() && kinsoku_allows(g, cluster_end - 1) {
+            if last.is_soft_hyphen() {
+                if x + hyphen_glyph(last).adv <= width + EPS {
+                    last_break = Some((cluster_end, true));
                 }
             } else {
-                last_break = Some((j + 1, false));
+                last_break = Some((cluster_end, false));
             }
         }
-        j += 1;
+        j = cluster_end;
     }
     if j >= g.len() {
         return (g.len(), false);
@@ -805,14 +938,12 @@ fn break_line(text: &str, g: &[SGlyph], i: usize, width: f64, hyphenate: bool, b
             }
         }
     }
-    // Don't separate a cluster's glyphs.
-    let (mut end, hy) = match last_break {
+    // Break candidates and greedy overflow are cluster boundaries; hyphenation also returns only
+    // cluster starts, so the resulting end always keeps each source cluster together.
+    let (end, hy) = match last_break {
         Some(b) if b.0 > i => b,
         _ => (j, false),
     };
-    while end > i + 1 && end < g.len() && g[end].byte == g[end - 1].byte {
-        end -= 1;
-    }
     (end, hy)
 }
 
@@ -835,6 +966,123 @@ fn kinsoku_between(before: char, after: Option<char>) -> bool {
     !no_line_end(before) && after.is_none_or(|c| !no_line_start(c))
 }
 
+#[cfg(test)]
+mod wrapping_tests {
+    use super::*;
+    use std::sync::Arc;
+
+    fn synthetic_glyphs(specs: &[(usize, usize, f64, char)]) -> Vec<SGlyph> {
+        // The face is only a required SGlyph field here; advances and cluster boundaries below are
+        // entirely synthetic, so the regressions don't depend on a particular font's shaping.
+        static DB: std::sync::OnceLock<FontDb> = std::sync::OnceLock::new();
+        let db = DB.get_or_init(|| FontDb::with_font_dirs(vec![]));
+        let face = db.face("Source Sans 3", "Regular").expect("bundled test face");
+        specs
+            .iter()
+            .map(|&(byte, len, adv, ch)| SGlyph {
+                face: Arc::clone(&face),
+                gid: 0,
+                byte,
+                len,
+                run: 0,
+                adv,
+                dx: 0.0,
+                dy: 0.0,
+                sx: 1.0,
+                sy: 1.0,
+                bshift: 0.0,
+                rotation: 0.0,
+                ascent: 8.0,
+                descent: 2.0,
+                leading: 0.0,
+                cap: 6.0,
+                xh: 4.0,
+                ch,
+                tcy: None,
+                lead: 0.0,
+                level: unicode_bidi::Level::ltr(),
+            })
+            .collect()
+    }
+
+    fn source_range(glyphs: &[SGlyph], start: usize, end: usize) -> Range<usize> {
+        let first = glyphs.get(start).expect("nonempty source range");
+        let last = glyphs.get(end - 1).expect("nonempty source range");
+        first.byte..last.byte + last.len
+    }
+
+    #[test]
+    fn greedy_wrap_keeps_an_oversized_first_cluster_and_its_source_range() {
+        let text = "بَت";
+        let glyphs = synthetic_glyphs(&[(0, 4, 2.0, 'ب'), (0, 4, 2.0, 'ب'), (4, 2, 1.0, 'ت')]);
+
+        let (end, hyphenated) = break_line(text, &glyphs, 0, 3.0, false, Burasagari::None);
+
+        assert!(!hyphenated);
+        assert_eq!(end, 2, "oversized base-plus-mark cluster must stay together");
+        assert_eq!(source_range(&glyphs, 0, end), 0..4);
+        assert_eq!(glyphs.get(end).map(|g| g.byte), Some(4));
+    }
+
+    #[test]
+    fn greedy_wrap_keeps_an_oversized_cluster_after_a_line_start_atomic() {
+        let text = "بَتَث";
+        let glyphs = synthetic_glyphs(&[(0, 4, 1.0, 'ب'), (4, 4, 2.0, 'ت'), (4, 4, 2.0, 'ت'), (8, 2, 1.0, 'ث')]);
+
+        let (first_end, _) = break_line(text, &glyphs, 0, 3.0, false, Burasagari::None);
+        assert_eq!(first_end, 1);
+        assert_eq!(source_range(&glyphs, 0, first_end), 0..4);
+
+        let (second_end, hyphenated) = break_line(text, &glyphs, first_end, 3.0, false, Burasagari::None);
+
+        assert!(!hyphenated);
+        assert_eq!(second_end, 3, "oversized cluster at the next line start must stay together");
+        assert_eq!(source_range(&glyphs, first_end, second_end), 4..8);
+        assert_eq!(glyphs.get(second_end).map(|g| g.byte), Some(8));
+    }
+
+    #[test]
+    fn narrow_arabic_area_wrap_keeps_base_and_mark_together_when_supported() {
+        let db = FontDb::global();
+        let Some(face) = db.face_covering('ب').filter(|face| face.covers('َ')) else {
+            // Arabic integration coverage depends on an installed font; synthetic tests above are
+            // the font-independent regression oracle.
+            return;
+        };
+        let text = "بَت";
+        let style = CharStyle { font_family: face.family.clone(), font_style: face.style.clone(), size: 20.0, ..CharStyle::default() };
+        let bidi = para_bidi(text, None);
+        let levels = bidi.as_ref().map_or(&[][..], |info| &info.levels);
+        let mut shaped = Vec::new();
+        shape_range(db, text, 0..text.len(), &[(0..text.len(), &style)], &OtFeatures::default(), levels, &mut shaped);
+        let Some(first) = shaped.first() else { return };
+        let first_end = shaped.iter().take_while(|g| g.byte == first.byte).count();
+        if first.byte != 0 || first_end < 2 || first_end >= shaped.len() {
+            return;
+        }
+        // Pick a narrow width that fits glyphs before one positive-advance glyph but not that next
+        // glyph. This ensures the old per-glyph loop would have returned inside the first cluster.
+        let mut prefix = shaped.first().map_or(0.0, |g| g.adv);
+        let width = (1..first_end).find_map(|k| {
+            let advance = shaped.get(k)?.adv;
+            if prefix > EPS && advance > EPS {
+                Some(prefix)
+            } else {
+                prefix += advance;
+                None
+            }
+        });
+        let Some(width) = width else { return };
+
+        let mut object = TextObject::point(Point::ZERO, text, style);
+        object.kind = TextKind::Area { frame: PathData::from_bezpath(&Rect::new(0.0, 0.0, width, 100.0).to_path(0.1)) };
+        let result = layout_with(db, &object, &LayoutOptions::default());
+
+        let next_cluster_byte = shaped.get(first_end).map(|g| g.byte);
+        assert_eq!(result.lines.first().map(|line| line.end), next_cluster_byte);
+    }
+}
+
 #[cfg(test)]
 #[test]
 fn japanese_letters_for_the_latin_space_are_kana_kanji_and_marks_not_hangul_or_punctuation() {
@@ -914,14 +1162,18 @@ fn candidates(text: &str, g: &[SGlyph], hyphenate: bool) -> Vec<Breakpoint> {
     v
 }
 
-/// Every-line composition of paragraph glyphs `sg` if applicable (justified area text with uniform
-/// line metrics); `None` falls back to the greedy single-line composer.
-fn compose_para(cx: &Ctx<'_>, sg: &[SGlyph], para: &ParaStyle, pen: &Pen<'_>) -> Option<Vec<(usize, bool)>> {
-    let justified = !matches!(para.justify, Justify::Auto | Justify::Left | Justify::Center | Justify::Right);
+/// Paragraphs longer than this (glyphs) are always broken line by line.
+const MAX_COMPOSE_GLYPHS: usize = 200_000;
+
+/// Every-line composition of paragraph glyphs `sg` if applicable (area text with uniform line
+/// metrics, justified or ragged); `None` falls back to the greedy single-line composer.
+fn compose_para(cx: &Ctx<'_>, sg: &[SGlyph], para: &ParaStyle, pen: &Pen<'_>, rtl: bool) -> Option<Vec<(usize, bool)>> {
+    let ragged = matches!(para.justify, Justify::Auto | Justify::Left | Justify::Center | Justify::Right);
+    let composer = cx.opts.composer.unwrap_or(para.composer);
     // A paragraph whose commas or full stops may hang is composed line by line (as the Japanese
     // single-line composer does).
     let may_hang = para.burasagari != Burasagari::None && sg.iter().any(hangs);
-    if cx.opts.composer != Composer::EveryLine || !justified || pen.regions.is_none() || sg.len() < 2 || may_hang {
+    if composer != Composer::EveryLine || pen.regions.is_none() || sg.len() < 2 || sg.len() > MAX_COMPOSE_GLYPHS || may_hang {
         return None;
     }
     let m = Metrics::of(&sg[0]);
@@ -948,9 +1200,21 @@ fn compose_para(cx: &Ctx<'_>, sg: &[SGlyph], para: &ParaStyle, pen: &Pen<'_>) ->
     }
     let last = *widths.last()?;
     let width = |k: usize| widths.get(k).copied().unwrap_or(last);
+    // Lines from `uniform_from` on are interchangeable (same width).
+    let uniform_from = widths.iter().rposition(|&w| (w - last).abs() > EPS).map_or(0, |k| k + 1);
     let cands = candidates(cx.text, sg, para.hyphenate);
     let justify_last = para.justify == Justify::JustifyAll;
-    compose(sg, &width, &cands, justify_last, 1.0).or_else(|| compose(sg, &width, &cands, justify_last, 4.0))
+    let params = |tolerance| Params { justify_last, ragged, tolerance, uniform_from };
+    // Ragged: first look for breaks that leave at most one rag zone (a sixth of the width) on
+    // each line, then accept any lines that fit.
+    let (strict, loose) = if ragged { (1.0, f64::INFINITY) } else { (1.0, 4.0) };
+    // The same rule as the line loop below: an opening bracket starting a wrapped line gives up
+    // the space before it.
+    let start_credit = |i: usize| {
+        let flush = !rtl && para.mojikumi == Mojikumi::LineEndHalf;
+        sg.get(i).filter(|g| flush && g.lead <= 0.0).and_then(|g| punct_half(g, Punct::Opening)).unwrap_or(0.0)
+    };
+    compose(sg, &width, &start_credit, &cands, &params(strict)).or_else(|| compose(sg, &width, &start_credit, &cands, &params(loose)))
 }
 
 fn flow(cx: &mut Ctx<'_>, paras: &[Range<usize>], para: &ParaStyle, regions: Option<&[Region]>) {
@@ -985,7 +1249,7 @@ fn flow(cx: &mut Ctx<'_>, paras: &[Range<usize>], para: &ParaStyle, regions: Opt
             pen.pending += para.space_before;
         }
         let n = sg.len();
-        let composed = compose_para(cx, &sg, para, &pen);
+        let composed = compose_para(cx, &sg, para, &pen, rtl);
         let mut li_para = 0;
         let mut i = 0;
         loop {
@@ -1189,6 +1453,7 @@ fn flow(cx: &mut Ctx<'_>, paras: &[Range<usize>], para: &ParaStyle, regions: Opt
                 glyph_start,
                 glyph_end: cx.out.glyphs.len(),
                 avail: if regions.is_some() { (ax0, ax1) } else { (start_x, x_end) },
+                region: if regions.is_some() { pen.ri } else { 0 },
             });
             pen.settled(baseline, m);
             // Further spans of this line band share the settled baseline.
@@ -1265,6 +1530,7 @@ fn on_path(cx: &mut Ctx<'_>, paras: &[Range<usize>], t: &TextObject, path: &Path
             glyph_start: 0,
             glyph_end: 0,
             avail: (0.0, 0.0),
+            region: 0,
         });
         return;
     }
@@ -1349,6 +1615,7 @@ fn on_path(cx: &mut Ctx<'_>, paras: &[Range<usize>], t: &TextObject, path: &Path
         glyph_start: 0,
         glyph_end: cx.out.glyphs.len(),
         avail: (0.0, ap.len()),
+        region: 0,
     });
 }
 

crates/text/src/lib.rs

@@ -23,23 +23,18 @@ pub mod test_fonts;
 pub mod thread;
 
 pub use craft_fonts::{CRAFT_FONTS, CraftFont};
-pub use features::OtFeatures;
-pub use fontdb::{FALLBACK_FAMILY, FontClass, FontDb, FontFace, FontMatch, FontTraits, style_weight, system_font_dirs};
+pub use features::{LIGATURE_TRACKING_LIMITS, OtFeatures, explicit_ligatures, ligatures_suppressed_by};
+pub use fontdb::{
+    FALLBACK_FAMILY, FontClass, FontDb, FontFace, FontMatch, FontTraits, PlatformFontFiles, set_platform_font_files, style_weight, system_font_dirs,
+};
 use kurbo::{Affine, BezPath, Point, Rect, Vec2};
 pub use layout::{layout, layout_with};
 pub use vectorcraft_doc::TextObject;
 
-pub use vectorcraft_doc::FirstBaseline;
+pub use vectorcraft_doc::{FirstBaseline, VerticalAlign};
 
-/// Paragraph composer (Paragraph panel menu).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum Composer {
-    /// Break each line as soon as it is full.
-    SingleLine,
-    /// Knuth–Plass total fit over the paragraph (justified area text only).
-    #[default]
-    EveryLine,
-}
+/// Paragraph composer; stored per text object in [`vectorcraft_doc::ParaStyle::composer`].
+pub use vectorcraft_doc::Composer;
 
 /// Layout parameters that the document model doesn't store per object (Area Type Options,
 /// composer, OpenType features). [`layout`] takes rows/columns/inset/first baseline from the object.
@@ -55,7 +50,10 @@ pub struct LayoutOptions {
     pub first_baseline: FirstBaseline,
     /// Minimum first-baseline offset in points.
     pub first_baseline_min: f64,
-    pub composer: Composer,
+    /// Vertical alignment of the lines in each row/column (Area Type Options "Align").
+    pub vertical_align: VerticalAlign,
+    /// Overrides the object's paragraph composer (`None` = use `ParaStyle::composer`).
+    pub composer: Option<Composer>,
     pub features: OtFeatures,
 }
 
@@ -68,7 +66,8 @@ impl Default for LayoutOptions {
             inset: 0.0,
             first_baseline: FirstBaseline::Ascent,
             first_baseline_min: 0.0,
-            composer: Composer::EveryLine,
+            vertical_align: VerticalAlign::Top,
+            composer: None,
             features: OtFeatures::default(),
         }
     }
@@ -128,6 +127,8 @@ pub struct LineInfo {
     /// Horizontal span available to the line (frame span minus indents; the content extent for
     /// point type). Used for hit testing across columns.
     pub avail: (f64, f64),
+    /// Area type: index of the frame cell ([`TextLayout::frames`]) the line sits in (0 otherwise).
+    pub region: usize,
 }
 
 #[derive(Clone, Debug, Default)]

crates/text/src/shape.rs

@@ -196,20 +196,43 @@ pub(crate) fn shape_range(
     levels: &[Level],
     out: &mut Vec<SGlyph>,
 ) {
+    if text.get(range.clone()).is_none() || range.is_empty() {
+        return;
+    }
     let level_at = |i: usize| levels.get(i - range.start).copied().unwrap_or_else(Level::ltr);
     let output_start = out.len();
+
+    // Text runs also carry non-shaping attributes (fill, stroke, etc.). Coalesce adjacent equal
+    // styles so an editor split does not become an accidental OpenType shaping boundary. Keep
+    // original run spans: each emitted cluster is attributed by its source byte below.
+    let mut spans: Vec<(Range<usize>, &CharStyle, Range<usize>)> = Vec::new();
     for (ri, (rr, st)) in runs.iter().enumerate() {
         let a = rr.start.max(range.start);
         let b = rr.end.min(range.end);
-        if a >= b {
+        if a >= b || text.get(a..b).is_none() {
             continue;
         }
+        if let Some((previous, previous_style, source_runs)) = spans.last_mut()
+            && previous.end == a
+            && *previous_style == *st
+        {
+            previous.end = b;
+            source_runs.end = ri + 1;
+            continue;
+        }
+        spans.push((a..b, *st, ri..ri + 1));
+    }
+
+    for (span, st, source_runs) in spans {
+        let a = span.start;
+        let b = span.end;
         let Some(primary) = db.face(&st.font_family, &st.font_style) else { continue };
         let pmap = primary.skrifa().map(|f| f.charmap());
         // Synthesized Small Caps shape lowercase letters separately (as smaller capitals).
         let small_caps = st.small_caps.is_some() && !st.all_caps;
         // Split into segments by font coverage (and case, for Small Caps).
-        let mut seg = Segment { range: a..a, run: ri, st, face: primary.clone(), small: false, level: level_at(a) };
+        let group_output_start = out.len();
+        let mut seg = Segment { range: a..a, run: source_runs.start, st, face: primary.clone(), small: false, level: level_at(a) };
         let mut cache: Vec<(char, Arc<FontFace>)> = Vec::new();
         let mut script = Script::Common;
         for (i, c) in text[a..b].char_indices() {
@@ -233,7 +256,7 @@ pub(crate) fn shape_range(
             if (face.id() != seg.face.id() || small != seg.small || level != seg.level || script_change) && !is_mark(c) {
                 if i > seg.range.start {
                     seg.range.end = i;
-                    shape_segment(text, &seg, feats, out);
+                    shape_segment(text, &range, &seg, feats, out);
                 }
                 seg = Segment { range: i..i, face, small, level, ..seg };
             }
@@ -243,7 +266,10 @@ pub(crate) fn shape_range(
         }
         if b > seg.range.start {
             seg.range.end = b;
-            shape_segment(text, &seg, feats, out);
+            shape_segment(text, &range, &seg, feats, out);
+        }
+        for glyph in &mut out[group_output_start..] {
+            glyph.run = source_run_at(runs, &source_runs, glyph.byte).unwrap_or(source_runs.start);
         }
     }
     // Right-to-left segments come out of the shaper in visual order: back to logical order for
@@ -255,6 +281,15 @@ pub(crate) fn shape_range(
     }
 }
 
+/// Index in the original run list containing `byte`, limited to one coalesced shaping span.
+/// Source runs are ordered and non-overlapping; partitioning keeps attribution bounded when a
+/// document contains many adjacent style runs.
+fn source_run_at(runs: &[(Range<usize>, &CharStyle)], span: &Range<usize>, byte: usize) -> Option<usize> {
+    let source = runs.get(span.clone())?;
+    let i = source.partition_point(|(range, _)| range.end <= byte);
+    source.get(i).filter(|(range, _)| range.contains(&byte)).map(|_| span.start + i)
+}
+
 /// The script `c` is shaped in: Japanese and Chinese text mixes Han, Hiragana, Katakana and
 /// Bopomofo, shaped together (splitting them would cost a shaper call per change of script).
 fn shaping_script(c: char) -> Script {
@@ -281,7 +316,7 @@ fn is_mark(c: char) -> bool {
         || matches!(c, '\u{200D}' | '\u{FE00}'..='\u{FE0F}')
 }
 
-fn shape_segment(text: &str, seg: &Segment, feats: &OtFeatures, out: &mut Vec<SGlyph>) {
+fn shape_segment(text: &str, context: &Range<usize>, seg: &Segment, feats: &OtFeatures, out: &mut Vec<SGlyph>) {
     let Segment { range, run, st, face, small, level } = seg;
     let (range, run, small) = (range.clone(), *run, *small);
     let text_seg = &text[range.clone()];
@@ -320,6 +355,15 @@ fn shape_segment(text: &str, seg: &Segment, feats: &OtFeatures, out: &mut Vec<SG
         }
         buf.set_direction(if level.is_rtl() { Direction::RightToLeft } else { Direction::LeftToRight });
         buf.guess_segment_properties();
+        // Harfrust keeps this Unicode context for joining/positional shaping, but does not emit
+        // glyphs for it. This retains context at real style/font segmentation boundaries without
+        // shaping across those boundaries or claiming cross-style ligatures/mark attachment.
+        if let Some(pre) = text.get(context.start..range.start) {
+            buf.set_pre_context(pre);
+        }
+        if let Some(post) = text.get(range.end..context.end) {
+            buf.set_post_context(post);
+        }
         let feats: Vec<Feature> = feats.resolve(st);
         let gb = shaper.shape(buf, ShapeOptions::new().features(&feats));
         for (info, pos) in gb.glyph_infos().iter().zip(gb.glyph_positions()) {

crates/text/src/tests_bidi.rs

@@ -1,12 +1,42 @@
 //! Direction, source-cluster and editing regressions; no RTL font assets required.
 use super::*;
 use kurbo::{Point, Rect, Shape};
-use vectorcraft_doc::{CharStyle, TextKind};
+use std::sync::Arc;
+use vectorcraft_doc::{CharStyle, TextKind, TextRun};
 
 fn text_layout(s: &str) -> TextLayout {
     layout(FontDb::global(), &TextObject::point(Point::ZERO, s, CharStyle::default()))
 }
 
+fn arabic_test_face(test: &str) -> Option<Arc<FontFace>> {
+    let db = FontDb::global();
+    let face = ["Geeza Pro", "Arial", "Noto Sans Arabic"]
+        .into_iter()
+        .filter_map(|name| db.face(name, "Regular"))
+        .find(|face| face.covers('ب') && face.covers('ل') && face.covers('ا'));
+    if let Some(face) = &face {
+        let path = face.path().map_or_else(|| "bundled font".to_string(), |p| p.display().to_string());
+        eprintln!("ASSERTIONS RUN: {test}; Arabic font {} {} ({path})", face.family, face.style);
+    } else {
+        eprintln!("SKIPPED: {test}; no installed candidate font covers Arabic beh, lam, and alef");
+    }
+    face
+}
+
+fn arabic_style(face: &FontFace) -> CharStyle {
+    CharStyle { font_family: face.family.clone(), font_style: face.style.clone(), ..CharStyle::default() }
+}
+
+fn assert_same_shaped_glyphs(left: &TextLayout, right: &TextLayout) {
+    assert_eq!(left.glyphs.len(), right.glyphs.len());
+    for (a, b) in left.glyphs.iter().zip(&right.glyphs) {
+        assert_eq!(
+            (a.gid, a.byte, a.len, a.font_id, a.advance, a.origin, a.xf, a.rtl),
+            (b.gid, b.byte, b.len, b.font_id, b.advance, b.origin, b.xf, b.rtl),
+        );
+    }
+}
+
 #[test]
 fn hebrew_and_arabic_are_visually_rtl_with_exact_source_clusters() {
     for s in ["שלום", "مرحبا"] {
@@ -85,10 +115,14 @@ fn hebrew_marks_stay_with_base_clusters() {
 fn arabic_contextual_forms_and_lam_alef_use_the_shaper() {
     let db = FontDb::global();
     // Installed fonts are optional; no proprietary or test font is copied into the repo.
-    let face =
-        ["Geeza Pro", "Arial", "Noto Sans Arabic"].into_iter().filter_map(|name| db.face(name, "Regular")).find(|f| f.covers('ل') && f.covers('ا'));
-    let Some(face) = face else { return };
-    let st = CharStyle { font_family: face.family.clone(), font_style: face.style.clone(), ..CharStyle::default() };
+    let Some(face) = arabic_test_face("arabic_contextual_forms_and_lam_alef_use_the_shaper") else { return };
+    let st = arabic_style(&face);
+    let pair = "لا";
+    let lam_alef = layout(db, &TextObject::point(Point::ZERO, pair, st.clone()));
+    let ligature = lam_alef.glyphs.iter().find(|g| g.byte == 0 && g.len == pair.len());
+    assert!(ligature.is_some(), "lam-alef must retain one cluster spanning both source letters: {lam_alef:?}");
+    assert_ne!(ligature.unwrap().gid, face.glyph_for('ل'), "lam-alef must use a shaped glyph");
+
     for s in ["سلام", "שלום سلام"] {
         let l = layout(db, &TextObject::point(Point::ZERO, s, st.clone()));
         let arabic: Vec<_> = l.glyphs.iter().filter(|g| s.get(g.byte..).is_some_and(|t| t.starts_with(['س', 'ل', 'ا', 'م']))).collect();
@@ -100,6 +134,70 @@ fn arabic_contextual_forms_and_lam_alef_use_the_shaper() {
     }
 }
 
+#[test]
+fn identical_style_arabic_run_splits_keep_joining_and_source_attribution() {
+    let db = FontDb::global();
+    let Some(face) = arabic_test_face("identical_style_arabic_run_splits_keep_joining_and_source_attribution") else { return };
+    let style = arabic_style(&face);
+    let text = "بب";
+
+    let mut single = TextObject::point(Point::ZERO, text, style.clone());
+    single.runs = vec![TextRun { text: text.to_string(), style: style.clone() }];
+    let mut split = TextObject::point(Point::ZERO, text, style.clone());
+    split.runs = vec![TextRun { text: "ب".into(), style: style.clone() }, TextRun { text: "ب".into(), style }];
+
+    let single = layout(db, &single);
+    let split = layout(db, &split);
+    assert!(single.glyphs.iter().any(|glyph| glyph.gid != face.glyph_for('ب')), "single run must exercise contextual beh forms");
+    assert_same_shaped_glyphs(&single, &split);
+    assert_eq!(split.glyphs.len(), 2, "beh-beh should remain two source clusters");
+    for glyph in &split.glyphs {
+        let expected_run = usize::from(glyph.byte >= "ب".len());
+        assert_eq!(glyph.run, expected_run, "source byte {} belongs to run {expected_run}", glyph.byte);
+    }
+}
+
+#[test]
+fn different_style_arabic_boundary_receives_joining_context() {
+    let db = FontDb::global();
+    let Some(face) = arabic_test_face("different_style_arabic_boundary_receives_joining_context") else { return };
+    let style = arabic_style(&face);
+    let text = "بب";
+    let joined = layout(db, &TextObject::point(Point::ZERO, text, style.clone()));
+    assert!(joined.glyphs.iter().any(|glyph| glyph.gid != face.glyph_for('ب')), "reference must use contextual beh forms");
+
+    let mut split = TextObject::point(Point::ZERO, text, style.clone());
+    split.runs =
+        vec![TextRun { text: "ب".into(), style: style.clone() }, TextRun { text: "ب".into(), style: CharStyle { size: style.size * 1.5, ..style } }];
+    let split = layout(db, &split);
+    assert_eq!(joined.glyphs.len(), 2);
+    assert_eq!(split.glyphs.len(), 2);
+    for glyph in &joined.glyphs {
+        let actual = split.glyphs.iter().find(|other| other.byte == glyph.byte).expect("same source cluster");
+        assert_eq!(actual.gid, glyph.gid, "joining form changed at style boundary for byte {}", glyph.byte);
+        assert_eq!(actual.len, glyph.len);
+        assert_eq!(actual.run, usize::from(glyph.byte >= "ب".len()));
+    }
+}
+
+#[test]
+fn shape_range_handles_empty_runs_and_selected_utf8_subranges() {
+    let db = FontDb::global();
+    let style = CharStyle::default();
+    let text = "Aب";
+    let runs = [(0..text.len(), &style)];
+    let mut glyphs = Vec::new();
+
+    shape::shape_range(db, text, 0..0, &runs, &OtFeatures::default(), &[], &mut glyphs);
+    shape::shape_range(db, text, 0..text.len(), &[], &OtFeatures::default(), &[], &mut glyphs);
+    shape::shape_range(db, text, 1..2, &runs, &OtFeatures::default(), &[], &mut glyphs);
+    assert!(glyphs.is_empty());
+
+    shape::shape_range(db, text, 1..text.len(), &runs, &OtFeatures::default(), &[], &mut glyphs);
+    assert!(!glyphs.is_empty());
+    assert!(glyphs.iter().all(|g| (1..text.len()).contains(&g.byte)));
+}
+
 #[test]
 fn bidi_isolates_numbers_and_brackets_keep_valid_clusters() {
     for s in ["שלום (123)", "مرحبا (Rust 42)", "English \u{2067}שלום 123\u{2069} end"] {

crates/text/src/tests_sysfonts.rs

@@ -237,3 +237,29 @@ fn the_database_tells_when_fonts_were_installed_or_removed_since_its_scan() {
     assert_eq!(db.load_system_fonts(), 2);
     assert_eq!(db.styles(FAMILY), ["Bold"]);
 }
+
+/// A font a font service loads from a file without an extension, outside the font folders.
+fn service_font() -> PathBuf {
+    std::env::temp_dir().join(format!("vc-sysfonts-{}-service", std::process::id())).join(".29457")
+}
+
+/// The fonts a font service (Adobe Fonts on Windows, through DirectWrite) loads in place are
+/// cataloged: named by the platform's lister, read whatever their file is called (#579).
+#[test]
+fn fonts_the_platform_lists_outside_the_font_folders_are_cataloged() {
+    let file = service_font();
+    std::fs::create_dir_all(file.parent().unwrap()).unwrap();
+    std::fs::write(&file, renamed_to("SourceSans3-Regular.ttf", "Service Sans3")).unwrap();
+    // The lister's files outside the font folders are scanned with them, each once (a collection
+    // lists its file once per face).
+    fn lister() -> Vec<String> {
+        vec![service_font().to_string_lossy().into_owned(); 2]
+    }
+    set_platform_font_files(lister);
+    let dirs = system_font_dirs();
+    assert_eq!(dirs.iter().filter(|d| **d == file).count(), 1, "{dirs:?}");
+    // A file named by itself is read without a font's extension, one in a folder isn't.
+    let db = FontDb::with_font_dirs(vec![file.clone()]);
+    assert_eq!(db.styles("Service Sans3"), ["Regular"]);
+    assert!(!FontDb::with_font_dirs(vec![file.parent().unwrap().to_path_buf()]).has_family("Service Sans3"));
+}

crates/text/src/tests_typo.rs

@@ -227,7 +227,7 @@ fn composer_lines_never_exceed_frame() {
     for (hy, composer) in [(false, Composer::EveryLine), (true, Composer::EveryLine), (false, Composer::SingleLine), (true, Composer::SingleLine)] {
         let mut t = area(&COPY.repeat(2), style(12.0), Rect::new(0.0, 0.0, 180.0, 2000.0), Justify::JustifyLeft);
         t.para.hyphenate = hy;
-        let l = layout_with(db(), &t, &LayoutOptions { composer, ..Default::default() });
+        let l = layout_with(db(), &t, &LayoutOptions { composer: Some(composer), ..Default::default() });
         assert!(l.lines.len() > 10);
         for (i, li) in l.lines.iter().enumerate() {
             assert!(li.x1 - li.x0 <= 180.0 + 1e-6, "{composer:?} hy={hy} line {i} too wide: {li:?}");
@@ -246,7 +246,7 @@ fn composer_lines_never_exceed_frame() {
 fn every_line_composer_is_more_even() {
     let t = area(&COPY.repeat(2), style(12.0), Rect::new(0.0, 0.0, 190.0, 2000.0), Justify::JustifyLeft);
     let spread = |c: Composer| {
-        let l = layout_with(db(), &t, &LayoutOptions { composer: c, ..Default::default() });
+        let l = layout_with(db(), &t, &LayoutOptions { composer: Some(c), ..Default::default() });
         // Worst word-space stretch (space glyph advance) over all justified lines.
         let mut worst: f64 = 0.0;
         for li in &l.lines[..l.lines.len() - 1] {
@@ -269,7 +269,7 @@ fn burasagari_keeps_the_every_line_composer_for_latin_text() {
     // A measure where the two composers break the copy differently.
     let mut t = area(&COPY.repeat(2), style(12.0), Rect::new(0.0, 0.0, 300.0, 4000.0), Justify::JustifyLeft);
     let ends = |t: &TextObject, c: Composer| {
-        let l = layout_with(db(), t, &LayoutOptions { composer: c, ..Default::default() });
+        let l = layout_with(db(), t, &LayoutOptions { composer: Some(c), ..Default::default() });
         l.lines.iter().map(|li| li.glyph_end).collect::<Vec<_>>()
     };
     let every_line = ends(&t, Composer::EveryLine);
@@ -278,6 +278,102 @@ fn burasagari_keeps_the_every_line_composer_for_latin_text() {
     assert_eq!(ends(&t, Composer::EveryLine), every_line);
 }
 
+/// Width of `s` set on one line.
+fn natural_width(s: &str, size: f64) -> f64 {
+    let l = layout(db(), &TextObject::point(Point::ZERO, s, style(size)));
+    l.lines[0].x1 - l.lines[0].x0
+}
+
+/// The text of each line.
+fn line_texts(t: &TextObject, l: &TextLayout) -> Vec<String> {
+    let text = t.plain_text();
+    l.lines.iter().map(|li| text[li.start..li.end].trim_end().to_string()).collect()
+}
+
+/// Ragged text: Every-line breaks before a word that would fit, to avoid leaving a lone short
+/// word on the last line (single-line keeps filling the first line). Auto alignment is ragged
+/// too, in either paragraph direction: set right to left, the lines break the same and stay
+/// flush right.
+#[test]
+fn every_line_composer_balances_ragged_lines() {
+    use vectorcraft_doc::ParaDirection;
+    const S: &str = "Destroy all creatures with toughness X or less.";
+    let w = natural_width("Destroy all creatures with toughness X or", 12.0) + 2.0;
+    assert!(w < natural_width(S, 12.0), "the sentence needs two lines");
+    let cases = [
+        (Justify::Left, None),
+        (Justify::Center, None),
+        (Justify::Right, None),
+        (Justify::Auto, None),
+        (Justify::Auto, Some(ParaDirection::RightToLeft)),
+        (Justify::Left, Some(ParaDirection::RightToLeft)),
+    ];
+    for (justify, direction) in cases {
+        let mut t = area(S, style(12.0), Rect::new(0.0, 0.0, w, 400.0), justify);
+        t.para.direction = direction;
+        t.para.composer = Composer::SingleLine;
+        let greedy = line_texts(&t, &layout(db(), &t));
+        assert_eq!(greedy, ["Destroy all creatures with toughness X or", "less."], "{justify:?} {direction:?}");
+        t.para.composer = Composer::EveryLine;
+        let every = line_texts(&t, &layout(db(), &t));
+        assert_eq!(every, ["Destroy all creatures with toughness X", "or less."], "{justify:?} {direction:?}");
+        // Burasagari (new type's Standard) leaves Latin text to the every-line composer.
+        t.para.burasagari = vectorcraft_doc::Burasagari::Standard;
+        assert_eq!(line_texts(&t, &layout(db(), &t)), every, "{justify:?} {direction:?} with burasagari");
+        if (justify, direction) == (Justify::Auto, Some(ParaDirection::RightToLeft)) {
+            let l = layout(db(), &t);
+            assert!(l.lines.iter().all(|li| li.rtl && (li.x1 - w).abs() < 1e-6), "right to left Auto is flush right: {:?}", l.lines);
+        }
+        // The options override wins over the object's setting.
+        let forced = layout_with(db(), &t, &LayoutOptions { composer: Some(Composer::SingleLine), ..Default::default() });
+        assert_eq!(line_texts(&t, &forced), greedy);
+    }
+}
+
+/// Every-line evens the rag of a long ragged paragraph: the spread of the line ends is no worse
+/// than greedy breaking, every line fits, and nothing is lost.
+#[test]
+fn every_line_composer_evens_the_rag() {
+    for (width, hy) in [(150.0, false), (190.0, false), (240.0, true), (310.0, false)] {
+        let mut t = area(&COPY.repeat(2), style(12.0), Rect::new(0.0, 0.0, width, 4000.0), Justify::Left);
+        t.para.hyphenate = hy;
+        let rag = |c: Composer| {
+            let mut t = t.clone();
+            t.para.composer = c;
+            let l = layout(db(), &t);
+            assert!(!l.overflow);
+            for li in &l.lines {
+                assert!(li.x1 - li.x0 <= width + 1e-6, "{c:?} {width}: line too wide {li:?}");
+            }
+            let clusters: std::collections::BTreeSet<(usize, usize)> = l.glyphs.iter().filter(|g| g.len > 0).map(|g| (g.byte, g.len)).collect();
+            assert_eq!(clusters.iter().map(|c| c.1).sum::<usize>(), COPY.len() * 2, "every character placed");
+            // Leftover space of all lines but the last: its sum of squares (how ragged) and the
+            // sum of squared differences between neighbours (how jagged).
+            let slack: Vec<f64> = l.lines[..l.lines.len() - 1].iter().map(|li| width - (li.x1 - li.x0)).collect();
+            let jag: f64 = slack.windows(2).map(|p| (p[0] - p[1]).powi(2)).sum();
+            (slack.iter().map(|s| s * s).sum::<f64>(), jag, l.lines.len())
+        };
+        let ((kp, kp_jag, kp_lines), (greedy, greedy_jag, greedy_lines)) = (rag(Composer::EveryLine), rag(Composer::SingleLine));
+        assert!(kp <= greedy + 1e-6, "{width}: every-line rag {kp} vs greedy {greedy}");
+        assert!(kp_jag <= greedy_jag + 1e-6, "{width}: every-line jag {kp_jag} vs greedy {greedy_jag}");
+        assert!(kp_lines <= greedy_lines + 1, "{width}: {kp_lines} lines vs {greedy_lines}");
+    }
+}
+
+/// Single-line breaking is the greedy breaker: each line takes as many words as fit.
+#[test]
+fn single_line_composer_is_greedy() {
+    let width = 190.0;
+    let mut t = area(COPY, style(12.0), Rect::new(0.0, 0.0, width, 2000.0), Justify::Left);
+    t.para.composer = Composer::SingleLine;
+    let l = layout(db(), &t);
+    let lines = line_texts(&t, &l);
+    for pair in lines.windows(2) {
+        let next_word = pair[1].split(' ').next().unwrap();
+        assert!(natural_width(&format!("{} {next_word}", pair[0]), 12.0) > width - 1e-6, "{pair:?}");
+    }
+}
+
 #[test]
 fn hyphenation_rules() {
     assert_eq!(hyphen::hyphenate_word("typography"), "typo-gra-phy");
@@ -361,6 +457,201 @@ fn rows_and_columns_flow_in_order() {
     }
 }
 
+// ---------- vertical alignment ----------
+
+fn valign(a: VerticalAlign) -> LayoutOptions {
+    LayoutOptions { vertical_align: a, ..Default::default() }
+}
+
+/// (space above the first line's ascent, space below the last line's descent) in `0..h`.
+fn block_space(l: &TextLayout, h: f64) -> (f64, f64) {
+    let (first, last) = (l.lines.first().unwrap(), l.lines.last().unwrap());
+    (first.baseline - first.ascent, h - (last.baseline + last.descent))
+}
+
+#[test]
+fn vertical_align_center_bottom_and_justify_in_a_rectangle() {
+    let t = area("First line\nSecond line\nThird line", style(12.0), Rect::new(0.0, 0.0, 200.0, 300.0), Justify::Left);
+    let top = layout(db(), &t);
+    let (above, below) = block_space(&top, 300.0);
+    assert!(above.abs() < 1e-6 && below > 200.0);
+    let center = layout_with(db(), &t, &valign(VerticalAlign::Center));
+    let (a, b) = block_space(&center, 300.0);
+    assert!((a - b).abs() < 1e-6 && a > 100.0, "{a} {b}");
+    // The model field reaches layout().
+    let mut tc = t.clone();
+    tc.area.vertical_align = VerticalAlign::Center;
+    assert!((layout(db(), &tc).lines[0].baseline - center.lines[0].baseline).abs() < 1e-9);
+    // Lines, glyph origins, outlines and transforms move together.
+    let d = center.lines[0].baseline - top.lines[0].baseline;
+    for (g, h) in center.glyphs.iter().zip(&top.glyphs) {
+        assert!((g.origin.y - h.origin.y - d).abs() < 1e-9);
+        assert!((g.xf.translation().y - h.xf.translation().y - d).abs() < 1e-9);
+        if !h.outline.elements().is_empty() {
+            assert!((g.outline.bounding_box().y0 - h.outline.bounding_box().y0 - d).abs() < 1e-6);
+        }
+    }
+    assert!(center.bounds.y0 > top.bounds.y0 + 100.0);
+    let bottom = layout_with(db(), &t, &valign(VerticalAlign::Bottom));
+    let (a, b) = block_space(&bottom, 300.0);
+    assert!(b.abs() < 1e-6 && a > 200.0);
+    // Justify: the first line stays, the last one reaches the bottom, gaps are equal.
+    let just = layout_with(db(), &t, &valign(VerticalAlign::Justify));
+    let (a, b) = block_space(&just, 300.0);
+    assert!(a.abs() < 1e-6 && b.abs() < 1e-6, "{a} {b}");
+    let gaps: Vec<f64> = just.lines.windows(2).map(|w| w[1].baseline - w[0].baseline).collect();
+    assert!(gaps.len() == 2 && (gaps[0] - gaps[1]).abs() < 1e-6 && gaps[0] > 100.0);
+    // A single line justifies to the top.
+    let one = area("Alone", style(12.0), Rect::new(0.0, 0.0, 200.0, 300.0), Justify::Left);
+    assert_eq!(layout_with(db(), &one, &valign(VerticalAlign::Justify)).lines[0].baseline, layout(db(), &one).lines[0].baseline);
+    // Inset: the space is measured inside it.
+    let inset = layout_with(db(), &t, &LayoutOptions { inset: 10.0, vertical_align: VerticalAlign::Bottom, ..Default::default() });
+    assert!(block_space(&inset, 290.0).1.abs() < 1e-6);
+}
+
+#[test]
+fn vertical_align_leaves_overflowing_text_where_it_is() {
+    let text = COPY.repeat(4);
+    let t = area(&text, style(12.0), Rect::new(0.0, 0.0, 200.0, 100.0), Justify::Left);
+    let top = layout(db(), &t);
+    assert!(top.overflow);
+    for a in [VerticalAlign::Center, VerticalAlign::Bottom, VerticalAlign::Justify] {
+        let l = layout_with(db(), &t, &valign(a));
+        assert!(l.overflow);
+        assert_eq!(l.lines.len(), top.lines.len());
+        assert_eq!(l.lines.last().unwrap().end, top.lines.last().unwrap().end);
+        // A full cell has less than a line of space left: the lines barely move.
+        assert!(l.lines[0].baseline - top.lines[0].baseline < top.lines[0].ascent + top.lines[0].descent);
+        assert!(block_space(&l, 100.0).1 >= -1e-6);
+    }
+}
+
+#[test]
+fn vertical_align_acts_on_each_column_on_its_own() {
+    // Enough text for column 1 and a few lines of column 2.
+    let t = area(COPY, style(12.0), Rect::new(0.0, 0.0, 420.0, 120.0), Justify::Left);
+    let opts = |a| LayoutOptions { columns: 2, gutter: 20.0, vertical_align: a, ..Default::default() };
+    let top = layout_with(db(), &t, &opts(VerticalAlign::Top));
+    let col = |l: &TextLayout, c: usize| l.lines.iter().filter(|li| li.region == c).cloned().collect::<Vec<_>>();
+    assert!(!top.overflow && !col(&top, 0).is_empty() && !col(&top, 1).is_empty());
+    assert!(col(&top, 1).iter().all(|li| li.x0 >= 220.0 - 1e-6));
+    let bottom = layout_with(db(), &t, &opts(VerticalAlign::Bottom));
+    for c in 0..2 {
+        let last = col(&bottom, c).last().cloned().unwrap();
+        assert!((last.baseline + last.descent - 120.0).abs() < 1e-6, "column {c} ends at the bottom");
+    }
+    let shift = |c: usize| col(&bottom, c)[0].baseline - col(&top, c)[0].baseline;
+    assert!(shift(1) > shift(0) + 20.0, "the short column moves further: {} {}", shift(0), shift(1));
+}
+
+#[test]
+fn vertical_align_in_a_circle_reflows_and_stays_inside() {
+    let circle = Circle::new((150.0, 150.0), 120.0).to_path(0.1);
+    let t = area_path("Centred text in a round frame flows again at its new height.", style(12.0), &circle, Justify::Left);
+    let top = layout(db(), &t);
+    for a in [VerticalAlign::Center, VerticalAlign::Bottom, VerticalAlign::Justify] {
+        let l = layout_with(db(), &t, &valign(a));
+        assert!(!l.overflow, "{a:?}");
+        assert_eq!(l.lines.last().unwrap().end, top.lines.last().unwrap().end);
+        let moved = if a == VerticalAlign::Justify {
+            l.lines.last().unwrap().baseline - top.lines.last().unwrap().baseline
+        } else {
+            l.lines[0].baseline - top.lines[0].baseline
+        };
+        assert!(moved > 20.0, "{a:?} {moved}");
+        for g in l.glyphs.iter().filter(|g| !g.outline.elements().is_empty()) {
+            let b = g.outline.bounding_box();
+            for p in [Point::new(b.x0, b.y0), Point::new(b.x1, b.y1)] {
+                assert!((p - Point::new(150.0, 150.0)).hypot() <= 121.0, "{a:?} {p:?}");
+            }
+        }
+    }
+    let c = layout_with(db(), &t, &valign(VerticalAlign::Center));
+    let (above, below) = block_space(&c, 270.0);
+    assert!((above - 30.0 - below).abs() < 10.0, "roughly centred: {above} {below}");
+}
+
+#[test]
+fn vertical_align_with_text_wrap_flows_again_around_the_object() {
+    let mut t = area(COPY, style(12.0), Rect::new(0.0, 0.0, 300.0, 400.0), Justify::Left);
+    let obstacle = Rect::new(100.0, 250.0, 200.0, 330.0).to_path(0.1);
+    t.wrap = vec![vectorcraft_doc::WrapShape { path: PathData::from_bezpath(&obstacle), wrap: Default::default() }];
+    let top = layout(db(), &t);
+    let bottom = layout_with(db(), &t, &valign(VerticalAlign::Bottom));
+    assert!(!bottom.overflow);
+    assert_eq!(bottom.lines.last().unwrap().end, top.lines.last().unwrap().end);
+    let last = bottom.lines.last().unwrap();
+    assert!(400.0 - (last.baseline + last.descent) < 15.0, "near the bottom: {}", last.baseline);
+    // Lines beside the object leave room for it (offset 6 pt).
+    for li in bottom.lines.iter().filter(|li| li.baseline + li.descent > 244.0 && li.baseline - li.ascent < 336.0) {
+        assert!(li.x1 <= 94.0 + 1e-6 || li.x0 >= 206.0 - 1e-6, "{li:?}");
+    }
+}
+
+#[test]
+fn vertical_align_on_vertical_type_moves_columns_along_the_block_axis() {
+    // Vertical type: the block axis runs right to left, so "bottom" is the frame's left edge.
+    let mut t = area("Tate\nYoko", style(20.0), Rect::new(0.0, 0.0, 200.0, 100.0), Justify::Left);
+    t.vertical = true;
+    let top = layout(db(), &t);
+    let bottom = layout_with(db(), &t, &valign(VerticalAlign::Bottom));
+    let center = layout_with(db(), &t, &valign(VerticalAlign::Center));
+    assert!(top.bounds.x1 > 190.0 && top.bounds.x0 > 100.0, "{:?}", top.bounds);
+    assert!(bottom.bounds.x0.abs() < 0.5, "{:?}", bottom.bounds);
+    assert!((center.bounds.x0 - (200.0 - center.bounds.x1)).abs() < 0.5, "{:?}", center.bounds);
+    // Glyphs stay inside the frame; lines keep line-space coordinates.
+    for g in &bottom.glyphs {
+        assert!(g.origin.x >= -1e-6 && g.origin.x <= 200.0 + 1e-6);
+    }
+}
+
+/// Top-to-Top leading (em box top to em box top): the first line hangs from the frame's top and a
+/// line's leading is the space below it. Vertical alignment measures the space from the lines that
+/// model placed, keeps their spacing when it shifts them, and justify adds its share on top of it.
+#[test]
+fn vertical_align_with_top_to_top_leading() {
+    use vectorcraft_doc::LeadingModel;
+    let st = |size: f64| CharStyle { size, leading: Some(size * 1.5), ..style(size) };
+    let mut t = area("", st(40.0), Rect::new(0.0, 0.0, 200.0, 300.0), Justify::Left);
+    t.runs = vec![TextRun { text: "大\n".into(), style: st(40.0) }, TextRun { text: "小\n中".into(), style: st(20.0) }];
+    t.para.leading_model = LeadingModel::EmBoxTop;
+    let top = layout(db(), &t);
+    assert_eq!(top.lines.len(), 3);
+    // The em box top sits 0.88 em above the baseline in the craft-fonts CJK faces; a system
+    // fallback (no craft-fonts) has its own metrics, which the relative checks below don't need.
+    if !crate::CRAFT_FONTS.is_empty() {
+        assert!((top.lines[0].baseline - 0.88 * 40.0).abs() < 0.01, "first em box at the top: {}", top.lines[0].baseline);
+    }
+    let gaps = |l: &TextLayout| l.lines.windows(2).map(|w| w[1].baseline - w[0].baseline).collect::<Vec<_>>();
+    let bottom = layout_with(db(), &t, &valign(VerticalAlign::Bottom));
+    assert!(block_space(&bottom, 300.0).1.abs() < 1e-6, "{:?}", block_space(&bottom, 300.0));
+    for (a, b) in gaps(&bottom).iter().zip(gaps(&top)) {
+        assert!((a - b).abs() < 1e-6, "spacing kept: {a} {b}");
+    }
+    let center = layout_with(db(), &t, &valign(VerticalAlign::Center));
+    let d = center.lines[0].baseline - top.lines[0].baseline;
+    assert!((d - block_space(&top, 300.0).1 * 0.5).abs() < 1e-6, "{d}");
+    let just = layout_with(db(), &t, &valign(VerticalAlign::Justify));
+    assert!((just.lines[0].baseline - top.lines[0].baseline).abs() < 1e-9, "the first line stays");
+    assert!(block_space(&just, 300.0).1.abs() < 1e-6);
+    let extra: Vec<f64> = gaps(&just).iter().zip(gaps(&top)).map(|(a, b)| a - b).collect();
+    assert!(extra.len() == 2 && (extra[0] - extra[1]).abs() < 1e-6 && extra[0] > 50.0, "{extra:?}");
+    // A round frame reflows with Top-to-Top leading too, without losing text.
+    let circle = Circle::new((150.0, 150.0), 120.0).to_path(0.1);
+    let mut round = area_path("", st(20.0), &circle, Justify::Left);
+    round.runs = t.runs.clone();
+    round.para.leading_model = LeadingModel::EmBoxTop;
+    let rtop = layout(db(), &round);
+    for a in [VerticalAlign::Center, VerticalAlign::Bottom, VerticalAlign::Justify] {
+        let l = layout_with(db(), &round, &valign(a));
+        assert!(!l.overflow, "{a:?}");
+        assert_eq!(l.lines.last().unwrap().end, rtop.lines.last().unwrap().end);
+        // The 40 pt line starts low in the circle already, so centring moves it a little.
+        let want = if a == VerticalAlign::Center { 1.0 } else { 20.0 };
+        assert!(l.lines.last().unwrap().baseline > rtop.lines.last().unwrap().baseline + want, "{a:?}");
+    }
+}
+
 // ---------- OpenType ----------
 
 #[test]
@@ -370,9 +661,24 @@ fn opentype_ligature_switches() {
     assert_eq!(layout(db(), &t).glyphs.len(), 1, "fi ligature by default");
     let off = LayoutOptions { features: OtFeatures { ligatures: false, ..Default::default() }, ..Default::default() };
     assert_eq!(layout_with(db(), &t, &off).glyphs.len(), 2);
-    // Tracking suppresses ligatures (as letterspaced type should).
-    let tracked = TextObject::point(Point::ZERO, "fi", CharStyle { tracking: 100.0, ..serif });
-    assert_eq!(layout(db(), &tracked).glyphs.len(), 2);
+    let fi = |tracking: f64, features: &[&str]| {
+        let st = CharStyle { tracking, features: features.iter().map(|s| s.to_string()).collect(), ..serif.clone() };
+        layout(db(), &TextObject::point(Point::ZERO, "fi", st)).glyphs.len()
+    };
+    // Small tracking adjustments (fitting a line) keep the ligature.
+    assert_eq!(fi(-5.0, &[]), 1, "tracking -5 keeps fi");
+    assert_eq!(fi(20.0, &[]), 1, "tracking +20 keeps fi");
+    let (tight, loose) = LIGATURE_TRACKING_LIMITS;
+    assert_eq!((fi(tight, &[]), fi(loose, &[])), (1, 1), "the limits themselves keep fi");
+    // Real letterspacing suppresses ligatures (as letterspaced type should), condensing sooner...
+    assert_eq!(fi(100.0, &[]), 2, "tracking 100 drops fi");
+    assert_eq!(fi(-30.0, &[]), 2, "tracking -30 drops fi");
+    assert_eq!(fi(-100.0, &[]), 2, "tracking -100 drops fi");
+    // ...unless the character turns them on explicitly.
+    assert_eq!(fi(100.0, &["liga"]), 1, "explicit liga wins over tracking");
+    assert_eq!(fi(100.0, &["+liga"]), 1);
+    assert_eq!(fi(100.0, &["liga", "-liga"]), 2, "the last tag wins");
+    assert_eq!(fi(0.0, &["-liga"]), 2, "explicit off still turns it off");
     let f = OtFeatures::from_tags(["dlig", "-liga", "smcp", "onum", "bogus"]);
     assert!(f.discretionary_ligatures && !f.ligatures && f.small_caps && f.oldstyle_figures && !f.fractions);
 }
@@ -404,17 +710,22 @@ fn uncovered_characters_do_not_break_layout() {
 #[test]
 fn layout_10k_area_text_is_fast() {
     let text: String = COPY.chars().cycle().take(10_000).collect();
-    let mut t = area(&text, style(10.0), Rect::new(0.0, 0.0, 400.0, 20_000.0), Justify::JustifyLeft);
-    t.para.hyphenate = true;
-    let _ = layout(db(), &t);
-    let n = 5;
-    let start = std::time::Instant::now();
-    for _ in 0..n {
-        let l = layout(db(), &t);
-        assert!(!l.overflow);
+    for (justify, composer) in
+        [(Justify::JustifyLeft, Composer::EveryLine), (Justify::Left, Composer::EveryLine), (Justify::Left, Composer::SingleLine)]
+    {
+        let mut t = area(&text, style(10.0), Rect::new(0.0, 0.0, 400.0, 20_000.0), justify);
+        t.para.hyphenate = true;
+        t.para.composer = composer;
+        let _ = layout(db(), &t);
+        let n = 5;
+        let start = std::time::Instant::now();
+        for _ in 0..n {
+            let l = layout(db(), &t);
+            assert!(!l.overflow);
+        }
+        let per = start.elapsed().as_secs_f64() * 1000.0 / n as f64;
+        eprintln!("layout of 10k chars ({justify:?}, {composer:?}, hyphenated): {per:.3} ms");
+        let budget = if cfg!(debug_assertions) { 400.0 } else { 10.0 };
+        assert!(per < budget, "{justify:?} {composer:?}: {per} ms");
     }
-    let per = start.elapsed().as_secs_f64() * 1000.0 / n as f64;
-    eprintln!("layout of 10k chars (justified, hyphenated): {per:.3} ms");
-    let budget = if cfg!(debug_assertions) { 400.0 } else { 10.0 };
-    assert!(per < budget, "{per} ms");
 }

crates/tools/src/direct.rs

@@ -201,15 +201,21 @@ fn anchor_owners(cx: &ToolContext, f: fn(&Node) -> bool) -> Vec<NodeId> {
     v
 }
 
-/// Anchor of any visible path or area type frame under `p`, topmost first: (id, si, ai, where it is).
+/// The anchor within `tol` of `p` nearest to it, of the topmost visible path or area type frame
+/// that has one: (id, si, ai, where it is).
 fn hit_anchor(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, usize, usize, Point)> {
     let owners = anchor_owners(cx, |n| matches!(n.kind, NodeKind::Path { .. }) || is_area_type(n));
     owners.into_iter().find_map(|id| {
         let pd = cx.doc.node(id).and_then(editable_path)?;
-        pd.anchors().find(|(_, _, a)| a.p.distance(p) <= tol).map(|(si, ai, a)| (id, si, ai, a.p))
+        nearest_anchor(&pd, p, tol).map(|(si, ai, a)| (id, si, ai, a))
     })
 }
 
+/// The anchor of `pd` within `tol` of `p` nearest to it: (subpath, anchor, where it is).
+fn nearest_anchor(pd: &PathData, p: Point, tol: f64) -> Option<(usize, usize, Point)> {
+    pd.anchors().map(|(si, ai, a)| (si, ai, a.p)).filter(|(.., a)| a.distance(p) <= tol).min_by(|x, y| x.2.distance(p).total_cmp(&y.2.distance(p)))
+}
+
 /// An edge of an area type frame under `p`, topmost first: (text, the edge's two anchors).
 fn hit_frame_edge(cx: &ToolContext, p: Point, tol: f64) -> Option<(NodeId, Vec<AnchorRef>)> {
     anchor_owners(cx, is_area_type).into_iter().find_map(|id| {
@@ -290,7 +296,8 @@ impl Tool for DirectSelectionTool {
             return out;
         }
         let p = ev.pos;
-        let tol = cx.pick_tol();
+        // Anchors and handle ends are picked from a little further than segments and objects.
+        let (tol, point) = (cx.pick_tol(), cx.point_tol());
         match (ev.kind, self.state.clone()) {
             (PointerKind::Down, _) if self.group => {
                 if let Some(out) = self.guide.press(cx, ev) {
@@ -332,7 +339,7 @@ impl Tool for DirectSelectionTool {
                     return vec![];
                 }
                 if let Some(sel) = self.spine.filter(|(id, _)| cx.selection.contains(*id))
-                    && let Some(out) = hit_spine_handle(cx, sel, p, tol)
+                    && let Some(out) = hit_spine_handle(cx, sel, p, point)
                 {
                     self.state = State::SpineHandle { id: sel.0, anchor: sel.1, out };
                     return vec![Action::Begin("Reshape Spine".into())];
@@ -343,17 +350,17 @@ impl Tool for DirectSelectionTool {
                     return self.mesh.press(g);
                 }
                 self.mesh.unfocus();
-                if let Some((id, si, ai, out)) = hit_handle(cx, p, tol) {
+                if let Some((id, si, ai, out)) = hit_handle(cx, p, point) {
                     self.state = State::Handle { id, si, ai, out };
                     self.handle_snap = HandleSnap::default();
                     return vec![Action::Begin("Reshape".into())];
                 }
-                if let Some((id, anchor, from)) = hit_spine_point(cx, p, tol) {
+                if let Some((id, anchor, from)) = hit_spine_point(cx, p, point) {
                     self.spine = Some((id, anchor));
                     self.state = State::SpinePoint { id, anchor, from, start: p, began: false };
                     return if cx.selection.contains(id) { vec![] } else { vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))] };
                 }
-                if let Some((id, si, ai, grab)) = hit_anchor(cx, p, tol) {
+                if let Some((id, si, ai, grab)) = hit_anchor(cx, p, point) {
                     if cx.doc.node(id).is_some_and(is_area_type) {
                         return self.press_type_area(cx, id, vec![(si, ai)], p, ev.mods.shift);
                     }
@@ -608,14 +615,14 @@ impl Tool for DirectSelectionTool {
     }
 }
 
-/// The anchor within the selection tolerance of `p`, of a selected path or the path under `p`:
-/// what Highlight anchors on mouse over marks (a press there picks it).
+/// The anchor within a press's reach of `p` ([`ToolContext::point_tol`]), of a selected path or the
+/// path under `p`: what Highlight anchors on mouse over marks (a press there picks it).
 fn hovered_anchor(cx: &ToolContext, p: Point) -> Option<(NodeId, Point)> {
     let under = hit_test(cx.doc, p, cx.hit_options()).map(|h| h.leaf);
-    let tol = cx.pick_tol();
+    let tol = cx.point_tol();
     cx.selection.objects.iter().copied().chain(under).find_map(|id| {
         let path = cx.doc.node(id).and_then(editable_path)?;
-        path.anchors().find(|(_, _, a)| a.p.distance(p) <= tol).map(|(_, _, a)| (id, a.p))
+        nearest_anchor(&path, p, tol).map(|(.., a)| (id, a))
     })
 }
 
@@ -685,6 +692,29 @@ mod tests {
         assert_eq!(down(&mut t, 100.0), vec![Action::Exec("select.anchors".into(), json!({"id": id.0, "anchors": [[0, 0]], "mode": "set"}))]);
     }
 
+    /// An anchor is picked from 2 px past its drawn square even where its segment is nearer, and
+    /// further with a larger anchor Size or Tolerance (#593); away from it the segment is.
+    #[test]
+    fn anchors_are_picked_before_the_segments_through_them() {
+        let (d, id) = doc_with_rect();
+        let (s, p) = (Selection::default(), paint());
+        let corner = vec![Action::Exec("select.anchors".into(), json!({"id": id.0, "anchors": [[0, 0]], "mode": "set"}))];
+        let press = |cx: &ToolContext, x: f64, y: f64| DirectSelectionTool::new(false).pointer(cx, &PointerEvent::new(PointerKind::Down, x, y));
+        let c = cx(&d, &s, &p);
+        // 4.3 px from the corner, 0.5 px from the top edge.
+        assert_eq!(press(&c, 104.2, 100.5), corner);
+        assert_ne!(press(&c, 110.0, 100.5), corner, "the segment, away from the anchor");
+        assert_ne!(press(&c, 105.0, 100.5), corner, "past the default reach (4.5 px)");
+        let large = ToolContext { anchor_size: 7, ..cx(&d, &s, &p) };
+        assert_eq!(press(&large, 106.0, 100.5), corner, "Size 7 draws them 9 px wide");
+        let loose = ToolContext { selection_tolerance: 8.0, ..cx(&d, &s, &p) };
+        assert_eq!(press(&loose, 107.5, 100.5), corner);
+        // On screen: at 200% the reach is half as far in the document.
+        let zoomed = ToolContext { zoom: 2.0, ..cx(&d, &s, &p) };
+        assert_eq!(press(&zoomed, 102.1, 100.2), corner);
+        assert_ne!(press(&zoomed, 102.6, 100.2), corner);
+    }
+
     /// A blend of two 20 pt squares centred on (110, 310) and (210, 310), selected.
     fn blend_doc() -> (vectorcraft_doc::Document, NodeId, NodeId) {
         let (mut d, _) = doc_with_rect();

crates/tools/src/draw2/anchor.rs

@@ -48,7 +48,7 @@ impl AnchorTool {
     }
 
     fn delete(cx: &ToolContext, p: Point) -> Vec<Action> {
-        hit_anchor(cx, p, cx.pick_tol()).map(remove_anchor).into_iter().collect()
+        hit_anchor(cx, p, cx.point_tol()).map(remove_anchor).into_iter().collect()
     }
 }
 
@@ -61,7 +61,8 @@ impl Tool for AnchorTool {
     }
     fn pointer(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Vec<Action> {
         let p = ev.pos;
-        let tol = cx.pick_tol();
+        // Anchors and handle ends are picked from a little further than segments.
+        let (tol, point) = (cx.pick_tol(), cx.point_tol());
         match (self.id, ev.kind) {
             ("addAnchor", PointerKind::Down) => {
                 if ev.mods.alt {
@@ -78,7 +79,7 @@ impl Tool for AnchorTool {
                 }
             }
             ("scissors", PointerKind::Down) => {
-                if let Some((id, si, ai)) = hit_anchor(cx, p, tol) {
+                if let Some((id, si, ai)) = hit_anchor(cx, p, point) {
                     return vec![Action::Exec("path.split".into(), json!({"id": id.0, "subpath": si, "anchor": ai}))];
                 }
                 match hit_segment(cx, p, tol) {
@@ -87,10 +88,10 @@ impl Tool for AnchorTool {
                 }
             }
             ("anchorPoint", PointerKind::Down) => {
-                if let Some((id, si, ai, out)) = hit_handle(cx, p, tol) {
+                if let Some((id, si, ai, out)) = hit_handle(cx, p, point) {
                     self.state = State::Handle { id, si, ai, out, began: false };
                     self.snap = HandleSnap::default();
-                } else if let Some((id, si, ai)) = hit_anchor(cx, p, tol) {
+                } else if let Some((id, si, ai)) = hit_anchor(cx, p, point) {
                     self.state = State::Convert { id, si, ai, start: p, began: false };
                 } else if let Some((id, si, seg, t)) = hit_segment(cx, p, tol) {
                     self.state = State::Reshape { id, si, seg, t, start: p, began: false };

crates/tools/src/lib.rs

@@ -274,6 +274,8 @@ pub struct ToolContext<'a> {
     /// Selection & Anchor Display → Tolerance: how near (screen pixels) a click must be to a path
     /// or an anchor to pick it.
     pub selection_tolerance: f64,
+    /// Selection & Anchor Display → Size (1–7, default 3): how big anchors and handles are drawn.
+    pub anchor_size: u32,
     /// Selection & Anchor Display → Object Selection by Path Only: a click inside a filled path
     /// doesn't pick it, only one on its path does.
     pub path_only: bool,
@@ -362,6 +364,14 @@ impl ToolContext<'_> {
     pub fn pick_tol(&self) -> f64 {
         self.tol(self.selection_tolerance)
     }
+    /// How near (document units) a press picks an anchor or a direction handle's end: the
+    /// selection tolerance, but at least 2 px past the drawn point, so a point is easy to catch
+    /// and wins over the segments through it, which are tested after it (#593).
+    pub fn point_tol(&self) -> f64 {
+        // Anchors are drawn 5 px wide at the default Size 3, a pixel more or less per step.
+        let half = (5.0 + f64::from(self.anchor_size.clamp(1, 7)) - 3.0) / 2.0;
+        self.tol(self.selection_tolerance.max(half + 2.0))
+    }
     pub fn hit_options(&self) -> vectorcraft_doc::hit::HitOptions {
         vectorcraft_doc::hit::HitOptions {
             tol: self.pick_tol(),
@@ -666,6 +676,7 @@ pub(crate) mod testutil {
             slices_locked: false,
             auto_add_delete: true,
             selection_tolerance: 3.0,
+            anchor_size: 3,
             path_only: false,
             type_path_only: false,
             double_click_isolate: true,

crates/tools/src/pen.rs

@@ -91,11 +91,11 @@ fn last_anchor(cx: &ToolContext, id: NodeId) -> Option<(usize, usize)> {
 /// Alt held over a handle end, an anchor or a segment of a selected path: the Anchor Point tool's
 /// gesture, within its tolerance.
 fn alt_converts(cx: &ToolContext, p: Point, m: Mods) -> bool {
-    let tol = cx.pick_tol();
+    let point = cx.point_tol();
     m.alt
-        && (hit_handle(cx, p, tol).is_some()
-            || crate::draw2::anchor_in(cx, editable_paths(cx), p, tol).is_some()
-            || crate::draw2::segment_in(cx, editable_paths(cx), p, tol).is_some())
+        && (hit_handle(cx, p, point).is_some()
+            || crate::draw2::anchor_in(cx, editable_paths(cx), p, point).is_some()
+            || crate::draw2::segment_in(cx, editable_paths(cx), p, cx.pick_tol()).is_some())
 }
 
 /// The selected paths the pen edits (not guides, nor locked or hidden ones).
@@ -123,7 +123,7 @@ impl Tool for PenTool {
         self.drag.is_some() || self.handle.is_some() || self.convert.is_some()
     }
     fn pointer(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Vec<Action> {
-        let tol = cx.tol(5.0);
+        let tol = cx.tol(5.0).max(cx.point_tol());
         // The path a press began is the selected one by the next event.
         if self.drawing && self.path.is_none() {
             self.path = active_path(cx).map(|a| a.0);
@@ -297,7 +297,7 @@ impl Tool for PenTool {
         o
     }
     fn cursor(&self, cx: &ToolContext, p: Point, m: Mods) -> Cursor {
-        let tol = cx.tol(5.0);
+        let tol = cx.tol(5.0).max(cx.point_tol());
         if let Some((id, first, last, _)) = self.active(cx) {
             let one = last_anchor(cx, id).is_some_and(|(_, ai)| ai == 0);
             if p.distance(first) <= tol && !one {

crates/tools/src/select.rs

@@ -36,6 +36,9 @@ enum State {
         /// Shift-pressed on this selected object: released without a drag, it leaves the
         /// selection.
         deselect: Option<NodeId>,
+        /// Pressed (no modifier) on this object of a selection of several: released without a
+        /// drag, it becomes the key object that Align aligns to (the key again: no key).
+        key: Option<NodeId>,
     },
     Scaling {
         handle: Handle,
@@ -235,14 +238,14 @@ impl Tool for SelectionTool {
                     && cx.select_behind
                     && let Some(behind) = object_behind(cx, p)
                 {
-                    self.state = State::Moving { start: p, began: false, deselect: None };
+                    self.state = State::Moving { start: p, began: false, deselect: None, key: None };
                     return vec![Action::Exec("select.set".into(), json!({ "ids": [behind.0] }))];
                 }
                 match hit_test(cx.doc, p, cx.hit_options()) {
                     Some(h) => {
                         let top = h.top_object(cx.isolation);
                         let mut out = vec![];
-                        let mut deselect = None;
+                        let (mut deselect, mut key) = (None, None);
                         if m.shift {
                             // A Shift-click takes a selected object out of the selection when it
                             // is released; a Shift-drag moves the selection, constrained.
@@ -253,8 +256,10 @@ impl Tool for SelectionTool {
                             }
                         } else if !cx.selection.contains(top) {
                             out.push(Action::Exec("select.set".into(), json!({ "ids": [top.0] })));
+                        } else if cx.selection.objects.len() > 1 && !m.cmd && !m.alt {
+                            key = Some(top);
                         }
-                        self.state = State::Moving { start: p, began: false, deselect };
+                        self.state = State::Moving { start: p, began: false, deselect, key };
                         out
                     }
                     None => {
@@ -276,7 +281,7 @@ impl Tool for SelectionTool {
                 if let Some(snap) = &self.moving {
                     (d, self.guides) = snap.snap(cx, start, d);
                 }
-                self.state = State::Moving { start, began: true, deselect: None };
+                self.state = State::Moving { start, began: true, deselect: None, key: None };
                 self.measure = cx.measurement_labels.then(|| (p, cx.offset_label(d.x, d.y)));
                 out.push(Action::Preview("object.transform".into(), json!({ "matrix": matrix_json(Affine::translate(d)), "copy": m.alt })));
                 out
@@ -323,15 +328,18 @@ impl Tool for SelectionTool {
                 self.state = State::Idle;
                 b.finish()
             }
-            (PointerKind::Up, State::Moving { began, deselect, .. }) => {
+            (PointerKind::Up, State::Moving { began, deselect, key, .. }) => {
                 self.state = State::Idle;
                 self.measure = None;
                 self.guides.clear();
                 self.moving = None;
-                match (began, deselect) {
-                    (true, _) => vec![Action::Commit],
-                    (false, Some(id)) => vec![Action::Exec("select.toggle".into(), json!({ "id": id.0 }))],
-                    (false, None) => vec![],
+                match (began, deselect, key) {
+                    (true, ..) => vec![Action::Commit],
+                    (false, Some(id), _) => vec![Action::Exec("select.toggle".into(), json!({ "id": id.0 }))],
+                    // A click on the key object again: no key.
+                    (false, None, Some(id)) if cx.selection.key == Some(id) => vec![Action::Exec("select.key".into(), json!({}))],
+                    (false, None, Some(id)) => vec![Action::Exec("select.key".into(), json!({ "id": id.0 }))],
+                    (false, None, None) => vec![],
                 }
             }
             (PointerKind::Up, State::Scaling { .. } | State::Rotating { .. }) => {
@@ -540,6 +548,37 @@ mod tests {
         assert!(t.pointer(&cx2, &shift(PointerKind::Up, 150.0, 150.0)).is_empty());
     }
 
+    /// #541: a click on one object of a selection of several makes it the key object; a click on
+    /// the key again lets it go. A drag moves them all, a lone object has no key.
+    #[test]
+    fn a_click_on_a_selected_object_makes_it_the_key() {
+        let (d, id) = doc_with_area_type();
+        let rect = d.layers[0].children().and_then(|c| c.first()).map(|n| n.id).unwrap();
+        let p = paint();
+        let click = |s: &Selection, x, y| {
+            let c = cx(&d, s, &p);
+            let mut t = SelectionTool::default();
+            assert!(t.pointer(&c, &ev(PointerKind::Down, x, y)).is_empty());
+            t.pointer(&c, &ev(PointerKind::Up, x, y))
+        };
+        let mut s = Selection::default();
+        s.add(rect);
+        s.add(id);
+        assert_eq!(click(&s, 150.0, 150.0), vec![Action::Exec("select.key".into(), json!({"id": rect.0}))]);
+        s.key = Some(rect);
+        assert_eq!(click(&s, 150.0, 150.0), vec![Action::Exec("select.key".into(), json!({}))], "the key again: no key");
+        // A drag moves the selection and leaves the key alone.
+        let c = cx(&d, &s, &p);
+        let mut t = SelectionTool::default();
+        t.pointer(&c, &ev(PointerKind::Down, 150.0, 150.0));
+        t.pointer(&c, &ev(PointerKind::Drag, 170.0, 150.0));
+        assert_eq!(t.pointer(&c, &ev(PointerKind::Up, 170.0, 150.0)), vec![Action::Commit]);
+        // One object selected: a click on it does nothing.
+        let mut one = Selection::default();
+        one.add(rect);
+        assert!(click(&one, 150.0, 150.0).is_empty());
+    }
+
     #[test]
     fn marquee_selects() {
         let (d, id) = doc_with_rect();

crates/trace/src/lib.rs

@@ -27,6 +27,8 @@ mod fit;
 mod mosaic;
 mod quantize;
 
+use std::sync::atomic::{AtomicUsize, Ordering};
+
 use serde::{Deserialize, Serialize};
 use vectorcraft_geom::PathData;
 
@@ -41,8 +43,18 @@ pub enum TraceError {
     Decode(String),
     #[error("image is empty")]
     Empty,
+    #[error("the image is {width} × {height} pixels, more than Image Trace takes ({max} megapixels)")]
+    TooLarge { width: u32, height: u32, max: u64 },
+    #[error(
+        "this trace would make more than {max} anchor points, more than the document can show smoothly: raise Noise, lower Paths or Colors, or pick a lower-fidelity preset"
+    )]
+    TooComplex { max: usize },
 }
 
+/// The most pixels an image to trace may have (64 megapixels: 256 MB decoded); larger images are
+/// refused instead of running out of memory.
+pub const MAX_PIXELS: u64 = 64 << 20;
+
 /// An RGBA8 raster (row-major, top row first).
 #[derive(Clone, Debug, PartialEq)]
 pub struct Raster {
@@ -67,13 +79,19 @@ impl Raster {
         }
         Self { width, height, rgba }
     }
-    /// Decode PNG / JPEG / WebP / GIF bytes.
+    /// Decode PNG / JPEG / WebP / GIF bytes (at most [`MAX_PIXELS`], checked before decoding).
     pub fn decode(bytes: &[u8]) -> Result<Self, TraceError> {
-        let img = image::load_from_memory(bytes).map_err(|e| TraceError::Decode(e.to_string()))?.to_rgba8();
-        let (w, h) = img.dimensions();
+        let decode_err = |e: image::ImageError| TraceError::Decode(e.to_string());
+        let reader = image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().map_err(|e| TraceError::Decode(e.to_string()))?;
+        let (w, h) = reader.into_dimensions().map_err(decode_err)?;
         if w == 0 || h == 0 {
             return Err(TraceError::Empty);
         }
+        if u64::from(w) * u64::from(h) > MAX_PIXELS {
+            return Err(TraceError::TooLarge { width: w, height: h, max: MAX_PIXELS >> 20 });
+        }
+        let img = image::load_from_memory(bytes).map_err(decode_err)?.to_rgba8();
+        let (w, h) = img.dimensions();
         Ok(Self { width: w, height: h, rgba: img.into_raw() })
     }
     /// Encode as PNG.
@@ -262,17 +280,25 @@ fn is_white(c: [u8; 3]) -> bool {
 
 /// Trace `img` with `params`.
 pub fn trace(img: &Raster, params: &TraceParams) -> TraceResult {
+    // No trace has more than `usize::MAX` anchors.
+    trace_within(img, params, usize::MAX).unwrap_or_default()
+}
+
+/// Trace `img` with `params`, giving up with [`TraceError::TooComplex`] once the paths have more
+/// than `max_anchors` anchor points (a photo traced at high fidelity can make millions). The
+/// colour layers are traced in parallel where threads are available.
+pub fn trace_within(img: &Raster, params: &TraceParams, max_anchors: usize) -> Result<TraceResult, TraceError> {
     let (w, h) = (img.width as usize, img.height as usize);
-    if w == 0 || h == 0 {
-        return TraceResult::default();
+    if w == 0 || h == 0 || img.rgba.len() != w * h * 4 {
+        return Ok(TraceResult::default());
     }
     let mut q = quantize(img, params);
     denoise(&mut q.labels, w, h, params.noise as usize);
     // Pixel count per palette entry.
     let mut counts = vec![0usize; q.palette.len()];
     for &l in &q.labels {
-        if l != TRANSPARENT {
-            counts[l as usize] += 1;
+        if let Some(c) = counts.get_mut(l as usize) {
+            *c += 1;
         }
     }
     // Layers bottom → top: largest area first.
@@ -282,46 +308,117 @@ pub fn trace(img: &Raster, params: &TraceParams) -> TraceResult {
     for (r, &i) in order.iter().enumerate() {
         rank[i] = r;
     }
-    let opts = fit::FitOptions {
-        polygon_tol: params.polygon_tolerance(),
-        fit_tol: params.fit_tolerance(),
-        corner_angle: params.corner_angle(),
-        snap_lines: params.snap_curves_to_lines,
+    let layers: Vec<(usize, usize)> =
+        order.iter().copied().enumerate().filter(|&(_, ci)| !(params.ignore_white && is_white(q.palette[ci]))).collect();
+    let job = Layers {
+        q: &q,
+        rank: &rank,
+        params,
+        opts: fit::FitOptions {
+            polygon_tol: params.polygon_tolerance(),
+            fit_tol: params.fit_tolerance(),
+            corner_angle: params.corner_angle(),
+            snap_lines: params.snap_curves_to_lines,
+        },
+        w,
+        h,
+        anchors: AtomicUsize::new(0),
+        max_anchors,
     };
-    let min_hole = params.noise.max(1) as i64;
     let mut out = TraceResult::default();
-    let mut mask = vec![false; w * h];
-    for (r, &ci) in order.iter().enumerate() {
+    for (paths, &(_, ci)) in parallel_map(&layers, |&(r, ci)| job.layer(r, ci)).into_iter().zip(&layers) {
+        out.paths.extend(paths.ok_or(TraceError::TooComplex { max: max_anchors })?);
         let color = q.palette[ci];
-        if params.ignore_white && is_white(color) {
-            continue;
-        }
-        let overlapping = params.method == Method::Overlapping;
-        for (m, &l) in mask.iter_mut().zip(&q.labels) {
-            *m = l != TRANSPARENT && if overlapping { rank[l as usize] >= r } else { l as usize == ci };
-        }
-        for comp in trace_mask(&mask, w, h) {
-            let mut subs = Vec::with_capacity(1 + comp.holes.len());
-            if let Some(sp) = fit::fit_loop(&comp.outer, &opts) {
-                subs.push(sp);
-            } else {
-                continue;
-            }
-            for hole in &comp.holes {
-                if hole.area2.abs() / 2 < min_hole && params.noise > 0 {
-                    continue;
-                }
-                if let Some(sp) = fit::fit_loop(hole, &opts) {
-                    subs.push(sp);
-                }
-            }
-            out.paths.push(TracedPath { path: PathData::new(subs), color, pixels: comp.pixels });
-        }
         if !out.palette.contains(&color) {
             out.palette.push(color);
         }
     }
-    out
+    Ok(out)
+}
+
+/// What tracing one colour layer needs.
+struct Layers<'a> {
+    q: &'a Quantized,
+    /// Each palette entry's layer, bottom (0) up.
+    rank: &'a [usize],
+    params: &'a TraceParams,
+    opts: fit::FitOptions,
+    w: usize,
+    h: usize,
+    /// Anchor points made so far, by every layer.
+    anchors: AtomicUsize,
+    max_anchors: usize,
+}
+
+impl Layers<'_> {
+    /// The paths of layer `r` (palette entry `ci`), or `None` once the anchors made pass the
+    /// maximum.
+    fn layer(&self, r: usize, ci: usize) -> Option<Vec<TracedPath>> {
+        let (params, opts) = (self.params, &self.opts);
+        let color = *self.q.palette.get(ci)?;
+        let overlapping = params.method == Method::Overlapping;
+        let mask: Vec<bool> = self
+            .q
+            .labels
+            .iter()
+            .map(|&l| l != TRANSPARENT && if overlapping { self.rank.get(l as usize).is_some_and(|&lr| lr >= r) } else { l as usize == ci })
+            .collect();
+        let min_hole = params.noise.max(1) as i64;
+        let mut paths = vec![];
+        for comp in trace_mask(&mask, self.w, self.h) {
+            let Some(outer) = fit::fit_loop(&comp.outer, opts) else { continue };
+            let mut subs = vec![outer];
+            for hole in &comp.holes {
+                if hole.area2.abs() / 2 < min_hole && params.noise > 0 {
+                    continue;
+                }
+                subs.extend(fit::fit_loop(hole, opts));
+            }
+            let path = PathData::new(subs);
+            let n = path.anchor_count();
+            if self.anchors.fetch_add(n, Ordering::Relaxed).saturating_add(n) > self.max_anchors {
+                return None;
+            }
+            paths.push(TracedPath { path, color, pixels: comp.pixels });
+        }
+        Some(paths)
+    }
+}
+
+/// `f` of each of `items`, in order, spread over the available cores.
+#[cfg(not(target_arch = "wasm32"))]
+fn parallel_map<T: Sync, R: Send>(items: &[T], f: impl Fn(&T) -> R + Sync) -> Vec<R> {
+    let threads = std::thread::available_parallelism().map_or(1, |n| n.get()).min(items.len());
+    if threads <= 1 {
+        return items.iter().map(f).collect();
+    }
+    let next = AtomicUsize::new(0);
+    let mut done: Vec<(usize, R)> = std::thread::scope(|s| {
+        let workers: Vec<_> = (0..threads)
+            .map(|_| {
+                s.spawn(|| {
+                    let mut mine = vec![];
+                    loop {
+                        let i = next.fetch_add(1, Ordering::Relaxed);
+                        let Some(item) = items.get(i) else { break };
+                        mine.push((i, f(item)));
+                    }
+                    mine
+                })
+            })
+            .collect();
+        // A worker's panic goes on in this thread, as if it had run here (the engine's guard
+        // reports it).
+        workers.into_iter().flat_map(|w| w.join().unwrap_or_else(|e| std::panic::resume_unwind(e))).collect()
+    });
+    done.sort_by_key(|(i, _)| *i);
+    done.into_iter().map(|(_, r)| r).collect()
+}
+
+/// `f` of each of `items`, in order (no threads on the web).
+#[cfg(target_arch = "wasm32")]
+fn parallel_map<T: Sync, R: Send>(items: &[T], f: impl Fn(&T) -> R + Sync) -> Vec<R> {
+    items.iter().map(f).collect()
 }
 
 #[cfg(test)]

crates/trace/src/tests.rs

@@ -278,3 +278,73 @@ fn timing_1000x1000_bw_under_300ms() {
     assert!(!res.paths.is_empty());
     assert!(ms < 300.0, "{ms} ms");
 }
+
+/// Stripes of `n` colours, each with a few dots of the next one: many layers, many small shapes.
+fn stripes(size: u32, n: u32) -> Raster {
+    let colour = |i: u32| [(i * 37 % 256) as u8, (i * 91 % 256) as u8, (i * 53 % 256) as u8, 255];
+    Raster::from_fn(size, size, |x, y| {
+        let band = x * n / size;
+        if (x % 9 < 3) && (y % 9 < 3) { colour(band + 1) } else { colour(band) }
+    })
+}
+
+/// #525: past the anchor budget the trace gives up with advice instead of making millions of
+/// anchors; under it, it is the plain trace.
+#[test]
+fn a_trace_past_its_anchor_budget_is_refused() {
+    let img = stripes(120, 8);
+    let p = TraceParams { mode: Mode::Color, colors: 16, noise: 1, ..TraceParams::default() };
+    let full = trace(&img, &p);
+    let anchors = full.anchor_count();
+    assert!(anchors > 100, "{anchors} anchors");
+    assert!(matches!(trace_within(&img, &p, anchors / 2), Err(TraceError::TooComplex { max }) if max == anchors / 2));
+    assert_eq!(trace_within(&img, &p, anchors).unwrap(), full);
+}
+
+/// Layers traced in parallel come out in the same order every time: bottom (largest) first.
+#[test]
+fn parallel_layers_keep_their_order() {
+    let img = stripes(90, 12);
+    let p = TraceParams { mode: Mode::Color, colors: 24, noise: 1, method: Method::Overlapping, ..TraceParams::default() };
+    let a = trace(&img, &p);
+    assert!(a.palette.len() > 8, "{} colours", a.palette.len());
+    for _ in 0..4 {
+        assert_eq!(trace(&img, &p), a);
+    }
+    // Overlapping: each layer's shapes cover the layers above, so the pixel counts fall upwards.
+    let firsts: Vec<usize> = a.palette.iter().filter_map(|c| a.paths.iter().find(|t| t.color == *c).map(|t| t.pixels)).collect();
+    assert!(firsts.windows(2).all(|w| w[0] >= w[1]), "{firsts:?}");
+}
+
+/// A PNG whose header says `w` × `h` pixels, with no image data.
+fn png_header(w: u32, h: u32) -> Vec<u8> {
+    fn crc(bytes: &[u8]) -> u32 {
+        let mut c = !0u32;
+        for &b in bytes {
+            c ^= u32::from(b);
+            for _ in 0..8 {
+                c = if c & 1 != 0 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
+            }
+        }
+        !c
+    }
+    let mut ihdr = b"IHDR".to_vec();
+    ihdr.extend(w.to_be_bytes());
+    ihdr.extend(h.to_be_bytes());
+    ihdr.extend([8, 6, 0, 0, 0]);
+    let mut png = b"\x89PNG\r\n\x1a\n".to_vec();
+    for chunk in [ihdr, b"IDAT".to_vec(), b"IEND".to_vec()] {
+        png.extend((chunk.len() as u32 - 4).to_be_bytes());
+        png.extend(&chunk);
+        png.extend(crc(&chunk).to_be_bytes());
+    }
+    png
+}
+
+/// An image too large to trace is refused from its header, before it is decoded.
+#[test]
+fn an_image_too_large_to_trace_is_refused_before_decoding() {
+    let err = Raster::decode(&png_header(30_000, 30_000)).unwrap_err();
+    assert!(matches!(err, TraceError::TooLarge { width: 30_000, height: 30_000, .. }), "{err}");
+    assert!(matches!(Raster::decode(&png_header(64, 64)), Err(TraceError::Decode(_))), "a small header goes on to decoding");
+}

crates/ui-egui/src/canvas.rs

@@ -230,7 +230,12 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
         hidden: vec![],
         rot: v.rotation,
         anti_alias: app.session.prefs.anti_aliased_artwork,
+        placed: vectorcraft_render::placed_document::generation(),
     };
+    // Placed documents' bitmaps are being made: draw again when they are ready.
+    if vectorcraft_render::placed_document::busy() {
+        ui.ctx().request_repaint_after(std::time::Duration::from_millis(30));
+    }
     if !app.canvas.worker_started {
         app.canvas.worker_started = true;
         if std::env::var_os("VECTORCRAFT_SYNC_RENDER").is_none() {
@@ -265,6 +270,7 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
             // General › Anti-aliased Artwork: off, edges are hard on screen (raster effects and
             // pattern tiles stay smooth), as in Illustrator.
             anti_alias: if app.session.prefs.anti_aliased_artwork { vectorcraft_render::AntiAlias::Art } else { vectorcraft_render::AntiAlias::None },
+            progressive_placed: true,
             ..opts
         };
         // Light documents render synchronously (no lag vs overlays); heavy ones go to the worker.
@@ -1030,6 +1036,13 @@ fn node_outline(n: &Node) -> BezPath {
                 bp.extend(vectorcraft_geom::shapes::rectangle(b).to_bezpath());
             }
         }
+        // A placed document shows its box, turned with it.
+        NodeKind::PlacedDocument(p) => {
+            let [a, b, c, d] = p.corners();
+            bp.move_to(a);
+            [b, c, d].into_iter().for_each(|q| bp.line_to(q));
+            bp.close_path();
+        }
         // An envelope shows its mesh (or top object), not its content.
         NodeKind::Envelope { .. } => {
             if let Some((lines, _)) = vectorcraft_doc::live::envelope_overlay(c) {
@@ -1041,6 +1054,30 @@ fn node_outline(n: &Node) -> BezPath {
     bp
 }
 
+/// The width of the key object's outline (Align to Key Object), thicker than the selection's.
+const KEY_OUTLINE: f32 = 2.5;
+
+/// The most anchor points the selection's outlines and anchors, and the hover highlight, are drawn
+/// for: an Image Trace of a photo selects hundreds of thousands of paths at once, whose outlines
+/// would make a mesh larger than the GPU takes in one buffer (#525).
+const OVERLAY_MAX_ANCHORS: usize = 100_000;
+
+/// Whether `nodes` have more than [`OVERLAY_MAX_ANCHORS`] anchor points to outline (counting
+/// stops there).
+fn too_many_anchors<'a>(nodes: impl IntoIterator<Item = &'a Node>) -> bool {
+    fn over(n: &Node, left: &mut usize) -> bool {
+        if let NodeKind::Path { path, .. } = &n.kind {
+            match left.checked_sub(path.anchor_count()) {
+                Some(l) => *left = l,
+                None => return true,
+            }
+        }
+        !matches!(n.kind, NodeKind::Envelope { .. }) && n.children().into_iter().flatten().any(|c| over(c, left))
+    }
+    let mut left = OVERLAY_MAX_ANCHORS;
+    nodes.into_iter().any(|n| over(n, &mut left))
+}
+
 /// [`Node::walk`] over what a selection highlight shows: an envelope's content is left out (the
 /// envelope shows its mesh instead).
 fn walk_drawn<'a>(n: &'a Node, f: &mut impl FnMut(&'a Node)) {
@@ -1160,7 +1197,7 @@ fn hover_highlight(app: &VectorcraftApp, p: &egui::Painter, xf: &Xf) {
     if st.selection.contains(id) {
         return;
     }
-    if let Some(n) = st.doc.node(id) {
+    if let Some(n) = st.doc.node(id).filter(|n| !too_many_anchors([*n])) {
         let color = c32(st.doc.layer_color(id));
         stroke_path(p, &node_outline(n), xf, Stroke::new(1.5, color));
     }
@@ -1351,6 +1388,9 @@ fn selection_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
         && app.ui.view.bounding_box
         && app.session.active().is_some_and(|st| !st.selection.is_empty() && st.selection.anchors.is_empty());
     let bbox = if show_box { app.selection_box() } else { None };
+    let st = app.session.active();
+    let big = st.is_some_and(|st| too_many_anchors(st.selection.objects.iter().filter_map(|id| st.doc.node(*id))));
+    let big_bounds = if big { app.selection_bounds() } else { None };
     let app = &*app;
     let Some(st) = app.session.active() else { return };
     let tool = app.session.tool_id();
@@ -1363,7 +1403,23 @@ fn selection_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
     // The selected anchors' handles (drawn once they are counted: Show handles when multiple
     // anchors are selected off shows them for a single one only).
     let (mut handles, mut with_handles) = (vec![], 0);
-    for id in &st.selection.objects {
+    // Too many paths to outline: the selection's bounds stand for them.
+    if let Some((b, id)) = big_bounds.zip(st.selection.objects.first()) {
+        stroke_path(p, &vectorcraft_geom::shapes::rectangle(b).to_bezpath(), xf, Stroke::new(1.0, c32(st.doc.layer_color(*id))));
+    }
+    // The key object (Align to Key Object): its outline drawn thicker, or its bounds when it has
+    // too many paths to outline.
+    if let Some((k, n)) = st.selection.key.and_then(|k| Some((k, st.doc.node(k)?))) {
+        let outline = if too_many_anchors([n]) {
+            n.geometric_bounds().map(|b| vectorcraft_geom::shapes::rectangle(b).to_bezpath())
+        } else {
+            Some(node_outline(n))
+        };
+        if let Some(bp) = outline {
+            stroke_path(p, &bp, xf, Stroke::new(KEY_OUTLINE, c32(st.doc.layer_color(k))));
+        }
+    }
+    for id in st.selection.objects.iter().filter(|_| !big) {
         let Some(n) = st.doc.node(*id) else { continue };
         let color = c32(st.doc.layer_color(*id));
         let partial = st.selection.partial(*id);
@@ -1633,11 +1689,13 @@ pub(crate) fn task_bar_rect(ctx: &egui::Context) -> Option<egui::Rect> {
 /// selection, pinned it stays put ([`crate::state::TaskBarPlace`]).
 fn task_bar(app: &mut VectorcraftApp, ui: &mut Ui, xf: &Xf) {
     let t = Tokens::get(ui.ctx());
-    let Some(st) = app.session.active() else { return };
-    if st.selection.is_empty() || !matches!(app.session.tool_id(), "selection" | "directSelection" | "groupSelection") {
+    if app.session.active().is_none_or(|st| st.selection.is_empty())
+        || !matches!(app.session.tool_id(), "selection" | "directSelection" | "groupSelection")
+    {
         return;
     }
-    let Some(b) = st.doc.bounds_of(&st.selection.objects, true) else { return };
+    let Some(b) = app.selection_bounds() else { return };
+    let Some(st) = app.session.active() else { return };
     let n = st.selection.len();
     let first = st.selection.objects.first().and_then(|id| st.doc.node(*id)).cloned();
     let is_group = first.as_ref().is_some_and(|f| matches!(f.kind, NodeKind::Group { .. }));
@@ -2024,6 +2082,46 @@ mod tests {
         assert_eq!(cmd_drag(&mut app, inside, inside), "selection");
     }
 
+    /// #525: a selection with more anchors than the overlay draws (a traced photo) shows its bounds,
+    /// not every outline and anchor, which made a mesh larger than the GPU takes; an ordinary one
+    /// still shows its outline and anchors.
+    #[test]
+    fn a_huge_selection_shows_its_bounds_instead_of_every_outline() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        let points = |n: usize| (0..n).map(|i| format!("L{} {}", 20.0 + 360.0 * i as f64 / n as f64, 100 + (i % 2) * 50)).collect::<String>();
+        let ctx = egui::Context::default();
+        let mut drawn = |n: usize| {
+            app.session.execute("path.create", &json!({"d": format!("M20 20 {} Z", points(n))})).unwrap();
+            frame(&mut app, &ctx, vec![]);
+            let shapes = shapes(&mut app, &ctx);
+            let points: usize = shapes.iter().map(|s| if let Shape::Path(ps) = s { ps.points.len() } else { 0 }).sum();
+            let squares = shapes.iter().filter(|s| matches!(s, Shape::Rect(_))).count();
+            (points, squares)
+        };
+        let (points, squares) = drawn(OVERLAY_MAX_ANCHORS + 10);
+        assert!(points < 100 && squares < 100, "{points} outline points, {squares} squares");
+        let (points, squares) = drawn(200);
+        assert!(points > 200 && squares > 200, "{points} outline points, {squares} squares");
+    }
+
+    /// #541: the key object's outline is drawn thicker than the rest of the selection's.
+    #[test]
+    fn the_key_object_has_a_thicker_outline() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        let a = app.session.execute("shape.rectangle", &json!({"x": 20, "y": 20, "width": 50, "height": 50})).unwrap()["id"].clone();
+        let b = app.session.execute("shape.ellipse", &json!({"x": 200, "y": 100, "width": 60, "height": 40})).unwrap()["id"].clone();
+        app.session.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+        let ctx = egui::Context::default();
+        frame(&mut app, &ctx, vec![]);
+        let thick =
+            |app: &mut VectorcraftApp| shapes(app, &ctx).iter().filter(|s| matches!(s, Shape::Path(ps) if ps.stroke.width == KEY_OUTLINE)).count();
+        assert_eq!(thick(&mut app), 0, "no key yet");
+        app.session.execute("select.key", &json!({"id": b})).unwrap();
+        assert!(thick(&mut app) > 0, "the key's outline");
+    }
+
     /// One headless canvas frame → the shapes drawn, `Shape::Vec`s flattened.
     fn shapes(app: &mut VectorcraftApp, ctx: &egui::Context) -> Vec<Shape> {
         let (shapes, mut delta) = frame_output(app, ctx);